Privacy Notice
Last updated: 9 October 2026
2.1 Controller and scope
MERKURI LTD, trading as MERKURI, is the controller for personal information used for the MERKURI corporate website and for processing that MERKURI determines itself. For a particular Event Hub, an event organiser or partner may be an independent or joint controller for specific processing. Where that applies, the relevant Event Hub or event documentation should identify the additional controller and its privacy information.
2.2 Information we process
| Category | Examples | Purpose |
|---|---|---|
| Optional Event Hub analytics | Event-scoped browser token held in browser; consent reference; pseudonymous HMAC references; daily counters for approved page/content/partner/reward interactions. | Measure use of the Event Hub and provide aggregate event and partner engagement reporting after consent. |
| QR route requests | Identifier-free server-side route request totals and ordinary infrastructure request metadata. | Resolve trusted QR destinations, operate routes and maintain aggregate route counts. |
| Partnership/business enquiries | Name, organisation, role, contact details, message and other fields actually requested by the form. | Receive, assess, respond to and administer business enquiries. |
| Operational/security data | IP address, request path, timestamp, user- agent, security events, rate-limit information, server/application diagnostics. | Operate, secure, troubleshoot and protect the Services. |
| Administrator information | Account identifiers, authentication data, audit/security records. | Provide and secure authorised administration. |
| Legal/compliance records | Consent/revocation evidence, rights-request records, incident records and records required to establish or defend legal claims. | Demonstrate choices, administer rights, comply with law and protect legal rights. |
2.3 Optional Event Hub analytics
Optional Event Hub analytics is off until you choose Accept Analytics. After acceptance, MERKURI creates a cryptographically random identifier scoped to that Event Hub and returns it to your browser for first-party storage. The identifier is transmitted only to MERKURI's first-party analytics endpoint for the stated purpose. The raw token is not intended to be persisted in the analytics database.
The server uses pseudonymous values and bounded daily counters. These values can distinguish a consenting browser within the relevant event and are therefore treated as personal data where applicable. The system does not use device fingerprinting, third-party advertising analytics, cross-event identity, session replay or behavioural advertising.
Reports may use the expression "estimated unique consenting browsers". This is not a count of unique people or verified attendees. A person may use more than one browser/device, multiple people may share a device, and browser storage may be cleared or blocked.
2.4 Analytics lawful basis and PECR
For optional Event Hub analytics that uses browser storage/access technologies requiring consent, MERKURI relies on the user's consent for the storage/access and, where the resulting information is personal data, for the associated analytics processing. You can refuse or withdraw without losing access to the Event Hub.
2.5 QR route requests
MERKURI may count successful requests to trusted Event Hub QR routes separately from optional analytics. These route counts are not connected to the Event Hub analytics browser identifier and are not presented as unique scans, unique people or confirmed attendance.
2.6 Partnership and business enquiries
If you contact us through a partnership or business enquiry form, we use the information you provide to respond and manage the relationship. For ordinary B2B enquiries, our basis is our legitimate interests in receiving and managing business communications. Where processing is necessary to take steps at your request before entering into a contract with you personally, contract may apply instead. We do not treat an enquiry as blanket consent to unrelated direct marketing.
2.7 Operational and security processing
We and our hosting, network, security and support providers may process technical information needed to operate, secure and troubleshoot the Services. Our usual basis is legitimate interests in maintaining a secure and reliable service, and where applicable compliance with legal obligations. Operational information is not reused as the Event Hub analytics identity.
2.8 Recipients
Personal information may be accessed by authorised MERKURI personnel and by service providers acting for us, such as hosting, content-delivery/security, transactional email, backup, monitoring and technical support providers. We may also disclose information where required by law, to professional advisers, or where reasonably necessary to establish, exercise or defend legal claims.
For event reporting, organisers or partners receive only the aggregate metrics approved for them. Partner reports do not expose browser identifiers, HMAC values, IP addresses, per-browser histories or cross-partner behaviour.
2.9 International transfers
Some service providers may process information outside the UK. Where this involves a restricted transfer, we will use an available UK adequacy regulation or another lawful safeguard, such as an approved UK transfer mechanism, as applicable.
You may request information about relevant safeguards through [email protected].
2.10 Retention
| Data | Maximum / default production policy |
|---|---|
| Event analytics browser identifier | Up to 30 days from creation; removed earlier on withdrawal. |
| Pseudonymous daily analytics records | Up to 90 days from collection; earlier where reporting/validation no longer requires them. |
| Minimal consent/revocation evidence | Up to 12 months after expiry or withdrawal, subject to necessity and legal- hold exceptions. |
| Deletion-only browser proof | Usable during active consent and retained for no more than seven days after withdrawal solely to retry deletion; removed earlier after confirmed deletion. |
| Routine application/security logs | Normally 30 days; a longer period only where justified by investigation, security or legal need. |
| Partnership enquiries | Normally 24 months after the last substantive contact unless converted into an active customer/contract record or a shorter/longer period is justified. |
| Backups | Target 30-day rolling cycle; |
| Incident/rights records | Normally retained for the period necessary to demonstrate handling and manage legal risk, documented in the internal retention schedule. |
These are MERKURI policy periods, not statutory retention periods. Legal holds or active disputes may require limited records to be preserved for longer.
2.11 Withdrawing analytics consent
You can change your analytics choice at any time through Analytics preferences in the Event Hub footer. Withdrawal stops new optional analytics immediately.
Where technically possible, MERKURI also removes retained pseudonymous analytics records linked to that browser's consent. If the device is offline, a deletion-only capability may be retained temporarily so the deletion request can be retried. It cannot authorise analytics. If the browser's stored proof is cleared before the withdrawal reaches MERKURI, selective deletion may no longer be technically possible; the retained records then expire under the normal retention schedule.
2.12 Your rights
Subject to applicable conditions and exemptions, you may have rights to access, correct, erase or restrict personal information, object to certain processing, receive certain information in portable form, and withdraw consent at any time where processing is based on consent.
Because Event Hub analytics is deliberately pseudonymous and does not require a name or account, we may need information reasonably necessary to locate the relevant record without creating a new identity system or collecting excessive information.
To exercise a right, contact [email protected]. You may also complain to the Information Commissioner's Office (ICO).
See https://ico.org.uk/make-a-complaint/ for the current complaint route.
2.13 Children
The general MERKURI corporate website is intended primarily for business audiences. Some Event Hubs may be used in settings where under-18s are reasonably likely to access the service. Before such an Event Hub is activated, MERKURI and the relevant organiser must assess the audience, privacy defaults, transparency and whether the UK Children's Code or additional safeguards apply.
2.14 Security
We use technical and organisational measures appropriate to the nature and risk of the processing, including access controls, HTTPS in production, separation of optional analytics from operational data, bounded retention, backup/restore controls and incident-response procedures. No online service can guarantee absolute security.
2.15 Changes
We may update this notice to reflect changes in the Services, providers or law. If a material change introduces a new analytics purpose, we will not silently treat a previous analytics choice as consent to that new purpose.