Privacy notice
Last updated 25 September 2026
This notice explains how Meridian Foods handles personal data in QuoteLens: our staff’s, and that of the suppliers who send us quotations.
The short version: we collect only what a sourcing event needs, a model reads supplier files but never decides on its own, suppliers never see each other’s prices, and every change is recorded against the person who made it.
1. Who we are and what this notice covers
QuoteLens is the internal sourcing workspace of Meridian Foods Pvt Ltd (“Meridian Foods”, “we”, “us”). Our Sourcing team uses it to write requests for quotation (RFx), send them to suppliers, read the quotations suppliers send back, compare them and record award decisions.
This notice explains what personal data QuoteLens handles, why, who else processes it for us, how long we keep it and what you can ask us to do. It applies to the QuoteLens web application, the emails it sends and receives, and the files suppliers submit through it. It does not cover other Meridian Foods systems, which have their own notices.
Meridian Foods is the Data Fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and rules made under it.
2. Whose data we handle
- Meridian Foods staff who sign in to QuoteLens: category buyers, approvers in Procurement and Finance, and administrators.
- Supplier contacts: people at vendor companies who receive our RFx emails, reply with quotations, or are named in the documents they send (sales managers, signatories, accounts contacts).
- People mentioned in documents: for example, a name on a certificate, a signature on a quotation, or a phone number in an email signature.
Suppliers never sign in to QuoteLens. Everything we hold about a supplier contact arrives by email or as a file they choose to send us.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, work email, role (buyer, approver, admin), hashed password | Meridian Foods IT when your account is created |
| Usage and audit data | Sign-in times, pages opened, review decisions, overrides and their reasons, approvals, exports | Recorded automatically as you use QuoteLens |
| Supplier contact data | Name, job title, work email, phone number, company, GSTIN printed on a quotation | Our vendor master; emails and documents suppliers send |
| Correspondence | RFx emails, supplier replies, clarification requests, attachments, message headers | Sent and received through the QuoteLens mailbox |
| Commercial documents | Price sheets, PDFs, Word files, photographs of printed rate cards, certificates, company profiles | Attached to supplier replies or uploaded by a buyer |
| Questions and answers | Questions staff ask about a comparison, the database query generated, the answer shown | Typed by staff in the Ask panel |
| Technical data | IP address, browser type, error logs, request timings | Our hosting provider, automatically |
We do not ask for, and ask suppliers not to send, sensitive personal data such as health, financial account or identity-document numbers. If a document contains it anyway, it is kept only as part of that document and is not extracted into the comparison.
4. How we use it
- Running sourcing events: sending RFx documents, matching replies to the right event and supplier, and sending clarification requests.
- Reading quotations: turning supplier files into prices per line, in the same unit and currency, with a link from every number back to where it was found.
- Decisions and records: keeping the review queue, the assumptions ledger, scenarios and the award memo, so a decision can be explained later.
- Security and accountability: authenticating staff, recording who changed what and when, and investigating misuse.
- Quality: measuring how accurately QuoteLens reads test documents so we can improve it. We use test documents for this, not live supplier files.
- Legal obligations: keeping procurement records for audit, tax and company-law purposes.
We do not sell personal data, use it for advertising, or build profiles of individual supplier contacts.
5. How AI models are used
QuoteLens uses large language models to read supplier documents, suggest which of our RFx lines a supplier’s item matches, and answer staff questions about a comparison. Specifically:
- Files and email text from suppliers are sent to Google’s Gemini API to be read. Where configured, a second model provider accessed through OpenRouter may be used to score matching decisions.
- We use these services under paid API terms, which state that the provider does not use our prompts or files to train its models.
- Every model request is logged in QuoteLens with its purpose, model, token counts, time taken and cost, so we can audit what was sent and why.
- No decision is made by a model alone. Numbers a model is unsure about are marked in the comparison and wait in the review queue. Awards are proposed by a buyer and approved by a named approver.
A model can misread a document. Every price in QuoteLens links to the page, cell or line it came from, and staff are expected to check marked cells before relying on them.
6. Our legal basis
For staff, we process personal data for employment purposes and to protect the company from loss or liability, which are legitimate uses under section 7 of the DPDP Act.
For supplier contacts, we process personal data you voluntarily provide in order to respond to our RFx and to enter into or perform a supply contract (section 7(a) of the DPDP Act), and to comply with legal obligations such as record-keeping and tax requirements.
Where we rely on consent, you may withdraw it at any time by writing to the Grievance Officer (section 16). Withdrawing consent does not affect processing already carried out.
8. Where data is stored
QuoteLens is hosted on cloud infrastructure that may be located outside India, including the Asia-Pacific region and the United States. Transfers are made to countries not restricted by the Government of India under section 16 of the DPDP Act, and our providers apply the security measures described in section 10 wherever the data is held.
9. How long we keep it
| Data | Kept for |
|---|---|
| Awarded RFx, quotations, review decisions, award memo | 8 years after the end of the financial year of the award, for audit and tax records |
| RFx that were cancelled or never awarded | 3 years after the last activity |
| Emails and attachments that did not match any RFx | 90 days, then deleted |
| Model-call logs | 2 years |
| Staff accounts | Deactivated when you leave; audit entries you made are kept with the RFx they belong to |
| Technical and error logs | 30 days |
When a retention period ends we delete the data or remove the parts that identify a person.
10. How we protect it
- All traffic is encrypted in transit (TLS). Data is encrypted at rest by our storage provider.
- Service keys are held only on the server and never sent to your browser. Files are private and opened through short-lived signed links.
- Only named Meridian Foods staff can sign in. Sessions expire after 7 days.
- Questions asked in the Ask panel run as read-only queries, limited to the RFx you are looking at.
- Every review action, override, approval and export is written to an audit trail that cannot be edited from the application.
If we become aware of a personal data breach, we will inform the Data Protection Board of India and affected people as the DPDP Act requires.
12. Your rights
Under the DPDP Act you can ask us to:
- tell you what personal data we hold about you and how it is processed, and who we have shared it with;
- correct, complete or update it;
- erase it, where we no longer need it and the law does not require us to keep it;
- nominate another person to exercise these rights on your behalf in the event of death or incapacity;
- address a grievance about how we handled your data.
Write to the Grievance Officer (section 16). We will acknowledge your request within 3 working days and reply within 30 days. If you are not satisfied with our reply, you can complain to the Data Protection Board of India.
13. A note for suppliers
Please send only what the RFx asks for. You do not need to send staff identity documents, bank details or personal phone numbers to quote. If you send a document by mistake, email the address the RFx came from, quoting the RFx code (for example MER-0419), and we will delete it.
Your prices are used only to evaluate the RFx you replied to and later RFx for the same category. They are never shared with other suppliers.
14. Children
QuoteLens is a business tool for adults. We do not knowingly process personal data of anyone under 18.
15. Changes to this notice
We review this notice at least once a year and when QuoteLens changes how it handles personal data. The date at the top shows the latest version. Significant changes will be announced to staff by email before they take effect.
16. Contact and Grievance Officer
- Grievance Officer
- Kavita Deshmukh, Head of Legal & Compliance
- privacy@meridianfoods.in
- Post
- Meridian Foods Pvt Ltd, Meridian House, 4th Floor, Andheri–Kurla Road, Andheri (East), Mumbai 400 059, Maharashtra, India
- Hours
- Monday to Friday, 10:00–18:00 IST
For questions about using QuoteLens rather than your data, see Help.