# Art. 14 Indirect Collection Notice Template

**From:** Meridian Analytics Ltd
Data Protection Office
47 Canary Wharf Tower, London E14 5AB
dpo@meridiananalytics.co.uk

**Date:** 14 March 2026

**To:** Alexandra Kowalski
Chief Financial Officer
Brightstone Ventures Ltd

**Subject:** Notice Regarding Personal Data We Hold About You

---

Dear Ms Kowalski,

We are writing to inform you that Meridian Analytics Ltd holds personal data concerning you, which we obtained from a source other than yourself. Under Article 14 of the UK General Data Protection Regulation (UK GDPR), we are required to provide you with the following information.

## 1. Who We Are

**Data Controller:** Meridian Analytics Ltd, 47 Canary Wharf Tower, London E14 5AB. Company number 09847362 (England and Wales).

**Data Protection Officer:** Dr Sarah Chen, dpo@meridiananalytics.co.uk

## 2. Source of Your Data

We obtained your personal data from **Companies House** (a publicly accessible source) and from **Brightstone Ventures Ltd** (your employer, who engaged our analytics services).

## 3. Categories of Personal Data

We hold the following categories of personal data concerning you:

| Category | Examples |
|----------|---------|
| Identity data | Full name, job title |
| Contact data | Business email address, business telephone number |
| Professional data | Company role, directorship records, appointment dates |

## 4. Purposes and Legal Basis

| Purpose | Legal Basis |
|---------|-------------|
| Providing analytics services to Brightstone Ventures Ltd | Art. 6(1)(b) — Performance of a contract (between Meridian and Brightstone) |
| Client relationship management | Art. 6(1)(f) — Legitimate interests (maintaining business relationships with client organisations) |
| Regulatory compliance (anti-money laundering, know your customer) | Art. 6(1)(c) — Legal obligation (Money Laundering Regulations 2017) |

**Legitimate interest:** Our legitimate interest in maintaining effective business relationships with the employees and officers of our client organisations, balanced against the minimal privacy impact of processing business contact data for this purpose.

## 5. Recipients

| Recipient | Purpose |
|-----------|---------|
| Amazon Web Services EMEA SARL | Cloud hosting |
| Our internal compliance team | Regulatory checks |

## 6. Retention

We will retain your data for the duration of our service agreement with Brightstone Ventures Ltd plus 6 years (to meet statutory retention requirements under the Companies Act 2006 and Limitation Act 1980).

## 7. Your Rights

You have the right to:
- **Access** your personal data (Art. 15)
- **Rectify** inaccurate data (Art. 16)
- **Erase** your data (Art. 17)
- **Restrict** processing (Art. 18)
- **Object** to processing based on legitimate interests (Art. 21)
- **Data portability** (Art. 20, where applicable)

To exercise any right, contact dpo@meridiananalytics.co.uk.

## 8. Right to Complain

You may lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Yours sincerely,

**Dr Sarah Chen**
Data Protection Officer
Meridian Analytics Ltd