GDPR Notice
Last updated June 2026
This notice describes how Merlise handles personal data of individuals in the European Economic Area and the United Kingdom, and how data subjects can exercise their rights.
1. Roles
For personal data in the documents you submit, you are the controller and Merlise acts as a processor on your instructions under a data processing agreement. For account and website data, Merlise is the controller.
2. Lawful bases
We process personal data on the bases of contract, legitimate interests, consent where required, and legal obligation, as set out in the Privacy Policy. Where we rely on legitimate interests, we balance those interests against your rights.
3. Your rights
You have the right to access your personal data and to request rectification, erasure, restriction, or portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
4. Exercising your rights
Send requests to hello@merlise.co. We will respond within the time required by law, normally within one month, and may ask for information to verify your identity. There is no fee for a reasonable request.
5. International transfers
Where we transfer personal data outside the EEA or the UK, we use Standard Contractual Clauses or another lawful transfer mechanism, together with supplementary measures where appropriate.
6. Subprocessors
We use vetted subprocessors under contracts that require equivalent data protection. A current list is available on request, and we give notice of material changes so you can object.
7. Breach notification
If a personal data breach is likely to result in a risk to individuals, we will notify the relevant controller and, where we are the controller, the competent supervisory authority and affected individuals as required by law.
8. Contact and complaints
For data protection questions, contact hello@merlise.co. You also have the right to lodge a complaint with your local supervisory authority.