Privacy policy

Last updated: 8 September 2026

This Privacy Policy explains how MERAH Trading GmbH ("MERA MERAH", "we", "us") collects, uses and shares personal data when you visit meramerah.com or purchase from our online shop. It has been prepared in line with the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and, where applicable, national data protection laws.

1. Data Controller

The controller responsible for the processing of personal data on this website within the meaning of the GDPR is:

MERAH Trading GmbH
Schloßgasse 7, 2112 Würnitz, Austria
Email: hello@meramerah.com
Company register: FN 605589y (Landesgericht Korneuburg)
VAT ID: ATU79539689

2. Data collected when visiting the website

2.1 Server log files. When you access our website for purely informational purposes without registering or otherwise submitting data, we automatically collect information that your browser transmits to our server (so-called server log files): pages visited, date and time of access, volume of data transferred, referring URL, browser type, operating system, and IP address (where possible in anonymised form). Processing takes place on the basis of Article 6(1)(f) GDPR (legitimate interest) to ensure stability and functionality of the site. This data is not passed on to third parties; we reserve the right to review the log files retrospectively if there is concrete evidence of unlawful use.

2.2 SSL/TLS encryption. This website uses SSL/TLS encryption to protect the transmission of personal data and confidential content (such as orders and enquiries). You can recognise an encrypted connection by "https://" in the URL bar and the padlock symbol.

3. Hosting and content delivery network

Our website is hosted by a provider whose servers are located exclusively within the European Union. Data collected via the website is processed on those servers unless specific third-party recipients are named below. A data processing agreement (Article 28 GDPR) is in place with our hosting provider to ensure the protection of visitor data and to prohibit unauthorised transmission to third parties.

4. Cookies

To make visiting our website attractive and to enable certain functions, we use cookies — small text files that are stored on your device. Some cookies are automatically deleted when you close your browser (session cookies), others remain on your device for longer periods (persistent cookies) and allow us to remember settings.

Where cookies process personal data, processing is based on Article 6(1)(b) GDPR (contract performance), Article 6(1)(a) GDPR (your consent), or Article 6(1)(f) GDPR (our legitimate interest in a fully functional, user-friendly website). You can configure your browser to notify you before cookies are set, and to accept or reject them individually. Please note that disabling cookies may limit the functionality of our website.

5. Contact

5.1 General. When you contact us (for example via contact form or email), personal data is processed exclusively to handle and respond to your enquiry, to the extent necessary. Legal basis is our legitimate interest in responding (Article 6(1)(f) GDPR); if your enquiry relates to a contract, Article 6(1)(b) GDPR applies additionally. Data is deleted once the matter is settled, unless statutory retention obligations apply.

5.2 Klaviyo (transactional email). For transactional emails triggered by user actions (contract conclusion, registration, password reset) we use Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA. Data is transferred based on our legitimate interest in effective and user-friendly email communication (Article 6(1)(f) GDPR). We have a data processing agreement (Article 28 GDPR) with Klaviyo. For US data transfers, Klaviyo is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection.

6. Customer accounts

Where you create a customer account, we process personal data pursuant to Article 6(1)(b) GDPR to the extent required. You may request deletion of your account at any time by contacting us at the address above. Upon deletion, your data is removed once all related contracts have been fully performed, provided no statutory retention obligations apply and no legitimate interest in further storage exists.

7. Direct marketing

7.1 Email newsletter. If you subscribe to our newsletter, we send you regular updates about our offerings. The only mandatory field is your email address; additional data is voluntary. We use a double opt-in procedure — you receive newsletters only after confirming subscription via a verification link. When you confirm, you consent under Article 6(1)(a) GDPR to the use of your data for newsletter delivery. We store the IP address, date and time of registration to prevent misuse. You may unsubscribe at any time via the link in each newsletter or by contacting us.

7.2 Klaviyo (marketing email). Newsletters and other promotional emails are dispatched via Klaviyo (address as above), on the basis of Article 6(1)(f) GDPR. Subject to your explicit consent under Article 6(1)(a) GDPR, Klaviyo also performs statistical analysis of email campaigns using web beacons / tracking pixels to measure open rates and interactions. Device information (access time, IP address, browser type, operating system) is collected but not merged with other data sets. You may withdraw consent to email tracking at any time with future effect.

7.3 Back-in-stock notifications. For temporarily unavailable items you may register for one-off email notifications when the item is back in stock. Only your email address is required; additional data is voluntary. We use a double opt-in procedure. Legal basis is your consent under Article 6(1)(a) GDPR. You may unsubscribe at any time.

7.4 Cart reminders. If you leave items in your cart without completing checkout, you may receive a one-off email reminder. Only your email address is required. Double opt-in applies. Legal basis: Article 6(1)(a) GDPR. You may unsubscribe at any time.

8. Order processing

8.1 General. For order fulfilment purposes (delivery and payment) we share personal data with the commissioned carrier and payment institution pursuant to Article 6(1)(b) GDPR.

8.2 Shipping providers.

  • FedEx Express Germany GmbH, Langer Kornweg 34k, 65451 Kelsterbach, Germany. If you have consented during checkout (Article 6(1)(a) GDPR), we forward your email and/or phone number to arrange delivery. Otherwise, only recipient name and delivery address are shared under Article 6(1)(b) GDPR.
  • Österreichische Post AG, Rochusplatz 1, 1030 Vienna, Austria. Same conditions as above.

You may withdraw consent to the sharing of contact details with these carriers at any time.

8.3 AI service — Anthropic. To provide certain services we use AI software from Anthropic Ireland Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (with onward data transfer to Anthropic PBC, USA). Data may be processed by Anthropic to organise, analyse, aggregate or prepare content for our services. Use of your data for training or improving Anthropic's AI models is expressly excluded. Where personal data is affected, processing is based on Article 6(1)(f) GDPR. A data processing agreement is in place. For transfers to the USA, Anthropic relies on the European Commission's Standard Contractual Clauses.

8.4 Payment providers. Depending on the payment method you select, your payment data (name, address, bank/card details, currency, transaction reference) and order information are shared with the relevant payment provider pursuant to Article 6(1)(b) GDPR, exclusively for payment processing: Apple Pay (Apple Distribution International, Cork, Ireland), EPS-Überweisung (PSA Payment Services Austria GmbH, Vienna), giropay (paydirekt GmbH, Frankfurt), Google Pay (Google Ireland Limited, Dublin), Klarna (Klarna Bank AB, Stockholm), PayPal (PayPal Europe S.à r.l., Luxembourg). For payment methods where the provider advances payment (e.g. Klarna invoice/instalments, PayPal), the provider may perform a creditworthiness check based on Article 6(1)(f) GDPR. Credit references may include probability scores based on a scientifically recognised statistical procedure. You may object to this processing at any time.

8.5 Sanctions list screening. When initiating business relationships and processing orders we reserve the right to screen the personal data you provide against EU and Member State sanctions lists. Legal basis: Article 6(1)(c) GDPR.

8.6 Electronic withdrawal function. Consumers concluding distance contracts on this website may exercise their statutory right of withdrawal using our electronic withdrawal function. When using the function, personal data such as identifiers of the contract, first and last name, and email address must be provided. Processing takes place under Article 6(1)(b) GDPR and, in relation to our statutory obligation, under Article 6(1)(c) GDPR. We use the data provided to confirm receipt of the withdrawal by email.

9. Online marketing

Own affiliate programme. In connection with our product presentations we operate an affiliate programme through which third-party site operators can place partner links leading to our offerings. Cookies used for the affiliate programme are typically set on the partner site once you click a partner link — we are not the data controller for those partner-site cookies. Where personal data is involved, processing is based on our legitimate financial interest in commission handling under Article 6(1)(f) GDPR.

10. Tools and other services

10.1 sevDesk (accounting). For bookkeeping we use the cloud-based accounting software provided by sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany. A data processing agreement is in place. Where personal data is involved, processing is based on Article 6(1)(c) GDPR (proper bookkeeping obligation).

10.2 Cookie consent tool (Pandectes GDPR). To obtain valid user consents for consent-requiring cookies, this website uses Pandectes cookie consent tool. Consent-requiring cookies/services are only loaded where the respective consent has been granted. The tool sets a technically necessary cookie to store your preferences. Where personal data (such as IP address) is processed for consent logging, processing takes place under Article 6(1)(f) GDPR and Article 6(1)(c) GDPR.

10.3 Cloudflare. For security purposes we use services provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects the website against unauthorised access, cyber-attacks, viruses and malware. It records IP addresses and further data to detect and block illegitimate access. Legal basis: Article 6(1)(f) GDPR. A data processing agreement is in place. Cloudflare is certified under the EU-US Data Privacy Framework.

11. Rights of data subjects

11.1 Under applicable data protection law you have the following rights with respect to the processing of your personal data:

  • Right of access — Article 15 GDPR
  • Right to rectification — Article 16 GDPR
  • Right to erasure — Article 17 GDPR
  • Right to restriction of processing — Article 18 GDPR
  • Right to notification — Article 19 GDPR
  • Right to data portability — Article 20 GDPR
  • Right to withdraw consent — Article 7(3) GDPR
  • Right to lodge a complaint with a supervisory authority — Article 77 GDPR

11.2 RIGHT TO OBJECT. IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR LEGITIMATE INTEREST, YOU HAVE THE RIGHT — ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION — TO OBJECT TO SUCH PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE. WHERE WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME. IF YOU EXERCISE THIS RIGHT, WE WILL CEASE PROCESSING YOUR DATA FOR DIRECT MARKETING PURPOSES.

12. Data retention period

The retention period for personal data is determined by the applicable legal basis, the purpose of processing and, where applicable, statutory retention periods (e.g. under commercial and tax law). Where processing is based on your explicit consent under Article 6(1)(a) GDPR, data is retained until you withdraw consent. Where processing is based on Article 6(1)(b) GDPR and statutory retention periods apply, data is routinely deleted after expiry of those periods. Where processing is based on Article 6(1)(f) GDPR, data is retained until you exercise your right to object under Article 21 GDPR, unless we can demonstrate compelling legitimate grounds. Unless otherwise specified, personal data is deleted once no longer necessary for the purposes collected.

This English version has been prepared as a good-faith rendering of the German-language master privacy notice which is the version legally binding under Austrian and EU consumer law. In case of conflicts of interpretation, the German version at meramerah.com/de/policies/privacy-policy prevails.