Privacy Policy
This Privacy Policy explains how Meridian Peoples Holdings Limited (“MPHL”) collects, uses, stores, and protects personal data in accordance with applicable UK data protection legislation, including the UK GDPR and Data Protection Act 2018.
Data Controller
Meridian Peoples Holdings Limited
27 Old Gloucester Street, London WC1N 3AX, United Kingdom.
MPHL acts as Data Controller in respect of personal data processed for its business operations and services.
Our commitment to data protection
- Lawful, fair, and transparent processing
- Specified, explicit, and legitimate purposes
- Data minimisation (only what is necessary)
- Accuracy and keeping data up to date
- Retention limits (not kept longer than necessary)
- Integrity, confidentiality, and robust security
Categories of data processed
- Contact Information: Name, address, personal email, and phone numbers.
- Business Identification: Professional titles, company names, and corporate contact details.
- Employment Information: CVs, work history, and qualifications for recruitment purposes.
- Technical Usage: IP addresses, browsing history, and interaction data with our digital platforms.
- Device Data: Browser types, operating systems, and device identifiers.
- Supplier Information: Financial details and contract history for service providers.
Lawful basis for processing
Contractual Necessity
Processing required to fulfill a contract with you or take pre-contractual steps.
Legal Obligation
Where we must comply with UK laws, such as tax reporting or regulatory audits.
Legitimate Interests
Processing for our valid business interests where they don't override your rights.
Consent
Where you have given clear, affirmative permission for a specific purpose.
Security and protection
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Contact Information: Name, address, personal email, and phone numbers.
- Business Identification: Professional titles, company names, and corporate contact details.
- Employment Information: CVs, work history, and qualifications for recruitment purposes.
- Technical Usage: IP addresses, browsing history, and interaction data with our digital platforms.
- Device Data: Browser types, operating systems, and device identifiers.
- Supplier Information: Financial details and contract history for service providers.
Retention and disposal
We maintain a documented retention schedule to ensure personal data is only kept for as long as is necessary for the purposes for which it was collected. Once the retention period expires, data is securely deleted or anonymised in accordance with our data destruction policies to prevent unauthorised recovery or access.
Retention and disposal
Under UK GDPR, you have the following rights regarding your personal data:
- The right to be informed
- The right of access (SAR)
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- The right to lodge a complaint with the ICO
International data transfers
If we transfer personal data outside the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: transfers to countries that have been deemed to provide an adequate level of protection, or use of specific Standard Contractual Clauses (SCCs) or the International Data Transfer Addendum (IDTA).
Privacy Policy
Meridian Peoples Holdings Ltd (“MPHL”, “we”, “us”, “our”) is committed to safeguarding privacy and complying with applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you interact with our website and services, and how you can exercise your rights.
By using our website and/or services, you acknowledge you have read and understood this Privacy Policy.
1. Who We Are
We are the data controller for the personal data described in this Privacy Policy unless we state otherwise.
Where we provide services to a customer that require us to process personal data on the customer’s behalf, the customer will typically act as the controller and we will act as a processor. In those cases, processing is governed by contract and we act only on documented instructions.
Privacy contact: dpo@meridianpeople.co.uk
You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO). We encourage you to contact us first so we can address concerns promptly.
2. Scope: When This Policy Applies
- Website visitors and online users
- Prospective customers, customers, and business contacts
- Suppliers and partners
- Job applicants (where applicable)
Our website and services are not directed at children and we do not knowingly collect children’s personal data without appropriate safeguards. If you believe a child has provided personal data to us, contact dpo@meridianpeople.co.uk.
This policy does not apply to third-party websites or services linked from our website (they are responsible for their own privacy notices).
3. What Personal Data We Collect
3.1 Information you provide
- Contact information: name, business email, phone number, organisation, job title
- Communications: content of messages and correspondence (web forms, email, calls)
- Account/relationship data (where applicable): customer contacts, authorised users, service communications, support interactions
3.2 Information collected automatically (website and security)
- Technical and usage data: IP address, device type, browser, operating system, referral source, pages visited, session information
- Security and access logs: where applicable, to protect our systems and services
3.3 Special category data / criminal offence data
We do not routinely seek to collect special category data (e.g., health, biometrics) or criminal offence data. If such data is processed (e.g., limited recruitment or customer-instructed processing), we apply enhanced safeguards and restrict access.
3.4 Information from third parties
We may receive business contact data from your employer/organisation (e.g., where you are a nominated contact) and/or publicly available sources (e.g., business websites or professional profiles), where permitted.
4. Why We Use Personal Data and Our Lawful Bases
We only process personal data where we have a lawful basis under UK GDPR.
4.1 Main purposes
- Responding to enquiries and providing requested information
- Business relationship management (B2B)
- Contracting and service delivery administration (where applicable)
- Support and operational management (where applicable)
- Website operation, performance and security
- Marketing communications (where permitted and/or consented)
- Recruitment (where applicable)
- Legal and regulatory compliance, and protecting our rights
4.2 Lawful bases
- Contract
- Legitimate interests
- Consent
- Legal obligation
Where we rely on legitimate interests, we do so only where our interests are not overridden by individuals’ rights and freedoms.
5. How We Share Personal Data
We do not sell personal data. We may share personal data with service providers acting as processors, professional advisers, authorities/regulators where required, and customers and authorised users as part of service delivery (where applicable). All processors are required to protect personal data and process it only in accordance with contractual terms.
6. International Transfers and Data Locations
We aim to store and process personal data in the UK and/or EEA wherever practical. Where personal data is transferred outside the UK without adequacy coverage, we implement safeguards such as the UK IDTA and/or the UK Addendum to EU SCCs. You may request further information by emailing dpo@meridianpeople.co.uk.
7. Cookies and Similar Technologies
Our website may use cookies and similar technologies to enable core site functionality and security, understand performance, and (where enabled) measure usage via analytics and/or marketing technologies. Cookie controls may be provided where required.
8. Data Retention and Disposal
We retain personal data only for as long as necessary for the purposes in this policy, including legal, regulatory, contractual, and legitimate business needs. When no longer required, we delete, anonymise, or restrict it.
8.1 Backups
Backups may contain personal data for resilience and recovery. Deletion from backups may not be immediate due to architecture, but backup data is protected by access controls and expires through rotation in line with retention periods.
9. Your Rights Under UK GDPR
- Access
- Rectify inaccurate data
- Erase in certain circumstances
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests or direct marketing
- Data portability where applicable
- Withdraw consent where processing is based on consent
9.1 How to make a request (search / export / delete)
To exercise your rights, contact dpo@meridianpeople.co.uk. We may need to verify your identity and request sufficient information to locate your data. Where we act as a processor, we may direct you to the customer (controller) or support the customer in responding.
10. Security (Technical and Organisational Measures)
We implement proportionate technical and organisational measures designed to protect personal data, including access controls, authentication, secure transmission protections (e.g., TLS where supported), logging/monitoring where supported, backups/recovery, supplier assurance, policies for rights handling/retention/incident response, and staff training.
11. Personal Data Breaches
We maintain an incident and personal data breach management process to assess, contain, and remediate incidents. Where we act as a processor, we notify the relevant customer (controller) without undue delay. Where we act as a controller, we assess notification requirements under UK GDPR.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The current version will always be available on this page with the “Last Updated” date shown.
13. Contact Details
Meridian Peoples Holdings Ltd (MPHL)
27 Old Gloucester Street
London, WC1N 3AX, United Kingdom
Privacy email: dpo@meridianpeople.co.uk