Privacy Policy

1. Who controls your data

The data controller is Lotus Group (“Mercatus Capital Lotus”, “we”), registered at [TODO: street, city, Albania], business identification number M21307501G. For any question about your data, write to us at [TODO: privacy@mercatus-lotus.com] or call us on +355 68 900 3377.

2. What data we collect

• Account data: first and last name, email address, password (stored hashed), and the role you choose (seller, buyer, investor).
• Profile and verification data: company, investment focus, and documents you upload for accreditation.
• Listing data: the financial and operational information you choose to publish about your company.
• Usage data: deals you save, access requests you make, and actions in your dashboard.
• Technical data: IP address and basic browser data, processed by the server for security and service delivery.

3. Why we process it, and on what basis

• To provide the service — creating your account, publishing listings, connecting the parties. Basis: performance of a contract.
• For security — sign-in, two-factor verification, abuse prevention. Basis: our legitimate interest and legal obligation.
• For counterparty verification and compliance (KYC/AML). Basis: legal obligation.
• For non-essential cookies and marketing communications. Basis: your consent, which you may withdraw at any time.

4. Deal confidentiality

Listings marked confidential do not display the company's identity publicly and are excluded from search engine indexing. Detailed data-room material is made available only to verified parties who have signed a non-disclosure agreement.

5. Who we share it with

We do not sell your data. We share it only with: verified counterparties in a transaction you take part in; our service providers (hosting, email, payments/escrow) acting as processors on our instructions; and authorities where the law requires it.

6. How long we keep it

Account data is kept while your account is active and deleted within [TODO: e.g. 30 days] of closure. Transaction records and KYC/AML data are kept for the period the law requires [TODO: e.g. 5 years].

7. Your rights

• Request access to your data and a copy of it.
• Have inaccurate or incomplete data corrected.
• Request erasure, where we have no legal duty to retain them.
• Restrict or object to processing.
• Receive your data in a portable format and transfer it.
• Withdraw consent at any time, without affecting processing already carried out.

8. Complaints

If you believe your rights have been breached, contact us at [TODO: privacy@mercatus-lotus.com] or on +355 68 900 3377. You also have the right to lodge a complaint with the supervisory authority: Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (IDP) (https://www.idp.al).

9. International transfers

Some of our service providers may process data outside Albania. Where that happens we rely on countries with an adequate level of protection, or on standard contractual clauses.

10. Changes

When we update this policy we change the date below. For material changes that affect consent, we will ask for your choice again.