Privacy Policy
How the operator collects, uses, stores and protects personal information.
This policy is written for the operator named below and describes what the software actually does. It is not legal advice and makes no claim of certification or regulatory approval. The operator must review it against the law of their own jurisdiction and their actual retention practices before publishing the portal.
Last reviewed: October 2026
1. Who is responsible for your information
The data controller for information held in this portal is Meridian Asset Administration Services, 1200 Harbor Street, Suite 900, Wilmington, DE 19801, operating in State of Delaware, United States. Privacy enquiries should be sent to support@example.com.
2. Information we hold
To administer a beneficiary record, the portal holds:
- Account information: your name, email address, telephone number, hashed password, and sign-in history.
- Beneficiary information: your beneficiary reference, contact details, address, date of birth where recorded, nationality, and your relationship to the arrangement.
- Asset records: the assets assigned to your record, their category, description, any recorded value, and verification status.
- Documentation: files you upload, the review outcome for each, and any reviewer feedback.
- Disbursement records: the status and full history of each disbursement record, including administrative decisions and notes.
- Communications: messages sent through the portal's secure message thread, and public contact enquiries.
- Audit records: sign-ins, failed sign-in attempts, document access, record changes and approvals.
3. Why we hold it
Information is processed to administer the disbursement of assigned assets, to verify identity and eligibility, to meet legal and record-keeping obligations, and to keep an auditable record of administrative decisions. The portal does not use your information for advertising and does not sell it.
4. Data minimisation
The portal asks for the information the administration process requires and no more. It does not ask for, and must never be given, your online banking password, card security code, PIN, or a one-time banking verification code. No such credentials are stored anywhere in this system.
5. Who can see your information
You can see your own records. Staff of the operator can see records where their role requires it — for example, a document reviewer reviewing a document you uploaded. Access is enforced on the server by role and by record ownership, and every access is attributable in the audit log.
Information is not shared with third parties except where the operator is required to do so by law, or where a service provider processes it on the operator's behalf under an appropriate agreement.
6. Document storage and security
Uploaded documents are stored outside the public web directory under randomly generated names. There is no public URL for any uploaded document. Access is granted only after an authorisation check on the server. Passwords are stored only as a one-way bcrypt hash. Sessions expire after inactivity, and repeated failed sign-ins are rate-limited.
7. Retention
Records are retained for as long as the administration process and applicable law require. When they are no longer required, they are deleted or anonymised. The operator should record its specific retention periods here before publishing.
8. Your rights
Depending on your jurisdiction, you may have the right to access the information held about you, to have inaccurate information corrected, to request erasure in certain circumstances, to restrict or object to certain processing, and to receive a portable copy of information you provided. To exercise any of these rights, contact support@example.com.
You can update most of your own contact details directly in your beneficiary profile. Information you cannot edit yourself — such as an asset record — can be corrected by an administrator on request.
9. Cookies and sessions
The portal uses a single session cookie, which is strictly necessary to keep you signed in. It is marked HTTP-only, uses the SameSite attribute, and is transmitted over HTTPS only. The portal does not use advertising or analytics tracking cookies.
10. Complaints
If you are unhappy with how your information has been handled, contact the operator first at support@example.com. You may also have the right to complain to the data protection authority in your jurisdiction.
11. Changes to this policy
This policy may be updated. The date of the last review is shown at the top of this page. Material changes affecting how your information is used will be communicated through the portal.