Privacy Policy

Effective: July 2026

1. Data Controller

The controller of personal data collected through the MerrVetura platform (merrvetura.com) is:

Berat Murati
Email: info@merrvetura.com

Preliminary notice: MerrVetura is currently operated by Berat Murati as a natural person, pending completion of the incorporation of a limited liability company (SH.P.K.) in the Republic of Kosovo. The data controller information will be updated and registry details will be added immediately after incorporation.

2. Data Collected

MerrVetura collects the following categories of personal data:

• Account data: display name, email address, phone number (if provided voluntarily), city of residence (if provided voluntarily), and language preferences;
• Listing data: vehicle information, prices, photos, and descriptions uploaded by the seller;
• Chat messages: content of messages exchanged between users through the integrated messaging feature;
• Usage data: listing view counts and aggregated platform statistics (without individual profiling).

We do not collect special category data (sensitive data) such as ethnic origin, religious beliefs, health data, or sexual orientation.

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Service delivery: creating and managing your account, publishing and displaying listings, operating the messaging system — legal basis: performance of a contract (Art. 6(1)(b) GDPR);
• Security and moderation: preventing abuse, moderating listings, and protecting platform integrity — legal basis: legitimate interests (Art. 6(1)(f) GDPR);
• Communications: sending transactional emails (account confirmation, password reset, system notifications) — legal basis: performance of a contract (Art. 6(1)(b) GDPR);
• Legal obligations: retaining data in accordance with applicable legal requirements — legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not sell your personal data or share it with third parties for marketing purposes.

4. Data Processors

To deliver platform services, MerrVetura uses the following carefully selected providers as data processors:

• Supabase Inc. — database and authentication; servers are located in the Frankfurt, European Union region (EU-Central-1). Supabase ensures GDPR compliance through Standard Contractual Clauses (SCCs). Account, listing, and message data is stored by Supabase;
• Vercel Inc. — web application hosting; infrastructure is configured with European servers. Vercel processes server request metadata (IP address, User-Agent) as a normal part of infrastructure operation;
• Resend Inc. — transactional email delivery (confirmation, password reset, system notifications). This service will be activated after the full platform launch.

Data processing agreements (DPAs) in accordance with GDPR requirements have been concluded with all data processors.

5. Cookies and Tracking

MerrVetura uses only technically necessary cookies — specifically, authentication session cookies required for the operation of logged-in accounts. These cookies do not require your consent because they are strictly necessary for the provision of the service.

We do not use:

• Tracking or analytics cookies;
• Advertising pixels (Facebook Pixel, Google Ads, etc.);
• Any other profiling or cross-site tracking mechanisms.

6. Your Rights

Under applicable data protection law, you have the following rights:

• Right of access: to receive confirmation and a copy of the data we process about you;
• Right to rectification: to request correction of inaccurate or incomplete data;
• Right to erasure: to request deletion of your data ("right to be forgotten"), subject to certain conditions;
• Right to restriction: to request restriction of the processing of your data;
• Right to object: to object to processing based on our legitimate interests;
• Right to data portability: to receive your data in a machine-readable format.

To delete your account and all associated data, send a request by email to info@merrvetura.com. We will confirm the deletion within 30 days.

If you believe your rights have been violated, you have the right to lodge a complaint with the competent data protection authority.

7. Data Retention

Account data is retained until the account is deleted. Deleted listings and messages are erased or anonymised within 90 days, unless legal obligations require longer retention. Server metadata (logs) is retained for short technical periods and deleted automatically.

8. Contact

For any questions or requests regarding the protection of your personal data, contact: info@merrvetura.com