Privacy Policy

1. Who we are

Meridian Drawback UK ("we", "us", "our") is a company registered in England & Wales (company number 16883417). We specialise in compliance-led duty and VAT recovery for UK e-commerce retailers and 3PL operators through Returned Goods Relief (RGR), Customs Drawback, and historical recovery audits. Our contact email is [email protected].

2. What data we collect

We may collect the following personal data:

• Name and email address (when you submit a form or contact us)
• Company name and job title
• Information you provide about your returns operations (volumes, markets, product types)
• Historical returns, import, and export data you submit for audit purposes
• Data submitted through our Compliance Hub Platform (case data, evidence, filing records)
• Website usage data (cookies, analytics — see Section 7)

3. How we use your data

We use your data to:

• Respond to your enquiries and provide eligibility assessments
• Conduct duty and VAT recovery audits on your behalf
• Manage our client relationship and deliver our services, including MRN matching, evidence pack creation, and CDS filing
• Operate and improve our Compliance Hub Platform
• Send you relevant updates about our services (only with your consent)
• Comply with legal and regulatory obligations (including HMRC requirements)

4. Legal basis for processing

We process your personal data on the following legal bases: (a) your consent (e.g., when you submit a form); (b) performance of a contract or steps prior to entering into a contract; (c) our legitimate interests in operating our business and improving our services; and (d) compliance with legal obligations.

5. Data sharing

We do not sell your personal data. We may share data with: (a) HMRC, where required for customs declarations and relief claims made on your behalf under Letter of Authority; (b) trusted service providers who assist in delivering our services (e.g., hosting, email, platform infrastructure); (c) AI service providers (see Section 6 below); (d) professional advisers (legal, accounting) where necessary. All third parties are required to protect your data appropriately.

6. AI-Assisted Processing

We use Anthropic's Claude API to assist with document extraction, data validation, anomaly detection, and narrative generation. When you submit data to Meridian, we may send relevant text excerpts (not full datasets) to Claude to support these functions.

Data Protection: We have a Data Processing Addendum with Anthropic (automatically incorporated into their Commercial Terms of Service) that covers data protection, encryption, and retention. Anthropic does not use API data to train its models. Data is encrypted in transit and at rest.

Your Control: AI outputs are recommendations only and are reviewed by our team before any compliance decision is made or filed with HMRC. You remain responsible for the accuracy of your data and the final compliance positions we file on your behalf.

7. Cookies

Our website uses essential cookies to ensure functionality and analytics cookies (Google Analytics) to understand how visitors use the site. You can control cookie preferences through your browser settings.

8. Data retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Customs and audit data, including evidence packs and audit logs, may be retained for up to 7 years in line with HMRC requirements and our compliance obligations.

9. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to or restrict processing
• Data portability
• Withdraw consent at any time

To exercise any of these rights, contact us at [email protected].

10. Contact & complaints

If you have questions about this policy or wish to make a complaint, contact us at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.