Privacy Policy

Mera ("Company", "we", "us", or "our") is committed to protecting your privacy and the personal data you entrust to us. This Privacy Policy explains how we collect, use, store, share, and protect information when you use our websites, products, and services including merahq.com, Mera Concierge, and Mera QR. By using our services, you consent to the data practices described in this policy. If you do not agree, please do not use our services.

We collect the following categories of information: Operator Information (hospitality businesses using our platform): • Business name, address, and contact details • Authorised representative names and email addresses • Payment and billing information • Account credentials • Business type and segment data Guest Information (collected on behalf of operators): • Name, email address, phone number • Booking and reservation details • Order history and preferences • Communication logs through Mera Concierge • Device information and IP address Automatically Collected Information: • Browser type, operating system, and device identifiers • Pages visited, time spent, and interaction patterns • Referral URLs and search queries • Cookies and similar tracking technologies

We use collected information for the following purposes: Service Delivery: • To create and manage operator accounts • To process bookings, orders, and payments • To provide AI concierge and QR ordering features • To build, host, and maintain operator websites Communication: • To send transactional notifications (booking confirmations, order updates) • To respond to support enquiries • To send product updates and feature announcements (with opt-out) Improvement & Analytics: • To analyse usage patterns and improve our products • To monitor system performance and uptime • To detect, prevent, and address technical issues • To generate aggregated, anonymised insights for operators Legal & Compliance: • To comply with applicable laws and regulations • To enforce our Terms and Conditions • To protect rights, property, and safety

Mera acts in two capacities: As a Data Controller: For information we collect directly from operators and website visitors (account registration, billing, analytics). As a Data Processor: For guest information processed on behalf of operators through our platform (bookings, concierge interactions, QR orders). Operators are the data controllers for their guest data and are responsible for obtaining appropriate consent and providing privacy notices to their guests. Operators must not use our platform to collect sensitive personal data (health, biometric, political, religious information) unless expressly agreed in writing.

We do not sell your personal data. We may share information in the following circumstances: Service Providers: We use trusted third-party services to operate our platform, including: • Payment processors (e.g., Stripe) for transaction handling • Cloud hosting providers for data storage and processing • Communication platforms (e.g., WhatsApp Business API) for messaging • Analytics services (e.g., Google Analytics) for usage insights These providers are contractually obligated to protect your data and use it only for the purposes we specify. Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request. Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change. With Consent: We may share information when you have given explicit consent to do so.

We implement appropriate technical and organisational measures to protect your personal data, including: • Encryption of data in transit (TLS/SSL) and at rest • Secure authentication and access controls • Regular security assessments and vulnerability testing • Employee access limited to authorised personnel on a need-to-know basis • Incident response procedures for data breaches While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including: • Active account data: Retained while your account is active and for 12 months after account closure • Billing and transaction records: Retained for 7 years to comply with tax and accounting regulations • Guest data (processed for operators): Retained according to operator instructions, or deleted within 90 days of operator account termination • Analytics data: Aggregated and anonymised data may be retained indefinitely • Communication logs: Retained for up to 24 months You may request earlier deletion subject to our legal retention obligations.

Depending on your jurisdiction, you may have the following rights regarding your personal data: • Access: Request a copy of the personal data we hold about you • Correction: Request correction of inaccurate or incomplete data • Deletion: Request deletion of your personal data (subject to legal retention requirements) • Portability: Request your data in a structured, commonly used format • Restriction: Request restriction of processing in certain circumstances • Objection: Object to processing based on legitimate interests • Withdrawal of Consent: Withdraw consent at any time where processing is based on consent To exercise any of these rights, please contact us at contact@merahq.com. We will respond within 30 days. If you are a guest whose data is processed through our platform, please contact the relevant operator directly, as they are the data controller for your information.

We use cookies and similar technologies to: • Remember your preferences and login status • Analyse traffic and usage patterns • Improve site performance and user experience Types of cookies we use: • Essential cookies: Required for basic site functionality (cannot be disabled) • Analytics cookies: Help us understand how you interact with our services • Preference cookies: Remember your settings and choices You can manage cookie preferences through your browser settings. Disabling certain cookies may affect site functionality.

Our primary operations and servers are located in Nigeria. If you access our services from outside Nigeria, your data may be transferred to and processed in Nigeria. Where we transfer data internationally, we implement appropriate safeguards, including contractual provisions, to ensure your data receives an adequate level of protection.

Our services are designed for businesses and their authorised adult representatives. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly. If you believe we have collected data from a minor, please contact us immediately.

Our services may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our platform.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by: • Posting the updated policy on our website • Updating the "Last updated" date • Sending a notice to your registered email for significant changes Your continued use of our services after any changes constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: • Email: contact@merahq.com • Address: Lagos, Nigeria • Website: merahq.com For data protection enquiries, you may also write to our Data Protection Officer at the address above.