Privacy Notice

1. Who we are and what this notice covers

Meridian – The Consulting Firm (“Meridian”, “we”, “us” or “our”) is the trading name of [legal name of the company], a company incorporated under the Companies Act, 2013 (CIN [CIN]), having its registered office at [registered office address], Kolkata, West Bengal, India.

Meridian is the Data Fiduciary, within the meaning of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), for the personal data described in this notice. This notice explains what personal data we process, why, on what basis, with whom we share it, how long we keep it, and how you can exercise your rights. It is issued in accordance with the DPDP Act and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”).

This notice applies to our website, enquiry and booking forms, WhatsApp and email communications, and to the personal data we process when providing consulting services. Where we have signed an engagement letter or data processing addendum with you, that document also applies and prevails over this notice to the extent of any inconsistency.

2. Personal data we collect

We collect only the personal data we need for the purposes set out in section 3. Depending on how you interact with us, this may include:

• Identity and contact data: name, email address, mobile number, organisation, designation and city.
• Enquiry and booking data: the description of your requirement, preferred meeting times and the record of your consent to be contacted.
• Engagement data: information you or your organisation provide for the engagement, which may include financial statements, management accounts, bank statements, loan documents, tax computations and returns, payroll records, budgets and business plans. For private client engagements, this may include income, expenditure, borrowings and tax information relating to you and members of your family.
• Know-your-client and contractual data: PAN, GSTIN, billing address and authorised-signatory details required to contract with and invoice you.
• Communications data: emails, WhatsApp messages, call scheduling records and meeting notes.
• Technical data: IP address, browser type and pages visited, collected by our hosting and security providers when you use the website.

We do not ask for, and request that you do not send us, passwords, PINs, OTPs or card numbers. We do not knowingly collect personal data of children (see section 10).

3. Why we process your personal data, and on what basis

We will not use your personal data for a new purpose without informing you and, where required, obtaining fresh consent.

4. Consent and how to withdraw it

Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action such as ticking the consent box on our forms. You may withdraw consent at any time, as easily as you gave it, by emailing us, by replying “STOP” to any WhatsApp message from us, or by using the unsubscribe link in our emails.

Withdrawal does not affect processing carried out before it. If you withdraw consent needed to perform an engagement, we may be unable to continue the engagement, and we will tell you so. We will continue to retain data we are required by law to keep (see section 7).

5. Who we share personal data with

We do not sell personal data. We share it only with the following, and only to the extent necessary:

• Data Processors that provide technology and services to us under written contracts requiring them to process data only on our instructions and to protect it: Zoho Corporation (customer relationship management, forms, bookings, email, accounting, e-signature and document storage); AiSensy, a WhatsApp Business solution provider, and Meta Platforms (WhatsApp messaging); Anthropic (AI-assisted drafting and analysis under business terms that exclude use of our data for model training); Cloudflare (website hosting and security); and Google (website fonts and, if enabled, website analytics).
• Arthh, our secretarial-support vendor, for scheduling, coordination and document handling, under a confidentiality and data processing agreement. See our Disclosures for the conflicts we manage in that relationship.
• Our associates, who work on engagements under written confidentiality obligations.
• Independent professionals (such as chartered accountants, advocates, lenders or insurance agents) only when you ask us to coordinate with them, and only the information needed for that purpose.
• Authorities where we are required to by law, court order or a lawful request from a government agency.

6. Transfers outside India

Some of our Data Processors store or process data outside India, including in the United States. Section 16 of the DPDP Act permits such transfers except to countries or territories restricted by notification of the Central Government. We will not transfer personal data to any restricted country or territory, and we choose providers that apply security safeguards at least as protective as those described in section 8. Where a provider offers Indian data residency, we use it for client records.

7. How long we keep personal data

• Enquiries that do not lead to an engagement: deleted within 12 months of our last contact with you, unless you ask us to delete them sooner.
• Engagement records and deliverables: for the duration of the engagement and up to eight years after it ends, to meet our professional and legal obligations and to respond to any claims.
• Invoices, books of account and tax records: for at least eight financial years, as required under the Companies Act, 2013, the Central Goods and Services Tax Act, 2017 and the Income-tax law.
• WhatsApp and email communications: retained with the relevant client or enquiry record and deleted with it.
• System and security logs: for at least one year, as required by the DPDP Rules.

When the retention period ends, or when the purpose is no longer served and no law requires retention, we erase the data and instruct our Data Processors to do the same.

8. How we protect personal data

We apply reasonable security safeguards appropriate to the nature of the data, including:

• encryption of data in transit and at rest on our core systems;
• multi-factor authentication and role-based access, so people see only what their role requires;
• company-owned accounts, devices and phone numbers for all client communication;
• access logs, periodic access reviews and secure deletion when people leave or engagements end;
• written confidentiality and data processing terms with associates, vendors and processors.

If a personal data breach occurs, we will inform the Data Protection Board of India and affected individuals as required by the DPDP Act and the DPDP Rules, describing the breach, its likely consequences, the steps we have taken and what you can do to protect yourself.

9. Your rights

Subject to the DPDP Act, you have the right to:

• Access information about the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared (section 11);
• Correction, completion, updating and erasure of your personal data, subject to data we must retain by law (section 12);
• Grievance redressal through our Grievance Officer (section 13), and, if you are not satisfied, to complain to the Data Protection Board of India;
• Nominate another individual to exercise your rights in the event of your death or incapacity (section 14).

To exercise any right, contact our Grievance Officer (section 12). We may ask you to verify your identity. We aim to respond within 30 days and in any event within the time prescribed by law. Under section 15 of the DPDP Act, you are expected not to provide false information or register frivolous grievances.

10. Children

Our services are intended for adults and businesses. We do not knowingly process the personal data of anyone under 18 years of age without verifiable consent of a parent or lawful guardian, as required by section 9 of the DPDP Act. Where a private client engagement involves information about a minor family member, we will process it only with the verifiable consent of the parent or guardian and only to the extent necessary.

11. Cookies and website analytics

Our website does not use advertising or tracking cookies. Our hosting provider may set strictly necessary cookies for security and performance, and fonts are loaded from Google, which receives your IP address when the page loads. If we introduce analytics that rely on cookies or similar technologies, we will update this notice and ask for your consent where the law requires.

12. Contact and grievances

Grievance Officer: [name and designation]
Email: consulting@meridian-consulting.co.in (subject line: “Data protection request”)
Post: [registered office address], Kolkata, West Bengal, India

If your grievance is not resolved to your satisfaction, you may file a complaint with the Data Protection Board of India in the manner prescribed under the DPDP Act and the DPDP Rules.

13. Changes to this notice

We may update this notice to reflect changes in our services or the law. We will post the updated notice on this page with a new effective date and, where changes are material, notify clients directly.