Skip to content

We use Google Analytics cookies to see how people find and use this site, only if you agree. Cookie policy

North Meridian
Book a call

Privacy

Last updated: November 10, 2026

1. Controller

Under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and digital rights (LOPDGDD), the controllers of the data collected through this site are:

  • Controllers: Mayda Morales Viera and Samuel Suárez Rodríguez, trading as North Meridian
  • Tax ID and address: Mayda Morales Viera, NIE Z3839847W, Carrer del Comte d’Urgell, Eixample, 08036 Barcelona; Samuel Suárez Rodríguez, NIE Z1285955F, Carrer de l’Impressor Caldentey, 3, 07200 Felanitx (Illes Balears)
  • Contact email: mayda.morales@north-meridian.dev and samuel.suarez@north-meridian.dev

2. What data we process

We only process data the person provides and what the site strictly needs in order to work:

  • Identity and contact data entered in the request form: name, company, email and, if you want, phone.
  • The content of the inquiry: the sector and a description of the problem you want solved. Do not include other people’s personal data or confidential information there: that belongs in the assessment phase, which is covered by a contract.
  • Commercial relationship data, if the inquiry becomes an engagement: billing details and whatever is needed to deliver the service.
  • Technical connection data logged by the hosting provider (IP address, date and time, pages served, browser type), solely to keep the service running and secure.
  • Browsing data, only if you accept analytics cookies: pages visited, where you came from, how the page is used, device and browser type, approximate location (country or city) and those cookies’ identifiers. They are listed in the cookie policy.

The form’s required fields (all but the phone) are the ones needed to reply: without them the inquiry cannot be handled.

We do not process special-category data (health, political opinions, trade-union membership and the rest of article 9 of the GDPR), we do not build profiles, and we do not take automated decisions with legal effects on people.

3. Why we process it

  • To handle the request we receive and reply with a proposed call or piece of work.
  • To manage the pre-contractual and contractual relationship with clients and suppliers.
  • To meet the legal, accounting and tax obligations that apply.
  • To send messages about our own services, only to someone who has expressly agreed, and with the option to opt out at any time.
  • To keep the website secure and available.
  • To learn how people find and use the site, in order to improve it, only if analytics cookies are accepted.

The data is not used for any purpose other than those above.

4. Legal basis

  • Consent (article 6.1.a of the GDPR) to reply to an inquiry sent through the form or by email, for commercial messages where they have been accepted, and for the site’s analytics (also under article 22.2 of the LSSI-CE). It can be withdrawn at any time, without affecting the lawfulness of processing already carried out.
  • Performance of a contract or pre-contractual steps (article 6.1.b) to prepare a proposal and deliver the services engaged.
  • Legal obligation (article 6.1.c) to keep invoices and commercial and tax records.
  • Legitimate interest (article 6.1.f) in keeping the site secure and in retaining correspondence for as long as liability could arise from it.

5. How long we keep it

  • Inquiries that do not become a contract: 12 months from the last message, then deleted.
  • Client data: for the life of the contract and, once it ends, blocked for the limitation periods of any legal claims that could arise.
  • Tax and accounting data: for the periods set by commercial and tax law.
  • Browsing data: 14 months in Google Analytics.

6. Who else processes the data

The data is not sold or disclosed to anyone, except where the law requires it. These providers are involved in running the site:

  • Cloudflare, Inc. — Hosting, the database where form requests are stored, protection against bots and abuse (Cloudflare Turnstile and a limit on submissions per IP address), and forwarding of email for the site’s domains.
  • Resend (Plus Five Five, Inc.) — Sending the emails the form produces: the notice to the controllers and the acknowledgment to whoever wrote.
  • The controllers’ email provider, where inquiries are received and answered.
  • Google Ireland Limited (Google Analytics), only if analytics cookies are accepted.

All of them act as processors, under a contract that meets article 28 of the GDPR.

Billing data is disclosed to the tax authorities where the law requires it.

7. International transfers

Cloudflare and Resend are U.S. companies, and Google may process browsing data there. These transfers rely on the EU-U.S. Data Privacy Framework, which all three companies have joined and which is covered by the European Commission’s adequacy decision of 10 July 2023, and also on the standard contractual clauses approved by the Commission (Decision 2021/914), which their contracts include. If another provider involving an international transfer is added, it will be stated here together with its safeguard.

8. Your rights

Anyone can exercise the following rights free of charge by writing to mayda.morales@north-meridian.dev and identifying themselves sufficiently:

  • Access: to know which of your data is being processed.
  • Rectification: to correct data that is inaccurate or incomplete.
  • Erasure: to ask for it to be deleted when it is no longer needed.
  • Objection: to object to processing based on legitimate interest.
  • Restriction: to ask that data be kept but not used while a complaint is resolved.
  • Portability: to receive the data in a structured, commonly used format.
  • Withdrawal of consent, at any time and without retroactive effect.

The request will be answered within one month of receipt.

9. Complaint to the supervisory authority

If you believe your data has not been handled properly, you can write first to mayda.morales@north-meridian.dev so we can try to resolve it. In any case, you have the right to lodge a complaint with the Spanish Data Protection Agency, the supervisory authority in Spain, through its online office at www.aepd.es (opens in a new tab).

10. Security of the data

Technical and organizational measures proportionate to the risk are in place: encryption of the site in transit, access to information only for people who need it for their work, backups, and processor contracts with the providers that act as processors. No system is infallible, but any incident that affects personal data will be handled under articles 33 and 34 of the GDPR.

11. Children

This site is aimed at professionals and companies. It is not intended for children under fourteen and their data is not knowingly collected. If we find that it has been provided, it will be deleted.

12. Changes to this policy

This policy may be updated if the services, the providers or the applicable law change. The current version is always the one published on this page, with its review date. Cookie use is set out separately in the cookie policy.