Legal
Last updated: 28.09.2026
This Privacy Policy (“Policy”) describes how MergeWave Capital OÜ, a private limited company established and operating under the laws of the Republic of Estonia, with its principal place of business at Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551 (“MergeWave”, “Company”, “we”, “us”, or “our”), collects, uses, stores, discloses, and otherwise processes personal data.
DARC is a brand and business initiative operated by MergeWave Capital OÜ and is not a separate legal entity or data controller.
For the purposes of applicable data protection legislation, including Regulation (EU) 2016/679 (“GDPR”) and the Estonian Personal Data Protection Act, MergeWave Capital OÜ is the data controller of personal data collected through DARC and its related services, websites, forms and communications.
This Policy applies to personal data processed in connection with:
the MergeWave Capital website at https://mergewave.capital/;
the DARC website at https://darcdefence.com/;
services, products and business activities offered under the DARC brand;
contact, registration, application, request, subscription and other forms operated by MergeWave or DARC;
communications and other interactions with MergeWave or DARC.
For the purposes of this Policy, references to our “Websites” include both the MergeWave Capital website and the DARC website.
1. DATA CONTROLLER
The data controller responsible for processing personal data under this Policy is:
MergeWave Capital OÜ
Harju maakond, Tallinn, Lasnamäe linnaosa,
Sepapaja tn 6, 15551
Estonia
Email: legal@mergewave.capital
DARC operates as a brand and business initiative of MergeWave Capital OÜ. Accordingly, where personal data is collected through DARC, including through the DARC website, forms, services or communications, such data is collected and processed by MergeWave Capital OÜ as the data controller.
Where required by applicable law, the Company may appoint a Data Protection Officer in accordance with Articles 37–39 GDPR.
2. CATEGORIES OF PERSONAL DATA
Depending on how you interact with MergeWave or DARC, we may collect and process:
a) Identification data
including your first and last name, job title, employer or company name, nationality and professional credentials.
b) Contact data
including your email address, telephone number, postal address and country of residence.
c) Information submitted through forms
including information you provide when contacting us, requesting information, requesting a demo or consultation, registering interest in our services, submitting an application or otherwise interacting with MergeWave or DARC.
d) Technical data
including IP address, device identifiers, browser type and version, operating system, language preferences, time zone settings and similar technical information.
e) Usage data
including information about how you use and interact with our Websites, pages viewed, links clicked, referring URLs, navigation patterns and similar information.
f) Communication data
including emails, messages, contact-form submissions and other communications between you and MergeWave or DARC.
g) Marketing and preference data
including your preferences regarding newsletters, product or company updates, event invitations, marketing communications and records of consent or withdrawal of consent.
h) Other information voluntarily provided by you
including information provided during meetings, calls, events, commercial discussions or other interactions with us.
3. LEGAL BASIS FOR PROCESSING
We process personal data only where a lawful basis under Article 6 GDPR applies.
Depending on the particular processing activity, we may rely on:
a) Consent — Article 6(1)(a) GDPR
Where you have freely provided specific, informed and unambiguous consent to a particular processing activity, including, where applicable, subscribing to marketing communications or other optional communications.
Where processing is based on consent, you may withdraw your consent at any time by using an unsubscribe mechanism provided in our communications, where applicable, or by contacting us at legal@mergewave.capital.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
b) Performance of a contract or pre-contractual measures — Article 6(1)(b) GDPR
Where processing is necessary to provide services to you, perform a contract with you, or take steps at your request before entering into a contractual relationship.
c) Compliance with legal obligations — Article 6(1)(c) GDPR
Where processing is required for compliance with applicable legal or regulatory obligations.
d) Legitimate interests — Article 6(1)(f) GDPR
Where processing is necessary for our legitimate business interests, including operating and securing our Websites and services, responding to business inquiries, preventing fraud, improving our services and managing relationships with clients, partners and prospective clients, provided that such interests are not overridden by your rights and freedoms.
4. PURPOSES OF PROCESSING
We may process personal data for the following purposes:
to provide and operate MergeWave and DARC services;
to respond to inquiries and requests submitted through our Websites or other communication channels;
to process contact, demo, consultation, registration or other forms;
to communicate with existing and prospective clients, users, partners and other business contacts;
to establish and manage contractual or pre-contractual relationships;
to operate, maintain, secure and improve our Websites and services;
to understand how our Websites and services are used;
to prevent fraud, misuse and security incidents;
to comply with applicable legal and regulatory requirements;
to establish, exercise or defend legal claims; and
where you have provided the required consent or another lawful basis applies, to send newsletters, company updates, product or service information, event invitations and other marketing communications.
Where consent is relied upon for a specific purpose, personal data will not be processed for materially different purposes on the basis of that consent without obtaining additional consent where required by law.
5. CONSENT AND MARKETING COMMUNICATIONS
Where we rely on your consent, the request for consent will be presented separately and in a clear and understandable manner.
Consent will not be obtained through pre-selected checkboxes or inactivity.
Where different optional processing purposes require consent, we may request separate consent for those purposes.
You are not required to consent to optional marketing communications in order to submit a general inquiry, request information, access services that do not require such consent, or enter into a contractual relationship with us.
We maintain appropriate records of consent where required to demonstrate when and how consent was obtained and the purposes for which it was provided.
You may withdraw your consent at any time without detriment by:
using the unsubscribe mechanism contained in the relevant communication, where available; or
contacting legal@mergewave.capital.
Following withdrawal, we will cease processing based on that consent unless another lawful basis permits or requires continued processing.
6. METHODS AND SOURCES OF DATA COLLECTION
We may obtain personal data:
directly from you through MergeWave or DARC Websites and forms;
when you contact MergeWave or DARC by email or other communication channels;
during meetings, calls, events or business discussions;
through cookies and similar technologies, subject to applicable consent requirements;
from publicly available professional and corporate sources; and
from partners, affiliates, representatives or other third parties where permitted by applicable law.
6. METHODS AND SOURCES OF DATA COLLECTION
We may obtain personal data:
directly from you through MergeWave or DARC Websites and forms;
when you contact MergeWave or DARC by email or other communication channels;
during meetings, calls, events or business discussions;
through cookies and similar technologies, subject to applicable consent requirements;
from publicly available professional and corporate sources; and
from partners, affiliates, representatives or other third parties where permitted by applicable law.
7. COOKIES AND SIMILAR TECHNOLOGIES
Our Websites may use cookies and similar technologies necessary for their operation.
Where required by applicable law, non-essential cookies and similar technologies, including certain analytics, advertising or tracking technologies, will only be activated after obtaining the user’s consent.
Users will be provided with appropriate controls to accept, reject or manage non-essential cookies and, where applicable, withdraw their consent.
Further information about the cookies and similar technologies used on a particular Website is available in the applicable Cookie Policy and/or cookie preference interface.
8. RETENTION OF PERSONAL DATA
We retain personal data only for as long as necessary for the purposes for which it was collected and processed, or as required by applicable law.
Retention periods may depend on the nature of the data, the purpose of processing, applicable statutory requirements and contractual or legal obligations.
Where personal data is processed solely on the basis of consent, withdrawal of consent may result in deletion of the relevant personal data unless continued retention is required or permitted under another lawful basis.
In general, business communication data may be retained for up to five (5) years following termination of the relevant relationship or the last meaningful contact, unless a different period is required or justified.
After the applicable retention period expires, personal data will be securely deleted or anonymized.
9. INTERNATIONAL DATA TRANSFERS
Personal data may be processed by service providers or other recipients located outside the European Economic Area.
Where such transfers occur, MergeWave Capital OÜ will implement appropriate safeguards in accordance with Chapter V GDPR, including, where applicable, European Commission adequacy decisions or Standard Contractual Clauses.
Information regarding applicable safeguards may be requested at legal@mergewave.capital.
10. DISCLOSURE TO THIRD PARTIES AND PROCESSORS
We may disclose personal data where necessary to service providers and processors supporting the operation of MergeWave and DARC, including providers of:
website hosting and infrastructure;
cloud services;
communications and email services;
customer relationship management systems;
analytics services;
professional, legal, accounting and financial services; and
other technology or operational services.
Where a third party processes personal data on our behalf as a processor, we require appropriate contractual and data-protection safeguards in accordance with Article 28 GDPR.
Personal data may also be disclosed where required by applicable law, regulation, court order or competent public authority.
11. YOUR DATA PROTECTION RIGHTS
Subject to the conditions established by applicable law, you may have the right to:
access your personal data;
correct inaccurate or incomplete personal data;
request deletion of your personal data;
request restriction of processing;
receive certain personal data in a portable format;
object to processing based on legitimate interests;
object at any time to processing for direct marketing purposes; and
withdraw consent at any time where processing is based on consent.
To exercise your rights, contact:
legal@mergewave.capital
We may request reasonable information necessary to verify your identity before processing your request.
12. RIGHT TO LODGE A COMPLAINT
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data has been processed in violation of applicable data protection law.
As MergeWave Capital OÜ is established in Estonia, the relevant Estonian supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
13. SECURITY
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Such measures may include access controls, encryption where appropriate, security monitoring, internal procedures and other safeguards proportionate to the risks associated with the processing.
14. CHILDREN
Our Websites and services are not intended for children under the age of 16, and we do not knowingly collect personal data from children through our business services.
If we become aware that personal data has been collected from a child contrary to applicable law, we will take appropriate steps to delete such data.
15. CHANGES TO THIS POLICY
We may update this Policy from time to time to reflect changes to our business activities, including the operation of DARC, our processing practices, technologies or applicable legal requirements.
The current version of the Policy will be made available through the relevant Website.
16. CONTACT
For questions regarding this Privacy Policy, the processing of personal data by MergeWave Capital OÜ or DARC, or the exercise of your data protection rights, please contact:
MergeWave Capital OÜ
Email: legal@mergewave.capital
For the avoidance of doubt, communications or personal data submitted through DARC are processed by MergeWave Capital OÜ as the data controller.