# General Data Protection Regulation (GDPR)

Last update: March 31, 2023

At Merge, data protection is a top priority – and has been from the beginning. In order to support customers that collect and process the personal data of EU citizens, Merge has implemented a wide array of controls and procedures to comply with the obligations of a data processor under the GDPR. For more information please visit [trust.merge.dev](https://trust.merge.dev/).

## Topic

| Topic                                     | Explanation                                                                                                                                                                                                             |
|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Individual in charge of GDPR compliance   | Gil Feig, CTO                                                                                                                                                                                                          |
| Data Protection Officer                    | Gil Feig, CTO                                                                                                                                                                                                          |
| Purpose of Processing                      | To enable our API integration service (the "Service"). For more details, see our Privacy Policy under _Types of Uses of Information & Personal Information_ ([Privacy Policy](https://merge.dev/legal/privacy-policy)). |
| Lawful Basis of Processing and Consent     | Consent: Via End Customer’s acceptance of [End Customer Terms](https://merge.dev/legal/end-customer-terms) during account linking process. The End Customer can withdraw its consent by unlinking their account with Merge customer’s Service.<br>Contract: Via contracts with Customers which give Merge permission to process personal data for the purpose of providing the Service to Customers. For more information, see the Merge Data Protection Agreement is available on our website ([Data Processing Agreement](https://merge.dev/legal/data-processing-agreement)).                                      |
| Withdrawal of consent (or opt out)       | For Customers, withdrawal of consent or opting out after initial consent/opt-in will be available via termination of their agreement with us.<br>For End Customers who have linked an account with Merge through a Customer Application, withdrawal of consent may be accomplished by unlinking their account on the Service where they originally linked it.<br>For visitors to the service, opting out can be done by emailing [hello@merge.dev](mailto:hello@merge.dev).                                           |
| Cookie Policy                             | Please reference the Cookies section under our Privacy Policy ([Privacy Policy](https://merge.dev/legal/privacy-policy)).                                                                                              |
| Deletion Policy                           | Deletion of data for Customers is available when terminating their agreement with us. Individual linked accounts can be deleted by Customers on behalf of End Customers who have linked an account at any time [via the Merge API](https://docs.merge.dev/hris/delete-account/).<br>Data Deletion on the website (merge.dev) for visitors can be done by contacting [hello@merge.dev](mailto:hello@merge.dev).                                                                                               |
| Data Access / Modification / Portability   | Customers can access, modify and download their data directly from the dashboard. Visitors can request a copy or update of their data by emailing [hello@merge.dev](mailto:hello@merge.dev).                                                                        |
| Security Controls                          | We maintain ISO 27001 and SOC 2 Type 2 certification alongside industry best practices to keep data secure. More information about our security practices is available at [trust.merge.dev](https://trust.merge.dev/).      |
| Notification of Data Breach                | Merge’s data breach notification process is outlined within its Incident Response Policy, and made available via our Trust Center at [Trust Center](https://trust.merge.dev).