This Privacy Policy governs the processing of the personal data of users of Mercan, a marketplace for the sale of second-hand items between private individuals (C2C), available as a mobile app (iOS and Android) and as a website at the mercan.es domain (hereinafter, "Mercan", the "Platform" or the "Service").
Mercan is committed to protecting the privacy and personal data of its users in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD").
Please read this Policy carefully before registering or using the Platform. By registering and using the Service, you declare that you have read and understood the content of this Privacy Policy. This Policy is complemented by the Platform's Terms of Use and, where applicable, the Cookie Policy.
The controller of your personal data is:
Mercan has not appointed a Data Protection Officer (DPO) as none of the mandatory appointment scenarios under Article 37 GDPR apply. Nevertheless, for any matter relating to the processing of your personal data or this Privacy Policy, and to exercise your rights, you may contact the controller at info@mercan.es.
Mercan processes the following categories of personal data, obtained directly from you when you register, complete your profile, post listings, communicate with other users, carry out transactions or otherwise interact with the Platform, as well as data generated automatically through use of the Service:
Name, email address, city, profile photo (optional) and profile bio or description (optional).
Email address and password. Passwords are stored encrypted and are never kept in plain text.
Listings of second-hand items, item photos, titles and descriptions, prices, messages exchanged in the chat with other users, offers and price negotiations, reviews, comments and reputation, as well as any reports of listings or users you may submit.
Information relating to purchases and sales made through the Platform, amounts, service fees, order status and receipt confirmations. Full payment card details are processed directly by Stripe; Mercan does not store or have access to your full card details.
For users acting as sellers who wish to receive payouts, Stripe collects and verifies identity and bank account data in order to comply with anti-money-laundering and customer identification ("Know Your Customer" or KYC) regulations. This data is provided to and processed directly by Stripe, which, with respect to those regulatory obligations (identity verification, prevention of money laundering and terrorist financing), acts as an independent data controller, without Mercan having access to the full identity documentation provided.
Data generated automatically when using the Platform, such as device identifiers, connection data, activity logs and data necessary for the operation, security and fraud prevention of the Service. The use of cookies and similar technologies is detailed in section 11.
When filling in forms or posting content, please do not include personal data of third parties without their consent, nor special categories of data (health, ideology, religion, racial or ethnic origin, sexual orientation, etc.). Posting identity documents or third-party personal data is expressly prohibited on the Platform. If you nevertheless include third-party data, you act under your sole responsibility and must have informed those persons and, where applicable, obtained their consent.
Mercan processes your personal data for the purposes detailed below, indicating in each case the legal basis under Article 6 GDPR:
Purpose: create and manage your account, allow access to the Service and authenticate your identity. Legal basis: performance of the contract (Art. 6.1.b GDPR), constituted by acceptance of the Platform's Terms of Use.
Purpose: enable posting and searching of listings, favorites management, buyer–seller chat, offers and price negotiations, reviews and seller reputation. Legal basis: performance of the contract (Art. 6.1.b GDPR).
Purpose: analyze the item photos you upload to automatically generate a title, description and suggested price to make posting easier. Legal basis: performance of the contract (Art. 6.1.b GDPR), as this feature is inherent to the service you request when starting AI-assisted posting; alternatively, legitimate interest (Art. 6.1.f GDPR) in facilitating and improving the posting experience.
Purpose: offer semantic item search and recommendations of similar items by creating vector representations (embeddings) of content. Legal basis: performance of the contract (Art. 6.1.b GDPR) and legitimate interest (Art. 6.1.f GDPR) in offering an effective, relevant search service.
Purpose: automatically moderate posted content using AI and manage the reporting system, to detect and prevent prohibited items or uses (weapons and ammunition, drugs, counterfeits or replicas, sexual or adult content, live animals, medicines, identity documents or third-party personal data, stolen goods, illegal services and scams), prevent fraud and ensure user safety. Legal basis: legitimate interest (Art. 6.1.f GDPR) in ensuring the security, legality and integrity of the Platform and protecting users; and compliance with legal obligations (Art. 6.1.c GDPR) where applicable.
Purpose: process payments through Stripe, hold the amount paid by the buyer, release payment to the seller via Stripe Connect (Express connected accounts) once the buyer confirms receipt, and charge the service fee (approximately 5% of the transaction amount). Legal basis: performance of the contract (Art. 6.1.b GDPR).
Purpose: verify the identity of sellers who receive payouts and comply with applicable anti-money-laundering and counter-terrorist-financing regulations. Legal basis: compliance with a legal obligation (Art. 6.1.c GDPR), managed through Stripe.
Purpose: send you emails necessary to provide the service (registration confirmations, verification and password recovery, message notices, offers, order confirmations, payment status, etc.). Legal basis: performance of the contract (Art. 6.1.b GDPR).
Purpose: manage queries, requests and complaints you send us, and handle the exercise of your data protection rights. Legal basis: performance of the contract (Art. 6.1.b GDPR), compliance with legal obligations (Art. 6.1.c GDPR) and legitimate interest (Art. 6.1.f GDPR) in properly assisting users.
Purpose: comply with applicable tax, accounting, commercial, consumer and fraud-prevention obligations. Legal basis: compliance with legal obligations (Art. 6.1.c GDPR).
Purpose: should we in the future send you commercial or promotional communications about the Service, we will do so only if you have given your consent or, where applicable, within the contractual relationship regarding our own similar products or services, and you may object at any time simply and free of charge. Legal basis: consent (Art. 6.1.a GDPR) or legitimate interest (Art. 6.1.f GDPR) where applicable.
For processing based on legitimate interest (Art. 6.1.f GDPR), Mercan has carried out the corresponding balancing test between that interest and the rights and freedoms of data subjects, concluding that the latter do not prevail. You may request additional information on that balancing test at info@mercan.es. For processing based on consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.
Mercan uses artificial intelligence technologies to improve and facilitate use of the Platform. In particular:
For this purpose, the text and images of listings may be sent to the APIs of AI model providers, specifically Google (Gemini models) and Groq, which act as data processors. These providers process such information solely to provide the AI service requested by Mercan (description generation, content moderation and creation of search embeddings) and in accordance with Mercan's instructions. Mercan may replace or supplement these providers with equivalent AI service providers, always under the same contractual guarantees (data processing agreements under Article 28 GDPR) and for the same purposes described here; in such case this Policy will be updated.
Some of these AI providers may be located or carry out processing outside the European Economic Area (e.g., in the United States), so such transmission may involve an international data transfer. In such cases, Mercan adopts the appropriate safeguards provided for by law, as described in section 6.
Mercan does not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you without the possibility of human intervention. In particular, if a listing is blocked, removed or restricted as a result of automatic content moderation, you may contact info@mercan.es to request review of that decision by a person, express your point of view and contest it.
To provide the Service, Mercan shares certain personal data with providers acting as processors or sub-processors, who process the data solely according to Mercan's instructions and with appropriate contractual guarantees (data processing agreements under Article 28 GDPR). The main processors and sub-processors are:
Database hosting, authentication services and file storage. Infrastructure located in the European Union.
Payment processing, management of the protected payment (escrow) service via Stripe Connect (Express accounts) and seller identity verification (KYC). Stripe processes card data and seller identity data. Mercan does not store full card details. With respect to certain regulatory obligations (KYC and anti-money-laundering), Stripe acts as an independent controller; we recommend consulting Stripe's privacy policy.
AI model providers to whose APIs listing text and images are sent to generate descriptions, moderate content and create search embeddings, under the terms of section 4.
Sending of transactional emails.
In addition to the above, Mercan may disclose data to:
Please also note that certain profile and listing data (such as your name, city, profile photo, bio, reviews and listing content) are visible to other users of the Platform as an inherent part of a marketplace between individuals. Chat content is shared with the other user in the conversation. When a user contacts or transacts with another, both may process each other's personal data outside Mercan's control, each being responsible for their use of that data under applicable law.
Mercan does not sell your personal data to third parties.
As a general rule, data is hosted and processed within the European Economic Area (EEA). However, some of the processors mentioned, in particular certain AI providers, may be located or carry out processing outside the EEA (e.g., in the United States).
In such cases, Mercan ensures that these international transfers are carried out with the appropriate safeguards provided for in Chapter V of the GDPR, including:
You may request additional information on the safeguards applied to international transfers and, where applicable, a copy of them, at info@mercan.es.
Mercan will retain your personal data for as long as necessary to fulfill the purposes for which it was collected and, in particular:
Once the applicable periods have elapsed, data will be deleted or, where applicable, duly blocked for the period during which legal liabilities may arise, in accordance with the LOPDGDD, and subsequently permanently erased.
You may exercise the following rights recognized by the GDPR and LOPDGDD at any time, free of charge:
To exercise these rights, send a request to the controller at info@mercan.es, indicating the right you wish to exercise and attaching, where applicable, a copy of a document proving your identity when necessary to verify it. Mercan will respond within one month of receipt, extendable by two additional months in especially complex cases, informing you of any extension.
You also have the right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan, 6, 28001 Madrid, with electronic office at www.aepd.es, especially where you consider that you have not obtained satisfaction in exercising your rights.
Mercan has adopted appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Such measures include, by way of example and without limitation:
In the event of a personal data breach entailing a high risk to your rights and freedoms, Mercan will notify you without undue delay, as well as the supervisory authority within the legally required terms and deadlines. Nevertheless, no transmission or storage system can guarantee absolute security, so we recommend that you properly safeguard your access credentials and not share them with third parties.
The Service is intended exclusively for persons over 18 years of age. Mercan is not directed at minors and does not knowingly collect personal data from persons under 18. By registering, you declare that you are over 18. If we become aware that data from a minor has been collected without proper authorization, we will delete such information as soon as possible. If you believe a minor has provided us with personal data, please notify us at info@mercan.es.
The Platform may use cookies and similar technologies (such as device identifiers or local storage) necessary for its proper functioning, user authentication and Service security. Cookies and technologies strictly necessary to provide the Service do not require consent. If we use analytical, personalization or third-party cookies that are not strictly necessary, your prior consent will be requested and detailed information will be provided through the corresponding Cookie Policy and, where applicable, a settings panel. You may manage or revoke your consent at any time.
For any matter relating to this Privacy Policy, the processing of your personal data or the exercise of the rights described in section 8, you may contact the controller at:
Mercan will handle your request within the legally established periods.
Mercan may modify this Privacy Policy to adapt it to legislative or case-law developments or changes in the operation of the Service. In the event of substantial changes, we will notify you by appropriate means. We recommend that you review this Policy periodically. The date of the last update appears at the beginning of the document.