Privacy Policy
This document is provided as a template for demonstration purposes and does not constitute legal advice.
Last updated: 2026-07-26
This Privacy Policy explains how the merlon platform (operated by the Wahlen Software group) processes personal data when you visit our websites, request a demo, or use the merlon service. We are committed to processing personal data in accordance with the revised Swiss Federal Act on Data Protection (nFADP) and the EU General Data Protection Regulation (GDPR), as applicable to you.
1. Who we are & controllers
merlon operates a dual-controller model. The entity responsible for your personal data (the "controller") depends on the region in which you are located.
Switzerland, EU/EFTA & Rest of World: Wahlen Software GmbH, Germaniastrasse 1, 8006 Zürich, Switzerland (UID CHE-139.189.280), is the controller. Privacy contact: privacy@merlon.ch.
Where you are a customer of merlon and upload personal data belonging to your own end users into the service, you generally act as the controller and Wahlen Software acts as your processor. That relationship is governed by our Data Processing Agreement (DPA). This Privacy Policy describes the processing for which Wahlen Software itself is the controller.
2. What data we collect
We collect the following categories of personal data:
- Account & identity data — name, work email, company, job title, and credentials you provide when creating an account or logging in.
- Contact & sales data — information you submit through demo requests, contact forms, and support tickets, including the content of your messages.
- Usage & device data — log data such as IP address, browser type, pages viewed, timestamps, and referring URLs, collected to operate and secure the service.
- Billing data — company billing details and tax identifiers; card payments are handled by our payment processors, and we do not store full card numbers.
- Communications — records of correspondence with our sales, support, and security teams.
3. Purposes & legal bases
We process personal data for the following purposes, relying on the legal bases set out below (GDPR terminology; equivalent bases apply under the nFADP):
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing and operating the merlon service | Performance of a contract (Art. 6(1)(b)) |
| Responding to demo, sales, and support requests | Legitimate interests / pre-contractual steps (Art. 6(1)(b), (f)) |
| Securing the platform & preventing abuse | Legitimate interests (Art. 6(1)(f)) |
| Billing, accounting & tax records | Legal obligation (Art. 6(1)(c)) |
| Analytics & marketing cookies | Consent (Art. 6(1)(a)) |
4. Data retention
We retain personal data only for as long as necessary for the purposes for which it was collected:
- Account data — for the duration of your relationship with us and deleted or anonymised within a reasonable period after account closure.
- Billing records — retained for the statutory periods required by Swiss and US law (typically up to 10 years for accounting records).
- Support & sales correspondence — retained for up to 24 months after the last interaction, unless a longer period is required.
- Server & security logs — retained for a limited period sufficient for security and troubleshooting, then rotated out.
5. Your rights
Subject to applicable law, you have the following rights over your personal data:
- Access — obtain confirmation of whether we process your data and a copy of it.
- Rectification — have inaccurate or incomplete data corrected.
- Deletion — request erasure of your data where there is no overriding legal ground to retain it.
- Portability — receive your data in a structured, commonly used, machine-readable format.
- Objection & restriction — object to processing based on legitimate interests, or request that processing be restricted.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at privacy@merlon.ch. We will respond within the timeframes required by applicable law.
6. International transfers
Because the Wahlen Software group operates in both the United States and Switzerland, personal data may be transferred across borders. We rely on the following transfer mechanisms:
- Swiss–US Data Privacy Framework (DPF) for transfers of Swiss personal data to the United States.
- EU–US Data Privacy Framework (DPF) for transfers of EU personal data to the United States.
- Standard Contractual Clauses (SCCs), with the Swiss addendum where relevant, as a fallback mechanism where the DPF does not apply.
Customer content is stored in the data residency region matching your account: US customers' data is hosted in a US region, while Swiss and EU customers' data is hosted exclusively in Switzerland.
7. Sub-processors
We engage a limited number of vetted sub-processors (for example, cloud hosting, email delivery, and payment processing) to help deliver the service. Each sub-processor is bound by contractual data protection obligations. Our current list of sub-processors is maintained in our Trust Center.
8. Security measures
We apply technical and organisational measures designed to protect personal data, including AES-256 encryption at rest, TLS 1.2+ in transit, multi-factor authentication and single sign-on, least-privilege access controls, and 24/7 monitoring by our in-house Blue and Purple Teams. Learn more on our Security & Compliance page.
9. Cookies
We use strictly necessary cookies to run the site and, with your consent, analytics and marketing cookies. You can manage your preferences at any time. For details, see our Cookie Policy or open .
10. Contact & complaints
For any privacy question or to exercise your rights, contact privacy@merlon.ch. If you believe we have not resolved your concern, you have the right to lodge a complaint with a supervisory authority:
- Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
- EU/EEA: the data protection authority in your country of residence or place of the alleged infringement.
11. Changes
We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date above and, where appropriate, by additional notice.