Privacy Policy

Effective date: 9 August 2026. Last updated: 9 August 2026.

1. Introduction

Meridian Studio ("Meridian", "we", "us") respects your privacy. This policy explains what personal information we collect through meridian-architectural.com (the "Site"), why we collect it, how we use and protect it, and the rights you have.

We are a South African business and process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"). Because we serve clients in the United States, this policy also describes our practices in plain terms for visitors outside South Africa.

Responsible party (data controller): Meridian Studio (Pty) Ltd, Still Bay, Western Cape, South Africa.

Information Officer: Nicoleen Booyens, hello@meridian-architectural.com, +27 61 528 0966.

2. What we collect

Information you give us. When you submit the contact form we collect your full name, firm name, email address, project type, the software your firm uses (optional), and your message. If you email us, message us on WhatsApp, or engage us for project work, we collect the information contained in those communications and any files you send us.

Information collected automatically. Our hosting provider records standard server logs, including IP address, browser type, pages requested, and timestamps, for security and operational purposes. The Site does not use advertising trackers or third-party analytics, and does not set cookies for tracking purposes.

Administrative access. Access to our lead administration area is protected by magic-link authentication, which processes the administrator's email address only.

3. Why we process your information

We process personal information to: respond to enquiries and provide requested information about our services; scope, agree, and deliver project work; send and receive project files and communications; issue quotes and invoices and receive payment; keep business and accounting records required by law; and secure and maintain the Site.

Under POPIA, our processing is justified because it is necessary to carry out actions for the conclusion or performance of a contract with you, to comply with legal obligations, or to pursue our legitimate interests in operating and promoting our business in a manner that does not override your rights.

4. How the Site works behind the scenes

The Site and its backend run on Railway, a hosting platform with infrastructure in the United States. Contact form notifications and transactional email are delivered through Resend. When a new enquiry arrives, an alert is sent to us on WhatsApp via CallMeBot. Our domain is registered through GoDaddy. These providers process data only as needed to deliver their service to us.

5. Cross-border transfers

Because our hosting and email infrastructure is located in the United States, personal information submitted through the Site is transferred outside South Africa. Section 72 of POPIA permits such transfers where, among other grounds, the transfer is necessary for the performance of steps you have requested, or the recipient is subject to a law, binding corporate rules, or a binding agreement providing an adequate level of protection substantially similar to POPIA. We rely on our providers' contractual data protection commitments and use providers with established security programmes.

6. Who we share information with

We share personal information only with the service providers described in section 4, with professional advisers where necessary, and where disclosure is required by law. We do not sell personal information, and we do not share it with advertisers.

7. Retention

We keep enquiry records and project correspondence for as long as needed for the purposes described above, and thereafter as required for legal, accounting, and insurance purposes. Our standard retention period for enquiry records is 24 months. Records relating to engaged project work are retained in line with applicable professional and tax record-keeping requirements.

8. Security

The Site is served over encrypted connections (TLS). Access to lead records is restricted to authorised personnel via magic-link authentication. We apply the principle of least privilege to administrative access and rely on the security programmes of our hosting and email providers for infrastructure protection. No system is completely secure, but we take reasonable, appropriate measures required by POPIA to protect personal information.

9. Your rights

Under POPIA you have the right to request access to the personal information we hold about you, to request correction or deletion of that information, to object to processing, and to complain to the Information Regulator. Visitors from other jurisdictions may have similar rights under their local law, and we will honour reasonable access, correction, and deletion requests from any visitor regardless of location.

To exercise any right, email hello@meridian-architectural.com. We may need to verify your identity before acting on a request. Formal access requests are handled under our PAIA Manual.

Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; enquiries@inforegulator.org.za; POPIAComplaints@inforegulator.org.za.

10. Changes to this policy

We may update this policy from time to time. The current version is always available on the Site, with the "Last updated" date shown at the top.

11. Contact

Meridian Studio

Still Bay, Western Cape, South Africa

hello@meridian-architectural.com

WhatsApp: +27 61 528 0966