GDPR Compliance

Data Controller

For the purposes of the General Data Protection Regulation, the data controller is the entity operating velvet-nebula.com, with registered office at 42 Merchants Quay, Dublin 8, D08 R2YX, Ireland.

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Consent: When you submit forms or accept cookies
• Contractual necessity: To fulfill service requests and obligations
• Legitimate interests: To improve our services and communicate relevant information
• Legal obligations: To comply with applicable laws and regulations

Data Subject Rights

Under GDPR, you have the following rights:

Right of Access

You may request confirmation of whether we process your personal data and obtain access to such data.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure

You may request deletion of your personal data when it is no longer necessary for the purposes collected, when you withdraw consent, or when there is no legal ground for processing.

Right to Restriction

You may request limitation of processing when you contest accuracy, when processing is unlawful but you oppose erasure, when we no longer need the data but you require it for legal claims, or when you object to processing.

Right to Data Portability

You may request to receive personal data in a structured, commonly used format and transmit it to another controller.

Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

When processing is based on consent, you may withdraw it at any time without affecting lawfulness of processing prior to withdrawal.

Data Protection Officer

For questions regarding data protection or to exercise your rights, contact us at the address provided on our Contact page.

Supervisory Authority

You have the right to lodge a complaint with the Data Protection Commission of Ireland if you believe we have not complied with applicable data protection laws.

International Data Transfers

Your personal data is processed within the European Economic Area. Any transfers outside the EEA are conducted with appropriate safeguards in accordance with GDPR requirements.

Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security assessments.

Last updated: September 2026