Privacy

How Mervantis OÜ handles personal data in connection with this website and with the internal applications described on this website, under Regulation (EU) 2016/679 (GDPR).

Controller

Controller: Mervantis OÜ, register code 14412321
Address: Asuvere tee 7-4, Tihemetsa alevik, Saarde vald, Pärnu maakond 86201, Estonia
Email: [email protected]
Data protection officer: Not appointed. Article 37 GDPR does not require one for this processing.

Cookies and tracking

This website sets no cookies. It runs no analytics, no advertising scripts and no third-party embeds. No consent banner is required because no consent is needed. This is a statement about mervantis.com itself; the advertising operated for the brands listed on the home page is covered by each brand's own privacy policy.

Data processed

Visiting this website writes a standard server log entry: IP address, date and time, page requested, referrer and user agent. This is processed under Article 6(1)(f) GDPR for the legitimate interest of operating and securing the website.

Web server: Operated by Mervantis OÜ on its own infrastructure inside the European Union.
Log retention: 30 days, after which log files are rotated and deleted.

Email sent to the address above is processed to answer the enquiry, under Article 6(1)(b) or 6(1)(f) GDPR depending on the subject.

Contact form

When you send the contact form, we receive what you type in it (name, email address, company, the topic you choose and your message) together with the time of sending and your IP address. We use this only to answer you and, if you ask for it, to prepare a quote. The legal basis is Article 6(1)(b) GDPR (steps taken at your request before a contract) or Article 6(1)(f) GDPR (our legitimate interest in answering business enquiries). The IP address is kept only to block automated spam.

Where it is stored: On Mervantis OÜ's own server inside the European Union, and in the company mailbox that receives the notification email.
Retention: Up to 24 months after our last exchange, unless the enquiry leads to a contract, in which case accounting and contract law set the retention period. You can ask us to delete it earlier.
Newsletters: None. The form does not subscribe you to anything, and we do not use your details for marketing.

Mervantis Ads Automation and Google account data

Mervantis Ads Automation is an internal application operated by Mervantis OÜ that connects to the Google Ads API. This section sets out how that application accesses, uses, stores and shares data obtained from Google. It is separate from the website processing described above.

Who authorises it: A single Google Account belonging to Mervantis OÜ and used by the company's own staff. No customer, visitor or other third party signs in to the application; it has no user accounts and no sign-up.
Scope requested: https://www.googleapis.com/auth/adwords only. No other Google API scope is requested. The application reads no Google profile, email, contacts, calendar, Drive or photo data.
Data read: Google Ads campaign, ad group, ad, keyword and budget configuration; performance metrics such as impressions, clicks, cost and conversions; and keyword search-volume, competition and forecast data from the Keyword Planner services.
Data written: Campaigns, ad groups, ads, keywords, bids and budgets — in Mervantis OÜ's own Google Ads accounts only.
Accounts reached: Only Google Ads accounts owned by Mervantis OÜ. The application does not access, and is not authorised to access, any other party's Google Ads account.
Where it runs and is stored: On Mervantis OÜ's own infrastructure inside the European Union. OAuth credentials are held in server-side configuration that is not reachable over the web. Data retrieved from the API is kept only as long as needed to operate and report on the advertising, and for no longer than 24 months.
Sharing: Data obtained from the Google Ads API is not sold, is not shared with third parties, is not used for any purpose other than operating Mervantis OÜ's own advertising, and is not used to develop, improve or train machine-learning or artificial-intelligence models.
Personal data: The application is not designed to retrieve personal data and Google Ads reporting is aggregated. Where a record nevertheless relates to an identifiable customer of one of the brands, that processing is governed by that brand's own privacy policy.

Mervantis OÜ's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and is limited to the practices disclosed in this section.

Recipients

Data is not sold and is not shared for advertising. Two processors are involved, engaged under Article 28 GDPR:

Cloudflare, Inc.: 101 Townsend St, San Francisco, CA 94107, United States.
Provides DNS, CDN, reverse proxy and email routing for this domain. All requests to this website pass through Cloudflare, so it processes the IP address of every visitor.
Brevo (Sendinblue SAS): 106 boulevard Haussmann, 75008 Paris, France.
Delivers the notification email when the contact form is sent. Data is processed inside the European Union.
Transfers outside the EU: Cloudflare, Inc. is established in the United States. Transfers rely on the Standard Contractual Clauses in Cloudflare's data processing addendum, together with its certification under the EU–US Data Privacy Framework.

Beyond that, personal data is disclosed only to our accountant for statutory accounting records, and to public authorities where a law requires disclosure.

Your rights

You may request access to your personal data, correction, erasure, restriction of processing, portability, or object to processing based on legitimate interest (Articles 15 to 21 GDPR). Write to [email protected]. We answer within one month, as Article 12(3) requires.

You may lodge a complaint with the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia.

Other websites

The brands listed on the home page operate their own websites and publish their own privacy policies. This policy covers mervantis.com and Mervantis Ads Automation; it does not cover the brands' own websites or their customers' data.

Version

In force since 29 September 2026 (contact form added; previous version 11 September 2026). If we change how personal data is processed, this page is updated and the date changes with it.