Privacy Policy – Merokam
Version: 2.3 • Effective date: 30 September 2026
This Privacy Policy explains how Merokam (the "Platform") collects, uses, stores and discloses personal data, in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and applicable Greek legislation.
1. Identity of the Data Controller
The Data Controller is the company that operates the merokam.gr platform. For any matter concerning your personal data, contact us:
- Email: [email protected]
- Subject: "GDPR – Request"
2. Who this applies to
The Platform is intended exclusively for adults (≥18 years old) in the following roles:
- Workers – looking for agricultural jobs
- Employers – post listings and look for staff
- Merchants – manage stores on the Marketplace
- Agronomists – provide consulting services
3. Data we collect
3.1 Registration & account data
- Full name, email, phone number
- Account type (worker / employer / merchant / agronomist)
- Region / location (text)
- Registration date, last login
3.2 Profile data
- Worker: profile photo (stored encrypted in private storage), geographic coordinates (latitude/longitude) for proximity alerts, availability, application history
- Employer: company name, business type, rating, main region
- Merchant: company name, contact email, Stripe Connect details
- Agronomist: GEOTEE registry number, work type (freelancer / company / public sector), specialties, services offered, CV, website, LinkedIn profile, regions/areas of availability
3.3 Transaction & payment data
- Job listings: title, description, location, dates, working conditions, Stripe checkout session
- Worker subscriptions: Stripe Customer ID, Stripe Subscription ID, payment status, dates
- Marketplace: product listings, orders, merchant Stripe Connect details, Stripe Payment Intent
- Invoices / receipts issued through the Platform
Merokam does not store card numbers or full payment details. Transactions are processed exclusively through Stripe. Stripe Privacy Policy: stripe.com/privacy
3.4 Geolocation data (workers)
If a worker voluntarily provides their coordinates (via the browser or manually), these are stored to send proximity job alerts. The worker can delete their geographic data at any time from their profile.
3.5 Identification & login data
- Phone verification with a one-time password (OTP) sent by SMS; the code is stored temporarily (up to 5 minutes) and deleted after verification
- Login via Google (Google Sign-In): if you choose it, we receive your name and email from Google to create or log in to the account
- Device token (Firebase Cloud Messaging) for push notifications in the Android app (see section 14)
3.6 Automatic / technical data
- IP address, browser, operating system, language
- Server and application log files
- Diagnostic error data (crash / error reports) via Sentry, which may include IP, user identity and technical details of the request
- Functional cookies, analytics (with consent), marketing (with consent)
3.7 Communications & user content
- Chatbot messages: the text of your query is transmitted to OpenAI to generate a response and is logged (together with the IP address and the bot's reply) for support, security and service improvement
- Phone-contact requests via chatbot: name, phone and your message, so we can call you
- User reviews / ratings
- Reports of policy-violating behavior
- Role change requests (role switch) and role change history
- Availability declarations of workers/agronomists (areas, tools, free-text description, means of transport)
3.8 Worker teams ('Make a Team')
When a listing needs more than one worker, a worker ('captain') can create a team and invite other workers through a unique invitation link. As part of this feature we process: expressions of interest in a listing, team composition and the status of each member (pending / accepted / rejected). Each member's name and status are visible to the captain and to the other members of the team.
4. Legal basis & purpose of processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Account creation & management | Performance of contract (Art. 6(1)(b)) |
| Phone verification (OTP) & login via Google | Performance of a contract / Security - Legitimate interest (art. 6(1)(b) / (1)(f)) |
| Publishing listings, applications, marketplace, worker teams | Performance of contract (Art. 6(1)(b)) |
| Chatbot operation & contact requests | Legitimate interest / Consent (Art. 6(1)(f) / (1)(a)) |
| Payment processing (Stripe) | Performance of contract (Art. 6(1)(b)) |
| Proximity notifications (geolocation) | Consent (Art. 6(1)(a)) |
| Analytics & service improvement | Legitimate interest / Consent (Art. 6(1)(f) / (1)(a)) |
| Marketing, newsletters | Consent (Art. 6(1)(a)) |
| Security, fraud prevention, blacklisting | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations (tax, etc.) | Legal obligation (Art. 6(1)(c)) |
5. Data retention period
- Active account: retained for the entire duration of use + 24 months of inactivity
- Job listings: publication duration + 24 months (for tax reasons)
- Transaction data (Stripe, invoices): 10 years (tax legislation)
- Geographic coordinates: until deleted by the user or account deletion
- Server logs: up to 12 months
- Error diagnostics (Sentry): up to 90 days
- OTP codes: up to 5 minutes (temporary memory)
- Chatbot conversation history & contact requests: up to 12 months
- Device token (push): until logout or uninstallation of the app
- Marketing / newsletters: until consent is withdrawn
- Minor's data (if identified): immediate deletion
6. Recipients & data disclosure
We do not sell your data. We only disclose it in the following contexts:
- Hosting & file storage: Hetzner Online GmbH (Object Storage, Nuremberg data center, Germany - EU) for profile photos and other files. hetzner.com/legal/privacy-policy
- Email: Zoho (smtp.zoho.eu) for transactional and informational emails. zoho.com/privacy
- SMS: Modulus (SMS gateway provider) for OTP codes and notifications.
- Stripe Inc.: for payment processing and subscription management. stripe.com/privacy
- OpenAI, L.L.C.: the text of your messages to the chatbot is transmitted to generate a response. openai.com/policies/privacy-policy
- Google (Google Ireland Ltd / Google LLC): login via Google, Google Analytics & Google Tag Manager (with consent), Google Maps, Google Fonts and Firebase Cloud Messaging for push notifications. policies.google.com/privacy
- Functional Software, Inc. (Sentry): monitoring errors and stability of the application. sentry.io/privacy
- Microsoft Corporation (Microsoft Clarity): website usage analytics, only with your consent. privacy.microsoft.com
- Meta Platforms Ireland Ltd (Meta Pixel & Conversions API): ad measurement on Facebook/Instagram (marketing), only with your consent. facebook.com/privacy/policy
- Other users: a worker's details (without phone) are revealed to an employer only after an application is accepted. In a worker team, each member's name and status are visible to the other members. A merchant's details are revealed to a buyer after an order is completed.
- Authorities / courts: where required by law or court order
- Business transfer: in the event of an acquisition or merger, with notice to you
7. International transfers
Hosting and file storage (Hetzner) takes place within the EU (Germany). Some other providers (e.g. Stripe, OpenAI, Google, Sentry) are based in or process data outside the EEA, mainly in the USA. These transfers are safeguarded through the EU-U.S. Data Privacy Framework (where applicable), Standard Contractual Clauses (SCCs) or equivalent mechanisms under art. 46-49 GDPR.
8. Data security
- Encryption in transit (HTTPS/TLS) and at rest for the files in object storage
- Profile photos are stored in private storage with temporary signed URLs (signed URLs, expiring in 15 minutes)
- Passwords are stored hashed (PBKDF2)
- Access control: each user sees only their own data
- Regular software and security updates
- In the event of a breach: notification to the Hellenic Data Protection Authority within 72 hours and notification to users where required (Art. 33-34 GDPR)
9. Cookies & tracking technologies
| Category | Purpose | Basis |
|---|---|---|
| Necessary | Login, session, CSRF | Legitimate interest |
| Analytics | Traffic measurement | Consent |
| Marketing | Targeted advertising | Consent |
We use our own consent mechanism together with Google Consent Mode: until you give consent, analytics cookies (Google Analytics 4, Microsoft Clarity) and marketing cookies (Google Ads, Meta Pixel) remain inactive. Your choice is stored in the mk_consent cookie for 180 days. You can change or withdraw your consent at any time from “Cookie settings” at the bottom of every page or from your browser settings.
10. Your rights (GDPR)
You have the following rights regarding your personal data:
- Access (Art. 15): to know what data we hold about you
- Rectification (Art. 16): to correct inaccurate or incomplete data
- Erasure (Art. 17): to request deletion of your account and data, unless there is a legal obligation to retain them
- Restriction of processing (Art. 18): under certain conditions
- Portability (Art. 20): receiving your data in JSON/CSV format
- Objection (Art. 21): objecting to processing based on legitimate interest or for marketing
- Withdrawal of consent: without retroactive effect, at any time
- Complaint: to the Hellenic Data Protection Authority (HDPA) — www.dpa.gr
To exercise a right: [email protected] — Subject: "GDPR – Request". We respond within 30 days.
11. Automated decision-making
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing or profiling. The proximity alerts system is based on geographic filtering without human decision-making to the detriment of the user.
12. Minors
The Platform is not intended for minors under 18 years old. If we become aware that we have collected a minor's data, we will delete it immediately and deactivate the account.
13. Third-party links & integrations
The Platform embeds third-party services such as Google Maps (map display – Google receives your IP address) and Google Fonts (fonts). These services operate under their own privacy policies, for which we are not responsible.
14. Android Application (Merokam App)
The Merokam app for Android displays the same pages as the merokam.gr website within an embedded WebView, so everything above regarding data, cookies and consent applies. In addition, the app requests the following device permissions:
- Location (precise/approximate): used only if you enable it voluntarily, for notifications of nearby jobs. You can disable it at any time from your device settings.
- Camera: used only when you choose to take a profile or document photo from within the app. We do not have access to the camera outside of this action, and we do not store photos without your explicit action.
- Notifications (push notifications): the app uses Firebase Cloud Messaging (Google) to send notifications (new jobs, application updates, messages). For this purpose a unique device token is stored, which is linked to your account while you are logged in and is deleted upon logout or uninstallation of the app. You can disable notifications from your device settings. Google/Firebase Privacy Policy: policies.google.com/privacy
- Network: the app needs internet access to work, without any additional data collection beyond the above.
The app does not collect your device's Advertising ID and does not use app data for third-party advertising purposes beyond what is already described in the cookies/analytics section of the website.
15. Changes to the Policy
We may update this Policy. The updated version is always published at merokam.gr/privacy-policy/ with its effective date. For material changes, we will notify you by email or platform notification at least 15 days before they take effect.
16. Contact
For any question or request regarding this Policy:
- Email: [email protected]
- Subject: "GDPR – Request"