This notice explains how Media Strategy Lab ("we", "us") processes personal data when you visit this website or contact us, in line with the EU General Data Protection Regulation (GDPR).
1. Controller
Media Strategy Lab, a brand of Orion Media Group LLC
30 N Gould St, Ste 5113, Sheridan, WY 82801, USA
Contact: via the contact form on this website
2. Data we process
- Server log data: IP address, date and time of request, browser and operating system, referrer URL. Legal basis: Art. 6(1)(f) GDPR (secure, stable operation).
- Contact form: name, email address, company/channel, service interest, budget range and your message. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(a) GDPR where you give consent.
- Email correspondence: the content you send us and your contact details. Legal basis: Art. 6(1)(b) and (f) GDPR.
Providing data is voluntary, but without your name, email and message we cannot answer an enquiry.
3. Cookies and local storage
We use only strictly necessary cookies and browser local storage required to deliver the site and remember your cookie choice. No advertising or cross-site tracking cookies are set without your prior consent (Art. 6(1)(a) GDPR, § 25 TDDDG). You can withdraw consent at any time by clearing your browser storage for this site.
4. Processors and recipients
We use carefully selected service providers bound by data processing agreements under Art. 28 GDPR: our website hosting provider and our database/backend provider (used to store contact form submissions), plus our email provider. Where data is transferred outside the EEA, transfers are protected by EU Standard Contractual Clauses. We do not sell personal data.
5. Retention
- Server logs: deleted or anonymised after a maximum of 30 days.
- Contact enquiries: kept for up to 24 months after the last contact, unless statutory commercial or tax retention periods (up to 10 years) apply.
6. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15)
- rectification of inaccurate data (Art. 16)
- erasure / "right to be forgotten" (Art. 17)
- restriction of processing (Art. 18)
- data portability (Art. 20)
- object to processing based on legitimate interests (Art. 21)
- withdraw consent at any time with future effect (Art. 7(3))
- lodge a complaint with a supervisory authority (Art. 77)
To exercise any right, send a request through the contact form on this website. We respond within one month.
7. Security
This site is served over TLS/HTTPS. Contact submissions are stored in an access-restricted database with row-level security, so submitted data is not publicly readable.
Access to submitted enquiries is limited to the members of our team who need it to respond to you, authentication to our backend is protected, and administrative credentials are not shared. We review access rights periodically and remove them when a team member no longer requires them.
8. Client project data
When you engage us for production work, we may process footage, images and audio that contain personal data of identifiable individuals, such as your staff, customers, patients or event attendees. In that context we act as a processor and you act as the controller. We process that material only on your documented instructions and for the purpose of producing the agreed deliverables.
You are responsible for obtaining the consents and releases required for the individuals who appear in the material you send us. Where your industry imposes additional obligations, such as patient confidentiality in healthcare or client confidentiality in legal and financial services, you remain responsible for confirming that the material may lawfully be shared and published. A separate data processing agreement covering this processing is available on request.
Project media is held in access-restricted cloud storage during an engagement and is removed from our working storage within ninety days of final delivery unless you ask us in writing to retain it for longer.
9. International transfers
We are established in the United States, and some of our service providers process data in the United States and other countries outside the European Economic Area. Where personal data of individuals in the EEA or the United Kingdom is transferred, we rely on the EU Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum, together with supplementary technical measures such as encryption in transit and at rest.
10. Analytics and measurement
We keep measurement on this site deliberately minimal. Where any analytics or performance measurement is used, it is limited to aggregate, non-advertising purposes and is only activated after you accept the relevant cookie category. We do not build advertising profiles from your visit, and we do not share visitor-level data with advertising networks.
11. Children
This website and our services are directed at businesses and professionals and are not intended for children. We do not knowingly collect personal data from anyone under sixteen. If you believe a child has provided personal data through this site, contact us and we will delete it.
12. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
13. Complaints
If you believe our processing infringes data protection law, we would prefer that you raise it with us first so we can resolve it quickly. You also have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, place of work or the place of the alleged infringement.
14. Changes
We may update this notice when our services or the legal environment change. The current version always applies, and material changes affecting an ongoing client engagement are communicated in writing.