Introduction

This Privacy Notice provides you with information about how and why Mercell Nederland B.V. collects and processes your personal data when you use any of the Mercell Portals. When the document refers to Mercell, it shall be understood as Mercell Netherlands B.V. and its subsidiaries (hereinafter referred to as “Mercell”, “We,” or “we”).

The Privacy Notice is addressed to users of Mercell Portals. Users are any person who uses or intends to use the Mercell Portals.
For us, it is important that your personal data and personal integrity are protected and dealt with in accordance with the applicable legal framework, and therefore we ensure that the information we have about you is processed in a lawful and transparent manner in accordance with the data protection regulations.

We refer to Personal data as any information that alone or by a combination with other information could be used to identify is about or can be related to an identified or identifiable natural person.
At Mercell we ensure that your personal data is processed in accordance with the applicable data protection regulations at all times.

We are regarded as data controllers for the processing of personal data described in this Privacy Notice. You will find contact details below.”

• WHO DO WE PROCESS PERSONAL DATA ABOUT?
• PURPOSE, CATEGORIES OF PERSONAL DATA, AND LEGAL BASIS
• MERCELL AS DATA PROCESSOR
• WHO DO WE SHARE INFORMATION ABOUT YOU WITH?
• HOW DOES A USER ACCESS HIS/HER PERSONAL DATA, AND HOW CAN THIS INFORMATION BE RECTIFIED?
• HOW LONG IS PERSONAL DATA STORED, AND HOW CAN A USER DELETE THEIR DATA?
• YOUR RIGHTS
• DISCLOSURE OF PERSONAL DATA
• CHANGES TO THE PRIVACY NOTICE
• CUSTOMER SERVICE AND CONTACT WITH MERCELL

Privacy notice for Negometrix (product)

Latest version: 27 January 2023

The Privacy Notice is addressed to customers of Mercell other private individuals using Mercell services.,   Customers of Mercell are or may be any legal person who hired or intends to hire Mercell services, including any legal person who acts on behalf of the customer.

For us, it is important that your personal data and personal integrity are protected and dealt with in accordance with the applicable legal framework, and therefore  we ensure that the information we have about you is processed in a lawful and transparent manner in accordance with the data protection regulations. 

We referred to  Personal data as any information that alone or by a combination with other information could be used to identify is about  or can be related to an identified or identifiable natural person. 

At Mercell we ensure that your personal data is processed in accordance with the applicable data protection regulations at all times.

We are regarded as data controllers for the processing of personal data described in this Privacy Notice. You will find contact details below. 

1. CONTENT OF THE  PERSONAL DATA TO PROCESS WHO DO WE PROCESS PERSONAL DATA ABOUT?

This Privacy Notice addresses Mercell’s processing of personal data about the following categories of personal data 

• Contact data of any person persons and employees of customers who use the Mercell portals;
• Contact data of people and other private individuals stated in public tender documents;
• Other personal private individuals who use the services offered by Mercell.

2. PURPOSE, CATEGORIES OF PERSONAL DATA, AND LEGAL BASIS

Below is a description of the purposes for which we process personal data, and what categories of personal data we process, as well as the legal basis for the processing.

I. Processing of personal data in connection with registration in the Mercell portals

In connection with registration and administration of your user in the Mercell portals, we process the following personal data about you:

• Name;
• Position;
• Email address;
• User name;
• Telephone number;
• LinkedIn profile ( not required );
• Photo ( not required ).
• Other information of relevance for our services you voluntarily register, such as your phone number.

Personal data that registered when you create a user profile will mainly be used to complete the purchase or provide a service based on what was registered or collected. For example, we will use your email address to provide the tender notification service that your employer has signed up for. Furthermore, your name may be published in the Mercell portals as a contact person for your employer in connection with an announced tendering process.

In addition, personal data can be used to document the use of the Mercell portals, since all activities are logged for IT security reasons. When a user logs into the portals, a unique ID is created. This ensures that the user does not have to enter a username and password multiple times during a given period of time. The ID also ensures the aforementioned logging of activities. Information created as a result of the use of the portals, including IP addresses, is stored on a central server belonging to Mercell. This information is only used for support purposes and is never provided to third parties.

For all processing described under this section, our legal basis for this processing activity will be either article 6 (1) letter b of the GDPR (Necessary for the performance of contracts) or letter f (legitimate interest), such as when the processing of personal data is necessary to prevent fraud.

II. Processing of personal data when you sign up for courses, webinars or seminars

If you sign up for courses or similar events via Mercell, we will process general contact information about you (name, employer,  and email). We process this personal data in order to offer you the course. Our legal basis for this processing activity is article 6 (1) letter b ( Necessary for the performance of a contract) of the GDPR.

Furthermore, we may share personal data about you with third parties when we use external course providers so that they can prepare the course content based on the participants. We only disclose the information relevant to the fulfillment of such this purpose. The legal basis for this processing activity is article 6 (1) letter b (agreement) and Article 6 (1) letter f (GDPR) (legitimate interest).

III. Processing of personal data in connection with the collection of tender documents from public databases

As part of the services Mercell provides, public tender documentation will be obtained from public databases such as Doffin and TED. In this connection, Mercell will be able to process contact information (name, email, employer, position) of employees of actors in tender processes, as well as other personal data that may be stated in these tender documents.

This personal data will only be used to disclose tenders in the Mercell portals so that the buyer and supplier can get in touch with each other. This is a type of processing Mercell has a legitimate interest in performing, as this is an information service that contributes to the fact that already publicly announced tenders reach a larger circle of suppliers. The legal basis for processing this type of personal data follows from article 6 (1) letter f of the GDPR (legitimate interest).

IV. Processing of personal data in connection with direct communication with you

Mercell strives for our customers to get updated and good information about various updates and other conditions we believe are relevant for our customers to enjoy the services we offer. From time to time, we will therefore send out newsletters and other relevant information to people who have registered a user profile in the Mercell portals.

If we send you inquiries that contain marketing for our services, we will ask for your consent first. The consent will be managed via a link in the email sent to you and will also be available on Mercell´s website. In some cases, consent can be collected through the Mercell portals. Our basis for processing this type of inquirywill be article 6 (1) letter a (consent) of the GDPR and § 15 (1) of the Norwegian Marketing Act, or similar regulation in local Marketing regulation.

In other cases, we will send you newsletters and other inquiries containing information only and not marketing, typically information about the product you use with us, the tender notification service, tender news, an invitation to seminars/webinars or similar. The legal basis for processing such inquiries is article 6 (1) letter f of the GDPR (legitimate interest). 

Customer surveys

Mercell processes personal data in connection with customer satisfaction surveys. It is necessary for Mercell to conduct such surveys in order to obtain feedback on our products and services so that they can be constantly developed and improved. By participating in the survey, you agree that we may process your data. Participation is voluntary. Mercell has a legitimate interest in processing your contact information for this purpose. 

Product development and analysis

Mercell may collect information about you as a user for analysis of how you, as a customer, use Mercell’s services on digital surfaces. This information is used to develop and prepare the functionality of existing products and services. We use Amplitude and Hubspot for traffic analysis on our website. See more about cookies below.

3. MERCELL AS DATA PROCESSOR

For several processing activities, Mercell will act as a data processor instead of a controller. This will mainly apply where buyers or suppliers upload documents containing personal data in the Mercell portals. In such cases, the purchaser or supplier uploading the relevant document will be responsible for the processing of the personal data contained in the document, and this party is thus responsible for ensuring that the processing takes place in accordance with the GDPR.

Mercell enters into data processing agreements with all buyers and suppliers for whom we process personal data.

4. WHO DO WE SHARE INFORMATION ABOUT YOU WITH?

Your personal data is treated confidentially with us, and only those with the necessary service needs with us will have access to your personal data. As a general rule, we will therefore, not share your personal data with anyone outside of Mercell.

In some cases, we may need to share your personal data with others. The people we share your information with are as follows:

Our IT service providers may access personal data if personal data is stored with the supplier, or the supplier otherwise gains access to personal data about you in accordance with the contract with us. This applies, for example, to our customer relationship management systems provider (Hubspot) or support service providers. Please note that some service providers could be located outside the EU/EEA (US). If personal data is transferred to countries outside the EU/EEA, Mercell will take appropriate measures and conduct the appropriate assessment to protect your security and to ensure that the transfer takes place with a sufficient degree of protection.  

Other companies within the Mercell Group may access personal data about you in connection with our provision of services to you.

5. HOW DOES A USER ACCESS HIS/HER PERSONAL DATA, AND HOW CAN THIS INFORMATION BE RECTIFIED?

Each user is responsible for ensuring that the information registered is valid and correct, including that only use information which is relevant to the use of the portals is registered on behalf of the company to which the user belongs. The user will be suspended or permanently blocked from the portals if false information is entered upon registration, e.g., false name or inappropriate contact information. 

Users who are logged on to the Mercell portals can control and update their own user profile. In the same part of the portals, it is possible to add and delete information that is not mandatory, including subscribing / unsubscribing for newsletters from Mercell. All user profiles that contain invalid information will be deleted without prior notice. If a user has forgotten their password, a request can be sent to create a new password by email.

If the user requires insight into registered data linked to the user’s own personal data, this is logged in Mercell’s portals. The user can contact Mercell at any time for information about logged information or other matters relating to personal data. Please see the contact information at the end of this document.

6. HOW LONG IS PERSONAL DATA STORED AND HOW CAN A USER DELETE THEIR DATA?

The information is stored during the period that complies with the law, and Mercell will delete the information when it is no longer needed. The storage period depends on the type of information and why it should be stored:

• User profiles that are registered in connection with the purchase of Mercell licenses are deleted when they have been inactive for a period of 12 months after the license expiry date.
• User profiles that are registered in connection with the use of the Mercell portals without the purchase of licenses are deleted when they have been inactive for 12 months.

In public tendering processes, we are in certain cases required by law to preserve published information. Therefore, any user information included as part of such published information cannot be deleted unless Mercell receives a claim for this from the user/organization responsible for the data. This deletion must also be done in accordance with applicable law.

Users who have doubts about what information can be deleted, including information about when and where, can contact Mercell. Please see the contact information at the end of this document.

7. YOUR RIGHTS

According to the GDPR, data subjects have several rights related to our processing of your personal data. Here you will find information about how you can exercise these rights towards Mercell in connection with the processing of your personal data. 

If you request us to exercise one or more of these rights, we will comply with your request within one month of its submission. The request can be directed to :security-nl@mercell.com and will strive to be answered in 20 business days. 

Access: you can send us a request for access to our processing of your personal data. 

Correction: if you believe that the information, we have stored about you is incorrect (e.g., email address or office), you can at any time request that we correct this. 

Protest: if you do not want us to process your personal data, you can object to the processing.

Withdraw your consent: you may withdraw your consent at any time that we may store and process your personal data where such consent has been given. If you would like to withdraw your consent, please use the contact details below in this Privacy Notice. 

Erasure: if you object to the processing of your personal data or you withdraw your consent, information that we have stored about you will be deleted on the condition that we have no other legal basis for retaining it. If you want your personal data deleted under other circumstances, you can easily direct an inquiry to us about this.

Data portability: you have the right to demand data portability for information about yourself that you have provided to Mercell, and which has a legal basis for processing in consent or agreement. If you wish to exercise your right to portability, the relevant information about you will be sent to you, or a third party that you designate if this is technically possible.

Right to restrict the processing: if you want us to restrict the processing of your personal data, you can request this.

Right to complain to a supervisory authority: if you believe that our processing of your personal data should be in violation of the GDPR, or other data protection regulations, you have the right to complain about this to the Norwegian Data Protection Authority. Complaints can be submitted on their website; https://www.autoriteitpersoonsgegevens.nl/.

8. CHANGES TO THE PRIVACY NOTICE

We may change this Privacy Notice from time to time in our sole discretion. When we make changes to this statement, we will change the revision date at the top of this page, and a modified Privacy Notice will take effect from the date of revision. You will always find the latest version on our website. 

We encourage you to review this Privacy Notice to be informed of how we protect your information.  

9. CUSTOMER SERVICE AND CONTACT WITH MERCELL

We are always happy to help you if you have any questions or concerns regarding your privacy. If you have any questions about the processing of your personal data, please use the contact details below. 

Our office is open 9am-4pm (CET), Monday to Friday. Office hours may differ on public holidays. 

About the data processing agreement: security-nl@mercell.com

Sales and general questions: +31 (0) 85 20 846 66

Data Privacy Request: security-nl@mercell.com