This Policy defines the procedures for processing and protecting the personal data of website users https://merceri.ru/ (hereinafter — the Website).

The Policy is prepared in accordance with the Federal Law dated 07/27/2006 No. 152-FZ "On Personal Data", the requirements for publishing the operator's policy when collecting personal data through the website, as well as the general approaches of Roskomnadzor to organizing personal data processing.

1. Terms

Personal Data — any information relating to an identified or identifiable individual, either directly or indirectly.

Operator — the administration of the Merceri website, independently or jointly with others organizing the processing of personal data and determining the purposes of such processing.

Processing of Personal Data — any action performed on personal data, including collection, recording, systematization, storage, clarification, use, transfer, anonymization, blocking, deletion, and destruction.

Cookie — a small piece of data stored by the user's browser and sent to the website with subsequent requests.

2. General Provisions

By using the Website, the user confirms that they have read this Policy. If the user does not agree with the terms of the Policy, they must stop using the Website and not submit personal data through the Website’s forms.

The Policy applies only to the merceri.ru website. The Operator does not control third-party websites that the user may visit via external links.

3. Categories of Personal Data Subjects

• Website visitors;
• buyers and potential buyers;
• users of personal accounts;
• representatives of legal entities and partners;
• individuals submitting inquiries through contact forms, messengers, email, or other communication channels.

4. What Data May Be Processed

Depending on the Website usage scenario, the Operator may process:

• full name or username;
• phone number, email address;
• shipping address, pickup point details, order comments;
• data about orders, products, payment, delivery, and returns;
• account and authorization data;
• correspondence and content of user inquiries;
• technical data: IP address, cookie information, browser and device type, date and time of access, visited page address, referrer.

The Operator does not intend to process special categories of personal data or biometric personal data. Users should not submit such data through the Website’s forms.

5. Purposes of Personal Data Processing

• registration and management of personal accounts;
• processing, confirmation, payment, and delivery of orders;
• communication with the user regarding orders, product selection, service, and support;
• execution of purchase and sale agreements, supply contracts, or other agreements with the user or the organization they represent;
• maintaining accounting, tax, and management records as required by law;
• handling inquiries, complaints, and requests;
• ensuring Website security, preventing abuse and technical malfunctions;
• improving Website performance, visit analytics, and service quality;
• sending informational and marketing messages only with a lawful basis or user consent.

6. Legal grounds for processing

The Operator processes personal data based on one or more of the following grounds:

• user consent;
• the necessity of concluding or fulfilling a contract with the user;
• fulfillment of obligations imposed on the Operator by Russian Federation law;
• the exercise of the Operator's rights and legitimate interests, provided this does not infringe on the user's rights and freedoms;
• other grounds provided by Russian Federation law.

7. Cookies and technical data

The Website uses necessary cookies for the shopping cart, authorization, security, and saving user settings. Disabling cookies may result in the inability to use certain Website functions, including the personal account and order processing.

Analytical and marketing cookies are used only with the user's consent if such tools are enabled on the Website. Users can accept cookies, reject non-essential cookies, or adjust consent categories in the cookie banner.

Users can also delete cookies or limit their use in their browser settings.

8. Delegation of processing and third-party transfers

The Operator may delegate personal data processing or transfer data to third parties if necessary to achieve processing purposes, for example:

• delivery services and pickup points;
• payment services and banks;
• telecommunications operators, hosting providers, CRM suppliers, support services, and mailing services;
• government authorities — in cases and procedures established by law.

Such transfers are performed only to the extent necessary for the specific purpose and under the condition of confidentiality and compliance with personal data legislation requirements.

9. Cross-border transfers

If the use of certain services requires cross-border transfer of personal data, the Operator carries out such transfer only with a legal basis and in compliance with Russian Federation legislation requirements.

10. Processing and storage periods

Personal data are processed no longer than necessary for processing purposes, unless a different term is established by law, contract, or user consent.

Order data, payment, and accounting documents may be stored for periods specified by Russian Federation law. After the processing purposes are achieved or consent is withdrawn, personal data must be deleted, destroyed, or anonymized unless other legal grounds for processing exist.

11. Personal data protection measures

The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions.

In cases of incidents that caused or might have caused unlawful disclosure, distribution, provision, or access to personal data, the Operator acts according to procedures established by Russian Federation law.

12. User rights

Users are entitled to:

• obtain information about the processing of their personal data;
• request correction, blocking, or deletion of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose;
• withdraw consent to personal data processing;
• appeal the Operator's actions or inactions to the authorized personal data protection authority or court;
• exercise other rights provided by Russian Federation law.

13. User inquiry procedure

Requests regarding personal data processing can be sent through the section Contact Us. It is recommended to include information that allows identification of the user and processing of the request: name, contact details for response, and the essence of the request.

The Operator may request additional information if necessary to verify the identity of the applicant and protect personal data from unauthorized access.

14. Policy changes

The Operator reserves the right to update this Policy. The new version takes effect upon publication on the Site, unless otherwise specified in the new version.

The current version is available at: https://merceri.ru/privacy-policy/.

Publication date of the version: May 30, 2026