Merot e-Faktura API — Privacy Policy
Version 1 — effective 1 October 2026
1. Who we are
The controller of the account data described below is МЕРОТ ДООЕЛ Скопје, EDB 4043022533490 (“Merot”). This policy covers the Merot e-Faktura API developer console at developer.merot.com and the pay.merot.com checkout. Contact for any privacy question: support@merot.com.
For the personal data contained in e-invoices that a customer sends through the API, the roles are different: the customer (or its client company) is the controller and Merot is the processor. That processing is governed by the Data Processing Agreement, which forms part of the Terms of Service.
2. What we collect
- Account data: name, e-mail address, password hash and multi-factor authentication details of console users.
- Company data from the UJP taxpayer registry: company name, tax/VAT number (EDB) and address.
- Representative and signer details: name, e-mail address and UJP EUJP-ID.
- Certificate public data: subject, issuer, serial number and validity of the customer’s certificate. We never receive private keys: they stay on the customer’s computer or token.
- E-invoice content sent through the API. The DPA describes it as names, addresses, tax numbers and contact details of the parties on invoices, line descriptions that may contain personal data, and audit records (IP address, user agent). Special categories of data are not intended.
- API usage logs.
- Payment records from pay.merot.com. Card payments are handled by Monri; card data is entered with Monri and is not stored by Merot.
3. Why we use it
To provide the Service: to run accounts and API keys, to receive, validate, store and archive e-invoices, to submit them to UJP (the tax authority’s e-Faktura system) and to the counterparty through UJP, to track status and deliver webhooks, to back up and export data, and to take payment for plans.
4. Who receives it
- UJP. E-invoices are submitted to UJP, which is a third party and not controlled by Merot.
- Sub-processors. The sub-processors authorised in the DPA (Annex A) are listed below. Anything not listed there is not authorised.
| Sub-processor | Service | Location | Data |
|---|---|---|---|
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. [TBD — lawyer: contracting entity] | Compute (EC2), managed Postgres (RDS), object storage (S3), key management (KMS), e-mail sending (SES SMTP), backups | eu-central-1 (Frankfurt): production; eu-west-1 (Ireland): archive replica, backups, KMS replica key | All Service data; SES: recipient addresses and message content of Service e-mails |
- Monri handles card payments on pay.merot.com.
5. Where it is stored
Production data, backups, logs and archives for the Service are stored and processed in the EU: AWS eu-central-1 (Frankfurt), with the archive replica in AWS eu-west-1 (Ireland).
6. How long we keep it
- Archived e-invoices are kept for 10 years in a WORM (write-once) archive and outlive the contract. Under the draft e-invoicing law, issuers and recipients keep e-invoices for the periods of the Law on Tax Procedure, read as 10 years, in original electronic form. That law is currently a draft and not adopted; the rule will be re-checked against the adopted text.
- Backups roll off on their own schedule: database point-in-time recovery 35 days; nightly dumps expire after 100 days.
- Erasure and retention. Personal data inside archived tax documents cannot be erased before the retention period ends. Personal data without another legal basis is kept only until the purpose ends.
7. How we protect it
Measures in place on the infrastructure include: an encrypted (KMS) database that is not publicly accessible, with point-in-time recovery and separate database roles; object storage with encryption, versioning, blocked public access, TLS-only access and access logging into an EU-only trail; an archive bucket with Object Lock (WORM, 10-year default retention) replicated to eu-west-1; host hardening (firewall, SSH allow-list, no password login, intrusion prevention, audit logging, automatic security updates); tenant isolation in the application and database (row-level security); and API keys stored hashed.
8. Your rights
You can ask for access to your personal data, and for its rectification, erasure, restriction or portability, and you can object to its processing. Write to support@merot.com. Where Merot acts as processor for an invoice, we forward your request to the responsible controller. Erasure is subject to the retention rules in section 6.
You may also lodge a complaint with the Personal Data Protection Agency (Агенција за заштита на личните податоци).