Privacy Policy

1. Data Controller Information

The Data Controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) for the Mercante1 platform is:

2. Controller vs. Processor Roles under the GDPR

We distinguish between two distinct data protection relationships under Article 4(7) and Article 28 GDPR:

• Mercante1 as Data Controller: We act as the independent Data Controller for the operation of the public website (mercante1.com), administration of Wholesaler subscriber accounts, billing of monthly SaaS subscriptions via Stripe, and handling direct communications or support inquiries.
• Mercante1 as Data Processor (Art. 28 GDPR): When a Wholesaler utilizes our software to organize restaurant accounts, chef contact details, delivery addresses, order histories, and bespoke pricing, the Wholesaler acts as the Data Controller. Mercante1 acts strictly as a Data Processor, processing restaurant tenant data on behalf of and according to the instructions of the Wholesaler under a Data Processing Agreement (DPA).

3. Categories of Data, Purposes & Legal Bases

a) Website Provision & Server Logs

When accessing our website, web servers automatically log standard network transmission data: IP address, date and timestamp, page requested, HTTP status code, referrer URL, and browser user agent. This information is processed to ensure technical delivery, prevent denial-of-service events, and safeguard system integrity. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operations).

b) Wholesaler Account Administration

During registration, we collect business trade name, representative name, business address, email, hashed password credentials (Argon2id), and phone number. This processing is necessary to establish, maintain, and fulfill the SaaS subscription contract (Art. 6(1)(b) GDPR).

c) SaaS Subscription Payments via Stripe

Monthly subscription payments are handled directly by Stripe Technology Europe Ltd. (Dublin, Ireland). Payment card details are collected directly by Stripe Elements; Mercante1 never receives, processes, or stores payment card numbers. We retain only Stripe customer identifiers, subscription status, and invoice reference numbers (Art. 6(1)(b) GDPR).

d) Restaurant Portal Data & Multi-Tenant Isolation

Wholesalers upload restaurant business names, delivery destinations, delivery schedules, order lines, and pricing exceptions. All restaurant tenant records are strictly isolated at the database engine level via PostgreSQL Row-Level Security (RLS) enforced by organization identifiers. Unauthorized cross-tenant queries are prevented at the database boundary (Art. 6(1)(b) & Art. 28 GDPR).

e) Transactional Communications & Alerts (Resend)

Automated transactional emails (order confirmations, restaurant access invitations, operational announcements) are dispatched through Resend Inc. using a durable transactional outbox pattern to decouple notifications from commercial database transactions (Art. 6(1)(b) and Art. 6(1)(f) GDPR).

4. Subprocessors and Cloud Infrastructure

We engage certified enterprise cloud providers bound by Data Processing Agreements in accordance with Article 28 GDPR:

5. Cookies and Storage Technologies

No Marketing or Tracking Cookies: Mercante1 does not employ marketing cookies, advertising pixels, or third-party behavioral profiling trackers.

We use exclusively strictly necessary technical cookies and browser storage (§ 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR):

• Authentication Session Tokens (Supabase Auth): To maintain secure authenticated sessions across application requests.
• Security & CSRF Tokens: To prevent cross-site request forgery and protect form submissions.
• Interface Preferences: Local storage of user interface settings (light theme display).

Because only strictly necessary technical cookies are used, cookie consent banners are not legally required under EU ePrivacy directives and German telecommunications law.

Anonymous visit counting: On this website we count page views as plain daily totals per page, source category (for example a search engine), and screen size (mobile or desktop). We set no cookies and store no IP addresses, browser identifiers, or anything else that could recognize a visitor. The totals are stored with Supabase in Frankfurt. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the reach of our website).

6. Data Retention & Deletion

Personal data is retained only for as long as required to achieve the purpose for which it was collected or as prescribed by statutory retention legislation.

Accounting and taxation documents are stored in accordance with statutory retention periods under the German Commercial Code (§ 257 HGB) and Fiscal Code (§ 147 AO) for 6 to 10 years. Upon termination of a Wholesaler subscription, all tenant database records are permanently deleted following the expiration of mandatory retention periods.

7. Your Rights as a Data Subject

Under the GDPR, you possess the following statutory rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Confirmation and information regarding your processed data.
• Right to Rectification (Art. 16 GDPR): Correction of inaccurate personal data.
• Right to Erasure (Art. 17 GDPR): Deletion of your data („right to be forgotten“).
• Right to Restriction of Processing (Art. 18 GDPR): Restriction of processing under statutory prerequisites.
• Right to Data Portability (Art. 20 GDPR): Receipt of your data in a structured, commonly used format.
• Right to Object (Art. 21 GDPR): Objection to processing based on legitimate interests (Art. 6(1)(f) GDPR).
• Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a competent supervisory authority. The lead supervisory authority for Mercante1 is:
  Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

8. Technical and Organizational Security Measures (TOMs)

Mercante1 implements state-of-the-art technical and organizational safeguards:

• PostgreSQL Row-Level Security (RLS): Kernel-level multi-tenant isolation guaranteeing zero cross-tenant visibility.
• End-to-End Encryption: All external web communications are encrypted in transit via TLS 1.3. Databases and backups use AES-256 encryption at rest.
• Cryptographic Credential Hashing: Passwords and invitation secrets are hashed using memory-hard Argon2id and Scrypt algorithms.
• Restricted Service Role Access: Administrative database keys bypass RLS only in narrowly scoped, audited system handlers (Stripe webhook, outbox delivery).