Privacy Policy
This Privacy Policy explains how MerchantLink collects, uses, and protects your personal data when you use our mobile application, website, and related services (together, the "Platform"). It applies to anyone who creates an account, places an order, requests a hire quote, or otherwise interacts with the Platform.
We are committed to protecting your personal data and to complying with our obligations under the UK General Data Protection Regulation, the Data Protection Act 2018, and other applicable data protection laws.
1. Who we are
The data controller for the personal data described in this Policy is Merchant Link Ltd, a company registered in England and Wales under company number 16823796, with its registered office at 57 Nook Road, Scholes, Leeds, England, LS15 4AX ("MerchantLink", "we", "us", "our").
You can contact us about your personal data at app@merchantlink.co.uk.
2. The personal data we collect
We collect the following categories of personal data:
2.1. Account data. Your name, email address, password (hashed, never in plain text), and the identity provider you used to sign in (where applicable).
2.2. Profile and preference data. Your delivery postcode and saved addresses, your customer type, your category interests, and your communication preferences.
2.3. Order and hire data. Details of your orders, hire quote requests, accepted bids, bookings, the items involved, delivery instructions, and any messages exchanged with Merchants through the Platform.
2.4. Payment data. Payment method details are collected and stored by Stripe on our behalf. We receive only a token and the last four digits of your card, the card brand, and the expiry month and year. We do not see or store your full card number, CVV, or PIN.
2.5. Communications data. The contents of any messages you send to us or to Merchants through the Platform, including dispute submissions and support requests, plus any attachments such as photographs.
2.6. Device and usage data. Your device type, operating system, app version, IP address, language settings, and how you interact with the Platform (pages viewed, taps, search terms). This data may be collected through analytics SDKs and is used to operate, secure, and improve the Platform.
2.7. Location data. Where you grant permission, your approximate location based on GPS or postcode. This is used to surface local Merchants and delivery options. You can turn this off in your device settings at any time; turning it off may reduce the relevance of search results.
2.8. Notification tokens. A device-specific identifier we use to send you push notifications, where you have granted notification permission.
2.9. Review and content data. Reviews and any other content you submit to the Platform.
We do not knowingly collect special category data (such as health, ethnicity, or political opinions). Do not submit special category data through the Platform.
3. Where we get your data from
3.1. From you directly, when you create an account, complete your profile, place an order or hire booking, or contact us.
3.2. From your device, through analytics, error reporting, and notification SDKs (subject to your permissions).
3.3. From third parties you choose to sign in with (Google, Apple). These providers share your name, email address, and a user identifier with us at the point of sign-in.
3.4. From Merchants in connection with your orders or hire bookings (for example, delivery progress updates, damage assessment information).
3.5. From Stripe, when you make a payment or save a payment method.
4. Why we use your data and our lawful bases
We use your personal data for the following purposes, on the lawful bases set out below.
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract (these Terms) |
| Processing your orders and hire bookings, including communication with Merchants | Performance of a contract |
| Processing payments, refunds, and the hire backstop charge | Performance of a contract; legitimate interests in preventing payment fraud |
| Providing customer support and handling disputes | Performance of a contract; legitimate interests in resolving complaints |
| Sending service emails and in-app notifications about your account and transactions | Performance of a contract |
| Sending marketing emails about new features, Merchants, or promotions | Consent (which you can withdraw at any time) |
| Personalising the home feed and search results | Legitimate interests in providing a relevant service |
| Preventing fraud, securing the Platform, and detecting misuse | Legitimate interests in protecting our users and our business; legal obligation |
| Complying with legal obligations (for example tax, accounting, regulatory) | Legal obligation |
| Defending or pursuing legal claims | Legitimate interests in protecting our rights |
Where we rely on legitimate interests, we have considered your rights and freedoms and concluded that our interest does not override them. You can object to our use of your data on this basis (see section 8 below).
5. Who we share your data with
We share your personal data only where it is necessary to operate the Platform or where we are required to by law. The categories of recipients are:
5.1. Merchants. When you place an order or accept a hire bid, we share the necessary delivery and contact details with the Merchant so they can fulfil your order or booking.
5.2. Payment provider. Stripe processes payments and stores card details on our behalf. Stripe acts as a data processor for some of our payment processing and as a separate controller for its own purposes. See Stripe's privacy notice at stripe.com/privacy.
5.3. Identity providers. Google and Apple, where you choose to sign in with them. They receive the fact that you have signed into MerchantLink.
5.4. Hosting and infrastructure. Supabase Inc. and Amazon Web Services provide the database, file storage, and serverless functions that power the Platform.
5.5. Email and notification providers. Resend delivers transactional and marketing emails. Expo delivers push notifications.
5.6. Analytics and error reporting providers. **Google Analytics ** helps us understand how the Platform is used.
5.7. Professional advisers. Our lawyers, accountants, and auditors, where required for advice or for the proper running of the business.
5.8. Authorities and regulators. Where we are required to share data by law, including in response to a valid court order, regulatory request, or tax obligation.
5.9. Buyers of our business. If we sell or restructure the business, we may share your data with potential or actual buyers, subject to confidentiality.
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
6. International transfers
The Platform is operated primarily from the United Kingdom. Some of our processors store or process data outside the UK, including in the European Economic Area and the United States. Where personal data is transferred outside the UK, we rely on:
(a) adequacy decisions made by the UK government;
(b) the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
(c) other appropriate safeguards permitted by UK GDPR.
You can ask us for a copy of the safeguards we apply by contacting us.
7. How long we keep your data
We keep your personal data for as long as it is needed for the purposes set out in this Policy. In particular:
(a) Account data: while your account is active, plus six years after closure to meet tax and accounting obligations.
(b) Order and hire data: at least six years from the end of the relevant tax year.
(c) Payment records: as required by the Payment Card Industry Data Security Standard and our financial obligations.
(d) Communications and support tickets: typically two years, longer where needed to handle a complaint or claim.
(e) Marketing data: until you withdraw consent or two years of inactivity, whichever is sooner.
(f) Analytics data: typically 14 months in identifiable form, then aggregated.
After the retention period, we delete or anonymise the data so that you can no longer be identified from it.
8. Your rights
Under UK GDPR you have the following rights:
8.1. Access. You have the right to a copy of the personal data we hold about you.
8.2. Rectification. You can ask us to correct any inaccurate or incomplete data.
8.3. Erasure. You can ask us to delete your personal data, subject to our retention obligations and any legitimate interests in keeping it.
8.4. Restriction. You can ask us to restrict our processing in certain circumstances.
8.5. Portability. You can ask us to provide your account, profile, and transaction data in a structured, commonly-used, machine-readable format.
8.6. Objection. You can object to our processing where we rely on legitimate interests. You can object at any time to processing for direct marketing.
8.7. Withdrawing consent. Where we process data on the basis of consent (for example marketing emails), you can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
8.8. Rights in relation to automated decision-making. We do not currently make decisions about you using solely automated means that have legal or similarly significant effects. If that changes, we will update this Policy.
To exercise any of these rights, contact us at app@merchantlink.co.uk. We will respond within one month. We may ask you to verify your identity before acting on a request.
9. Complaints
If you are not happy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
- Website: ico.org.uk
- Helpline: 0303 123 1113
We would appreciate the opportunity to address your concerns first; please contact us at app@merchantlink.co.uk.
10. Cookies and similar technologies
Our mobile app does not use browser cookies, but it does use local storage on your device to keep you signed in and to remember your preferences. Our website uses cookies as described in the Cookie Policy.
11. Children
The Platform is intended for users aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
12. Security
We use technical and organisational measures to protect your personal data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. No system is perfectly secure; we cannot guarantee absolute security, but we work continuously to maintain a high standard.
You play an important role too. Keep your account credentials confidential, use a strong unique password, and let us know if you suspect unauthorised use.
13. Changes to this Policy
We may update this Policy from time to time. Where the change is significant, we will give you at least 30 days' notice by email or through the app. The "Last updated" date at the top of this Policy will always show when it was last revised.
14. How to contact us
For questions about this Policy or about your personal data, contact us at app@merchantlink.co.uk or through the Help section of your account.