This privacy statement describes the way we collect and process your personal data when you are using Mercell's website and portal.
We hold the role as data controller with regard to the processing of personal data described in this privacy statement.
1. Whose personal data do we process?
This privacy statement describes our processing of personal data related to the following categories of individuals:
- Contact persons and employees of customers who use the Mercell-portal
- Contact persons and other private individuals that appear in public tender documents
- Other private individuals that make use of the services offered by Mercell
2. Purpose, Personal data categories and legal basis
In the following we will specify the purpose of the processing of personal data, which categories of personal data we process, and the legal basis for such processing.
I. Processing of personal data in connection with registration in the Mercell-portal
In connection with registration and administration of your account in the Mercell-portal, we will process the following of your personal data:
- Name
- Job title
- E-mail address
- Personal username
- Other information provided voluntarily by you, such as telephone number
Personal data registered when setting up a user profile will mainly be used for the completion of a purchase or for providing a service based on the information registered. We will, for example, use your e-mail address for the purpose of providing the tender notification services that your employer has registered for. Furthermore, your name may be published in the Mercell-portal as a contact person for your employer in connection with announced tender processes.
In addition, personal data may be used for the purpose of documenting the use of the Mercell-portal, since all activities are logged for IT security reasons. When a user logs into the portal, a unique ID is created. This ensures that the user do not have to submit a username and password multiple times within a certain time frame. The ID also enables the abovementioned logging of activities. Information that is created as a result of the use of the portal, including IP addresses, is stored on a central server belonging to Mercell. This information will solely be used in connection with user support and will never be made accessible to a third party.
All processing described under this section will be based on either GDPR Article 6 no. 1 letter b) (agreement) or letter f) (legitimate interest).
II. Processing of personal data when enrolling in a course, webinar or seminar
If you enroll in a course or a similar event via Mercell, we will process your general contact information (name, employer, e-mail). We will process this personal data for the purpose of offering you the course. Our basis for this processing is GDPR Article 6 no. 1 letter b) (agreement).
Furthermore, we may share your personal data with third parties when we engage external speakers for the purpose of allowing them to prepare relevant content based on the categories of participants attending the course. We will only share data that is necessary for fulfilling the purpose of providing such relevant content. The basis for this processing is GDPR Article 6 no. 1 letter b) (agreement) and letter f) (legitimate interest).
III. Processing of personal data when retrieving tender documents from public databases.
As a part of the services provided by Mercell, public tender documentation will be collected from public databases such as Doffin and TED. In connection with such retrieval of documents, Mercell may process contact information of employees of actors participating in tender processes (name, e-mail, employer, position), as well as other personal information that may be included in the tender documents in question.
This personal data will only be used for communicating tenders in the Mercell-portal to facilitate contact between the purchaser and supplier. Mercell has a legitimate interest in carrying out such processing activity, as this is an information service which will provide for more effective public tender processes. The basis for such processing is therefore GDPR Article 6 no.1 letter f) (legitimate interest).
IV. Processing of personal data when we communicate directly with you
Mercell aims at providing our customers with updated and solid information on the different updates and other issues we deem to be relevant for the customers to enjoy the services we offer. From time to time we will therefore publish newsletters and other relevant information to individuals who have registered a user profile in the Mercell-portal.
We will only communicate marketing content to you if you have expressly given your consent to such communication. Consent is obtained when you register for the Mercell-portal and may be withdrawn at any time on your profile in the Mercell-portal. Our basis for this type of communication is GDPR Article 6 no. 1 letter a) (consent) and the Marketing Practices Act section 15 (1).
We will also send you newsletters and other content containing general information such as information on the product we provide you with, the tender notification service, tender news, invitation to seminars/webinars etc. Such communication will not include any marketing material, and our basis for such communication is GDPR Article 6 no. 1 letter f (legitimate interest).
V. Use of cookies on the Mercell website
Mercell uses cookies and similar technology for gaining insight into user interactions on our website. We use the following categories of cookies on our websites:
- Essential cookies: Cookies that are essential for providing the services Mercell offers to its customer.
- Performance- and functionality cookies (HubSpot): Cookies that are used to improve the website's functionality. These cookies are not crucial for providing our services, but are used for ensuring you the best possible user experience.
- Analytical cookies (Google Analytics, HubSpot, Hotjar, Facebook Pixel, LinkedIn Insight Tag): Cookies that are used to collect and aggregate information to help us understand how our websites are used and monitor the efficiency of our marketing campaigns. They also help us tailor our websites to user preferences.
- Marketing cookies (Google Ads, Facebook Pixel, LinkedIn Insight Tag, HubSpot): Cookies that are used for creating marketing content that is relevant to you. This type of cookies ensures that the same ads do not pop up several times in a row, that the ads are based on your preferences and that they are presented correctly.
- Social media cookies (Facebook Pixel, HubSpot, LinkedIn Insight Tag): Cookies that ensure that you are be able to share sites and content that you find interesting on our websites through third party suppliers of social media and other websites (LinkedIn, Facebook etc). These cookies may also be used for marketing purposes.
Our main purpose for such use of cookies to gain insight into user interactions on our website in order to be able to provide the best possible service. The personal data that is processed in this context is Cookie-ID, type of device, type of browser and IP address.
You may at any time withdraw your consent to use of cookies by turning it off in your browser. However, it is important to emphasize that doing so might result in reduced functionality on our websites.
4. Mercell as data processor
Mercell will from time to time also hold the role as a data processor instead of data controller, e.g. where purchasers or suppliers upload documents to the Mercell-portal. In such circumstances the purchasers or suppliers who uploads the document in question will have the role as data controller of the personal data included in the documents, and these parties will therefore be responsible for ensuring that such processing of personal data takes place in compliance with GDPR.
Mercell has entered into data processing agreements with all purchasers and suppliers we process personal data on behalf of.
5. With whom do we share your personal data?
Our IT-service providers may have access to personal data if the personal data is stored with the provider or the provider has in another way gained access to your personal data under the service agreements they have entered into with us. This applies for example to our CRM-system provider (Hubspot).
Other companies in the Mercell group may gain access to your personal data in connection with our delivery of services to you.
Our cookies services providers may gain access to your personal data in connection with your visit to our websites.
The abovementioned parties act in accordance with a valid data processing agreement and under our instructions. We do not share personal data in other instances or in other ways than what is described in this privacy statement, unless you explicitly request or consent to this. However, in certain cases, Mercell reserves the right to release information regarding registered users to public authorities if required by law.
6. How can a user gain access to his/her personal data, and how can one rectify the data?
Each user is responsible for ensuring that the registered information is valid and correct, including making sure that only the necessary user information for using the portal is registered on behalf of the company that the user belongs to. The user will be suspended or permanently blocked from the portal if false information is provided at registration, i.e. a false name or inaccurate contact information.
Users that are logged on to the Mercell-portal can control and update their own user profile. It is also possible to add and delete information that is not mandatory, such as subscription/unsubscription from Mercell's newsletters. All user profiles that contain invalid information will be deleted without prior notification. If a user has forgotten his/her password, a request can be submitted for generating a new code, via e-mail.
If the user demands access to registered information connected to the user's own personal data, it will be logged in the Mercell-portal. The user can contact Mercell at any time for information on the logged information or other things relating to its personal data. Please see the contact information at the end of this document.
7. For how long will the personal data be stored, and how can a user delete his/her data?
The data is stored for as long as required by law, and Mercell will delete the data when it is no longer required for the purposes described under this privacy statement. This period is dependent on the type of information and why it is being stored:
- User profiles that are registered in connection with purchase of Mercell licenses are deleted when they have been inactive for a period of 12 months after expiry of the license period.
- User profiles that are registered in connection with use of the Mercell-portal without purchasing licenses are deleted when they have been inactive for 12 months.
In some public tender processes, we are required by law to store certain published information. Any user information included in such published information can therefore not be deleted if Mercell does not receive a request for this from the user/organization that is responsible for the data. This deletion must also be carried out according to applicable law.
Further information on the type of data we store and how you can have this deleted can be retrieved by contacting Mercell. Please find the contact information at the end of this document.
8. Your rights
According to the personal data legislation, you as the registered party have the right to:
- Request access to all personal data we process about you;
- Request that the processed personal data is deleted or corrected;
- Withdraw your consent if you have previously consented to processing of personal data. Users who for instance do not wish to receive marketing material from Mercell can unsubscribe from receiving newsletters and other information by updating this on their user profile;
- Retrieve your personal data that you previously have submitted to Mercell and transfer these to another data controller without Mercell's interference (data portability); and
- File a complaint with the supervisory authority (Datatilsynet).
9. Changes to the privacy statement
We may make minor changes to this privacy statement. The latest version can always be found on our website. You will be notified in case of major changes.
10. Customer service and contact with Mercell
We are always happy to help you. Our office is open from 9-16 (CET), Monday through Friday. The office hours may vary on public holidays.
Issues regarding the data processing agreement: dpo@mercell.com
Sales'- and general questions: + 47 21 01 88 00 / post@mercell.com
Support: + 47 21 01 88 60 / support@mercell.com
Invoicing: + 47 21 01 88 14 / betaling@mercell.com