Privacy Policy.

This policy applies to visitors to meridianselect.ro and people who contact us through the form, by email, or by telephone about Meridian Select products and projects. It describes processing carried out directly by Meridian Select and the technical services used to operate the website.

Third-party websites and platforms reached through links — including Instagram, TikTok and YouTube — have their own policies and act independently for processing performed on their platforms.

The data controller is Meridian Select SRL, company registration number (CUI) 54689436, with its registered office at 84B Libertății Street, Hodoșa village, Sărmaș commune, Harghita County, Romania.

For questions, requests, or the exercise of your data-protection rights, contact us at gabrielvoda2006@gmail.com, call +40 727 746 503, or use the contact page. You may use the subject line “Data protection” so that we can identify your request quickly.

Send a request about your data

We collect data directly from you, data generated when you use the website, and technical data supplied by the security infrastructure. We do not request special-category data — such as health, biometric, or belief information — and ask you not to include it in the project description.

• Identification and contact data: name, email address, and telephone number.
• Enquiry data: stated role, product of interest, and project description.
• Submission data: site language, source page, unique enquiry identifier, submission date and time, and email-notification status.
• Security data: IP address and technical information required by Cloudflare Turnstile and infrastructure logs. The IP address is not included in the enquiry record stored in Supabase; only the hostname confirmed by Turnstile is retained there.
• Privacy preferences: analytics and marketing choices, preference version, and update time, stored locally in the browser.
• Analytics or advertising data: only with your consent, online identifiers, device information, viewed pages, interactions, and campaign-attribution data through Google Analytics 4 and TikTok Pixel.

We use data only for defined purposes. The applicable legal basis depends on the context in which you interact with us.

We use strictly necessary local storage to remember your cookie choice and Cloudflare Turnstile technologies to secure the contact form. These functions are not used for advertising.

Google Tag Manager, Google Analytics 4, and TikTok Pixel are not loaded before a positive choice for the relevant category. Refusal does not restrict access to content or the form. Your choice is stored in the browser for no more than 6 months, after which it is requested again; you can change it from this page at any time.

Accepting or withdrawing consent takes effect for the future. Withdrawal does not affect processing that was lawful before it. The lifetime of cookies and identifiers placed after consent depends on the service configuration and provider policy.

• Strictly necessary — remembering the preference, delivering the page, and preventing spam; these cannot be disabled through the interface.
• Analytics — Google Analytics 4 for website-usage statistics; enabled only with consent.
• Marketing — TikTok Pixel for campaign measurement and attribution; enabled only with consent.

Access within Meridian Select is limited to people who need the data to handle the enquiry. We may disclose data to providers operating the services below, professional advisers, or public authorities where required by law.

• Vercel — website hosting, content delivery, and the serverless function that receives the form.
• Supabase — the enquiry database, hosted in Central Europe (Zurich), eu-central-2; public access is blocked through RLS and the absence of public policies.
• Resend — delivery of the enquiry notification to the Meridian Select email address.
• Cloudflare — Turnstile anti-spam verification and abuse prevention.
• Google Ireland Limited and affiliates — email service; Google Tag Manager and Google Analytics 4 only after analytics consent.
• TikTok Technology Limited and affiliates — TikTok Pixel and advertising measurement only after marketing consent.

Although the enquiry database is configured in Switzerland, some providers or their affiliates may process data outside the European Economic Area. Depending on the destination and provider, transfers rely on a European Commission adequacy decision, the EU–US Data Privacy Framework, or European Commission-approved standard contractual clauses, together with supplementary measures where required.

You may request information about the mechanism applying to a transfer and, subject to contractual and legal restrictions, a copy of the relevant safeguards.

We apply the storage-limitation principle and delete or anonymise data once its purpose has been fulfilled.

• Raw form enquiries and operational copies of communications: no more than 24 months after submission, with earlier deletion when no longer needed. Supabase runs a daily automatic deletion for records older than 24 months.
• Cookie preference: no more than 6 months in browser local storage, unless changed or deleted sooner.
• Security and infrastructure logs: for the period set by the provider and only as long as necessary for security, diagnostics, and abuse prevention.
• If an enquiry leads to a contract, legal dispute, or statutory obligation, relevant data is kept separately for the period required by law or needed to establish, exercise, or defend legal claims.

Your name, email address, and telephone number are required to submit the form because they are needed to identify the enquiry and enable us to respond. Without them, the form cannot be submitted. Your role, product of interest, and project description are optional, although they help us provide a relevant answer.

You may instead contact us directly by email or telephone. We do not use information supplied in an enquiry for unsolicited commercial messages.

Depending on the circumstances and GDPR conditions, you have the following rights, which are generally exercised free of charge:

• Access — confirmation of processing and a copy of your personal data.
• Rectification — correction of inaccurate data and completion of incomplete data.
• Erasure — deletion where there is no longer a legal ground for retention, subject to statutory exceptions.
• Restriction — temporary limitation of data use in the circumstances provided by the GDPR.
• Portability — receipt of data you provided in a structured format for automated processing based on consent or contract.
• Objection — challenge to processing based on legitimate interests; we will stop unless we demonstrate compelling legitimate grounds or a need to defend legal claims.
• Withdrawal of consent — at any time for analytics and marketing, without retroactive effect.

Send a request about your data

We respond without undue delay and normally within one month. The period may be extended by another two months for complex or numerous requests, in which case we will inform you within the first month. We may request reasonable information to verify your identity without collecting more than necessary.

If you believe processing infringes the law, you may complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): 28–30 G-ral. Gheorghe Magheru Boulevard, District 1, 010336 Bucharest; anspdcp@dataprotection.ro; +40 31 805 9211. Your right to seek a judicial remedy remains unaffected.

Meridian Select does not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Turnstile may automatically reject a suspicious submission; if that happens, you may contact us by email or telephone.

Following marketing consent, TikTok may perform measurement, attribution, and audience segmentation under its own rules. Your choice does not affect your ability to use the website or send an enquiry.

We apply technical and organisational measures proportionate to risk: encrypted connections, server-side database access, RLS without public policies, request-rate limits, Turnstile, field validation, and access limited to authorised persons. No internet-connected system can guarantee absolute security; we assess and handle incidents in accordance with legal obligations.

The website and form are intended for people seeking information about products and projects, not children. We do not knowingly collect information about minors. If you learn that a minor has submitted data without the involvement of a legal representative, contact us so that we can assess and remove it where appropriate.

We may update this policy when services, providers, or legal requirements change. We publish the version and update date on this page. If a change affects an existing cookie choice, we will request consent again before enabling the new purposes.