Privacy Policy
Last Updated: 10 February 2026 · Effective Date: 10 February 2026
1. Introduction
Meridium ("we", "us", or "our") is committed to protecting the personal data of individuals who interact with our services. This Privacy Policy describes how we collect, use, store, and protect personal data in connection with our AI consulting services and this website. It applies to clients, website visitors, and other individuals whose data we process.
If you have questions about this policy, please contact us at [email protected].
2. Data We Collect
2.1 Information You Provide
When you submit an enquiry through our contact form or communicate with us directly, we collect:
- Your name and email address (required)
- Your phone number (optional)
- Your message or enquiry content
- Your organisation or role, if you choose to share it
2.2 Information Collected Automatically
When you visit our website, we may collect technical data including your IP address, browser type, pages visited, and time spent on the site. This information is collected through cookies and similar technologies, as described in our Cookie Policy.
2.3 Project Data
During the course of a client engagement, you may share organisational data, documents, or system access with us. All such data is governed by a separate engagement agreement and handled under the conditions set out in that agreement.
3. How We Use Your Data
We use personal data only for the following purposes:
- To respond to your enquiry and communicate with you about our services
- To fulfil the scope of work agreed in an engagement
- To send relevant updates or information, where you have consented
- To improve our website and services through aggregated, anonymised analytics
- To comply with applicable legal obligations in Hong Kong
We do not use your personal data for automated decision-making or profiling.
4. Legal Basis for Processing
We process personal data under the following legal bases, as applicable under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and general data protection principles:
- Consent: Where you have given clear consent for a specific purpose
- Contract: Where processing is necessary to fulfil a service engagement
- Legitimate interest: For responding to enquiries and improving our services
- Legal obligation: Where required by applicable law
5. Data Retention
We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law:
- Enquiry data: up to 12 months after last communication, unless a client relationship is established
- Client engagement data: for the duration of the engagement, plus up to 24 months, unless otherwise agreed
- Financial records: as required by Hong Kong tax and company law (typically 7 years)
- Website analytics: aggregated data retained for up to 24 months
6. Data Sharing
We do not sell, rent, or trade personal data. We may share personal data with:
- Service providers acting on our behalf (e.g. cloud hosting), under contractual data processing agreements
- Analytics providers, using only anonymised or aggregated data
- Authorities or regulators, where required by law
We do not transfer personal data outside of Hong Kong except where necessary to provide our services, and only to jurisdictions with adequate data protection provisions.
7. Data Protection Measures
We take data security seriously and implement appropriate technical and organisational measures, including encrypted data transfer (HTTPS), access controls, regular internal security reviews, and formal data agreements with any third-party processors. In the event of a data breach that may affect your rights, we will notify you and the relevant authorities as required by law.
8. Cookies
Our website uses cookies for essential functionality and, with your consent, for analytics purposes. Please see our Cookie Policy for full details on the types of cookies used and how to manage them.
9. Your Rights
Under the PDPO and applicable data protection principles, you have the right to:
- Request access to the personal data we hold about you
- Request correction of inaccurate personal data
- Request deletion of your personal data, subject to legal obligations
- Withdraw consent at any time, where processing is based on consent
- Object to processing for direct marketing purposes
- Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong
To exercise any of these rights, please contact us at [email protected]. We will respond within 40 days as required by the PDPO.
10. Third-Party Links
Our website may contain links to external websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies independently.
11. Children's Privacy
Our services are directed at organisations and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via our website with an updated effective date. Continued use of our services following notification of changes constitutes acceptance of the revised policy.
13. Contact
For all privacy-related enquiries or to exercise your rights, please contact:
Meridium
17 Science Park East Avenue, Sha Tin, New Territories, Hong Kong
Email: [email protected]
Phone: +852 3482 9617
For complaints that remain unresolved, you may contact the Office of the Privacy Commissioner for Personal Data: www.pcpd.org.hk.