Privacy Notice

Effective 6 October 2026.

This notice explains how GAMSOL uses the information you provide through Mercor Claim.

Who is responsible

GAMSOL operates this service. Postal address: Postfach 8008 Zürich, Switzerland.

What we collect

We collect your contact details, information about your Mercor work and payments, answers about working arrangements, documents you choose to upload, messages sent through the contact form, and account and security records, including sign-in and submission IP addresses. We save a dated copy of the information you submit each time.

How we use your information

We use your information to assess potential claims, investigate working practices and payment arrangements, review evidence, contact you about your submission and manage your account.

Your information helps us understand how Mercor work was arranged and paid, even if you never take part in legal proceedings. Registering helps us see how many people may be affected and plan any proceedings. If people later choose to act together, they may be able to share costs and negotiate from a stronger position. We cannot promise any outcome. Choosing not to take part in proceedings does not, by itself, end our use of your information for the investigation. You can ask about your data protection rights through the contact form or by post.

If proceedings are proposed, we may share the contact details you provide with our legal partner so they can explain your options. Speaking with them does not oblige you to join. For this purpose, contact details means your name, verified sign-in email address and any phone number you provide. We do not share sign-in links.

We also use account and security records to protect the service and keep a record of submissions. Optional marketing updates are separate from the investigation and are not a condition of registration or submission.

Optional website analytics

If you allow analytics, we use a random browser identifier to count visits to key pages, form progress and registrations. We record campaign labels and the referring website’s hostname, without names, email addresses, form answers, IP addresses or full referring URLs. The analytics cookie lasts 30 days and analytics records are deleted after 90 days. You can change your choice using the analytics control on public and registration pages; declining does not affect registration. Figures cover consenting browsers, rather than all visitors.

Our lawful bases

We rely on legitimate interests to operate a secure service, investigate potential claims, assess evidence and contact you about your submission. These interests are balanced against your rights and reasonable expectations. You can object to this use of your information.

Where evidence includes special-category information, such as health or trade-union information, we use it only where necessary to establish, exercise or defend legal claims. Please do not upload unrelated sensitive information. We rely on consent for optional analytics and marketing; you can withdraw it in your account. If a specific legal obligation requires processing or disclosure, we rely on that obligation.

Acknowledging this notice does not consent to legal proceedings. We do not determine whether you have a legal claim solely through automated processing.

Your privacy in relation to Mercor

Registering or submitting information does not notify Mercor or give it access to your account or submission. Your account and submission are not public.

We will not contact Mercor about you or share your identity or information with Mercor without your express consent, unless required by law.

Who may handle your information

Authorised staff may review your information. Our legal partner may receive your contact details for the purpose described above. Providers of hosting, file storage and email services may handle information where needed to operate the service. Professional advisers may receive relevant information for the investigation or advice on potential claims. Information may also be disclosed where required by law.

These uses do not give Mercor access to your information. We do not send your answers or earnings information to advertising platforms.

Providers and international processing

Hostinger provides hosting and database services from the United Kingdom, with backups stored in Germany. Cloudflare provides private document storage and the security check, and Amazon Web Services provides email delivery. We operate from Switzerland; private document storage is configured in the EU and email delivery uses the AWS Europe (London) region. Support services and subprocessors may process information in other countries.

These providers' data-processing terms provide contractual safeguards for relevant international transfers, including standard contractual clauses and UK addenda where applicable. See the Hostinger data-processing terms, Cloudflare data-processing terms and AWS data-protection information. Contact us if you would like details of the safeguards relevant to your information.

Legal action requires a separate decision

We will not start legal proceedings in your name or include you in a claim without your separate, express consent. You can decide not to take part. Creating an account, submitting information, speaking with our legal partner or accepting the website Terms does not give that consent. We will explain any proposed action, costs and necessary disclosure before asking you to decide.

How long we keep information

We review unsubmitted drafts after 12 months of inactivity. Before deleting a draft, we aim to give 30 days' notice where we can contact you. Submitted information is reviewed at least annually and retained only while needed for an active investigation, potential legal claims or a documented obligation. When an investigation closes, we set a disposal date based on those remaining needs; information subject to a legal hold is retained until that hold ends.

Our retention schedule provides for contact messages to be reviewed for deletion 12 months after resolution and security audit history after 12 months, unless an incident or legal hold justifies longer. Expired sessions and rate-limit counters are removed through routine maintenance. Expired sign-in and email-change token records and accepted email-queue metadata are removed after 30 days; queued message content is cleared when the email provider accepts it. Provider acceptance does not confirm delivery to an inbox.

Backup copies follow the hosting provider's rolling retention schedule. If a backup is restored, deletion requests must be reapplied before affected records are used. We do not treat a decision not to join proceedings as permission to retain information indefinitely.

Your rights

You may request access, correction, deletion or restriction, or object to our use of your information, where those rights apply. We verify requests proportionately, consider any applicable legal hold, and explain any lawful reason that prevents us from fulfilling a request. You can complain to the UK Information Commissioner's Office.

Contact

Once you have signed in through a link sent to your email address, use the private contact form for questions or requests about your information. The form accepts up to two messages per UTC day. If you cannot access your account or prefer to write, contact us by post at Postfach 8008 Zürich, Switzerland.