Privacy Policy

About this notice

This notice covers merch365.eu and the information used to respond to merchandise enquiries. “Merch365”, “we” and “us” refer to the legal operator identified below, which is the controller responsible for this personal information. We welcome enquiries from individuals and businesses. Further business information is provided on our Company Details.

For a privacy question or a request about your information, email sales@merch365.eu. Please identify the enquiry or correspondence concerned so that we can locate the relevant records.

Information we receive

When you send a project brief, we receive your name, company or organisation, email address, project type and message. You may also provide a required date, approximate quantity and selected products with quantities. If you contact us by email, we receive your message, sender details and any attachments you choose to send.

During a project discussion, you may provide artwork, branding instructions, delivery information and contact details for people involved in the project. Only provide information needed for your request, and make sure you are entitled to share information about other people.

The website also processes technical information needed to serve pages and protect the enquiry form, including the IP address associated with a request. Hosting and email services process connection and security information in providing their services.

Why information is used

• Enquiries and quotations: to understand your request, communicate with you and prepare a project proposal. Where you personally request steps towards a contract, the basis is taking those steps at your request. For business representatives, the basis is the legitimate interest in managing relevant business enquiries and relationships, subject to the rights and interests of the people concerned.
• Project administration: to coordinate an agreed project and related communications. The relevant basis is performance of a contract with you, or the legitimate interest in administering a contract with the organisation you represent.
• Website security: to limit abuse, repeated submissions and unauthorised access. The basis is the legitimate interest in protecting the website and communications, subject to the rights and interests of the people concerned.
• Legal obligations and claims: where records must be retained or disclosed to comply with a legal requirement, or where information is necessary to establish, exercise or defend a legal claim.

Where consent is the appropriate basis for an additional use, that use requires a separate, clear choice. Sending the current project form does not enrol you in a newsletter.

How the enquiry form works

A submitted enquiry is saved in a restricted WordPress inbox and sent by email to the Merch365 enquiry address. Access to that inbox requires administrator permissions.

The custom form uses keyed hashes derived from an IP address and email address to count repeated submissions. These counters stop being used for rate limiting 15 minutes after their latest successful update. Expired entries may remain in server storage until routine cleanup. Hashing does not necessarily make these identifiers anonymous. This does not set the retention period for the enquiry itself or for hosting logs.

Your merchandise selection is stored separately in your browser. It contains product identifiers and quantities, rather than the contact details or message you enter in the form. The Cookie Policy explains this storage.

Service providers and other recipients

Authorised Merch365 team members can access enquiry information where they need it to respond or manage the project. We do not sell enquiry details.

The website is hosted using HostGator. Mail for the merch365.eu domain is routed through Google’s email infrastructure. These services are involved in website operation and delivery or receipt of correspondence.

Information relevant to an agreed project may also need to be provided to the people or organisations carrying out design, production or delivery. Information shared for that work is to be limited to what it requires. We may disclose information where required by law or where necessary to deal with a legal claim.

Partner logos and external links do not by themselves send your project enquiry to those partners. Following an external link takes you to a separately operated website with its own privacy information.

International processing

Hosting and email providers operate internationally, and information may be processed outside your country, including outside the European Economic Area. Newfold Digital, the group behind HostGator, publishes data-processing terms addressing international transfers. Google also publishes data-processing terms and transfer safeguards for its business services.

Transfers covered by data-protection law require an applicable transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. You can contact sales@merch365.eu for information about the arrangements relevant to your enquiry.

Provider information: Newfold data-processing terms and Google Workspace data-processing terms.

Retention and deletion

Our retention policy is to keep information only while it is needed for the purpose for which it was collected. For an enquiry that does not become an order, the relevant criteria are whether discussions remain active, whether a response or requested follow-up is outstanding, and whether a specific legal obligation or genuine dispute requires a record to be kept.

Where a project proceeds, relevant correspondence and project records may need to be retained for the duration of the project and for applicable accounting, contractual or legal-claim requirements. Those requirements depend on the record and the law that applies. This notice does not set a blanket retention period for every type of record.

The website does not automatically delete enquiry records after a fixed number of days. Deletion therefore needs to cover the website inbox and relevant email copies, subject to any lawful retention requirement. Backup copies may remain until they are replaced or expire under the applicable backup arrangements.

To ask about the retention of your enquiry or request deletion, contact sales@merch365.eu.

Your rights and requests

Where applicable data-protection law provides them, you may have rights to access, correct or erase personal information; restrict or object to processing; and receive certain information in a portable form. These rights depend on the circumstances and are not unconditional. If processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Send requests to sales@merch365.eu. We may ask for proportionate information to verify your identity. Under the GDPR, the normal response period is one month; where an extension is permitted, the reason and extension must be explained.

You can also complain to Malta’s Information and Data Protection Commissioner, or, where the GDPR applies, the supervisory authority in the place of your habitual residence, work or the alleged infringement. The European Data Protection Board’s directory lists the national authorities.

Security and automated decisions

The website uses HTTPS, restricted access to the enquiry inbox and form checks intended to reduce misuse. No internet transmission or storage system can be guaranteed completely secure.

The current enquiry workflow does not make decisions about you with legal or similarly significant effects using solely automated processing. Product selection and form validation help process your request; project decisions are handled through communication with the team.

Changes to this notice

The date at the top of this page shows when the notice was last updated. We may update this notice when the website, service providers or information-handling practices change. Questions can be sent to sales@merch365.eu.