Privacy notice

Last updated: May 2026

This notice explains how MarketHub SRL (“Mercatum”, “we”, “us”) processes personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”) and Romanian data protection law.

1. Who we are

The data controller responsible for your personal data is:

• MarketHub SRL
• Registered office: Bucharest, Romania [full address to be added]
• Trade Registry number: [J.../.../.... to be added]
• Tax identification (CUI): [RO........ to be added]
• Email: privacy@mercatum.ro

For any question about how we handle your data, please write to the email above. We respond within 30 days, as required by the GDPR.

2. What personal data we collect

We collect personal data in the following situations:

• When you contact us (through the contact form, by email, or by phone): your name, work email address, company name, the content of your message, and any other information you choose to share.
• When you visit our website: technical information such as IP address, browser type, operating system, referring page, pages visited, and approximate location derived from your IP. This data is processed automatically by our hosting provider for security and reliability purposes.
• During a commercial engagement: contact details of your representatives, business correspondence, contractual documents, and any data necessary to deliver the agreed services.

We do not knowingly collect data from minors. We do not process special categories of data (health, biometrics, political opinions, etc.) unless you explicitly provide them in the course of a project.

3. Why we process your data and on what legal basis

We process your personal data on the following legal grounds (GDPR Article 6):

• Your consent (Art. 6(1)(a)) — when you submit the contact form or subscribe to communications.
• Performance of a contract (Art. 6(1)(b)) — to deliver services we have agreed to provide and to manage the contractual relationship.
• Compliance with legal obligations (Art. 6(1)(c)) — accounting, taxation, archiving, and other obligations under Romanian and EU law.
• Our legitimate interests (Art. 6(1)(f)) — to keep our website secure, to prevent fraud, and to manage and grow our business in a reasonable way. We balance these interests against your rights and freedoms.

4. How long we keep your data

• Contact form submissions and prospect correspondence: up to 24 months from the last interaction, then deleted or anonymised.
• Client data (during and after a contract): for the duration of the contract plus 10 years for financial and accounting records, as required by Romanian law.
• Server logs: typically 6 to 12 months, retained for security and operational purposes.
• Marketing consent records: until consent is withdrawn or for a maximum of 3 years from the last engagement.

5. Who we share your data with

We do not sell, rent, or trade your personal data. We share data only with:

• Service providers acting on our instructions as data processors — for example, our hosting provider, email provider, and accounting firm. Each is bound by a written data processing agreement.
• Public authorities — only when required by a binding legal request (court order, tax inspection, etc.).
• Professional advisors — lawyers, auditors, and consultants, under strict confidentiality obligations.

6. International transfers

Where possible, we keep data within the European Economic Area. If a service provider operates outside the EEA, we ensure transfers are protected by appropriate safeguards under the GDPR, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — to obtain confirmation of whether we process your data and to receive a copy.
• Right to rectification — to have inaccurate data corrected and incomplete data completed.
• Right to erasure (“right to be forgotten”) — in the circumstances set out in Art. 17 GDPR.
• Right to restriction of processing — under the conditions of Art. 18.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to processing based on our legitimate interests, including profiling.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please write to privacy@mercatum.ro. We may need to verify your identity before responding.

8. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Romanian Data Protection Authority:

• Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
• B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania
• Website: www.dataprotection.ro

You may also complain to the supervisory authority in your country of residence within the EU.

9. Cookies and tracking

Our website uses a minimal set of cookies and similar technologies:

• Strictly necessary cookies — required for the website to function (e.g. load balancing, security). These do not require consent under the ePrivacy directive.
• Analytics — if and when enabled, we will use privacy-friendly analytics that do not track individuals across sites. You will be asked for consent before any non-essential cookies are set.

You can disable cookies in your browser settings at any time. Doing so may affect website functionality.

10. Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS), access controls, regular backups, and staff confidentiality obligations. No internet transmission is, however, fully secure, and we cannot guarantee absolute security.

11. Changes to this notice

We may update this privacy notice from time to time to reflect changes in our practices or in the law. The “Last updated” date at the top of this page indicates when the notice was last revised. For material changes, we will make reasonable efforts to notify you.

12. Contact

For any question about this privacy notice or about how we process your data, please contact us at privacy@mercatum.ro or via our contact page.