Privacy Policy

Introduction

This Privacy Policy belongs to MeridianBD LLC and describes how the company collects, uses, stores and protects information in the course of running its computer integrated systems design practice. The practice is operated by the developer Meridian BD, and this policy explains the commitments that the developer Meridian BD makes to visitors of the website at meridianbd.autos and to clients of the watchroom. We have written this policy in plain language because a privacy notice is only useful if the people reading it can understand what it says without a legal glossary beside them.

We are a small practice and we treat information with the restraint that a small practice can afford. We do not buy contact lists. We do not sell personal information. We do not build advertising profiles. We do not embed social media trackers in our pages. What we do hold is the information you choose to send us, the information needed to deliver an engagement you have asked for, and the records that our own working method requires us to keep so that a client can trust the findings we present.

This policy applies to the website, to enquiries sent by email or through the contact form, and to engagements delivered by the watchroom. It should be read together with our Terms of Service, which describe the commercial relationship, and with any specific data processing agreement signed for a particular engagement. Where a signed agreement sets stricter terms than this policy, the stricter terms prevail.

Who We Are

The controller of personal information described in this policy is MeridianBD LLC, a company registered in the United States. The company operates from the following business address:

Questions about this policy, requests about personal information, and complaints about how information has been handled can be sent to escalate@meridianbd.autos, or raised by telephone on +15512998215. The telephone line reaches the watchroom during business hours on Monday to Friday, from 8:00 to 18:00 Mountain Time.

Where this policy says we or us, it means MeridianBD LLC acting through its watchroom. Where it says you, it means the person visiting the website, sending an enquiry, or acting for a client organisation in connection with an engagement.

Scope of This Policy

This policy covers information collected through the public website, through the contact form, through email and telephone contact, and through the delivery of services. It does not cover information that a client organisation collects inside its own systems and shares with us only as raw evidence for an audit. In that situation the client remains the controller of the information and we act as a processor under the direction of the client, on the terms of the engagement.

This policy does not apply to websites operated by other organisations, including vendor portals and cloud consoles that we may reference in a report. Those services publish their own privacy notices and we encourage you to read them before using them.

Some information is collected automatically by the hosting infrastructure that serves this website. That collection is described in the sections on information we collect and on cookies and local storage below.

Information We Collect

The information we collect falls into four groups. The first group is information you give us directly. The second group is information generated by your use of the website. The third group is information created while delivering an engagement. The fourth group is information we receive from other people who are acting on your behalf.

Information you give us directly

When you use the contact form or send an email, you may give us your name, your email address, a subject line and the content of your message. If you call the watchroom you may give us your name, your telephone number and details of the system you want to discuss. If you become a client, you will give us the business contact details of the people involved in the engagement, the names of the systems in scope, and whatever documentation you choose to share.

Information generated by your use of the website

The server that hosts this site records standard request information, including the internet protocol address from which a request arrived, the date and time of the request, the page requested, the browser identification string, and the referring page when a browser supplies one. This information is generated by the web server software and is used for security monitoring and troubleshooting. It is not combined with the contact details of any visitor.

Information created during an engagement

An engagement produces working records, including bearing sheets, sighting logs, audit findings, escalation ladder notes and handover briefs. These records may contain the names and business contact details of the people who attended sessions, and may describe system configuration that the client considers confidential. They are handled under the confidentiality terms of the engagement and are not published or reused for any other purpose.

Information received from other people

A colleague may forward an email to us, or a client may introduce us to a supplier. In those cases we receive personal information from a third party. We ask people who introduce others to us to do so only where the person being introduced would reasonably expect it, and we delete the introduction if the person asks us to.

How We Collect Information

Most information arrives by email or by the contact form. The contact form on this website is deliberately simple. It does not submit to a database and it does not transmit anything to a third party. When you press the send button, the script in your browser assembles the contents of the form into an email that is handed to your own mail client, addressed to escalate@meridianbd.autos. You can read the message before it is sent and you can cancel it. Nothing reaches us until you choose to send that email.

Some information arrives by telephone. We do not record telephone calls. A watchkeeper takes notes by hand during a call and those notes go into the file for the enquiry.

Information generated automatically by the web server is collected whenever a page is requested. We do not augment it with tracking pixels, fingerprinting scripts or cross-site identifiers.

Why We Use Information

We use information for a short and specific list of purposes. We use it to reply to your enquiry and to decide whether the watchroom is the right instrument for the problem you described. We use it to deliver the services you have engaged, including preparing bearing sheets, running rounds, writing sighting logs and compiling handover briefs. We use it to keep our own commercial records, including proposals, invoices and the correspondence that supports them. We use it to protect the website and the watchroom from abuse, fraud and unauthorised access. And we use it to meet our legal and accounting obligations.

We do not use information for profiling, for automated decision making that produces legal or similarly significant effects, or for selling to advertisers. We do not ask for information we do not need, and where a purpose can be met without personal information we prefer to meet it that way.

Legal Bases for Processing

Where data protection law requires a legal basis for processing, we rely on one of the following. We rely on consent where you have given it, for example when you ask to be added to a mailing list for seasonal watchroom notes. You can withdraw consent at any time by writing to the watchroom address and the withdrawal takes effect for future processing.

We rely on the performance of a contract where processing is necessary to deliver an engagement you have asked us to provide, or to take steps at your request before a contract is signed. We rely on legitimate interests where processing is necessary for the running of our business in a way that you would reasonably expect, such as replying to an enquiry, keeping commercial records and securing the website, and where those interests are not overridden by your own rights.

We rely on legal obligation where processing is necessary to comply with tax, accounting or other statutory duties. Where we rely on legitimate interests we have carried out a balancing assessment and we will explain the outcome on request.

Client Systems and Sighting Logs

Much of our work involves reading client systems. During a sighting log week we observe live behaviour and write down what we see. We are careful to observe at the level of systems rather than individuals. Where a log would otherwise capture the personal data of a client customer or employee, we ask the client to supply the observation through a filtered view, and where that is not possible we redact identifying detail at the point of writing the log.

A sighting log may still reference a user account by name or identifier where the identity is the point of the finding. Those references are kept inside the client record, are delivered only to the client, and are never used for any purpose outside the engagement.

When we act as a processor for client data, we follow the written instructions of the client, we apply the same security measures described in this policy, we assist the client in responding to requests from the individuals whose data is held, and we return or delete the data at the end of the engagement as the client directs.

Cookies and Local Storage

This website does not set advertising cookies and does not load third party tracking scripts. The pages do not require a login and do not create a user profile. If the hosting provider places a cookie for load balancing or security, that cookie is strictly necessary for the site to function and is not used to identify visitors for any other purpose.

The browser script that powers the menu, the reveal animation and the contact form stores nothing in your browser beyond the life of the page. It does not write to local storage, session storage or an index of any kind. Closing the tab removes everything the script held in memory.

You can configure your browser to block cookies entirely. The public pages of this site will continue to work, because the menu and the contact form do not depend on cookies.

Analytics and Measurement

We keep measurement to the minimum needed to know whether the site is working. The web server records the requests it receives, as described in the section on information generated by your use of the website. From that log we can see how many requests were served and which pages were requested most often. We do not attempt to identify individual visitors from that log and we do not cross reference it with enquiry records.

We do not use any third party analytics product that sets cookies across sites. If we ever introduce a measurement tool that collects more than the server log, we will update this policy before the tool goes live and we will offer a way to opt out where the law requires one.

Sharing and Disclosure

We do not sell personal information and we do not share it with advertisers, data brokers or lead generation businesses. We share information only in the limited circumstances described in this section.

We share information with service providers who help us run the practice, as described in the next section. We share information with professional advisers, such as our accountant, where it is needed to keep proper records. We disclose information where the law requires it, where a court order compels it, or where disclosure is necessary to establish, exercise or defend a legal claim. We disclose information where we believe in good faith that disclosure is necessary to protect the safety of a person or the security of a system.

If the business is reorganised, merged or sold, information may be transferred to the successor organisation as part of that transaction. We would notify affected clients before any transfer that changes the controller of their information, and the successor would remain bound by the commitments in this policy until a new policy is published.

Service Providers

We use a small number of service providers. Our website is served by a hosting provider. Our email is handled by a mail provider. Our accounting records are kept with an accounting professional. Each provider receives only the information necessary for the task and each is bound by a contract that requires appropriate confidentiality and security.

We do not permit a service provider to use information received from us for its own marketing, and we do not permit a provider to combine information received from us with information it holds for other customers. Where a provider processes information outside the country in which it was collected, the transfer is covered by the safeguards described in the next section.

International Transfers

MeridianBD LLC is based in the United States and most of our processing takes place there. Some clients are located in other countries and some service providers operate infrastructure in several regions. Where information is transferred from a country with strict data protection law to a country with weaker protections, we rely on appropriate safeguards, which may include standard contractual clauses approved by the relevant authority or an adequacy decision covering the destination.

We will tell you which safeguard applies to a particular transfer if you ask. For client engagements, the transfer mechanism is recorded in the engagement documents so that the client can audit it during their own compliance review.

Retention of Records

We keep information only for as long as we need it. Enquiries that do not lead to an engagement are kept for twelve months and then deleted, unless the person asks us to keep them longer. Engagement records, including bearing sheets, sighting logs, audit reports and handover briefs, are kept for the duration of the engagement and for a further period agreed with the client, which is normally one year after the handover brief night, so that follow up questions can be answered.

Commercial records such as invoices and contracts are kept for the period required by tax and accounting law in the jurisdictions where we operate, which is normally seven years. Security logs generated by the web server are kept for a short period, normally ninety days, and then rotated out of existence.

Where a client instructs us to delete engagement records earlier than the default period, we will do so and will confirm the deletion in writing, except where a legal obligation requires us to keep a record of the transaction.

Security of Records

We protect information with measures that are proportionate to its sensitivity. Access to engagement records is limited to the watchkeeper leading the engagement and to the second watchkeeper named in the handover brief. Accounts are protected by strong authentication and are not shared between people. Devices are encrypted at rest. Records are stored in client nominated storage where the client has a preference, and otherwise in storage that we control with encryption and version history.

We do not send client records to personal email addresses, we do not discuss engagement detail on social media, and we do not carry unencrypted copies of engagement records on removable media. If we become aware of a breach of security that is likely to result in a risk to individuals, we will notify the affected client without undue delay and will cooperate fully with any investigation they choose to run. Where the law requires us to notify a supervisory authority, we will do so within the statutory period.

No system is perfectly secure. We can promise that we take security seriously, that we review our measures at least once a year, and that we will tell you honestly if something goes wrong.

Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. You may ask for a copy of the personal information we hold about you. You may ask us to correct information that is inaccurate or incomplete. You may ask us to delete information where there is no good reason for us to keep it. You may ask us to restrict the processing of information while a question about its accuracy is resolved. You may object to processing that we carry out on the basis of legitimate interests, and you may ask for the information you gave us to be provided in a portable format.

You may also withdraw consent at any time where we relied on consent to process the information. Withdrawal does not affect processing that happened before the withdrawal.

To exercise any of these rights, write to escalate@meridianbd.autos with enough detail for us to locate the information and to satisfy ourselves that the request is genuine. We will respond within thirty days and we will not charge a fee unless the request is manifestly unfounded or excessive. If we cannot meet the request in full, we will explain why and we will tell you how to complain.

Privacy for Children

This website is a business site and the watchroom is a business service. Neither is directed at children and we do not knowingly collect personal information from anyone under the age of sixteen. If you believe that a child has sent personal information to the watchroom, please write to escalate@meridianbd.autos and we will delete the information as quickly as possible.

Marketing Communications

We send seasonal watchroom notes to people who ask for them. We do not add enquirers to a mailing list automatically, and we do not treat an engagement as consent to marketing. Every note carries a way to unsubscribe and every unsubscribe request is honoured without conditions. If you have asked to hear from us and later decide that you would rather not, one message to the watchroom address is enough and we will keep a suppression record so that you are not contacted again by mistake.

Third Party Links

Our pages may link to websites that we do not control, such as standards bodies, vendor documentation and public registries. When you follow a link to another site, that site is subject to its own privacy notice. We are not responsible for how another organisation handles information, and we encourage you to check the notice of any site before you give it your details.

Changes to This Policy

We review this policy at least once a year and whenever our practices change. When we make a material change we will update the date at the top of the page and, where the change affects clients with active engagements, we will write to them directly. Continuing to use the website after a change is published means that the updated policy applies to information collected after that date.

Earlier versions of this policy are kept in the watchroom record so that a visitor can see what the policy said on the date they gave us their information. If you need a copy of an earlier version, write to the watchroom address and we will send it.

How to Contact Us

We prefer to hear from you directly. Write to escalate@meridianbd.autos, call +15512998215, or send a letter to the watchroom at the address below. Please include enough detail for us to understand the question, and tell us how you would like to be contacted.

If you are not satisfied with our response, you may have the right to complain to the data protection authority in your country. We would ask that you give us a chance to put things right first, because most problems are easier to solve in a conversation than in a complaint file.