GDPR & Privacy Compliance

Roles

For account and billing data, Irmu is the controller. For content retrieved through the API on your instruction, Irmu is a processor and you are the controller — you decide what is collected and why.

Lawful basis

We process account data to perform our contract with you, usage metadata under legitimate interests in securing and operating the platform, and marketing data on consent.

Transfers

Data may be processed in the United States and the European Union. Transfers out of the EEA rely on Standard Contractual Clauses supplemented by encryption in transit and at rest.

Data subject requests

If you receive a request relating to data you processed through Irmu, we will assist you in responding within the statutory timeframe. Requests can be raised at info@irmu.com.

We maintain records of processing and notify affected customers of a personal data breach without undue delay and within 72 hours of becoming aware of it.