Privacy notice

Version 4.1 · last updated 1 November 2026 · controller: Meridian Digital Ltd., Seoul

1. What this notice covers

This notice describes how Meridian Digital handles personal data when you visit this website, contact us, or are a client. Where we host a client's website, we act as a processor for that site's visitor data under a separate data processing agreement — this notice explains what we do with it.

2. Data we collect as a controller

• Client account data — names, work email, phone numbers, company details, billing address and tax identifiers.
• Contract data — statements of work, hosting agreements, data processing agreements and correspondence.
• Billing data — invoices, payment status and the last four digits of a payment method. Card data is handled by our payment processor; we never store full card numbers.
• Web server logs — IP address, requested URL, user agent and response code, kept for 30 days.

3. Data we process as a processor

For sites we host, we process visitor data on the client's instructions: request logs, form submissions and aggregated analytics. We do not use that data for our own purposes, we do not sell it, and we do not run advertising networks or cross-site trackers on client sites.

4. What we do not do

• No third-party analytics, advertising pixels or social embeds on this website.
• No sale or rental of personal data.
• No content inspection beyond what is needed to operate, secure and support the service.
• No hosting of VPN, proxy or relay services (see the AUP).

5. Why we process it

• Contract — delivering projects, hosting, support and billing.
• Legal obligation — tax records, entity verification, lawful requests from authorities.
• Legitimate interests — security, abuse prevention, capacity planning and answering enquiries.

6. Retention

• Client and contract records: 7 years after the end of the relationship.
• Visitor logs for hosted sites: 30 days, then deleted; aggregated statistics are kept for 13 months.
• Support tickets: 3 years after closure.
• Backups: 30 days rolling, then overwritten.

7. Cookies

This website sets no cookies. The client portal uses a session marker in your browser's session storage to keep you signed in for the length of a visit; it is not a cookie and contains no personal data. Sites we build use only the cookies necessary for their function unless the client instructs otherwise, in which case a consent banner is part of the scope.

8. Sub-processors

We use a payment processor, a CDN provider and data-centre operators in Korea, Japan, Hong Kong and Singapore. A current list is available on request and is attached to every data processing agreement. Transfers outside Korea are covered by standard contractual clauses.

9. Your rights

You may request access to, correction of or deletion of your personal data, object to processing based on legitimate interests, and ask for a portable copy. Write to [email protected]; we respond within 30 days. Visitors of a hosted site should contact that site's operator first — we will assist them as processor.

10. Security and incidents

Access to client records is limited to staff who need it, protected by hardware keys and logged. If a security incident affects personal data, we notify affected clients within 72 hours with what we know and what we have done.

11. Contact

Questions: [email protected], or by post to the registered office at 8F, 42 Teheran-ro 4-gil, Gangnam-gu, Seoul 06232, Republic of Korea.