Data Protection
Last updated: 2 October 2026
This statement sets out how Meridian handles personal data as a processor on your behalf and describes the data protection terms that apply when you use the Service, under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). It supplements our Privacy Policy and Terms of Service.
1. Roles
For personal data in your Workspace, such as your tenants', owners', and staff's details, you are the controller and Meridian is the processor acting only on your documented instructions, which include these terms and your use of the Service's features. For our own account, billing, and website data, Meridian is the controller.
2. Processing particulars
Subject matter: provision of the property management Service. Duration: for the term of your account plus any legally required retention. Nature and purpose: hosting, storing, organizing, transmitting, and displaying personal data to operate the Service. Categories of data subjects: your tenants, owners, staff, contractors, and contacts. Categories of personal data: identity and contact details, tenancy and property records, financial and payment records, documents, and communications.
3. Our obligations as processor
We will: process personal data only on your documented instructions and as permitted by law; ensure persons authorized to process it are under confidentiality obligations; implement appropriate technical and organizational security; assist you, taking into account the nature of processing, to respond to data subject requests and to meet your security, breach, and impact-assessment obligations; and, at your choice, delete or return personal data at the end of the Service, subject to legally required retention.
4. Sub-processors
You authorize us to engage sub-processors to provide the Service: currently a licensed UAE PSP (rent payments), Cloudflare R2 (document storage), and our email and SMS providers. We impose data protection obligations on each that are no less protective than these terms and remain responsible for their performance. We will give notice of any intended addition or replacement of a sub-processor and consider any reasonable objection you raise.
5. International transfers
Where personal data is transferred or processed outside the UAE, we rely on the conditions and safeguards permitted under the PDPL and its executive regulations.
6. Security measures
Measures include database-level isolation of each Workspace with row-level security, role-based access control, hashing of passwords, encryption of data in transit, audit logging of important actions, restricted and monitored administrative access, and scanning of uploaded files.
7. Data subject requests
The Service provides tools for you to access, correct, delete, or restrict the personal data in your Workspace. If a data subject contacts us directly about your Workspace data, we will refer them to you and assist you as processor.
8. Personal data breaches
We maintain procedures to detect, investigate, and respond to personal data breaches, and will notify you without undue delay after becoming aware of a breach affecting your Workspace data, with the information reasonably available to help you meet your own notification obligations.
9. Audit and information
On reasonable written request, and subject to confidentiality, we will make available information necessary to demonstrate compliance with these terms and allow for reasonable audits, which may be satisfied through our documentation and third-party reports where available.
10. Return and deletion
On termination you may export Customer Data for 30 days. After that we delete personal data in our live systems in line with the Privacy Policy, except where retention is required by law, and backups are overwritten on their ordinary cycle.
11. Precedence and contact
If these data protection terms conflict with the Terms of Service on data protection matters, these terms prevail for personal data in your Workspace. For data protection questions, contact dpo@meridianpms.app.