What we dowith your data.

Digital Composition Lab (DCL) is an R&D software product development lab. For the personal data described in this notice, DCL is the data controller — the party that decides why and how it is used — within the meaning of Article 4(7) UK GDPR and EU GDPR.

This notice covers digitalcompositionlab.com and our own correspondence, recruitment, and commercial relationships. When we build or operate software for a client, that client is normally the controller and DCL acts as their processor under a written agreement meeting Article 28 — section 10 explains what that means for you.

DCL has assessed the criteria in Article 37 UK GDPR and EU GDPR — public-authority status, large-scale regular and systematic monitoring, and large-scale processing of special-category or criminal-offence data — and none currently applies to our own processing. We are therefore not obliged to appoint a statutory Data Protection Officer, and we would rather say that plainly than imply an office we do not have.

Responsibility is not left unowned. A named privacy lead inside DCL is accountable for this notice, for our Article 30 record of processing activities, for our transfer risk assessments, and for answering your requests. Reach that person at privacy@digitalcompositionlab.com; writing "DPO request" in the subject line routes it directly and starts the statutory clock.

If our processing changes such that a DPO becomes mandatory — or a client contract requires one — we will appoint a qualified person, publish their contact details in this section, and notify the relevant supervisory authority.

With no representative currently required or appointed, the privacy lead above is the single contact for any matter relating to our processing.

Different people give us different data for different reasons, so the sections that follow are organised by who you are. Find yourself here and read that section — the rest may not apply to you at all.

The site is deliberately thin. It sets no cookies of its own, runs no advertising or cross-site analytics, and does not fingerprint your device.

This is the most common reason we hold anything about you: you got in touch about working together.

Once an engagement starts, we hold the ordinary business-contact data needed to run it — as a controller, separately from any personal data inside the systems we build for you, which section 10 covers.

We build some ventures with partners, and we buy services like any other business. Both involve holding contact data about the people on the other side.

Recruitment data is handled by a small number of people and never used for anything other than the hiring decision it belongs to.

DCL does not run a marketing machine. We send nothing you did not ask for, and there is no newsletter you were quietly subscribed to by booking a call.

If we ever publish updates about the lab's work, subscribing will be an explicit, unticked opt-in under Article 6(1)(a), with an unsubscribe link in every message and a preference you can change at any time. Withdrawing it will not affect anything else in our relationship.

When we design, build, test, or operate software for a client, the personal data inside that system belongs to their relationship with you, not ours. The client is the controller; DCL is their processor.

In that role we act only on the client's documented instructions, under an Article 28 agreement that binds us to confidentiality, appropriate security, prior authorisation for any sub-processor, assistance with your rights requests and breach notifications, and deletion or return of the data when the engagement ends. We do not use client data to train models, build our own products, or for any purpose of our own.

If your data sits in a product we built for someone else, exercise your rights with that organisation — they hold the relationship and the record. Write to us at privacy@digitalcompositionlab.com anyway if you cannot identify them, and we will point you to the right controller.

Where an engagement requires access to live personal data, we prefer pseudonymised or synthetic datasets in development and testing, and take production access only where there is no workable alternative — logged, time-limited, and least-privilege.

We set no cookies of our own — no third-party analytics, no advertising, no cross-site tracking, and nothing that requires a consent banner for our own purposes. One embedded third-party tool sets its own.

We count anonymous, aggregate page-engagement events — which pages are viewed, read and scrolled — using no cookies and nothing that identifies you; browsers signalling Global Privacy Control are not counted at all.

The list of third parties is deliberately short. Each acts as our processor under an Article 28 agreement, may act only on our documented instructions, and may not use your data for its own purposes. We do not sell personal data, and we do not share it for anyone else's marketing.

A current list of sub-processors is available on request. Client contracts carry a change-notification commitment, giving you time to object before a new sub-processor starts.

DCL works from Jordan and the United States and collaborates with partners in the United Kingdom, so personal data you send us will be accessed from those countries, and our providers may store it in their own regions. Neither Jordan nor the United States benefits from a general UK or EU adequacy decision.

Every restricted transfer out of the UK or EEA is therefore made under Article 46 safeguards: the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, or the IDTA where it is the appropriate instrument. Each is supported by a documented transfer risk assessment covering the destination's legal regime and, where the assessment calls for it, supplementary measures — encryption in transit and at rest, access controls, pseudonymisation, and a policy of challenging unlawful government access demands.

You have the right to see the safeguards that apply to a specific transfer. Ask at privacy@digitalcompositionlab.com and we will send you a copy of the relevant clauses with commercial terms redacted.

Nothing is kept indefinitely. Each category has a period and a reason for that period, and deletion at the end is a scheduled task rather than an intention.

Our Article 32 measures are the ones we would want from a supplier of ours: access limited to the people who need it and reviewed when roles change; multi-factor authentication on every account; encryption in transit and at rest; separated development, test, and production environments; pseudonymised or synthetic data in non-production wherever it will do; logged and time-limited access to anything live; and confidentiality obligations in every employment and supplier contract.

They are real measures, not a guarantee. No system is perfect, and we would rather say so than claim otherwise.

If a personal data breach occurs, we investigate immediately, contain it, and record it. Where Article 33 requires it we notify the relevant supervisory authority within 72 hours of becoming aware, and where the risk to you is high we tell you directly without undue delay, in plain language, with what happened and what to do about it. Where we are a processor, we notify the client controller without undue delay so they can meet their own obligations.

We make no decisions about you by automated means and we do not profile you. Nothing on this site or in our correspondence produces a legal or similarly significant effect within the meaning of Article 22.

We do not use your personal data to train machine-learning models — not ours, and not a third party's. Where an engagement involves AI systems, the terms are set in the client contract, the client remains the controller, and any use of personal data for training requires their documented instruction and its own lawful basis.

If that ever changes for our own processing, we will describe the logic involved, the significance, and the consequences for you in this section before it starts — along with your right to human review.

These rights are yours by law, they are free to use, and using one never counts against you.

Email privacy@digitalcompositionlab.com and say what you want. There is no form to complete and no account to create, and you never have to explain why.

We may ask one or two questions to confirm you are who you say you are — usually replying from the address we already hold is enough. We ask for identity documents only where the request is high-risk and nothing lighter will do, and we delete anything you send for that purpose as soon as the check is complete.

We respond within one month. For genuinely complex or numerous requests we may extend by up to two further months, and if we do, we tell you why within the first month. Requests are free; the law lets us charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and if we ever rely on that we will explain our reasoning and how to challenge it.

If you are unhappy with our answer, reply and say so — a second person reviews it. That route is optional and never a precondition for going to a regulator.

The California Consumer Privacy Act, as amended by the CPRA, gives you these rights. We honour them for California residents regardless of whether the statutory thresholds apply to us in a given year.

DCL operates from Jordan, and Jordan's Personal Data Protection Law No. 24 of 2023 applies to that processing alongside the obligations above.

Under it you may ask us to confirm what we hold, obtain a copy, correct or update it, request its erasure or the cessation of processing, withdraw a consent you previously gave, and object where processing is unlawful or no longer necessary. Where the law requires consent for a particular purpose, we ask for it specifically rather than bundling it into a general acceptance.

Requests go to privacy@digitalcompositionlab.com on the same terms as every other request in this notice — free, and answered within one month. If our answer does not satisfy you, you may complain to the Personal Data Protection Council established under that law, via the Ministry of Digital Economy and Entrepreneurship.

Our site and services are intended for people acting in a professional capacity. We do not knowingly collect personal data from anyone under 16, and we do not offer information-society services directly to children. If you believe a child has given us data, tell us and we will delete it without delay.

This site links to a small number of external pages — our partners, Calendly, and professional profiles. Once you follow a link, that organisation's privacy notice governs, not ours. We check who we link to, but we do not control what they do with your data and cannot answer for it.

When something material changes — a new processor, a new purpose, a new transfer route, a change of legal basis — we update the date at the top and describe what changed in this section. We do not quietly widen what we do with data you have already given us; where a change requires your consent, we ask before it takes effect.

Version history: August 2026 — first published.

Every question, request, and complaint about personal data goes to privacy@digitalcompositionlab.com. It is the same address for access, correction, deletion, transfer safeguards, and anything you would ordinarily send to a data protection officer. A person reads it.

Postal correspondence can be sent to our registered address in section 01. If you write to us on paper, include an email address or we will be slow.