1. Who is responsible?
MerchantSecure is responsible for processing personal data through this website and application. For privacy questions or to exercise your rights, contact us at noreply@merchantsecure.co.
2. What data do we process?
- account data such as name, email address and login details;
- company, billing and payment details;
- the domains, URLs and publicly accessible website content you submit for a scan;
- scan results, comments, progress and communications;
- technical data, such as IP address, browser information, session and security logs.
Payment card data is processed by our payment provider and is not stored in full by MerchantSecure.
3. Why and on what legal basis?
We process data to operate your account and order, handle payments, provide scans and reports, offer support, prevent fraud and abuse, secure the service and comply with statutory administrative obligations. We do so to perform the agreement, meet legal obligations and pursue our legitimate interests. Where consent is required, we request it separately.
4. Who do we share data with?
We share only necessary data with service providers for hosting, payments, email, security and operation of our AI Engine. These parties may process the data solely for the agreed services. We do not sell personal data.
5. International transfers
When a service provider processes data outside the European Economic Area, we use an appropriate transfer mechanism where required, such as an adequacy decision or European Commission-approved standard contractual clauses.
6. Retention periods
We retain personal data no longer than necessary for the purposes for which it was collected. Administrative data is retained for the statutory period. Account, scan and security data is deleted or anonymised when no longer needed, unless a legal obligation or ongoing dispute requires longer retention.
7. Security and cookies
We take appropriate technical and organisational measures to protect data. Functional and security cookies may be necessary for your session, language choice and account to work securely. We request prior consent for non-essential cookies where legally required.
8. Your rights
You may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent at any time. You may also lodge a complaint with the Dutch Data Protection Authority. We may request additional information to verify your identity.
9. Changes
We may update this privacy policy when our services or legislation change. The latest version is always available on this page.
Last updated: 6 September 2026.