Mervantis OÜ Privacy

Privacy

How Mervantis OÜ handles personal data in connection with this website and with the internal applications described on the entity page, under Regulation (EU) 2016/679 (GDPR).

Controller

Controller
Mervantis OÜ, register code 14412321
Address
Asuvere tee 7-4, Tihemetsa alevik, Saarde vald, Pärnu maakond 86201, Estonia
Email
[email protected]
Data protection officer
Not appointed. Article 37 GDPR does not require one for this processing.

Cookies and tracking

This website sets no cookies. It runs no analytics, no advertising scripts and no third-party embeds. No consent banner is required because no consent is needed. This is a statement about mervantis.com itself; the advertising operated for the brands listed on the entity page is covered by each brand's own privacy policy.

Data processed

Visiting this website writes a standard server log entry: IP address, date and time, page requested, referrer and user agent. This is processed under Article 6(1)(f) GDPR for the legitimate interest of operating and securing the website.

Web server
Operated by Mervantis OÜ on its own infrastructure inside the European Union.
Log retention
30 days, after which log files are rotated and deleted.

Email sent to the address above is processed to answer the enquiry, under Article 6(1)(b) or 6(1)(f) GDPR depending on the subject.

Mervantis Ads Automation is an internal application operated by Mervantis OÜ that connects to the Google Ads API. This section sets out how that application accesses, uses, stores and shares data obtained from Google. It is separate from the website processing described above.

Who authorises it
A single Google Account belonging to Mervantis OÜ and used by the company's own staff. No customer, visitor or other third party signs in to the application; it has no user accounts and no sign-up.
Scope requested
https://www.googleapis.com/auth/adwords only. No other Google API scope is requested. The application reads no Google profile, email, contacts, calendar, Drive or photo data.
Data read
Google Ads campaign, ad group, ad, keyword and budget configuration; performance metrics such as impressions, clicks, cost and conversions; and keyword search-volume, competition and forecast data from the Keyword Planner services.
Data written
Campaigns, ad groups, ads, keywords, bids and budgets — in Mervantis OÜ's own Google Ads accounts only.
Accounts reached
Only Google Ads accounts owned by Mervantis OÜ. The application does not access, and is not authorised to access, any other party's Google Ads account.
Where it runs and is stored
On Mervantis OÜ's own infrastructure inside the European Union. OAuth credentials are held in server-side configuration that is not reachable over the web. Data retrieved from the API is kept only as long as needed to operate and report on the advertising, and for no longer than 24 months.
Sharing
Data obtained from the Google Ads API is not sold, is not shared with third parties, is not used for any purpose other than operating Mervantis OÜ's own advertising, and is not used to develop, improve or train machine-learning or artificial-intelligence models.
Personal data
The application is not designed to retrieve personal data and Google Ads reporting is aggregated. Where a record nevertheless relates to an identifiable customer of one of the brands, that processing is governed by that brand's own privacy policy.

Mervantis OÜ's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and is limited to the practices disclosed in this section.

Recipients

Data is not sold and is not shared for advertising. One processor is involved, engaged under Article 28 GDPR:

Cloudflare, Inc.
101 Townsend St, San Francisco, CA 94107, United States.
Provides DNS, CDN, reverse proxy and email routing for this domain. All requests to this website pass through Cloudflare, so it processes the IP address of every visitor.
Transfers outside the EU
Cloudflare, Inc. is established in the United States. Transfers rely on the Standard Contractual Clauses in Cloudflare's data processing addendum, together with its certification under the EU–US Data Privacy Framework.

Beyond that, personal data is disclosed only to our accountant for statutory accounting records, and to public authorities where a law requires disclosure.

Your rights

You may request access to your personal data, correction, erasure, restriction of processing, portability, or object to processing based on legitimate interest (Articles 15 to 21 GDPR). Write to [email protected]. We answer within one month, as Article 12(3) requires.

You may lodge a complaint with the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia.

Other websites

The brands listed on the entity page operate their own websites and publish their own privacy policies. This policy covers mervantis.com and Mervantis Ads Automation; it does not cover the brands' own websites or their customers' data.

Version

In force since 11 September 2026. If we change how personal data is processed, this page is updated and the date changes with it.