MERIXA MANEGEMENT MICRO PRIVACY POLICY

MERIXA MANAGEMENT MICRO PRIVACY POLICY

Effective date: 1 September 2026

This Privacy Policy explains how Merixa Limited (“Merixa”, “we”, “us” or “our”) handles personal information in connection with the Merixa Management Micro mobile application (“Management Micro” or the “Application”).

Management Micro is designed around data minimisation and local-device processing. Business and financial information that you enter, create, calculate or save within the Application is designed to remain on your device rather than being stored in a Merixa user account or central user-content database.

This Privacy Policy applies only to Merixa Management Micro. Other Merixa applications, the Merixa website and Merixa's professional or consultancy activities may be subject to separate privacy notices.

1. Who we are

For personal information for which Merixa determines the purposes and means of processing:

Data controller: Merixa Limited
Country of establishment: United Kingdom
Privacy contact: contact@merixa.co.uk

You may contact us about this Privacy Policy or about applicable data-protection rights using the email address above.

2. Privacy at a glance

Management Micro is designed so that:

you do not need to create a Merixa user account or profile;

working information entered into the Application is designed to remain locally on your phone or tablet;

Merixa does not operate a central database containing your Management Micro financial information, management accounts, cash information, scenarios or other locally created working content;

Management Micro does not use generative AI to process your working information;

Merixa does not use your locally stored business information for advertising;

Merixa does not use Management Micro for behavioural advertising or profiling;

Management Micro is not designed to collect or track your precise geographic location;

supported reports or workspace information can be encrypted and decrypted locally using Application functionality; and

purchases and subscriptions, where applicable, are administered through the relevant application store.

Information that remains solely on your device is not received by Merixa merely because you enter, calculate, edit, view, import or save it within Management Micro.

3. Information stored and processed locally

Management Micro allows you to record, import, calculate, analyse and review business information.

Depending on the features you use, locally processed information may include:

client and supplier details;

financial and management-account information;

cash balances and cash movements;

planned and actual amounts;

budgets and forecasts;

profit and loss information;

working-capital information;

assumptions and calculations;

scenarios and stress tests;

variance analysis;

management actions and operational events;

notes and review information;

management reports;

thresholds and notification preferences;

Application settings; and

other information that you choose to enter or import into the Application.

This information is designed to remain within the local Application environment on your device.

Merixa does not operate a central user-content repository containing this information and cannot normally view or retrieve it.

4. Client, supplier and other third-party information

Management Micro may allow you to enter information relating to clients, suppliers, employees, directors, business contacts or other individuals as part of your own business management activities.

Merixa does not receive that information merely because you enter or retain it locally within Management Micro.

If you or your organisation use Management Micro to process personal information relating to another person, you are responsible for ensuring that you have appropriate authority and a lawful basis for that processing and that you comply with any data-protection, confidentiality, professional, contractual or regulatory obligations that apply to you.

Where you use Management Micro on behalf of an organisation, that organisation may have its own responsibilities as a data controller or otherwise under applicable data-protection law.

Management Micro should not be used to store information that you are not authorised to possess or process.

5. Local storage and device backups

Information stored locally within Management Micro remains under the control of your device and Application environment.

Depending on your operating system, device manufacturer and settings, locally stored Application information may also become part of:

a device backup;

an Apple or Google backup service;

a device-transfer service; or

another backup service that you have enabled.

Those services are controlled by the relevant provider and by your own device or account settings.

Merixa does not control copies independently created or maintained through your personal device or cloud-backup arrangements.

For this reason, deleting information from Management Micro or uninstalling the Application may not automatically delete copies that exist within an independently maintained device or cloud backup.

6. Reports, exports, encrypted workspaces and sharing

Management Micro allows users to create, export and share information from the Application.

Depending on the functionality used, this may include management reports, Owner Briefs, Complete Management Reports, CSV or PDF files, or supported encrypted Application information or workspaces.

Where you deliberately export or share information:

you choose whether to export it;

you choose the recipient or destination;

you choose the communication or storage method used to transfer it; and

you are responsible for ensuring that the recipient is appropriate and authorised to receive it.

A user-initiated export or share does not mean that Merixa receives or stores a copy of the information.

If you use another application or service to send, save or share an exported file — for example email, messaging, cloud storage or another document service — that third party may process the information under its own privacy terms.

7. Local encryption

Management Micro provides local encryption and decryption functionality for supported information.

Where this functionality is used, the encryption and decryption process is designed to take place locally on your device.

You remain responsible for controlling access to encrypted files, any credentials or information necessary to access them, and the devices or services on which exported encrypted information is subsequently stored.

Encryption functionality within Management Micro does not replace appropriate security controls for your phone or tablet. You should maintain suitable device access controls, operating-system updates, passwords or biometric protection and secure backup arrangements.

No electronic security system can guarantee absolute security.

8. No Merixa user account

Management Micro does not require you to register for a Merixa user account.

Merixa therefore does not ordinarily maintain an Application database containing:

Management Micro usernames or passwords;

Application user identity profiles;

a central copy of your locally stored business information;

an Application contact list linked to a Merixa account; or

a server-side Management Micro workspace associated with your identity.

Your Apple or Google account is maintained by the relevant platform, not by Merixa.

9. Purchases and subscriptions

Purchases, subscriptions and other store transactions relating to Management Micro are administered through the platform from which you obtain the Application, such as:

Google Play and Google Play Billing; or

Apple App Store and StoreKit.

Apple and Google may independently process information such as:

platform account information;

payment information;

transaction details;

purchase history; and

subscription status,

under their own privacy policies and contractual arrangements.

Merixa does not receive or store your complete payment-card number, bank-account credentials, Apple account password or Google account password.

The Application or relevant platform services may provide limited purchase or entitlement information necessary to determine whether you are entitled to use paid Application functionality.

10. Support enquiries

Information that you deliberately send to Merixa is different from information that remains locally within Management Micro.

If you contact Merixa for technical support, privacy assistance or another Application-related enquiry, we may receive information that you voluntarily provide, including:

your name;

your email address;

information about the Application;

device or operating-system information that you choose to provide;

screenshots or files that you choose to attach;

diagnostic information that you deliberately provide; and

the contents of your communication.

We use this information to respond to your enquiry, investigate the issue, protect the Application where necessary and maintain appropriate business records.

You should avoid sending sensitive business or personal information to Merixa in a support request unless it is genuinely necessary for us to assist you.

Merixa cannot access locally stored Management Micro information merely because you contact us for support.

11. Advertising, analytics, tracking and location

Under Management Micro's current operating model, Merixa does not use the Application to:

conduct behavioural advertising;

create advertising profiles from your financial or management information;

sell your locally entered Application information to advertisers or data brokers;

track your activity across unrelated applications for advertising purposes; or

collect or track your precise real-time geographic location.

Management Micro's Google Play Data Safety declaration is intended to remain consistent with the Application's actual production data-handling practices.

If Merixa introduces functionality in a future release that materially changes how personal information is collected, transmitted or shared — including new analytics, telemetry, advertising or third-party processing — the applicable privacy disclosures and application-store declarations will be reviewed and updated before or when the change takes effect as required by applicable law.

12. Notifications and Application settings

Management Micro allows you to configure settings such as thresholds, quiet times and management notifications or reminders.

These preferences form part of your Application settings and are designed to remain associated with the Application environment on your device.

Your mobile operating system may also process notification permissions and related device settings under its own controls.

You can change notification permissions through Management Micro where available and through your device settings.

13. Why Merixa processes personal information

Where the UK GDPR, Data Protection Act 2018 as amended, EU GDPR or another applicable data-protection law applies, Merixa processes personal information that it actually receives only where there is an appropriate legal basis.

Providing the Application and requested services

Where processing is necessary to provide functionality or a service that you have requested from Merixa, we may rely on performance of a contract or steps connected with that contract where applicable.

Legitimate interests

We may process limited personal information where necessary for our legitimate interests, including:

answering support and privacy enquiries;

investigating technical or security issues;

maintaining and securing Management Micro;

preventing misuse;

protecting Merixa's legal and intellectual-property rights;

establishing, exercising or defending legal claims; and

maintaining reasonable business and compliance records.

We use legitimate interests only where those interests are not overridden by the rights and interests of the individuals concerned.

Legal obligations

We may process or disclose personal information where reasonably necessary to comply with applicable law, regulatory requirements, court orders or other legally binding obligations.

14. Who may receive personal information held by Merixa

Because Management Micro is designed around local processing, Merixa does not disclose locally stored Application information that Merixa has never received.

For personal information that Merixa does receive, such as support correspondence, recipients may include:

service providers supporting Merixa's business communications, IT or hosting arrangements where necessary;

professional advisers where reasonably necessary;

courts, regulators, law-enforcement bodies or other public authorities where disclosure is legally required or permitted; and

Apple or Google in relation to their independent application-store, billing, distribution and platform services.

Service providers acting on Merixa's behalf are expected to process relevant personal information only for authorised purposes and subject to appropriate contractual and security requirements where required by law.

15. International processing

Information that remains solely within Management Micro on your device is not transferred internationally by Merixa merely because you use the Application.

Apple, Google, cloud-backup providers and other services that you independently choose to use may process information internationally under their own privacy arrangements.

Where personal information actually held by Merixa is transferred internationally and applicable data-protection law requires safeguards, Merixa will use an appropriate lawful transfer mechanism or other protection recognised by the relevant law.

16. Retention

Locally stored Management Micro information

Merixa does not impose a server-side retention period on information that exists only within Management Micro on your device.

You control how long that information remains on your device, subject to the Application's functionality, device operating system and any independent backups that you maintain.

Support correspondence

Routine Application support and privacy correspondence may normally be retained for up to two years after the last meaningful contact.

Information may be retained for longer where reasonably necessary to:

resolve an ongoing issue;

comply with law;

maintain required financial or business records;

investigate security or misuse;

establish, exercise or defend legal rights; or

resolve an actual or anticipated dispute.

Information should not be retained by Merixa for longer than reasonably necessary for the purposes for which it is held.

Store information

Information independently held by Apple or Google is subject to those platforms' own retention policies and legal obligations.

17. Deleting Management Micro information

Because Merixa does not operate a central user account containing your locally stored Management Micro content, Merixa cannot normally delete that information remotely.

Depending on the Application functionality and your device, you may manage locally stored information by:

deleting individual information within Management Micro;

deleting or replacing imported information;

deleting exported files;

clearing Application storage;

managing device or cloud backups; or

uninstalling Management Micro.

Uninstalling the Application does not necessarily remove independently stored exported files, cloud backups, Apple or Google account information, purchase history or subscription records.

You should separately manage those items through the relevant device, storage service or platform.

18. Your data-protection rights

Depending on where you live and the particular processing involved, applicable law may provide rights concerning personal information that Merixa holds about you.

These may include rights to:

request access to your personal information;

request correction of inaccurate information;

request deletion in applicable circumstances;

request restriction of processing;

object to certain processing;

receive certain information in a portable format where the right applies; and

complain to an appropriate data-protection authority.

Because Merixa does not operate a central database containing your locally stored Management Micro content, we generally cannot access, identify, provide, correct or remotely erase information that exists only within your Application on your device.

Where Merixa does possess personal information about you — for example because you contacted us for support — you can make a privacy request by contacting:

contact@merixa.co.uk

We may need to take reasonable steps to confirm your identity before responding to certain requests.

UK users also have the right to raise concerns with the Information Commissioner's Office (ICO).

Users in the European Economic Area may have the right to complain to the competent data-protection supervisory authority in their country.

Other jurisdictions may provide additional mandatory privacy rights where their laws apply.

19. Automated decision-making and profiling

Merixa does not use Management Micro to make automated decisions about you that determine whether you receive employment, credit, insurance, professional services or another legal or similarly significant outcome.

The calculations, scenarios, forecasts, stress tests and management analyses generated within Management Micro are tools controlled by the user for business analysis. They are not used by Merixa to profile users or make decisions about them.

20. Children's privacy

Management Micro is a business and management application and is not designed or directed specifically for use by children.

Merixa does not knowingly use Management Micro to collect personal information from children into a Merixa user database.

Users responsible for entering information about other individuals should not enter children's personal information unless they have appropriate authority, a lawful reason to do so and appropriate safeguards.

21. External applications and websites

Management Micro may allow you to open or use third-party applications, websites or services.

For example, you may choose to use another service to:

share an exported report;

store a file;

send an email;

access an external professional or official website; or

manage your Apple or Google account.

Once you choose to interact with another service, that provider may process information under its own privacy policy.

Merixa does not control the independent privacy practices of third-party services merely because Management Micro allows you to interact with them.

22. Security

Management Micro's local-first architecture is intended to reduce unnecessary central collection of financial and business information.

Security also depends on how you manage your own device and exported information.

We recommend that you:

protect your device with an appropriate password, PIN or biometric control;

keep your operating system and Application reasonably up to date;

control access to exported reports and encrypted files;

maintain appropriate backup security;

protect any information or credentials used to access encrypted material; and

avoid sharing confidential reports with unauthorised recipients.

No application, device or electronic storage system can guarantee absolute security.

23. No sale of personal information

Merixa does not sell personal information collected through Management Micro.

Merixa does not share Management Micro user information for cross-context behavioural advertising or equivalent targeted advertising arrangements.

If these practices were to change, this Privacy Policy and relevant application-store disclosures would be updated as required before or when such processing begins.

24. Changes to this Privacy Policy

We may update this Privacy Policy where necessary to reflect:

changes to Management Micro;

changes to our data-handling practices;

changes to application-store requirements;

changes to applicable law or regulatory guidance; or

security, operational or organisational developments.

Where a change materially affects how Merixa processes personal information, we will take reasonable steps to make the updated information available before or when the change takes effect as required by applicable law.

The effective date shown at the beginning of this Privacy Policy identifies the current version.

25. Contact us

Questions about Management Micro privacy or requests concerning personal information actually held by Merixa can be sent to:

Merixa Limited
Email: contact@merixa.co.uk
United Kingdom

This Privacy Policy applies specifically to Merixa Management Micro.