Privacy Policy – Merokam

1. Identity of the Data Controller

The Data Controller is the company that operates the merokam.gr platform. For any matter concerning your personal data, contact us:

• Email: [email protected]
• Subject: "GDPR – Request"

2. Who this applies to

The Platform is intended exclusively for adults (≥18 years old) in the following roles:

• Workers – looking for agricultural jobs
• Employers – post listings and look for staff
• Merchants – manage stores on the Marketplace
• Agronomists – provide consulting services

3. Data we collect

3.1 Registration & account data

• Full name, email, phone number
• Account type (worker / employer / merchant / agronomist)
• Region / location (text)
• Registration date, last login

3.2 Profile data

• Worker: profile photo (stored encrypted in private storage), geographic coordinates (latitude/longitude) for proximity alerts, availability, application history
• Employer: company name, business type, rating, main region
• Merchant: company name, contact email, notification preferences (categories, products, regions)
• Agronomist: GEOTEE registry number, work type (freelancer / company / public sector), specialties, services offered, CV, website, LinkedIn profile, regions/areas of availability

3.3 Transaction & payment data

• Job listings: title, description, location, dates, working conditions, Stripe checkout session
• Worker and merchant subscriptions: Stripe Customer ID, payment identifier (Stripe Checkout Session), duration, start and end dates, status
• Marketplace: product listings and contact requests (inquiries) between merchants and producers
• Invoices / receipts issued through the Platform

Merokam does not store card numbers or full payment details. Transactions are processed exclusively through Stripe. Stripe Privacy Policy: stripe.com/privacy

3.4 Geolocation data (workers)

If a worker voluntarily provides their coordinates (through the browser, the app or manually), they are stored to send alerts about nearby jobs. The worker can delete their location data at any time from their profile.

The worker's notification preferences are also stored: maximum distance, channels (email, SMS, push) and whether they want jobs with accommodation beyond that distance.

3.5 Identification & login data

• Phone verification with a one-time password (OTP) sent by SMS; the code is stored temporarily (up to 5 minutes) and deleted after verification
• Login via Google (Google Sign-In): if you choose it, we receive your name and email from Google to create or log in to the account
• Device token (Firebase Cloud Messaging) for push notifications in the Android and iOS apps (see section 14)

3.6 Automatic / technical data

• IP address, browser, operating system, language
• Server and application log files
• Diagnostic error data (crash / error reports) via Sentry, which may include IP, user identity and technical details of the request
• Functional cookies, analytics (with consent), marketing (with consent)

3.7 Communications & user content

• Chatbot messages: the text of your query is transmitted to OpenAI to generate a response and is logged (together with the IP address and the bot's reply) for support, security and service improvement
• Phone-contact requests via chatbot: name, phone and your message, so we can call you
• User reviews / ratings
• Reports of policy-violating behavior
• Role change requests (role switch) and role change history
• Availability declarations of workers/agronomists (areas, tools, free-text description, means of transport)

3.8 Worker teams ('Make a Team')

When a listing needs more than one worker, a worker ('captain') can create a team and invite other workers through a unique invitation link. As part of this feature we process: expressions of interest in a listing, team composition and the status of each member (pending / accepted / rejected). Each member's name and status are visible to the captain and to the other members of the team.

4. Legal basis & purpose of processing

5. Data retention period

• Active account: retained for the entire duration of use + 24 months of inactivity
• Job listings: publication duration + 24 months (for tax reasons)
• Transaction data (Stripe, invoices): 10 years (tax legislation)
• Geographic coordinates: until deleted by the user or account deletion
• Server logs: up to 12 months
• Error diagnostics (Sentry): up to 90 days
• OTP codes: up to 5 minutes (temporary memory)
• Chatbot conversation history & contact requests: up to 12 months
• Device token (push): until logout or uninstallation of the app
• Marketing / newsletters: until consent is withdrawn
• Minor's data (if identified): immediate deletion

6. Recipients & data disclosure

We do not sell your data. We only disclose it in the following contexts:

• Hosting & file storage: Hetzner Online GmbH (Object Storage, Nuremberg data center, Germany - EU) for profile photos and other files. hetzner.com/legal/privacy-policy
• Email: Zoho (smtp.zoho.eu) for transactional and informational emails. zoho.com/privacy
• SMS: Modulus (SMS gateway provider) for OTP codes and notifications.
• Stripe Inc.: for payment processing and subscription management. stripe.com/privacy
• OpenAI, L.L.C.: the text of your messages to the chatbot is transmitted to generate a response. openai.com/policies/privacy-policy
• Google (Google Ireland Ltd / Google LLC): login via Google, Google Analytics & Google Tag Manager (with consent), Google Maps, Google Fonts and Firebase Cloud Messaging for push notifications. policies.google.com/privacy
• Functional Software, Inc. (Sentry): monitoring errors and stability of the application. sentry.io/privacy
• Microsoft Corporation (Microsoft Clarity): website usage analytics, only with your consent. privacy.microsoft.com
• Meta Platforms Ireland Ltd (Meta Pixel & Conversions API): ad measurement on Facebook/Instagram (marketing), only with your consent. facebook.com/privacy/policy
• Other users: when a worker applies for a job, the job's employer sees their name, email and phone number so they can contact them. In a worker team, each member's name and status are visible to the other members. In the Marketplace, producers' contact details are shown to merchants with an active subscription, and each merchant inquiry is shown to the producer it is addressed to.
• Authorities / courts: where required by law or court order
• Business transfer: in the event of an acquisition or merger, with notice to you

7. International transfers

Hosting and file storage (Hetzner) takes place within the EU (Germany). Some other providers (e.g. Stripe, OpenAI, Google, Sentry) are based in or process data outside the EEA, mainly in the USA. These transfers are safeguarded through the EU-U.S. Data Privacy Framework (where applicable), Standard Contractual Clauses (SCCs) or equivalent mechanisms under art. 46-49 GDPR.

8. Data security

• Encryption in transit (HTTPS/TLS) and at rest for the files in object storage
• Profile photos are stored in private storage with temporary signed URLs (signed URLs, expiring in 15 minutes)
• Passwords are stored hashed (PBKDF2)
• Access control: each user sees only their own data
• Regular software and security updates
• In the event of a breach: notification to the Hellenic Data Protection Authority within 72 hours and notification to users where required (Art. 33-34 GDPR)

9. Cookies & tracking technologies

We use our own consent mechanism together with Google Consent Mode: until you give consent, analytics cookies (Google Analytics 4, Microsoft Clarity) and marketing cookies (Google Ads, Meta Pixel) remain inactive. Your choice is stored in the mk_consent cookie for 180 days. You can change or withdraw your consent at any time from “Cookie settings” at the bottom of every page or from your browser settings.

10. Your rights (GDPR)

You have the following rights regarding your personal data:

• Access (Art. 15): to know what data we hold about you
• Rectification (Art. 16): to correct inaccurate or incomplete data
• Erasure (Art. 17): to request deletion of your account and data, unless there is a legal obligation to retain them
• Restriction of processing (Art. 18): under certain conditions
• Portability (Art. 20): receiving your data in JSON/CSV format
• Objection (Art. 21): objecting to processing based on legitimate interest or for marketing
• Withdrawal of consent: without retroactive effect, at any time
• Complaint: to the Hellenic Data Protection Authority (HDPA) — www.dpa.gr

To exercise a right: [email protected] — Subject: "GDPR – Request". We respond within 30 days.

11. Automated decision-making

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing or profiling. The proximity alerts system is based on geographic filtering without human decision-making to the detriment of the user.

12. Minors

The Platform is not intended for minors under 18 years old. If we become aware that we have collected a minor's data, we will delete it immediately and deactivate the account.

13. Third-party links & integrations

The Platform embeds third-party services such as Google Maps (map display – Google receives your IP address) and Google Fonts (fonts). These services operate under their own privacy policies, for which we are not responsible.

14. Mobile apps (Android and iOS)

The merokam apps for Android and iOS provide the same services as the merokam.gr website and process the data described above. In addition, they request the following device permissions:

• Location (precise/approximate): used only if you enable it voluntarily, for notifications of nearby jobs. You can disable it at any time from your device settings.
• Photos: used only when you choose a profile photo from your device. We have no access to your photos beyond this action, and we do not store photos without your explicit action.
• Notifications (push notifications): the apps use Firebase Cloud Messaging (Google), and on iOS Apple's notification service, to send notifications (new jobs, application updates, messages). For this purpose a unique device token is stored, linked to your account while you are logged in and deleted when you log out or uninstall the app. Alerts about new jobs near you are sent only if you have chosen them in your notification settings. You can also turn off notifications in your device settings. Google/Firebase Privacy Policy: policies.google.com/privacy
• Network: the app needs internet access to work, without any additional data collection beyond the above.

The apps do not collect your device's Advertising ID and contain no third-party analytics or advertising tools.

15. Changes to the Policy

We may update this Policy. The updated version is always published at merokam.gr/privacy-policy/ with its effective date. For material changes, we will notify you by email or platform notification at least 15 days before they take effect.

16. Contact

For any question or request regarding this Policy:

• Email: [email protected]
• Subject: "GDPR – Request"