Last revision: .
1. Data controller and scope
The controller responsible for processing data on this corporate website is Merito Media LLC, with contact address in 407 Lincoln Rd, Suite 6H, Miami Beach, FL 33139, United States. You can write to the postal address or use the contact form.
This policy covers browsing and enquiries on merito.media. Linked publications explain on their own websites how data is processed for their forms, accounts, newsletters and other services.
2. Data we process
The form collects your name, email address, reason for contacting us, message and the date you accepted the privacy information. You may add an organisation and select the recipient publication; both are optional. The required fields allow us to identify and handle your enquiry. Without them, you cannot submit it through the form.
We also process technical data needed to serve the pages and protect the service, such as IP addresses, browser information, request dates and session data. Error logs may contain technical information relating to an incident.
Provide only the information needed. Do not include passwords, full identity documents or sensitive health information or data about other people that is not essential to your request. If you act on someone else’s behalf, you must be authorised to share their data.
3. Purposes and legal bases
We use contact data to receive, organise, direct to the appropriate team and respond to editorial, commercial, press, partnership or privacy enquiries. The enquiry is recorded and an email notification is sent to the group’s contact.
Where the General Data Protection Regulation (GDPR) applies, the ordinary handling of the form is based on the consent you give by ticking the box and submitting it, under Article 6(1)(a). If you request a quotation or a contractual relationship, necessary pre-contractual steps may be based on Article 6(1)(b).
Protection against abusive submissions and maintaining security serve our legitimate interest in preserving the service, under Article 6(1)(f) where applicable, taking users’ rights into account. Compliance with legal obligations relies on Article 6(1)(c) where an enforceable obligation exists.
Sending an enquiry does not subscribe you to a newsletter or authorise promotional messages unrelated to your request. Newsletter subscriptions, where available, are managed by the relevant publication under its own information.
4. Data retention
How long an enquiry is kept depends on its purpose: while it is being handled, during necessary follow-up and, if a collaboration or contract results, while that relationship is managed. After it closes, information needed for legal obligations or potential claims is limited to what is necessary for the applicable periods.
These criteria apply to both enquiry records and related correspondence. You can request erasure of your data; we will assess whether any information must be retained for a legal reason. Technical data is used for the time needed for operation, security and incident analysis. Cookie durations are stated below.
Your optional analytics choice is stored in your browser until you change it or clear its storage. The duration of analytics cookies, if accepted, is explained in the cookies section. Their duration does not by itself determine how long the provider may retain its reports.
5. People and providers with access
Authorised staff within the group and the publication you contact may handle your enquiry. Hosting, email and maintenance providers may process the information needed to provide their services. Data may also be shared with authorities or other entities when a legal obligation requires it.
Form messages are not automatically published or sold as contact lists. The information is used for the purpose of your enquiry and the operational needs described in this policy.
If you accept optional analytics in production, Google processes measurement data through Google Analytics. You can read how Google uses information from websites that use its services and your privacy options.
6. International data processing
The controller is based in the United States. Handling enquiries and providing hosting or email services may involve processing from other countries. The entity’s address does not by itself determine where all information is stored.
Where processing falls under the GDPR, transfers outside the European Economic Area require a valid mechanism under Articles 44 onwards, such as an applicable adequacy decision or appropriate safeguards. Through the contact form, stating “Privacy”, you can request information about the destinations and safeguards relevant to your enquiry and, where applicable, how to obtain a copy of them.
7. Cookies and browsing
The inventory, providers and options for changing your choice are described in the cookie policy. The “Analytics cookies” control manages Google Analytics only; it does not control the automatic loading of Google Maps.
This website uses technical cookies to maintain the session, show submission results and protect the form. The session cookie is called merito-media-session; XSRF-TOKEN helps verify that form requests come from valid browsing.
The session cookie has a lifetime of 120 minutes of inactivity; it may be renewed as you continue browsing. The cookie XSRF-TOKEN has a lifetime of 120 minutes from issue or renewal. You can delete or block these cookies in your browser, although the form may stop working correctly.
Optional analytics with consent
In production, Google Analytics 4 is offered to understand website use, including pages viewed and technical browser and device information. It relies on your consent under Article 6(1)(a) of the GDPR where applicable. The tool does not load until you select “Accept analytics”. You can reject it and continue using the website and form.
If you accept, these cookies may be installed: _ga and _ga_*. Their configured duration is 28 days and may be renewed through use of the service. The settings disable Google Signals and advertising personalisation signals. Enquiry data is not deliberately included in audience measurement, and the page address sent is limited to the domain and path, without query parameters.
The browser remembers your choice in local storage, under the key merito.media-analytics-consent. You can change it using the “Analytics cookies” button. Withdrawing acceptance disables measurement and removes the analytics cookies managed by this control; you can also clear site data in your browser. Withdrawal does not automatically erase data already sent to Google: you can request information through the rights channels described in this policy.
Cookie information for a linked publication must be consulted on that website.
8. Maps, images and external websites
The Google Maps map on the contact page loads automatically when you open it. This connects your browser to Google, which may receive your IP address, browser information and the source of the request, and use cookies or similar technologies under its privacy policy. The map loads independently of your Google Analytics choice. You do not need to share your location to view the group’s address on the map.
Headlines link to their original publications. Some story images load from the publication’s domain or its image provider. When requesting these resources, your browser sends the destination server connection data, such as your IP address, and the referrer information allowed by its settings.
When you follow an external link, the destination website’s terms and policies apply. Inclusion in the group’s directory does not replace each service’s specific privacy information.
9. Your rights and how to exercise them
You can request information about your data, correct it and request its erasure. Where legal requirements are met, you can also exercise rights to object, restrict processing and data portability. If processing relies on your consent, you can withdraw it at any time; withdrawal does not affect the lawfulness of earlier processing.
Use the contact form stating “Privacy” and explaining your request, or write to the postal address. If you know it, identify the email address or conversation concerned. Additional information to verify your identity will only be requested where necessary; do not send a complete copy of your identity document by default.
Where the GDPR applies, requests are generally handled within one month. If their complexity allows a lawful extension, you will be told the reason and deadline. You can complain to the competent data protection authority, including the Spanish Data Protection Agency where applicable.
10. Automated decisions and security
Enquiries are not used to make automated individual decisions with legal or similarly significant effects on you, or to build commercial profiles. Technical form controls limit abuse of the service.
Access controls and technical measures are applied to protect information. No system guarantees absolute security; if you identify an incident, report it through the contact form without including unnecessary data or credentials.
11. Review and related documents
The date at the start identifies this policy’s revision. Changes in services or their processing will be reflected on this page. You can also consult the legal notice.