# Layered Privacy Notice — Layer 1 (Short Notice) Template

## How We Use Your Data

**Meridian Analytics Ltd** collects and uses your personal data to provide our data analytics services under your subscription agreement.

**What we collect:** Your name, contact details, payment information, and how you use our platform.

**Why:** To deliver our services, manage your account, process payments, and improve our platform.

**Legal basis:** Performance of our contract with you (Art. 6(1)(b) UK GDPR) and, for analytics and improvement, our legitimate interests (Art. 6(1)(f) UK GDPR).

**Your rights:** You can access, correct, delete, or export your data at any time. You can also object to certain processing or restrict how we use your data.

**Contact our DPO:** dpo@meridiananalytics.co.uk

**Read our full privacy notice** for complete details on data sharing, international transfers, retention periods, and how to exercise your rights.

---

# Layered Privacy Notice — Layer 2 (Full Notice) Template

## Privacy Notice — Meridian Analytics Ltd

**Last updated:** 14 March 2026

### 1. Who We Are

Meridian Analytics Ltd is the data controller for your personal data. We are registered in England and Wales (company number 09847362) with our registered office at 47 Canary Wharf Tower, London E14 5AB.

**Data Protection Officer:** Dr Sarah Chen
**Email:** dpo@meridiananalytics.co.uk
**Address:** 47 Canary Wharf Tower, London E14 5AB

### 2. What Data We Collect

| Category | Examples | Source |
|----------|---------|--------|
| Identity data | Full name, job title, company name | You provide this when registering |
| Contact data | Email address, phone number, postal address | You provide this when registering |
| Financial data | Bank account details, payment card details, billing address | You provide this for payment processing |
| Technical data | IP address, browser type, device identifiers, login timestamps | Collected automatically when you use our platform |
| Usage data | Dashboard access, report generation, API queries, feature usage | Collected automatically through your platform activity |
| Communications data | Support tickets, emails, chat messages with our team | Generated through your interactions with us |

### 3. Why We Use Your Data and Our Legal Basis

| Purpose | Legal Basis | Article |
|---------|-------------|---------|
| Providing our analytics platform services | Performance of a contract | Art. 6(1)(b) |
| Account management and customer support | Performance of a contract | Art. 6(1)(b) |
| Billing and payment processing | Performance of a contract | Art. 6(1)(b) |
| Platform security and fraud prevention | Legitimate interests (protecting our platform and users) | Art. 6(1)(f) |
| Service improvement through aggregated analytics | Legitimate interests (improving our services) | Art. 6(1)(f) |
| Marketing communications (with your consent) | Consent | Art. 6(1)(a) |
| Compliance with legal obligations (tax, financial records) | Legal obligation | Art. 6(1)(c) |

### 4. Who We Share Your Data With

| Recipient | Purpose | Safeguard |
|-----------|---------|-----------|
| Amazon Web Services EMEA SARL | Cloud hosting | Standard Contractual Clauses |
| Stripe Payments Europe Ltd | Payment processing | Art. 28 Data Processing Agreement |
| Zendesk Inc | Customer support | Standard Contractual Clauses + UK IDTA |

We do not sell your personal data to any third party.

### 5. International Transfers

Some of our processors transfer data outside the UK and EU. Where this happens, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (EU Commission Decision 2021/914)
- UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs
- Transfer Impact Assessments for each transfer

### 6. How Long We Keep Your Data

| Data Category | Retention Period | Basis |
|---------------|-----------------|-------|
| Account and contact data | Duration of subscription + 6 years | Limitation Act 1980 |
| Financial and billing data | 6 years from date of transaction | Companies Act 2006, HMRC requirements |
| Technical and usage data | 2 years from collection | Legitimate interest in service improvement |
| Marketing consent records | Duration of consent + 3 years | GDPR accountability |
| Support correspondence | 3 years from resolution | Legitimate interest in service quality |

### 7. Your Rights

Under UK GDPR, you have the right to:

| Right | Description | How to Exercise |
|-------|-------------|-----------------|
| Access (Art. 15) | Obtain a copy of your personal data | Email dpo@meridiananalytics.co.uk |
| Rectification (Art. 16) | Correct inaccurate data | Email dpo@meridiananalytics.co.uk |
| Erasure (Art. 17) | Request deletion of your data | Email dpo@meridiananalytics.co.uk |
| Restriction (Art. 18) | Limit how we process your data | Email dpo@meridiananalytics.co.uk |
| Portability (Art. 20) | Receive your data in a machine-readable format | Email dpo@meridiananalytics.co.uk |
| Object (Art. 21) | Object to processing based on legitimate interests | Email dpo@meridiananalytics.co.uk |
| Marketing opt-out (Art. 21(2)) | Stop all direct marketing (absolute right) | Click "Unsubscribe" or email dpo@meridiananalytics.co.uk |

We will respond to your request within 30 calendar days.

### 8. Automated Decision-Making

Meridian Analytics Ltd does not subject you to any solely automated decisions that produce legal effects or similarly significant effects concerning you as defined under Article 22 UK GDPR.

### 9. Complaints

If you are unhappy with how we handle your data, you have the right to complain to:

**Information Commissioner's Office (ICO)**
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

### 10. Changes to This Notice

We may update this privacy notice from time to time. Material changes will be communicated to you via email and/or a prominent notice on our platform at least 14 days before the changes take effect.