Privacy policy

The legal entity responsible for deciding how personal information is used will be identified before this draft is finalised.

[To be confirmed before this policy is finalised: the responsible legal entity and its required identification details.]

The information involved depends on how you interact with MergeHall. It may be provided by you, by an organisation that invites you to a deal, or created as you use the service.

The public marketing website uses Plausible for simple, aggregate page-view statistics. Plausible is self-hosted on Rajoka infrastructure, United Kingdom, sets no cookies and does not track individual visitors across sites. Cloudflare delivers the website and the analytics script. Hosting and security systems may still create technical logs needed to deliver and protect the website.

Personal information may be used to provide and administer the service, authenticate users, apply access permissions, support collaboration, respond to enquiries, maintain service records, protect the service and meet legal obligations.

We may also use service information to understand and improve how MergeHall operates, where the intended use is permitted and appropriate safeguards apply.

Where data protection law requires a legal basis, the expected bases include performing a contract, taking requested steps before a contract, pursuing legitimate interests that do not override individual rights, meeting legal obligations and using consent where it is specifically requested.

The basis that applies will depend on the information, the purpose and whether MergeHall acts for its own purposes or processes information on behalf of a customer organisation.

[To be confirmed before this policy is finalised: the final legal-basis analysis for each processing purpose.]

Information may be shared with authorised users in the relevant organisation or deal workspace, according to the access granted to them. It may also be handled by service providers that support hosting, infrastructure, communications, service delivery and professional advice, only for the relevant purpose.

Information may be disclosed where required by law, to protect legal rights or in connection with a proposed business transaction, subject to appropriate controls.

[To be confirmed before this policy is finalised: the final categories of recipients and sub-processor information.]

The following descriptions reflect current practices rather than guarantees:

Information is expected to be kept only for as long as needed for the purpose for which it was collected, including providing the service, maintaining necessary records and meeting legal obligations. Different categories of information may require different retention approaches.

[To be confirmed before this policy is finalised: the retention schedule and deletion process for each relevant category.]

Depending on the circumstances and applicable law, you may have rights to ask for access to personal information, correction, deletion, restriction, portability or objection to certain uses. You may also be able to withdraw consent where consent is the basis used and raise a concern with the relevant data protection authority.

Some rights are subject to conditions or exceptions. The final policy will explain how to make a request and how identity will be checked before information is released or changed.

Some service providers may process information outside the United Kingdom. Where that happens, the final policy will describe the relevant destination and the measures used for the transfer.

[To be confirmed before this policy is finalised: the transfer locations and transfer mechanisms relevant to the service.]

This draft may change during legal review. Once a final policy is published, material updates will be communicated in an appropriate way and the published update date will be changed.

Questions or requests about personal information will be directed through the privacy contact route identified in the final policy.

[To be confirmed before this policy is finalised: the privacy contact route.]