# DSAR Response Letter Template

**CONFIDENTIAL**

---

**From:** Meridian Analytics Ltd
Data Protection Office
47 Canary Wharf Tower, London E14 5AB
dpo@meridiananalytics.co.uk

**Date:** 14 March 2026

**To:** James Whitfield
17 Bloomsbury Square
London WC1A 2NS

**Reference:** DSAR-2026-0214

**Subject:** Response to Your Data Subject Access Request

---

Dear Mr Whitfield,

Thank you for your Data Subject Access Request received on 14 February 2026. We have processed your request in accordance with Article 15 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

## 1. Confirmation of Processing

We confirm that Meridian Analytics Ltd does process personal data concerning you.

## 2. Personal Data Provided

Please find enclosed the personal data we hold about you, organised into the following categories:

| Category | Description | Source |
|----------|-------------|--------|
| Identity Data | Full name, date of birth, national insurance number | Provided by you during account registration on 03 June 2023 |
| Contact Data | Email address, telephone number, postal address | Provided by you during account registration and subsequently updated by you on 11 January 2025 |
| Financial Data | Bank account details, transaction history (June 2023 to February 2026) | Provided by you and generated through your use of our analytics platform |
| Technical Data | IP addresses, browser type, device identifiers, login timestamps | Collected automatically through our platform's technical infrastructure |
| Usage Data | Dashboard access logs, report generation history, API query logs | Generated through your interaction with our platform |
| Communications Data | Support ticket correspondence (4 tickets between September 2023 and December 2025) | Generated through your communications with our support team |

The complete data extract is provided in the attached file **DSAR-2026-0214-data-extract.csv**.

## 3. Supplementary Information (Article 15(1)(a)-(h))

### (a) Purposes of Processing
- Provision of data analytics services under your subscription agreement
- Account management and customer support
- Billing and payment processing
- Platform security and fraud prevention
- Service improvement through aggregated usage analytics

### (b) Categories of Personal Data
Identity data, contact data, financial data, technical data, usage data, and communications data as detailed in Section 2 above.

### (c) Recipients of Your Data
Your personal data has been disclosed to the following recipients:

| Recipient | Category | Purpose | Safeguard |
|-----------|----------|---------|-----------|
| Amazon Web Services EMEA SARL | Cloud infrastructure provider | Data hosting and processing | Standard Contractual Clauses (EU Commission Decision 2021/914) |
| Stripe Payments Europe Ltd | Payment processor | Subscription billing | Data Processing Agreement per Art. 28 GDPR |
| Zendesk Inc | Customer support platform | Support ticket management | Standard Contractual Clauses and UK International Data Transfer Agreement |

### (d) Retention Period
Your personal data will be retained for the duration of your subscription agreement plus 6 years following termination, in accordance with our data retention policy and applicable limitation periods under the Limitation Act 1980.

### (e) Your Rights
You have the right to:
- Request rectification of inaccurate data (Article 16)
- Request erasure of your data (Article 17)
- Request restriction of processing (Article 18)
- Object to processing (Article 21)
- Data portability (Article 20)

### (f) Right to Complain
You have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

### (g) Source of Data
Where data was not obtained directly from you, the source is indicated in the table in Section 2. All personal data held by Meridian Analytics Ltd was either provided directly by you or generated through your use of our services.

### (h) Automated Decision-Making
Meridian Analytics Ltd does not subject your personal data to any solely automated decision-making processes that produce legal effects or similarly significant effects concerning you as defined under Article 22 UK GDPR.

## 4. Redactions Applied

Certain data items within support ticket correspondence have been redacted to protect the rights and freedoms of third parties, in accordance with Article 15(4) UK GDPR. Specifically:
- Names and email addresses of other individuals mentioned in support tickets have been replaced with [REDACTED — Third Party Data].

## 5. Further Enquiries

If you have questions about this response or wish to exercise any of your other data protection rights, please contact our Data Protection Officer at dpo@meridiananalytics.co.uk or write to the address above.

Yours sincerely,

**Dr Sarah Chen**
Data Protection Officer
Meridian Analytics Ltd

---

**Enclosures:**
1. DSAR-2026-0214-data-extract.csv (encrypted, password sent separately)
2. DSAR-2026-0214-redaction-log.pdf