Privacy Policy

Merces Ltd | Effective Date: 18 June 2026

Last Updated: 27 June 2026

1. Who We Are 

Merces Ltd ("Merces", "we", "us", "our") is an Irish technology company registered in Ireland. We operate the Merces mobile application and platform (the "App"), which enables users to complete verified movement challenges and earn real-world rewards from participating businesses. 

Our registered address is: 46 Radcliff Hall, St Johns Road, Sandymount, Dublin 4, Ireland. 

Data Controller contact: Paul O’Donnell (paul@mercesapp.com). 

Website: www.mercesapp.com 

 

2. What This Privacy Policy Covers 

This Privacy Policy explains how Merces Ltd collects, uses, stores, and protects your personal data when you use the Merces app or visit our website. It applies to all users of the Merces platform, including runners, walkers, and vendor partners. 

This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679, the Data Protection Acts 1988 to 2018 (Ireland), and any other applicable data protection legislation. 

 

3. Data We Collect 

3.1 Information You Provide Directly 

  • Full name and email address when you register an account 

  • Phone number  

  • Profile information you choose to add 

  • Location information you provide when setting your challenge zones 

3.2 Information From Third-Party Integrations 

Strava: If you connect your Strava account, we receive access to your activity data solely to verify that you have completed a running or walking challenge. Specifically, we receive: activity type, distance, start time, and completion status. We do not receive your Strava password. We do not display your Strava data to any other user. We do not store your Strava data beyond what is necessary to verify challenge completion, and we do not retain it for longer than 7 days after verification. 

We use Strava data only for the purpose of verifying your movement activity in connection with a specific Merces challenge. We do not use Strava data for advertising, analytics, AI training, or any other purpose. 

3.3 Information Collected Automatically 

  • Device type and operating system 

  • App usage data including challenges viewed, joined, and completed 

  • Redemption activity including which rewards you have claimed 

  • Push notification interaction data 

  • Log data including timestamps of activity 

3.4 Information From Vendor Partners 

When you redeem a reward with a vendor partner, the vendor confirms your redemption via their Merces web panel. We log the time, vendor, and challenge associated with each redemption. We do not receive payment or transaction data from vendor POS systems. 

 

4. How We Use Your Data 

We use your personal data for the following purposes and on the following legal bases under GDPR: 

4.1 Performance of Contract (Article 6(1)(b) GDPR) 

  • To create and manage your Merces account 

  • To verify your movement activity via Strava and determine challenge completion 

  • To generate and deliver reward codes and QR codes upon successful challenge completion 

  • To process reward redemptions with vendor partners 

  • To communicate with you about your account, challenges, and rewards 

4.2 Legitimate Interests (Article 6(1)(f) GDPR) 

  • To improve the Merces platform and user experience 

  • To monitor platform security and prevent fraud 

  • To analyse challenge completion and redemption patterns at an aggregate level to improve our service 

  • To provide vendor partners with anonymised and aggregated redemption analytics 

4.3 Legal Obligation (Article 6(1)(c) GDPR) 

  • To comply with applicable Irish and EU law 

  • To respond to lawful requests from regulatory or law enforcement authorities 

4.4 Consent (Article 6(1)(a) GDPR) 

  • To send you marketing communications about new challenges, rewards, and Merces updates (you may withdraw consent at any time) 

  • To send you push notifications (you may disable these in your device settings at any time) 

 

5. Strava Data - Specific Commitments 

Because Merces integrates with the Strava API, we make the following specific commitments in relation to Strava data: 

  • We only access Strava data for the authenticated user. We never access, display, or share any other user's Strava data. 

  • We use Strava data solely to verify that the authenticated user has completed a qualifying movement activity for the purpose of a specific Merces challenge. 

  • We do not store Strava activity data for longer than 7 days following verification of a challenge. 

  • We do not use Strava data for targeted advertising or to build advertising profiles. 

  • We do not sell, license, or transfer Strava data to any third party. 

  • We do not use Strava data to train, fine-tune, or evaluate any artificial intelligence or machine learning model. 

  • If you disconnect your Strava account from Merces, we will promptly delete all Strava data associated with your account within 30 days. 

  • You may request deletion of your Strava data at any time by contacting us at info@mercesapp.com. 

 

6. Who We Share Your Data With 

We do not sell your personal data. We may share your data in the following limited circumstances: 

6.1 Vendor Partners 

When you redeem a reward, the relevant vendor partner can see that a valid redemption has occurred via their Merces web panel. They see only confirmation that a valid, verified challenge completion has been presented for redemption. 

6.2 Service Providers 

We use trusted third-party service providers to operate the Merces platform, including: 

  • Square Root Solutions (app development and hosting) 

  • Firebase / Google Cloud (push notifications and cloud infrastructure) 

  • iDonate (charitable donation processing for Impact Challenges) 

All service providers are required to process your data only in accordance with our instructions and applicable data protection law. 

6.3 Legal Requirements 

We may disclose your personal data if required to do so by law or in response to a valid legal request from a competent authority. 

6.4 Business Transfers 

In the event of a merger, acquisition, or sale of all or part of Merces Ltd, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer. 

 

7. Data Retention 

We retain your personal data only for as long as necessary for the purposes set out in this Privacy Policy, or as required by law. 

  • Account data: retained for the duration of your account and for 2 years following account deletion, unless a longer retention period is required by law 

  • Challenge and redemption data: retained for 3 years following the redemption event for commercial record-keeping purposes 

  • Strava activity verification data: retained for a maximum of 7 days following challenge verification, then permanently deleted 

  • Marketing data: retained until you withdraw consent or unsubscribe 

  • Log and security data: retained for up to 12 months 

 

8. Your Rights Under GDPR 

As a data subject under GDPR, you have the following rights: 

8.1 Right of Access 

You have the right to request a copy of the personal data we hold about you. We will respond within 30 days. 

8.2 Right to Rectification 

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. 

8.3 Right to Erasure 

You have the right to request that we delete your personal data. We will honour such requests unless we have a legal obligation to retain the data or a legitimate interest in doing so. 

8.4 Right to Restriction of Processing 

You have the right to request that we restrict the processing of your personal data in certain circumstances. 

8.5 Right to Data Portability 

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller. 

8.6 Right to Object 

You have the right to object to our processing of your personal data where we rely on legitimate interests as our legal basis. You also have the absolute right to object to processing for direct marketing purposes at any time. 

8.7 Right to Withdraw Consent 

Where we process your data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. 

8.8 Right to Disconnect Strava 

You may disconnect your Strava account from Merces at any time through the app settings. Upon disconnection, we will delete all Strava data associated with your account within 30 days. 

To exercise any of these rights, please contact us at paul@mercesapp.com. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission of Ireland at www.dataprotection.ie. 

 

9. Data Security 

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include: 

  • Encrypted data transmission via HTTPS/TLS 

  • Secure JWT-based authentication 

  • Access controls limiting staff access to personal data on a need-to-know basis 

  • Regular security reviews of our infrastructure 

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and will notify you without undue delay where required by law. 

 

10. International Data Transfers 

Your personal data is primarily processed and stored within the European Economic Area (EEA). Where we use service providers outside the EEA, we ensure that appropriate safeguards are in place in accordance with GDPR requirements, including the use of Standard Contractual Clauses approved by the European Commission. 

 

11. Children 

The Merces app is not directed at or intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at paul@mercesapp.com and we will delete it promptly. 

 

12. Cookies and Tracking 

The Merces mobile application does not use cookies. Our website (www.mercesapp.com) may use standard analytics tools to understand visitor behaviour. Where cookies are used on our website, we will obtain your consent in accordance with applicable law. 

 

13. Impact Challenges and iDonate 

When you participate in an Impact Challenge, your movement activity triggers a charitable donation made by the relevant vendor partner through our integration with iDonate. In this context, iDonate processes payment data on behalf of the vendor. Merces does not process your payment data in connection with Impact Challenges. The vendor's donation is a lump-sum commitment made by the vendor, not a payment made by you. 

For information on how iDonate processes data, please refer to iDonate's privacy policy at www.idonate.ie. 

 

14. Changes to This Privacy Policy 

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of any material changes by posting a notice in the app or by email. The updated policy will be effective from the date posted. Your continued use of Merces after the effective date constitutes your acceptance of the updated policy. 

 

15. Contact Us 

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us: 

[Text Wrapping Break]Paul O'Donnell 

CEO, Merces Ltd 

Email: paul@mercesapp.com 

Website: www.mercesapp.com 

[Text Wrapping Break]You also have the right to lodge a complaint with the Irish Data Protection Commission: 

Data Protection Commission 

21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland 

Website: www.dataprotection.ie 

Phone: +353 (0)1 765 0100