1. Data we collect
- Information you provide: name, email, phone number, type of incident, amount lost, time frame, description of what happened, and any documents you choose to share.
- Technical information: IP address, browser type, device type, referring URL, and pages viewed.
- Marketing attribution: UTM parameters and the URL that brought you to the site.
- Cookies and similar technologies: small files used for site functionality, analytics, and (where you consent) advertising measurement.
2. How we use your data
- To review your case and contact you about it.
- To provide, maintain, and improve our services.
- To comply with legal obligations and prevent fraud.
- To measure the performance of our marketing, including ads on platforms such as Meta (Facebook and Instagram), with your consent where required.
3. Legal bases (GDPR / UK GDPR)
- Consent — for non-essential cookies and marketing communications.
- Performance of a contract — to act on your case-review request.
- Legitimate interests — to operate, secure, and improve the site.
- Legal obligation — to comply with applicable law.
4. Sharing
We share personal data only with:
- Service providers who host, secure, and operate our site (under written data-processing terms).
- Specialists assigned to review your case.
- Authorities, when required by law or to protect rights, safety, or property.
- Advertising and analytics partners, in aggregated or hashed form, where you have consented.
We do not sell your personal data.
5. Advertising and Meta Pixel / Conversions API
Where permitted, we use the Meta Pixel and/or Meta Conversions API to measure the effectiveness of advertising on Facebook and Instagram. Data shared with Meta is hashed (for example, your email address is irreversibly hashed before being sent) and used solely for ad attribution, optimization, and audience exclusion. You can opt out via the cookie banner or your device's ad-tracking settings.
6. International transfers
Your data may be processed outside your country of residence. Where applicable, we rely on Standard Contractual Clauses or equivalent safeguards approved by competent regulators.
7. Retention
We keep intake data for as long as needed to handle your case and to comply with legal, accounting, and reporting obligations — typically up to 24 months after the last interaction. You may ask us to delete your data sooner (see Section 9).
8. Security
Submissions are transmitted over TLS. Data is stored in access-controlled systems with logging, encryption at rest, and restricted personnel access. No system is perfectly secure, but we apply industry-standard safeguards.
9. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your data.
- Object to or restrict processing.
- Withdraw consent at any time, without affecting prior lawful processing.
- Lodge a complaint with your local data-protection authority.
To exercise any right, email privacy@mercer-safe.group.
10. Children
This site is not intended for individuals under 18. We do not knowingly collect personal data from minors.
11. Changes
We may update this Policy. The "Last updated" date reflects the most recent revision. Material changes will be flagged on this page.
12. Contact
Privacy questions: privacy@mercer-safe.group.