Privacy Policy

1. About This Policy

This Privacy Policy explains how Merxac ("Merxac", "we", "us", or "our") collects, uses, stores, shares, and protects personal information obtained through the merxac.com website, inquiry and application forms, the Commodity Market Intelligence Service (CMIS) platform, email correspondence, and other business interactions. By using any part of the Merxac website or submitting information to us, you acknowledge that you have read and understood this policy.

Merxac operates as a global commodity acquisition support service. Our website and services are directed at business professionals. This policy applies to all personal information processed in connection with our website and services, regardless of where you are located.

2. Who We Are

Merxac is the operator of merxac.com and the CMIS platform. For the purposes of applicable data protection legislation, Merxac generally acts as the data controller (or "business," under U.S. state privacy law) in respect of personal information collected through our website, inquiry forms, business-development activity, and CMIS accounts, because we determine why and how that information is used. Where a Deal Portal customer submits personal information and instructs Merxac to process it solely on that customer's behalf in connection with a specific engagement, Merxac may instead act as a processor or service provider for that information, governed by the applicable customer agreement. Questions about this policy or our data practices may be directed to info@merxac.com.

3. Information We Collect

3.1 Information you provide directly. We collect information that you voluntarily submit to us, including through inquiry forms, partner and supplier applications, account registration, email communication, and other direct business correspondence. This may include:

• Name, job title, and company name
• Business email address and telephone number (including WhatsApp)
• Country of operation and company registration jurisdiction
• Company type, role, and nature of business (e.g. buyer, seller, producer, trader)
• Commodity interests, transaction type, volumes, target regions, and intended use
• Documentation described or referenced in submissions (we do not store uploaded documents unless separately agreed)
• Message content, questions, and other free-text information you provide
• Consent records and communication preferences

3.2 CMIS account and platform data. If you register for or use the CMIS platform, we collect:

• Email address, password (stored in hashed form), and account profile information
• Multi-factor authentication (MFA) configuration data
• Subscription tier and billing reference (payment processing is handled by a third-party provider; we do not store card numbers)
• CMIS activity logs: searches, filter selections, map interactions, screener queries, and features accessed
• Session metadata including login timestamps and access device type

3.3 Automatically collected technical data. When you visit merxac.com, our servers and analytics tools may automatically collect:

• IP address and approximate geographic location derived from IP
• Browser type, version, and operating system
• Referring URL, pages visited, and navigation path on the site
• Session duration and engagement metrics
• Device type and screen resolution

3.4 Communications and correspondence. If you communicate with Merxac by email or through third-party channels, we retain the content of those communications to the extent necessary for business purposes, compliance, and dispute resolution.

3.5 Information obtained from third parties. We may cross-reference information you provide against publicly available sources, sanctions lists, company registries, and other third-party compliance resources as part of our standard due diligence and Know Your Business (KYB) process. We do not purchase personal data lists for marketing purposes.

4. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation (GDPR) or equivalent legislation applies, we rely on the following legal bases for processing your personal information:

• Consent — where you have given clear consent, for example by submitting an inquiry form or subscribing to communications. You may withdraw consent at any time by contacting us.
• Contractual necessity — where processing is necessary to provide CMIS access, respond to a supplier or buyer application, or fulfill a service engagement.
• Legitimate interests — where processing is necessary for our legitimate business interests, including operating and improving the website, preventing fraud, assessing counterparty credibility, and communicating with business contacts, provided those interests are not overridden by your rights.
• Legal obligation — where processing is required to comply with applicable law, including anti-money laundering (AML) obligations, sanctions screening requirements, Know Your Customer (KYC) / Know Your Business (KYB) requirements, and regulatory demands.

5. How We Use Your Information

We use the information we collect for the following purposes:

• To review and respond to commodity acquisition inquiries, supplier applications, and partner requests
• To assess commercial fit and counterparty credibility as part of our standard review process
• To provide, operate, and improve the CMIS platform and website
• To manage CMIS accounts, authenticate users, and administer subscriptions
• To conduct sanctions screening, KYC/KYB checks, and compliance due diligence as required by applicable law or our internal policies
• To communicate with you regarding your inquiry, application, subscription, or business correspondence
• To detect, prevent, and respond to fraud, security incidents, or misuse of our services
• To monitor and analyse platform usage for performance, feature development, and security purposes
• To comply with legal, regulatory, and professional obligations
• To maintain records for dispute resolution and legal proceedings

6. How We Share Your Information

We do not sell personal information. We do not share personal information with third parties for their independent marketing purposes. We may share information in the following limited circumstances:

• Service providers: We engage third-party service providers for hosting, analytics, email delivery, authentication, payment processing, and compliance screening. These providers process data on our behalf under appropriate data processing agreements and are not permitted to use it for their own purposes.
• Professional advisors: Legal counsel, accountants, compliance consultants, and auditors who are bound by professional confidentiality obligations.
• Compliance and law enforcement: Where required by applicable law, court order, or lawful government request; or where disclosure is necessary to protect Merxac's legal rights or the safety of third parties.
• Potential counterparties: In the context of a specific business inquiry where you have expressly submitted information for the purpose of being introduced to or evaluated by potential commodity buyers, sellers, or partners. We will not share your contact details without your awareness and in the context of the inquiry you submitted.
• Business transfers: In the event of a merger, acquisition, sale of assets, or restructuring, personal information may be transferred as part of the transaction, subject to appropriate confidentiality obligations.

7. International Data Transfers

Merxac operates globally and may process or store personal information in countries outside your own jurisdiction, including countries that may not have data protection laws equivalent to those in your home jurisdiction. Where required, we implement appropriate safeguards for international transfers, including standard contractual clauses approved by applicable regulators, or we rely on other permitted transfer mechanisms. By submitting information through our website or services, you acknowledge that your information may be transferred and processed in jurisdictions outside your own.

8. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this policy, and as required by applicable legal, regulatory, compliance, or accounting obligations. In practice:

• Inquiry and application submissions are retained for a minimum of three years from the date of submission, or longer if required by applicable law or an ongoing business relationship.
• CMIS account data is retained for the duration of the account and for a period of up to five years following account closure.
• Communications and correspondence are retained for a minimum of five years from the date of the last communication in a thread.
• Technical and analytics data is retained for up to 24 months.
• Sanctions and compliance records may be retained for longer periods as required by applicable AML, KYC, or financial crime legislation.

When information is no longer required, it is securely deleted, anonymised, or de-identified in accordance with our data retention schedule.

9. Your Rights

Depending on your jurisdiction, you may have some or all of the following rights in relation to your personal information:

• Right of access: The right to request a copy of the personal information we hold about you.
• Right to rectification: The right to request correction of inaccurate or incomplete information.
• Right to erasure ("right to be forgotten"): The right to request deletion of your personal information, subject to our legal obligations to retain certain records.
• Right to restriction of processing: The right to request that we limit how we use your information in certain circumstances.
• Right to data portability: The right to receive a structured, machine-readable copy of certain information you have provided to us.
• Right to object: The right to object to processing based on legitimate interests, or to direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to complain: The right to lodge a complaint with a supervisory authority (such as the UK ICO, a EU data protection authority, or equivalent) if you believe your rights have been infringed.

To exercise any of these rights, please contact us at info@merxac.com. We will respond within the timeframe required by applicable law. We must take reasonable steps to verify that a person making a request is the individual to whom the information relates or an authorized representative — depending on the request, we may ask you to confirm control of an email address, provide information already associated with the record, or provide evidence of authorization if you are acting as an authorized agent. We will not use information collected solely for verification for any unrelated purpose. If applicable law provides an appeal right and we deny all or part of a request, you may appeal by replying to our decision or emailing info@merxac.com with the subject "Privacy Appeal"; you may also have the right to contact the relevant supervisory authority independently of or after an appeal. We will not unlawfully discriminate against you for exercising a privacy right, though exercising a right may affect a service if the information is necessary to provide it — for example, deleting account information may require closing the account.

Merxac does not make decisions producing legal or similarly significant effects about individuals solely through automated processing without human involvement. CMIS may use automated methods for sorting, filtering, geocoding, matching, clustering, and ranking business-directory data, but these analytical functions are not a definitive legal, credit, employment, or eligibility determination about an individual or organization.

10. Cookies and Tracking Technologies

The Merxac website uses cookies and similar technologies to operate securely, remember your preferences, and understand how the site is used. Full details — including the categories of cookies we use, how our cookie consent banner works, and how to change your preferences at any time — are set out in our Cookie Policy. Disabling non-essential cookies may reduce convenience but will not prevent access to core content.

11. Sanctions, AML, and Compliance Screening

As part of our commercial due diligence, we screen companies and individuals submitting inquiries or applications against applicable sanctions lists, including those published by OFAC (U.S. Treasury), the UK Office of Financial Sanctions Implementation (OFSI), and the United Nations Security Council. We may decline to engage with, respond to, or introduce any party that appears on a sanctions list, or where engagement would, in our assessment, create unacceptable compliance risk. We retain records of our screening process as required by applicable anti-money laundering, counter-terrorism financing, and sanctions legislation.

12. Data Security

Merxac implements technical and organisational security measures appropriate to the nature and sensitivity of the information we process. These include access controls, encryption of data in transit and at rest where appropriate, multi-factor authentication for CMIS accounts, and periodic security reviews. No method of data transmission or storage is completely secure. While we take reasonable precautions, we cannot guarantee that data submitted via the internet will not be intercepted or that our systems will not be compromised. We encourage users to protect their CMIS credentials and to notify us promptly at info@merxac.com if they suspect any unauthorised access.

13. Links to Third-Party Websites and Services

The Merxac website and CMIS platform may contain links to third-party websites, resources, or services, including data source publishers listed on the Data & Sources page. We are not responsible for the privacy practices, security, content, or availability of third-party websites. We encourage you to review the privacy policies of any third-party services you access through links on our site.

14. Children's Privacy

The Merxac website and CMIS platform are intended for use by business professionals and are not directed at children under the age of 16 (or the applicable age threshold in your jurisdiction). We do not knowingly collect personal information from children. If you believe that a child has submitted personal information to us, please contact us at info@merxac.com and we will take steps to delete it.

15. Marketing Communications

Merxac does not engage in unsolicited mass marketing. We may communicate with individuals who have submitted inquiries or applications to update them on relevant opportunities or developments directly connected to their submission. You may opt out of non-essential communications at any time by contacting info@merxac.com or using the unsubscribe mechanism in the message. Service, security, transactional, legal, or account-related communications may continue even after you opt out of marketing. We may maintain a minimal suppression record to ensure a marketing opt-out or removal request is respected.

16. California and Other U.S. State Privacy Rights

If the California Consumer Privacy Act, as amended, or another U.S. state privacy law applies to you and to Merxac for the relevant processing, you may have rights to know or access categories and specific pieces of personal information we hold, request deletion, request correction, opt out of a "sale" or "sharing" of personal information, limit certain uses of sensitive personal information, and receive equal service and pricing when exercising these rights, subject to statutory exceptions. Merxac does not sell personal information for money and does not knowingly engage in cross-context behavioral advertising, but certain U.S. state laws define "sale" and "sharing" broadly enough that they could technically capture some routine service-provider disclosures; where that is the case for a particular individual, we will honor the applicable opt-out right. If we are legally required to treat a qualifying browser-based opt-out preference signal, such as Global Privacy Control, as a valid opt-out for a covered activity, we will process that signal as required by law for the browser or device from which it is received. This section does not state or imply that Merxac is a data broker or engages in a sale of personal information under any statute; that determination depends on the specific facts and the law in force at the relevant time. Residents of other U.S. states may have similar or additional rights, including rights to appeal a denied request, which we will honor to the extent they apply.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. The effective date at the bottom of this page indicates when the policy was last revised. Where changes are material, we will take reasonable steps to bring them to your attention, for example by updating the effective date and posting a notice on the website. Your continued use of our website or services after such changes constitutes acceptance of the revised policy.

18. Contact

For questions, rights requests, or concerns about this Privacy Policy or how we handle your information, please contact us at info@merxac.com.

This policy reflects Merxac's current data practices and should be reviewed by qualified legal counsel in each applicable jurisdiction. Merxac reserves the right to modify this policy at any time in accordance with section 17 above.