Privacy policy

This Privacy policy explains how Metamerch (“we”, “us”, “our”) collects, uses, shares and protects personal information. It is written to meet the EU General Data Protection Regulation and UK GDPR (together, “GDPR”) and South Africa’s Protection of Personal Information Act 4 of 2013 (“POPIA”).

Related documents: Terms of use · Vendor terms of use

1. Who is responsible

Metamerch is the responsible party under POPIA and the controller under GDPR for:

• accounts we operate (registration, login, billing contact, support);
• demo and contact enquiries submitted on this website;
• the public vendor directory and vendor registration;
• security, product analytics we control, and our own legal compliance.

When a customer uses the workspace to store campaign, site, inventory, artwork or job data about their staff, contractors or other people, that customer is the responsible party / controller. We then act as their operator (POPIA) and processor (GDPR) on their instructions.

Information officer / privacy contact: anton.foster@metamerch.global

2. Whose information we process

• Website visitors and people who book a demo or contact us.
• Customer users (employees or contractors of a subscriber).
• Vendors and their portal users.
• People whose details customers or vendors upload into the Service (for example site contacts). We process that data only as operator/processor.

3. What we collect

• Identity and contact: name, email, phone, company, job title, country, language preference.
• Account: password (stored hashed), roles, permissions, business-unit membership, avatar.
• Vendor listing: trading name, address, capabilities, bio, logo, website, public contact details you choose to publish.
• Transactional: quotes, invoices, assignment status, messages you send in the Service.
• Technical: IP address, browser type, device, approximate location derived from IP, logs needed for security.
• Optional site photos and geo-tags uploaded for assignments.

We do not seek special-category data (GDPR Art. 9) or POPIA special personal information. Please do not send health, biometric, religious or children’s data through the contact form.

4. How we collect it

• Directly from you (forms, registration, portal, email).
• From the organisation that invites you to a business unit or vendor.
• Automatically when you use the Service (logs, cookies as described below).

5. Purposes and lawful bases

Under GDPR Art. 6 and POPIA section 11 we rely on:

• Contract: to create and run your account, vendor listing or paid plan, and to respond to a demo request you submit.
• Legitimate interests (GDPR) / pursuing our legitimate interests (POPIA s11(1)(f)): to secure the Service, prevent abuse, improve features, and keep a public directory accurate. You may object as set out below.
• Consent: marketing emails beyond a service reply, optional cookies that are not strictly necessary, and the contact-form terms acknowledgement we record. You may withdraw consent at any time without affecting prior processing.
• Legal obligation: tax, accounting, and responding to lawful requests from regulators or courts.
• Operator/processor instructions: processing Customer Content because a customer has instructed us to host it.

POPIA further requires that processing is adequate, relevant, not excessive, collected for a specific purpose, and that we take reasonable steps to ensure information is complete and not misleading.

6. Contact and demo form

If you submit the contact form we use your name, email, company (if given) and message only to respond to that enquiry. We ask you to accept the Terms of use and this policy first. A hidden honeypot field is used to reduce spam; it is not used to profile you.

7. Who we share information with

• Hosting, email delivery and infrastructure operators who process data only on our instructions and under written contracts.
• Vendors you invite or assign, limited to what the job or listing requires.
• Other users in the same business unit, according to roles and permissions.
• Professional advisers or authorities where required by law or to defend a claim.

We do not sell personal information. Public vendor listings show only the fields described on the registration and listing pages.

8. International transfers

The Service may be hosted or supported outside your country (including outside South Africa and the EEA/UK). Where GDPR applies we use an appropriate safeguard such as an adequacy decision or standard contractual clauses. Where POPIA section 72 applies we transfer only to operators or third parties who are subject to a law, binding corporate rules or contract that provides an adequate level of protection, or with your consent, or as otherwise permitted.

9. Retention

• Contact enquiries: up to 24 months after we close the enquiry, unless a longer period is needed for a dispute.
• Accounts and vendor listings: for the life of the account plus a short wind-down period, then deletion or anonymisation, unless law requires longer (for example invoices).
• Security logs: typically 12 months.
• Customer Content: until the customer deletes it or the subscription ends, then in line with our backup cycle and any data-processing terms.

10. Security

We use access controls, encryption in transit, hashed passwords, business-unit scoping and staff permissions to protect personal information. No method of transmission or storage is completely secure; please use a strong unique password and tell us promptly of any suspected breach.

If a security compromise is likely to affect you, we will notify you and the Information Regulator (and, where GDPR applies, the relevant supervisory authority and data subjects) as required by POPIA section 22 and GDPR Articles 33–34.

11. Your rights

Subject to the limits in GDPR and POPIA, you may:

• request access to the personal information we hold about you (POPIA s23; GDPR Art. 15);
• request correction of inaccurate or incomplete information (POPIA s24; GDPR Art. 16);
• request deletion or destruction where we are not entitled to keep it (GDPR Art. 17; POPIA objection / deletion in appropriate cases);
• object to processing based on legitimate interests, and to direct marketing (POPIA s11(3); GDPR Art. 21);
• restrict processing (GDPR Art. 18);
• receive a portable copy of data you provided to us by contract or consent (GDPR Art. 20);
• withdraw consent where processing is based on consent;
• not be subject to a solely automated decision with legal or similarly significant effects (GDPR Art. 22; POPIA s71) — we do not make such decisions.

To exercise these rights, email anton.foster@metamerch.global. We may need to verify your identity. We will respond within the time POPIA or GDPR requires.

12. Complaints

Please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with:

• the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — complaints.IR@inforegulator.org.za — https://inforegulator.org.za;
• your EU/EEA supervisory authority, or the UK Information Commissioner’s Office if UK GDPR applies.

13. Cookies

We use cookies or similar storage that are strictly necessary to run the Service: session authentication, CSRF protection, locale (en-GB / af-ZA) and your theme preference. These do not require consent. We do not currently use advertising or cross-site tracking cookies. If we introduce analytics cookies that are not strictly necessary, we will ask for consent first.

14. Children

The Service is aimed at organisations and adult professionals. We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.

15. Changes

We will post updates on this page and change the “Last updated” date. Where a change is material we will also notify account holders by email or in the workspace where reasonably possible.

16. Contact

Privacy and information-officer requests: anton.foster@metamerch.global · Contact