Legal & Compliance
GDPR Notice for EU/EEA Users
How MumuWorks applies GDPR principles, legal bases, data subject rights, transfer safeguards, and retention rules when personal data is processed in connection with EEA users.
1. Scope
This GDPR Notice applies to users located in the European Economic Area, or EEA, when personal data is processed by MumuWorks in connection with its websites, tenant applications, AI assistants, workflow tools, knowledge base features, WhatsApp integrations, support services, billing operations, or other customer-facing services.
Depending on the feature and customer relationship, MumuWorks may act as a controller for website, account, support, security, and billing data, or as a processor on behalf of a customer that uses MumuWorks to process its own business and end-customer data. Where MumuWorks acts only as a processor, requests about that customer-controlled data may need to be directed to the relevant customer first.
2. Legal bases for processing
MumuWorks relies on one or more lawful bases under the GDPR depending on the processing context.
Contract performance
We process personal data when necessary to create accounts, deliver subscriptions, authenticate users, provide requested AI and automation features, maintain integrations, respond to support inquiries, and administer the service relationship.
Legitimate interests
We may process data for service security, abuse prevention, fraud detection, internal analytics, operational monitoring, support quality, product improvement, and reasonable commercial administration, provided those interests are not overridden by individual rights.
Legal obligations
We may process and retain data where required to comply with accounting, tax, regulatory, audit, law-enforcement, sanctions, security, or dispute-resolution obligations.
Consent
Where required, we rely on consent for non-essential cookies, certain communications, or other optional processing. Consent can be withdrawn at any time, although withdrawal does not affect processing already carried out before withdrawal.
3. Data subject rights
Subject to verification, legal exceptions, and the role MumuWorks plays in the relevant processing activity, EEA users may have the following rights:
Right of access
You may request confirmation that personal data is being processed and obtain a copy of relevant information about the processing.
Right to rectification
You may ask us to correct inaccurate or incomplete personal data where we are responsible for the relevant records.
Right to erasure
You may request deletion of personal data where the GDPR provides that right, for example when data is no longer necessary, consent is withdrawn, or processing is unlawful, subject to retention duties and lawful exceptions.
Right to restrict processing
You may ask us to limit processing in circumstances such as contested accuracy, disputed lawful basis, or pending objection review.
Right to object
You may object to processing based on legitimate interests, including related profiling, and we will assess whether compelling legitimate grounds override the objection.
Right to data portability
Where applicable, you may request a structured, commonly used, machine-readable copy of personal data processed by automated means on the basis of consent or contract.
Right to withdraw consent
Where processing depends on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
Right to lodge complaints
You may lodge a complaint with an EEA supervisory authority if you believe your personal data has been processed in a way that violates applicable law.
4. International transfers
MumuWorks may transfer personal data outside the EEA when necessary to provide hosting, storage, AI processing, messaging, support, or related services. Where such transfers occur, MumuWorks uses appropriate safeguards that may include contractual protections, provider commitments, security controls, access restrictions, and operational measures designed to protect transferred data.
5. Data retention
MumuWorks retains personal data only for as long as needed to fulfill the purposes for which it was collected, provide the service, maintain required records, resolve disputes, enforce agreements, and comply with legal obligations. Retention periods vary based on the data type, the customer relationship, operational necessity, and applicable legal or regulatory requirements.
6. Contact and complaints
To exercise a GDPR-related request or raise a privacy question, contact [email protected]. If you remain dissatisfied after contacting MumuWorks, you may lodge a complaint with your local EEA supervisory authority.