Data Processing Agreement

1. Roles

• Customer is the Controller of all client personal data it inputs into the Service.
• Meridian is the Processor, acting only on Customer's documented instructions as set out in this DPA and the Terms of Service.

2. Subject matter and duration

• Subject matter: provision of cashflow forecasting software requiring the processing of client personal and financial data.
• Duration: for the term of the subscription, plus the data retention period described in Section 8.

3. Nature and purpose of processing

Meridian processes personal data solely to: store, calculate, display, and generate reports from data entered by Customer's authorised users, and to provide related support and security functions.

4. Categories of data subjects and data

• Data subjects: Customer's clients (individuals or couples), and where relevant, their family members referenced in a forecast (e.g., beneficiaries, dependents).
• Categories of data: name, date of birth, tax residency/jurisdiction, currency, income, assets, expenditure, retirement and estate planning assumptions, and survivor/death-scenario data for couples. No special category data is knowingly processed unless entered by Customer at its own discretion and risk.

5. Processor obligations

Meridian agrees to:

• Process personal data only on Customer's documented instructions, including regarding international transfers, unless required otherwise by law (in which case Meridian will inform Customer, unless prohibited from doing so);
• Ensure personnel authorised to process the data are bound by confidentiality;
• Implement appropriate technical and organisational security measures (see Section 7);
• Not engage a sub-processor without Customer's general authorisation (see Section 6);
• Assist Customer, insofar as reasonably possible, in responding to data subject requests and regulatory obligations;
• Notify Customer without undue delay, and in any event within 72 hours, on becoming aware of a personal data breach affecting Customer's data;
• At Customer's choice, delete or return all personal data at the end of the subscription, and delete existing copies unless retention is required by law;
• Make available to Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for audits on reasonable notice, at Customer's expense, no more than once per year absent a security incident.

6. Sub-processors

Customer provides general authorisation for Meridian to engage the sub-processors listed in the current Sub-processor List, which include infrastructure and hosting providers necessary to operate the Service (currently: Supabase, Vercel; Stripe for billing data only). Meridian will:

• Impose data protection terms on sub-processors no less protective than this DPA;
• Notify Customer of any intended addition or replacement of a sub-processor with at least 14 days' notice, giving Customer the opportunity to object on reasonable data protection grounds.

7. Security measures

• Encryption of data in transit (TLS) and at rest.
• Per-firm data isolation enforced at the database level via Supabase Row-Level Security — one firm's queries cannot access another firm's records.
• Access to production data restricted to authorised personnel on a need-to-know basis, with authentication controls.
• Regular dependency and platform security updates.
• Backups maintained on a rolling 30-day window, with automated daily snapshots.
• Additional controls (two-factor authentication, audit logging, and periodic penetration testing) are on the product roadmap and will be added to this DPA as they are implemented.

8. Data return and deletion

On termination of the subscription, Customer may export its data in CSV or PDF format within 60 days. After this period, Meridian will delete all Customer personal data from production systems within 30 further days, and from backups within their normal rotation cycle (max 90 days), unless retention is required by applicable law.

9. International transfers

Meridian's hosting infrastructure (Supabase, Vercel) is located in the EU (eu-west-1, Ireland). This constitutes a transfer of personal data outside the UAE. Meridian ensures such transfers are subject to contractual data protection terms with its hosting providers requiring a standard of protection consistent with UAE Federal Decree-Law No. 45 of 2021 (PDPL), including confidentiality, security, and breach-notification obligations. Current hosting regions are specified in the Sub-processor List.

10. Liability

Liability under this DPA is subject to the limitations set out in Section 10 of the Terms of Service.

11. Governing law

This DPA is governed by the laws of the United Arab Emirates, consistent with the Terms of Service.