Privacy policy
Last updated:
This policy explains what personal data we collect through mercurco.com and in our trade correspondence, why we process it and what rights you have. Most of it belongs to people who represent wholesalers, importers, packers and retail chains, or who grow fruit and vegetables for us.
Data controller
The controller of your personal data is HM Distribution sp. z o.o., a company trading as Mercur (“Mercur”, “we”).
- Company
- HM Distribution sp. z o.o.
- Trading name
- Mercur
- Office
- Aleje Jerozolimskie 148, 02-326 Warszawa, Poland
- sales@mercurco.com
We have not appointed a data protection officer. For anything related to your personal data, write to sales@mercurco.com.
What data we collect
We collect the data you give us and the technical data your browser sends with every visit:
- from the quotation request form: company name, type of business, country and city of delivery, email address, phone number, product, Incoterms rule, volume, preferred start of deliveries, the details of your request and how you heard about us;
- from the software demo request form: company name, country, your role, the warehouses and countries where the company holds stock, shipments per month, number of salespeople, the software used today, email address and phone number;
- from email, phone calls and messaging apps: your name, job title, contact details and anything you include in your message;
- when we sign and perform a contract: the data needed for the load specification, transport documents (CMR), quality control reports and invoices;
- when you visit the website: IP address, browser and operating system, the referring page and the time of the visit, and if you consent to Google Analytics, also a cookie ID and the course of your visit (details in the cookies section).
Purposes and legal bases
Each purpose has its own legal basis under Article 6(1) GDPR:
- answering your request, preparing a quotation and trade talks with the company you represent: our legitimate interest (point f), or steps taken at your request before entering into a contract when you act on your own behalf (point b);
- concluding and performing a sales or grower contract: the contract (point b), and for our counterparty's staff, our legitimate interest in performing it smoothly (point f);
- bookkeeping, tax settlements and transport documentation: legal obligation (point c);
- sending commercial information, such as an offer for the next season: the consent you give in the form (point a), which Polish electronic communications law also requires;
- cookie-free visitor statistics (Vercel Web Analytics) and website security: our legitimate interest (point f);
- visitor statistics in Google Analytics: the consent you give in the website's consent box (point a), which Article 399 of the Polish Electronic Communications Law also requires;
- establishing, pursuing and defending legal claims: our legitimate interest (point f).
Who receives your data
We do not sell data. We share it only with those we need in order to prepare an offer or ship the goods:
- our website hosting and analytics provider, Vercel Inc.;
- our Google Analytics provider, Google Ireland Limited, only if you consent to it;
- our email provider, which carries the messages sent through the form;
- our accounting firm, legal advisers and the companies that maintain our IT systems;
- hauliers, shipping lines, freight forwarders and customs agents, when your data goes into a consignment note, bill of lading or customs declaration;
- certification bodies and public authorities where the law requires it, for example the Agricultural and Food Quality Inspection (IJHARS) checking marketing standards, or the National Revenue Administration.
Service providers act on our instructions under a data processing agreement.
Transfers outside the EEA
Vercel Inc. is based in the United States, so technical data from your visit may leave the European Economic Area. If you consent to Google Analytics, data about your visit may also be processed in the US by Google LLC, the parent company of Google Ireland. The transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified, or on standard contractual clauses. The same applies to any other provider outside the EEA that we use. We will send you a copy of the safeguards on request.
How long we keep data
- an enquiry that did not lead to a contract: 24 months from the last message, so that we can come back with an offer for the next harvest season;
- a contract: for as long as it is performed, then until the limitation period for claims expires, as a rule 3 years (Article 118 of the Polish Civil Code);
- invoices and accounting records: 5 years from the end of the calendar year in which the tax payment deadline passed;
- data processed on the basis of consent: until you withdraw it;
- technical data from your visit: the hosting provider deletes server logs after the period set in its service, and Vercel Web Analytics does not store IP addresses;
- Google Analytics data: no longer than 14 months, after which only aggregate reports without identifiers remain. Google Analytics cookies expire after 13 months at the latest, and the record of your choice in the consent box after 12.
Your rights
You have the right to:
- access your data and receive a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased when there is no longer a basis for processing it;
- restrict processing, for example while we check whether the data is accurate;
- receive the data we process on the basis of consent or a contract in a portable format;
- object to processing based on our legitimate interest, and to direct marketing at any time without giving reasons;
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise a right, write to sales@mercurco.com. We reply within one month. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl).
Do you have to give us your data
Giving us your data is voluntary. Without the company name, country of delivery and email address we cannot prepare an offer, which is why those form fields are mandatory.
We do not make decisions based solely on automated processing and we do not profile website visitors.
Changes to this policy
The date of the last change is shown at the top of this page. We also notify our trading partners by email of changes that affect an ongoing relationship.
This policy is available in Polish and English. If the versions differ, the Polish version prevails.