Our role under GDPR
Mercurium Analytics Ltd. acts as a data controller for the information collected via our marketing site, and as a data processor for content uploaded by customers into the Mercurium platform. Both roles are supported by a written Data Processing Agreement (DPA) available on request.
Lawful bases we rely on
- Contract performance — delivering the Mercurium platform to subscribing customers.
- Legitimate interest — protecting our site from abuse, responding to business enquiries, securing the platform.
- Consent — optional analytics cookies, marketing emails, research interviews.
- Legal obligation — tax, corporate and sanctions-related record-keeping.
Data subject rights
Every individual whose personal data we process has the right to:
- Access the data we hold about them.
- Rectify inaccurate or outdated information.
- Erasure ("right to be forgotten"), subject to contractual or legal retention needs.
- Restrict or object to certain processing.
- Data portability in a common format.
- Withdraw consent at any time (without affecting lawful processing that happened before).
- Lodge a complaint with a supervisory authority (ICO in the UK).
To exercise a right, email contact@mercurium-analytics.com. We respond within 30 days.
International transfers
Mercurium's production infrastructure is EU-resident by default. Where data is transferred outside the UK/EU (for example to a customer's global entity), we rely on UK International Data Transfer Agreements and EU Standard Contractual Clauses, with supplementary technical measures documented in our DPA.
Sub-processors
A full, up-to-date list of sub-processors (hosting, email, analytics, etc.) is available on request. We notify customers of new sub-processors at least 30 days before onboarding, and we contractually bind each one to the same GDPR obligations we hold.
Breach notification
We notify affected customers without undue delay — and in any event within 72 hours — of a confirmed personal data breach, with the information they need to meet their own Article 33 reporting obligations.
Data Protection Officer
Mercurium has appointed a Data Protection lead who handles GDPR enquiries. Reach them at contact@mercurium-analytics.com.
Records & accountability
We maintain Article 30 records of processing activities, Data Protection Impact Assessments for high-risk features, internal training, and an incident response runbook that is tested quarterly.