GDPR Compliance

Last Updated: November 3, 2026

1. Introduction

Muse-iris is committed to protecting personal data in accordance with the General Data Protection Regulation (GDPR). This document outlines how we comply with GDPR requirements and respect your data protection rights.

2. Data Controller

Muse-iris acts as the data controller for personal information collected through our website and services. We determine how and why personal data is processed.

Contact details:
Muse-iris
47 Westbourne Terrace
London W2 3UL
United Kingdom
Email: [email protected]

3. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

3.1 Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of the data we hold about you.

3.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

3.3 Right to Erasure

You can request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Legal obligations require erasure

3.4 Right to Restriction of Processing

You can request limitation of how we use your data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification

3.5 Right to Data Portability

You can request to receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

3.6 Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests.

3.7 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.

3.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not complied with GDPR requirements.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: www.ico.org.uk

4. Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit agreement for specific processing activities
• Contract Performance: To fulfill service agreements and respond to inquiries
• Legal Obligation: To comply with legal and regulatory requirements
• Legitimate Interests: For business operations, security, and service improvement, balanced against your rights

5. Data Categories and Processing Purposes

Data Category	Purpose	Legal Basis
Contact Information	Service inquiries, project communication	Consent, Contract
Technical Data	Website functionality, security	Legitimate Interest
Project Details	Service delivery, proposal development	Contract
Communication Records	Service provision, record keeping	Contract, Legal Obligation

6. Data Retention Periods

We retain personal data only as long as necessary:

• Inquiry data: 2 years from last contact
• Client project data: Duration of service plus 7 years for accounting purposes
• Website analytics: 26 months
• Cookie data: As specified in cookie consent preferences

7. Data Security Measures

We implement appropriate technical and organizational measures including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments
• Staff training on data protection
• Incident response procedures

8. International Data Transfers

We primarily process data within the UK and European Economic Area. If data is transferred internationally, we ensure appropriate safeguards are in place through standard contractual clauses or other approved mechanisms.

9. Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

10. Data Breach Notification

In the event of a personal data breach that poses risks to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.

11. Exercising Your Rights

To exercise any of your GDPR rights, contact us at [email protected] with:

• Clear description of your request
• Verification of your identity
• Specific data or processing you're referring to

We will respond to verified requests within one month, extendable by two additional months for complex requests.

12. Updates to This Policy

We may update this GDPR compliance information to reflect changes in our practices or legal requirements. Significant changes will be communicated through website notices.