Privacy Policy

Last updated: 25-08-2026

 

This Privacy Policy describes how Merrachi B.V. (“MERRACHI”, “we”, “us” or “our”) collects, uses and discloses personal data when you visit our website, use our services, make a purchase through merrachi.com or otherwise communicate with us (together, the “Services”).

 

“You” means the user of the Services, meaning a customer, website visitor, or any other individual whose personal data we process under this Privacy Policy.

 

Please read this Privacy Policy carefully. Where we rely on your consent for a particular type of processing, we ask for that consent separately and specifically. Simply using the Services does not by itself constitute consent to processing that legally requires it, such as marketing or non-essential cookies. If you do not agree with this Privacy Policy, we ask that you do not use the Services.

 

How we process your personal data

We collect personal data from you to provide the Services. What we collect depends on how you interact with us. In addition to the purposes below, we may use your information to communicate with you, provide the Services, comply with legal obligations, enforce our terms and conditions, and protect the Services and the rights of us, our users or third parties.

 

For what purpose do we process your personal data?

For the delivery of products and services, we process payments, fulfil orders, send notifications about your account, purchases, exchanges and returns, manage your account, arrange shipping, facilitate exchanges and returns, and enable product reviews.

 

For customer service, we process only the personal data necessary to handle your request, respond to you and manage our relationship with you. Phone conversations may be recorded for training and quality purposes.

 

For marketing and advertising, we may personalise the Services and provide recommendations based on your account activity and usage profile. We send marketing communications by email, SMS or push notification where you have opted in or where otherwise permitted by applicable law. Where required by law, we obtain your consent before processing personal data for personalised advertising or marketing profiling.

 

For surveys and customer insights, where you participate in a survey as a registered customer and have provided the required consent, we may link your responses to your purchase history to analyse customer needs and behaviour. Results are analysed on an aggregated basis where possible.

 

To improve our Services, we may process browsing and usage data for analytical and statistical purposes so that we understand how the Services are used and can improve them.

 

For security and fraud prevention, we process relevant personal data to detect, investigate and deter fraudulent, illegal or harmful activity. We may block a transaction or suspend an account where fraud or other unlawful activity is reasonably suspected.

 

What is the legal basis for processing your personal data?

We only process your personal data where a valid legal basis applies under applicable data protection law.

 

For the delivery of products and services, including payment processing, order fulfilment, account administration, shipping, exchanges and returns, processing is generally necessary for the performance of an agreement with you or to take steps at your request before entering into an agreement.

 

Where we are required to retain or disclose personal data to comply with applicable laws, including tax and accounting obligations, we process your data to comply with a legal obligation.

 

For customer service, we may rely on our legitimate interest in responding to your requests and managing our relationship with you. Where your request concerns your rights under applicable data protection law, processing may also be necessary to comply with a legal obligation.

For marketing communications, personalised advertising and other processing activities that require consent, we rely on your consent. You may withdraw your consent at any time.

For surveys where your responses are linked to your customer or purchase history, we rely on your consent.

 

For improving our Services, analysing usage and understanding customer satisfaction, we may rely on our legitimate interests, provided that your interests and fundamental rights do not override those interests. Where consent is required for the use of cookies or similar technologies, we rely on your consent.

 

For security and fraud prevention, we rely on our legitimate interest in protecting our business, customers and Services and preventing fraudulent or unlawful activity.

 

What personal data do we process?

Information you provide directly to us may include:

 

• basic data, such as your name, address, contact details, language preference and country;
• financial and transaction data, such as payment or card details and information about your purchases, orders, exchanges and returns;
• account information, including your username, password and other account credentials;
• information about your purchases and interactions with our Services, such as items you view, add to your cart or add to a wish list; and
• customer service information, including information you share when you contact us.

We may also process technical and usage information relating to your use of our Services, including information about your device, browser, IP address, network connection and interactions with our website and communications, where permitted by applicable law.

 

Some features require specific information about you. You may choose not to provide certain information, but this may mean that you cannot use certain features or Services.

 

What information do we process through third parties?

We may receive personal data from third parties that support us in providing the Services. This may include financial institutions and payment service providers, logistics, transport and delivery service providers, providers supporting our website and Services, such as IT management, customer service, payment processing, data analytics and cloud storage providers, and third parties you designate or authorise, for example through social media widgets or login integrations.

 

We may also receive information from business and marketing partners, where permitted by applicable law, including information collected through pixels, web beacons, SDKs, cookies and similar technologies when you visit our website, open our communications or interact with our advertisements.

 

We may disclose or receive personal data in connection with a corporate transaction, such as a merger, acquisition, restructuring or sale of assets, where required by law or where necessary to establish, exercise or defend legal claims or protect the Services and the rights of us, our users or others.

 

Who do we share your personal data with?

Depending on the Services you use and how you interact with us, we may share your personal data with the following categories of recipients:

• service providers acting on our behalf, including providers of IT, website hosting, payment processing, fulfilment, logistics, customer service, data analytics and cloud storage services;
• business and marketing partners, where this is necessary and permitted by applicable law;
• our affiliates or other companies within the MERRACHI group, where relevant to the provision and operation of our Services;
• professional advisers, such as legal, accounting or insurance advisers, where necessary;
• competent authorities or other third parties where disclosure is required by law or necessary to establish, exercise or defend legal claims; and
• third parties involved in a corporate transaction, such as a merger, acquisition, restructuring or sale of assets.

We only share personal data where there is a valid legal basis for doing so and, where a third party processes personal data on our behalf, we put appropriate contractual safeguards in place where required by applicable data protection law.

 

We are not responsible for the accuracy of information provided to us by third parties, nor for their own privacy policies or practices. Please see “Third-party websites and links” below.

 

Storing and securing your personal data

How long we keep your personal data depends on the purpose for which it was collected and the legal obligations that apply to us.

 

For products and services, we retain relevant data for as long as necessary to perform the agreement with you and to comply with applicable legal obligations, including applicable tax, accounting, warranty and limitation periods. Certain financial and transactional records may therefore generally be retained for up to 7 years where required by Dutch law.

 

For customer service, we generally retain relevant information for up to 2 years after your last contact with us, unless a longer retention period is necessary or permitted for another purpose.

 

For marketing and advertising, we retain personal data for as long as we have a valid basis to do so. If you withdraw your consent or unsubscribe from marketing communications, we will stop using your data for direct marketing. We may retain limited information, such as your contact details and marketing preferences, where necessary to ensure that we respect your opt-out request or comply with other legal obligations.

 

For improving our Services, we anonymise or aggregate data where possible. Where data remains identifiable, we retain it only for as long as necessary for the relevant analytical purpose.

 

For security and fraud prevention, we retain relevant information for as long as reasonably necessary to detect, investigate and prevent fraudulent or unlawful activity, taking into account applicable legal obligations and limitation periods.

 

Technical and organisational measures

We take appropriate technical and organisational measures to protect your personal data against loss, theft, unauthorised access, unwanted disclosure and unlawful processing.

 

Technical measures include a secure platform for our customer administration, including encryption of data in transit and at rest, regular software updates and security patches, and access to personal data restricted to authorised personnel, protected by strong passwords and two-factor authentication where appropriate.

 

Organisational measures include policies and procedures designed to ensure that personal data is processed only for specified purposes, regular staff training on data protection and privacy, and appropriate contractual arrangements with service providers where required. We take reasonable steps to ensure that service providers processing personal data on our behalf provide sufficient guarantees to protect that data and comply with applicable data protection laws.

 

No system is completely secure, and we cannot fully guarantee the security of data transmitted over the internet, although we take all reasonable steps to protect it.

 

Cookies and similar technologies

We use cookies and similar technologies on our website. For more information about the cookies and similar technologies we use, the purposes for which they are used and how you can manage your preferences, please see our Cookie Policy.

 

User-generated content

The Services may let you post product reviews and other content. Anything you post in a public area may become visible to other users or members of the public. We do not control who accesses information you make publicly available and cannot guarantee that it will be respected or kept secure.

 

We are not responsible for the privacy, accuracy or use of information that you voluntarily disclose in public areas or that you receive from third parties.

 

Third-party websites and links

Our website may link to third-party websites or platforms. We encourage you to review their own privacy and security policies before following such links, as we are not responsible for their privacy practices, security, accuracy or reliability.

 

Information you share on public or semi-public platforms, including third-party social networks, may be visible to other users of those platforms and may be used by them in accordance with the applicable terms and privacy policies of those platforms. A link to a third-party website or platform does not imply that we endorse its content unless we expressly state otherwise.

 

Surveys and customer insights

Where you choose to participate in a survey, we process your responses to understand customer needs and improve our products and shopping experience.

 

Where we intend to link your survey responses to your customer account or purchase history, such as information about what and how often you purchase, we will ask for your specific consent before doing so.

 

The legal basis for linking survey responses to your customer or purchase history is your consent. You may withdraw your consent at any time by contacting us at legal@merrachi.com. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

 

Survey responses are analysed in aggregate where possible. We do not share individual survey responses with third parties for their own marketing purposes. We retain survey responses for no longer than necessary for the relevant research purpose and, where appropriate, delete or anonymise them after the retention period has expired.

 

Exercising your rights

Subject to the conditions and exceptions set out in the GDPR, you have several rights in relation to your personal data.

 

You may request access to the personal data we hold about you and information about how we use and share it. You may ask us to correct inaccurate or outdated data and, in certain circumstances, request that we delete your personal data or restrict its processing.

 

Where we process your personal data based on consent, you may withdraw your consent at any time. You may also object to processing based on our legitimate interests, including related profiling, and you have an absolute right to object to the processing of your personal data for direct marketing purposes.

 

You may also have the right to data portability, meaning that you can receive certain personal data you have provided to us in a structured, commonly used and machine-readable format and, where technically feasible, request that it be transmitted to another controller.

 

You can unsubscribe from marketing emails at any time via the unsubscribe link included in those emails. We may still send you important non-promotional communications, such as messages relating to your account, orders or our contractual relationship with you.

 

To exercise your rights or raise a privacy-related concern or complaint, please contact us first at legal@merrachi.com. We will investigate your concern and aim to resolve it as quickly as possible.

 

We may ask you to verify your identity before responding to a request. You may appoint an authorised representative to act on your behalf, in which case we may request evidence of that authorisation and, where appropriate, take reasonable steps to verify your identity.

 

If you are dissatisfied with how we handle your request or complaint, you have the right to lodge a complaint with the competent data protection supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens. Depending on your circumstances, you may also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work or the place where you believe an infringement of applicable data protection law has occurred.

 

Transfer of personal data outside the European Economic Area

We may store or otherwise process your personal data outside your country of residence, including outside the European Economic Area where this is necessary for the provision of our Services or where our service providers operate.

 

Where we transfer personal data outside the European Economic Area to a country that is not subject to an adequacy decision by the European Commission, we use appropriate safeguards in accordance with applicable data protection law. These safeguards may include the European Commission’s Standard Contractual Clauses and, where necessary, supplementary measures designed to provide an appropriate level of protection.

 

You may contact us at legal@merrachi.com if you would like further information about the safeguards used in connection with international transfers of your personal data.

 

Contact us

Merrachi B.V. is the controller of your personal data for the purposes of applicable data protection law, including the GDPR.

 

For questions about this Privacy Policy, to exercise your privacy rights or to raise a privacy-related concern, please contact us at legal@merrachi.com.

 

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our processing activities, Services, operational practices or applicable law.

 

We will publish the updated version on our website and revise the “Last updated” date accordingly. Where required by applicable law, we will also notify you of material changes through an appropriate communication channel.