EU/UK Data Rights

Last Updated: March 9, 2026

If you are located in the European Union (EU) or United Kingdom (UK), you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR. This page explains those rights and how to exercise them.

1. Legal Basis for Processing

We process your personal data under the following legal bases:

1.1 Contractual Necessity

Processing necessary to perform our contract with you (providing AI coaching services).

1.2 Legitimate Interest

Processing necessary for our legitimate interests in operating, improving, and securing our platform, provided these interests do not override your rights.

1.3 Consent

For certain processing activities (e.g., marketing communications), we rely on your explicit consent, which you may withdraw at any time.

1.4 Legal Obligations

Processing necessary to comply with legal obligations under EU or member state law.

2. Your Rights Under GDPR

As an EU/UK data subject, you have the following rights:

2.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to access that data along with information about:

• The purposes of processing
• The categories of personal data
• The recipients of your data
• The retention period
• Your other GDPR rights

2.2 Right to Rectification (Article 16)

You can request correction of inaccurate personal data or completion of incomplete data.

2.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there's no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data was unlawfully processed
• Deletion is required to comply with a legal obligation

2.4 Right to Restriction of Processing (Article 18)

You can request that we restrict processing of your data when:

• You contest the accuracy of the data (during verification)
• Processing is unlawful but you oppose deletion
• We no longer need the data but you need it for legal claims
• You've objected to processing (pending verification of legitimate grounds)

2.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller where:

• Processing is based on consent or contract
• Processing is carried out by automated means

Note: This feature is available on our Annual subscription plan.

2.6 Right to Object (Article 21)

You can object to processing of your personal data when:

• Processing is based on legitimate interests
• Processing is for direct marketing purposes
• Processing is for scientific/historical research or statistical purposes

2.7 Right Not to be Subject to Automated Decision-Making (Article 22)

While Serene Space AI uses AI for coaching, we do not make automated decisions that produce legal effects or similarly significantly affect you without human oversight. You have the right to:

• Obtain human intervention
• Express your point of view
• Contest automated decisions

2.8 Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

2.9 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe we've violated GDPR. See Section 6 for contact details of EU supervisory authorities.

3. How to Exercise Your Rights

To exercise any of your GDPR rights:

Response Time: We will respond to your request within one month of receipt. If your request is complex, we may extend this period by two additional months and will inform you of the extension.

No Fee: Exercising your rights is free of charge. However, we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

4. International Data Transfers

Serene Space AI is based in the United States. When you use our services from the EU/UK, your personal data is transferred to the U.S. We protect your data during international transfers through:

4.1 Standard Contractual Clauses (SCCs)

We use European Commission-approved Standard Contractual Clauses for data transfers to ensure adequate protection equivalent to GDPR standards.

4.2 Additional Safeguards

• Healthcare-grade encryption (AES-256)
• TLS 1.3 for data in transit
• SOC 2 Type II certified data centers
• Regular security audits and assessments
• Strict data access controls

4.3 Third-Party Processors

We only work with third-party service providers who provide adequate GDPR-compliant safeguards. All processors are bound by Data Processing Agreements (DPAs) that include Standard Contractual Clauses.

5. Data Protection Officer (DPO)

While not legally required to appoint a DPO, we have designated a privacy team to handle GDPR compliance matters:

6. EU Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority in your EU member state, place of work, or place of alleged infringement.

Key Supervisory Authorities:

• Ireland (European HQ for many tech companies): Data Protection Commission (DPC) - www.dataprotection.ie
• UK: Information Commissioner's Office (ICO) - ico.org.uk
• Germany: Federal Commissioner for Data Protection - www.bfdi.bund.de
• France: Commission Nationale de l'Informatique et des Libertés (CNIL) - www.cnil.fr

For a complete list of EU supervisory authorities, visit: EDPB Member List

7. UK-Specific Information

For UK residents, the UK GDPR and Data Protection Act 2018 apply. Your rights are substantially the same as under EU GDPR. The UK supervisory authority is:

8. Data Retention

We retain your personal data as follows:

• Active accounts: For the duration of your subscription plus 90 days
• Deleted accounts: Permanently deleted within 30 days (up to 90 days in backup systems)
• Financial records: 7 years (legal requirement)
• Anonymized data: May be retained indefinitely for research and analytics

9. Children's Data

Serene Space AI is not intended for children under 18. We do not knowingly collect data from children. If we discover we have collected data from a child under 16 (the age of consent under GDPR), we will delete it immediately.

10. Updates to This Notice

We may update this EU/UK Data Rights notice from time to time. Material changes will be communicated via email or platform notification at least 30 days in advance.

11. Additional Resources

For more information, please review:

• Privacy Policy - Our complete privacy practices
• Terms of Service - Platform terms and conditions
• GDPR Official Text: gdpr-info.eu
• UK GDPR Guidance: ICO GDPR Guide