Privacy notice

Which role we are in

Meridian is software a brokerage uses to run its own business. When a brokerage captures a client's details in Meridian, the brokerage is the responsible party for that personal information and we are the operator processing it on their instruction. We do not decide what a brokerage collects about its clients or why.

For the brokerage's own users, the people who sign in to Meridian, we are the responsible party. That covers names, work email addresses, sign in records and the audit trail of what those users did in the product.

What we process

On behalf of a brokerage, and only because the brokerage put it there:

• Client and prospect details, including names, contact details, identity or passport numbers, dates of birth and addresses.
• Policy, quote, claim and commission records.
• Documents a brokerage uploads, including FICA packs, banking confirmations and policy schedules.
• Notes, calls, meetings and correspondence a broker records against a client.

What we process about the people who sign in

For our own purposes as responsible party:

• Name, work email address and role inside the brokerage.
• Sign in times, the network address a session came from, and the device that connected.
• A record of actions taken in the product, which exists so a brokerage can produce its own audit trail.
• Support correspondence.

Why we process it

To provide the service the brokerage subscribes to, to keep it secure, to bill for it, and to meet our own legal obligations. We do not sell personal information, we do not share it with insurers, and we do not use a brokerage's client data to train anything.

Insurers do not receive it

No insurer has access to any brokerage's records through Meridian, in identifiable or aggregated form, whether or not that insurer holds equity in the business. This is a design property of the platform rather than a policy that could be changed quietly.

Where it is stored

Client records and documents are stored in South African infrastructure. Where a copy is held elsewhere for resilience or backup, that is stated to the brokerage rather than buried, and it remains subject to the same protections.

How long we keep it

For as long as the brokerage remains a customer, and afterwards only for as long as a legal obligation or a legitimate dispute requires. A brokerage can export its data at any time and can ask for deletion when the relationship ends, subject to any retention we are independently required to observe.

Your rights under POPIA

You may ask what personal information we hold about you, ask for it to be corrected or deleted, object to processing, and complain to the Information Regulator.

If you are a client of a brokerage rather than one of its users, direct the request to that brokerage first. They decide what is held about you, and we will support them in answering you.

How it is protected

Access is scoped by role and by team, so a broker reaches their own book rather than everything. Documents are served through short lived signed links tied to one brokerage. Every access to a client document or identifier is written to an audit trail the brokerage can read.

When our own staff need to open a support session on a brokerage's account, that session is time limited, requires a stated reason, is visible on screen while it is open, and is written into that brokerage's own audit trail.

Complaints

Speak to our Information Officer first. If you are not satisfied, the Information Regulator (South Africa) can be reached at enquiries@inforegulator.org.za.