Privacy policy

Material-UI SAS a Simplified Joint Stock Company (hereinafter "MUI"), registered with the Paris Trade and Companies Register under number 852 357 748, having its registered office at 128 rue La Boétie, 75008 Paris, acting as data controller within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and of French Act No. 78-17 of 6 January 1978 as amended, known as the “French Data Protection Act” (hereinafter together the “Regulations”), attaches particular importance to the protection of personal data and to the privacy of the Users of its services.

This privacy policy applies to the processing of personal data (hereinafter the “Personal Data”) carried out by MUI in connection with the Services, concerning the Users of the Website and of the MUI code Library (hereinafter the “Users”), whether such data are provided directly by the Users or collected indirectly during their browsing, installation, execution or use of the software components distributed by MUI.

The Library means all of the code library components offered by MUI, including in particular Material UI, Joy UI, Base UI and MUI System (open source components), as well as MUI X Pro and MUI X Premium (components distributed under a paid licence).

The Personal Data collected are processed by:

  • MUI, the company operating the website accessible at https://mui.com/ (hereinafter the “Website”), registered with the Paris Trade and Companies Register under number 852 357 748, having its registered office at 128 rue La Boétie, 75008 Paris.

This Privacy Policy (hereinafter the “Policy”) is intended to inform data subjects of the manner in which MUI collects, processes and protects Personal Data in connection with:

  • (i) the production, maintenance and distribution of several open source code libraries (Material UI, Joy UI, Base UI, MUI System);
  • (ii) the marketing of templates via the marketplace (hereinafter “MUI Store”);
  • (iii) the marketing of paid licences for the advanced features of the code libraries (MUI X Pro and MUI X Premium);
  • (iv) browsing on the Website, creation and management of a client account, processing of orders, technical support and management of customer relations;
  • (v) the compliance monitoring of the use of components distributed under a paid licence by means of a telemetry module integrated into those components (hereinafter together the “Services”).

This Policy does not apply to the artificial intelligence features of the components distributed under a paid licence, in particular the MUI X AI Assistant, nor to MUI Recipes, which are governed by a dedicated privacy policy: https://mui.com/legal/ai-privacy/ .

It does not apply either to the processing carried out for the recruitment and the administration of MUI's staff and independent contractors, who receive a separate information notice.

The Website within the meaning of this Policy includes the pages dedicated to the MUI Design Kits and the base-ui.com website.

Given the variety of relationships that MUI maintains with natural persons, this Policy distinguishes, within the generic category of Users, three distinct capacities, which do not necessarily overlap and to which specific processing regimes apply:

  • the Visitors and Customers of the Website, i.e. any natural person who browses the Website, creates a client account, subscribes to a paid licence, purchases a template on the MUI Store marketplace or communicates with MUI’s customer service (hereinafter the “Visitors and Customers”);
  • the Authorised Developers, i.e. any natural person who, acting on behalf of a licensee, installs, runs, integrates or uses the components distributed under a MUI X Pro or MUI X Premium paid licence and whose usage data may be processed by the telemetry module described in Article 1.4 (hereinafter the “Authorised Developers”);
  • the MUI Store Contributors, i.e. any natural person who offers templates for sale on the MUI Store marketplace and receives in that capacity compensation paid by MUI (hereinafter the “Contributors”).

When this Policy uses the term “Users” without further specification, it shall be understood as collectively designating the three capacities set out above. Where a provision specifically targets only one of these capacities, it shall expressly say so.

MUI undertakes to limit the processing of Personal Data to the cases listed in this Policy, and to update the latter in order to ensure a high level of protection of Personal Data in compliance with the applicable Regulations.

By accessing or using the Services, the User acknowledges having read this Policy.

If the User does not agree, they shall cease any use of the Services.

ARTICLE 1. Personal data collected

When using the services offered by MUI, Users may be required to transmit Personal Data, directly or indirectly, in particular through their use of the Website and, as regards Authorised Developers, through their use of the components distributed under a paid licence.

1.1 Data collected automatically when browsing the Website

When a User accesses the Website, Personal Data are collected automatically in order to enable browsing and to ensure the security of the services.

In this respect, MUI may collect:

  • Connection data: IP address, pages viewed, links clicked, connection timestamp;
  • Technical data: type of browser used, operating system, unique connection identifier.

Certain technical data relating to browsers and devices may not, in themselves, directly identify an individual.

However, insofar as such data may, in certain circumstances, be linked to a natural person directly or indirectly, MUI mentions them in this Policy for the sake of transparency.

However, insofar as they may, in certain circumstances, allow the indirect identification of a person, MUI mentions them in this Policy for the sake of transparency.

For further information on the cookies and trackers placed during browsing on the Website, the User is invited to consult Article 5 of this Policy.

1.2 Data provided by Visitors and Customers

Creation of a client account

Access to the subscription, licensing and purchasing services offered on the Website requires the creation of a client account.

In this respect, MUI can collect the following data:

  • Identification and contact data: surname, first name, email address (used as login identifier);
  • Account-related data: email address, password stored in encrypted form, pseudonym displayed by the Website, account preferences and settings.

Certain data are strictly necessary for the authentication of the Customer, the management of their account and the securing of access to the services.

Purchase of a paid licence

When a Customer purchases a MUI X Pro or MUI X Premium licence, MUI collects, through its payment service providers Stripe and PayPal, the data necessary for the processing of the order:

  • Identification and billing data: surname, first name or corporate name, billing address, email;
  • Commercial data: transaction number, history and details of subscriptions, amount of purchases, data relating to the settlement of invoices and to any exchanges connected with the subscription;
  • Payment data, it being specified that banking data (in particular the bank card number) are processed exclusively by the payment service providers Stripe and PayPal, in accordance with their own privacy policies, and are not retained by MUI.

Purchases on the MUI Store marketplace

The MUI Store is a marketplace allowing Visitors and Customers to purchase templates designed on the basis of MUI library components.

When a Customer makes such a purchase, MUI and its payment service providers collect the data necessary for the processing of the order, the delivery of the template and the performance of the contractual relationship.

In this respect MUI collects the following data:

  • Identification and billing data: surname, first name or corporate name, billing address, email;
  • Commercial data: transaction number, history and details of subscriptions, amount of purchases, data relating to the settlement of invoices and to any exchanges connected with the subscription;
  • Payment data, it being specified that banking data (in particular the bank card number) are processed exclusively by the payment service providers Stripe and PayPal, in accordance with their own privacy policies, and are not retained by MUI.

Exchanges with customer service

MUI collects the data arising from exchanges with Visitors and Customers in connection with the management of customer service and technical support, in particular the content of communications sent by email, through the Website or via the technical support tools made available.

Certain data are essential to the creation and management of the client account, to the subscription of a licence, to the processing of a purchase on the MUI Store and, more broadly, to the provision of the services.

If such information is not provided, access to all or part of these services may be limited or impossible.

1.3 Data provided by MUI Store Contributors

Contributors who wish to offer templates for sale on the MUI Store marketplace are required to provide MUI, in addition to basic identification data, with:

  • Banking and financial information enabling the payment of their compensation;
  • Tax information, including where applicable company registration details, enabling compliance with MUI’s reporting and accounting obligations.

These data are strictly necessary for the performance of the contractual relationship binding MUI to its Contributors and for compliance, by MUI, with its legal obligations in tax and accounting matters.

1.4 Data collected by the telemetry module integrated into the MUI X Pro and MUI X Premium components

The components distributed under paid licence by MUI (MUI X Pro and MUI X Premium) incorporate a dedicated telemetry module, named “@mui/x-telemetry”, intended to collect usage data relating to the use of these components by Authorised Developers.

This module operates exclusively in the development environment, either server-side (Node.js) or browser-side depending on the category of data concerned. In the production environment, telemetry is entirely disabled and removed from the executed code.

The telemetry module pursues two distinct purposes.

On the one hand, the improvement of the components, through the analysis of the most used components, the identification of malfunctions and the guidance of future developments.

On the other hand, verifying the compliance of the use of the paid components with the terms of the licence granted, and in particular checking the number of Authorised Developers actually covered by the licence, by counting the development machines.

The telemetry module relies on two distinct mechanisms, structured according to the nature and sensitivity of the data processed.

  • An objection mechanism (“opt-out”) applies to the data collected server-side, enabled by default and based on MUI’s legitimate interest within the meaning of Article 6(1)(f) of the GDPR, the Authorised Developer may object to it at any time and without having to provide any justification.
  • A prior consent mechanism (“opt-in”) applies to the data collected browser-side, which constitute trackers within the meaning of Article 82 of the French Act of 6 January 1978 as amended, disabled by default and based on the free, specific, informed and unambiguous consent of the Authorised Developer, within the combined meaning of Article 6(1)(a) of the GDPR and the aforementioned Article 82.

The table below describes, for the sake of transparency, the categories of data processed by the telemetry module, their collection environment, their description, their nature under the Regulations, their legal basis, the applicable mechanism and their retention period:

Data Environment Description Nature Legal Basis Mechanism Retention Period
machineId Server (Node.js, postinstall) SHA-256 hash of the machine's hardware identifier Pseudonymised personal data Legitimate interest (Art. 6(1)(f) GDPR) OPT-OUT (enabled by default) Duration of the contractual relationship. Archival: 5 years after contract end.
projectId Server (Node.js, postinstall + runtime) SHA-256 hash of the repository or package name Not personal data Legitimate interest (Art. 6(1)(f) GDPR) OPT-OUT (enabled by default) Duration of the contractual relationship. Archival: 5 years after contract end.
isDocker / isCI Server (Node.js, postinstall) Booleans indicating the technical environment Not personal data Legitimate interest (Art. 6(1)(f) GDPR) OPT-OUT (enabled by default) Duration of the contractual relationship. Archival: 5 years after contract end.
anonymousId Browser (runtime, localStorage) Unique identifier stored in the browser's localStorage Personal data - Tracker (Art. 82 French Data Protection Act) Consent (Art. 6(1)(a) GDPR + Art. 82 French DPA) OPT-IN (disabled by default) Duration of the contractual relationship. Archival: 5 years after contract end.
fingerprint Browser (runtime, browser API + localStorage) Browser digital fingerprint (fingerprintjs), non-resettable Non-resettable personal data - Tracker (Art. 82 French DPA) Consent (Art. 6(1)(a) GDPR + Art. 82 French DPA) OPT-IN (disabled by default) Duration of the contractual relationship. Archival: 5 years after contract end.
sessionId Browser (runtime, sessionStorage) Session identifier stored in sessionStorage Ephemeral personal data - Tracker (Art. 82 French DPA) Consent (Art. 6(1)(a) GDPR + Art. 82 French DPA) OPT-IN (disabled by default) Duration of the session

Legend: rows with a yellow background correspond to the objection mechanism (opt-out, enabled by default, can be disabled at any time); rows with a green background correspond to the prior consent mechanism (opt-in, disabled by default, can be enabled only upon the explicit and separate consent of the Authorised Developer).

Server-side data (machineId, projectId, isDocker / isCI)

The collection of these data takes place upon installation of the components (postinstall script), in a Node.js server environment, outside of any web browser.

The processing of these data is based on MUI’s legitimate interest within the meaning of Article 6(1)(f) of the GDPR, which consists in verifying compliance with licence terms by its licensees and in improving the distributed components.

MUI informs the licensee of the existence of this collection from the first use of the components, by way of a clear message displayed in the development terminal.

The licensee and their Authorised Developers may disable this collection at any time, without having to provide any justification, by calling the function “muiXTelemetrySettings.disableTelemetry()” in the application code or by setting the environment variable “MUI_X_TELEMETRY_DISABLED=true”. The deactivation takes effect immediately.

Browser-side data (anonymousId, fingerprint, sessionId)

The collection of these data is disabled by default. It can be enabled only on the basis of the prior, free, specific, informed and unambiguous consent of the Authorised Developer, in accordance with Article 82 of the French Act of 6 January 1978 as amended and Article 6(1)(a) of the GDPR.

Consent may be obtained by any of the following means:

  • (i) a specific message displayed in the browser console upon the first execution of the components, inviting the Authorised Developer to accept or refuse browser-side collection;
  • (ii) the voluntary call to the function “muiXTelemetrySettings.enableBrowserTelemetry()” by the Authorised Developer;
  • (iii) the voluntary setting of the environment variable “MUI_X_BROWSER_TELEMETRY_ENABLED=true”. The Authorised Developer may withdraw their consent at any time by calling the function “muiXTelemetrySettings.disableBrowserTelemetry()” or by setting the environment variable “MUI_X_BROWSER_TELEMETRY_ENABLED=false”. The withdrawal of consent does not affect the lawfulness of processing based on consent carried out prior to such withdrawal.

The data collected by the telemetry module may under no circumstances be commercially exploited for any purpose extraneous to the operation, support, maintenance, improvement, security and compliance management of the components. They are not sold to third parties. Any communication or access granted to third-party providers is strictly limited to what is necessary for the achievement of those purposes.

The detailed operational terms of the telemetry module are described in the “MUI X Telemetry Guide” accessible at https://mui.com/x/guides/telemetry/ .

ARTICLE 2. Purposes of the processing of personal data

MUI collects and processes the Users’ Personal Data in compliance with the Regulations, for the following purposes:

  • Creating, managing and administering client accounts;
  • Ensuring the authentication and securing of access to the client account;
  • Processing and performing licence subscriptions and purchases of templates, collecting payments and issuing invoices;
  • Providing, operating and improving the components distributed under paid licence (MUI X Pro and MUI X Premium);
  • Providing technical support and after-sales service to licensees;
  • Monitoring the compliance of the use of paid components with the terms of the licence granted, by means of the telemetry module described in Article 1.4;
  • Managing the relationship with MUI Store Contributors and paying the compensation due to them;
  • Managing complaints, technical incidents and returns;
  • Ensuring the security of the Website and of MUI’s information systems, preventing fraud and abusive uses;
  • Measuring the audience of the Website, producing usage statistics and analysing the use of the services for improvement purposes;
  • Sending marketing and promotional communications, on the basis of the User’s consent;
  • Complying with the legal, regulatory, accounting and tax obligations applicable to MUI;
  • Managing requests for the exercise of rights and the traceability of the actions carried out in order to demonstrate MUI’s compliance with the Regulations.

ARTICLE 3. Legal bases of processing and retention periods

In accordance with the requirements of Articles 6 and 13 of the GDPR, the processing of Personal Data implemented by MUI is based on distinct legal bases depending on the purposes pursued, as summarised in the table below.

Personal Data concerned Legal basis of processing Retention period
Client account identification and management data (email address, username, optional profile information) Performance of the contract (Art. 6(1)(b) GDPR) Until deletion of the account or after a prolonged period of inactivity, then intermediate archiving of five (5) years to take account of the ordinary civil limitation period (Art. 2224 of the French Civil Code)
Commercial data (transaction number, history and details of subscriptions and purchases of templates, settlement of invoices) Performance of the contract (Art. 6(1)(b) GDPR) Five (5) years from the last contact, then intermediate archiving to take account of the applicable limitation periods
Subscription and usage data (subscription status and timestamps, credit balances and usage metadata, organization, group and team identifiers) Performance of the contract (Art. 6(1)(b) GDPR) Duration of the contractual relationship, then intermediate archiving of five (5) years
Technical support and customer relations data (exchanges, tickets, content of communications) Performance of the contract (Art. 6(1)(b) GDPR) for Customers, legitimate interest (Art. 6(1)(f) GDPR) for users of the open source components One (1) year from the closure of the request, then intermediate archiving of five (5) years to take account of the applicable contractual limitation period
Billing and transaction data (banking data being processed exclusively by the payment service providers) Legal obligation (Art. 6(1)(c) GDPR) Ten (10) years from the issuance of the invoice, pursuant to Article L. 123-22 of the French Commercial Code
Data relating to MUI Store Contributors (identity, banking information) Performance of the contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR) Duration of the contractual relationship; retention of supporting documents and accounting records in accordance with applicable legal obligations
Data relating to contributors to the open source code libraries (identity, contributor licence agreement, vulnerability reports) Performance of the contract (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) Duration of the relationship with the contributor; retention of the accounting records relating to any bounty paid in accordance with applicable legal obligations
Connection and browsing data (IP address, browser type, operating system, pages viewed) Legitimate interest relating to the security of the Website (Art. 6(1)(f) GDPR) Six (6) months maximum, save where longer retention is necessary in the event of a security incident or litigation (evidentiary archiving)
Telemetry data collected server-side: machineId, projectId, isDocker / isCI Legitimate interest (Art. 6(1)(f) GDPR) Duration of the contractual relationship, then intermediate archiving of five (5) years
Telemetry data collected browser-side: anonymousId, fingerprint Consent (Art. 6(1)(a) GDPR and Art. 82 of Act 78-17) Duration of the contractual relationship, then intermediate archiving of five (5) years
Telemetry data collected browser-side: sessionId Consent (Art. 6(1)(a) GDPR and Art. 82 of Act 78-17) Duration of the session, then permanent deletion upon closing of the relevant tab
Data used for commercial prospecting and sending of marketing communications Consent (Art. 6(1)(a) GDPR) or, for communications addressed to professionals, legitimate interest (Art. 6(1)(f) GDPR) Three (3) years from the last contact, then intermediate archiving in the absence of any response or positive action from the User
Data relating to applicants and to MUI's staff and independent contractors Steps taken prior to entering into a contract and performance of the contract (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR) Covered by a separate information notice, to which those persons are referred
Data collected via trackers subject to consent (see Article 5) Consent (Art. 82 of Act 78-17) Lifetime of the trackers limited to thirteen (13) months and retention period of the information collected limited to twenty-five (25) months, in accordance with Article 5 of CNIL Recommendation No. 2020-092 of 17 September 2020

MUI may also process certain data strictly necessary for the prevention of fraud, the securing of the Website, the handling of complaints and the defence of its rights, on the basis of its legitimate interest (Art. 6(1)(f) GDPR) or compliance with a legal obligation (Art. 6(1)(c) GDPR), for periods strictly limited to the purposes pursued.

At the end of the applicable retention periods, the data are deleted or anonymised. MUI carries out, where necessary, periodic reviews in order to verify whether the retention of the data remains justified.

Where the User requests the deletion of their data, MUI shall endeavour to process the request as promptly as possible and, in any event, within a maximum period of one (1) month from its receipt, except where the retention of the data is required or authorised by applicable law.

If new processing of Personal Data is carried out, that is to say where MUI intends to use them for purposes other than those set out above, MUI shall specifically inform the Users by reasonable means so that they may exercise their rights.

ARTICLE 4. Recipients of personal data

MUI discloses Personal Data only in the cases described in this Policy. MUI never sells or rents User data to third parties.

In the course of its business, MUI uses technical service providers who may be required to process certain Personal Data in the capacity of processors within the meaning of Article 28 of the GDPR, or, for some of them, in the capacity of separate data controllers acting in accordance with their own privacy policies.

This is the case, in particular, of the payment service providers and of the banking institutions receiving transfers, which determine on their own the purposes and means of the processing they carry out.

Personal Data are accessible, within MUI and on a need-to-know basis, to the technical, product, sales, support, accounting and administrative teams, according to the purposes described in Article 2.

Outside MUI, Personal Data are disclosed to the following categories of recipients:

  • hosting providers of the Website, of the documentation, of the online store and of the application services, as well as of the telemetry endpoint;
  • the provider responsible for the authentication of client accounts and the securing of access;
  • payment service providers and banking institutions, for the collection of payments and the receipt of transfers;
  • accounting and invoicing providers, for the issuance and the keeping of accounting records;
  • customer support, ticketing and communication tools, including the public code repository platform used for technical support;
  • audience measurement, product analytics and search tools;
  • customer relationship management, business identification and email campaign tools;
  • artificial intelligence model providers and the associated tracing and vector storage tools, in respect of the features described in the dedicated privacy policy;
  • monitoring, error reporting, logging and security tools;
  • human resources, payroll and applicant tracking providers, in respect of the processing concerning MUI's staff and applicants;
  • competent courts, administrative authorities and MUI's professional advisers, where the disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.

The identity of the providers falling within each of these categories, the purpose for which they are engaged, their location and a link to their respective privacy policies are set out at https://mui.com/legal/subprocessors/ .

That page is kept up to date and constitutes the reference list, this Policy setting out only the categories of recipients in accordance with Article 13(1)(e) of the GDPR. Users may obtain, upon request addressed to sales@mui.com, the identity of the recipients to whom their own Personal Data have been disclosed, in accordance with Article 15(1)(c) of the GDPR.

MUI may also be required to disclose Personal Data to administrative or judicial authorities where required by law, in order to comply with applicable law, to enforce its agreements and contractual policies, or to protect and defend its rights and those of third parties.

ARTICLE 5. Cookies and trackers

In connection with the use of the Website, MUI uses cookies and other similar technologies (hereinafter together the “Cookies”) in order to ensure the operation of the Website, to improve the browsing experience, to measure audience and to strengthen security.

Cookies are small text files that may be placed on the User’s device (computer, smartphone, tablet) during browsing. They allow, in particular, the recognition of a device, the storage of certain information or the collection of data relating to browsing.

Other similar technologies, such as web beacons, pixels or browser local storage, may also be used for the same purposes and are subject to the same legal regime.

MUI may use the following categories of Cookies:

  • Strictly necessary Cookies. These cookies are essential for the operation of the Website and for access to its essential functionalities, in particular with regard to security, authentication, access to services and storage of consent preferences. These cookies are exempt from the obligation to obtain consent in accordance with the provisions of Article 82 of the French Act of 6 January 1978 as amended.
  • Personalisation Cookies. These cookies enable the Website to remember the User’s choices (display mode, language, region) and to adapt the display or certain functionalities according to their preferences. Where they are not strictly necessary for the operation of the Website, their placement is subject to prior consent.
  • Audience measurement and performance Cookies. These cookies make it possible to measure Website traffic, to analyse browsing and to improve performance and ergonomics. Their placement is subject to prior consent, except where they strictly meet the exemption conditions set out in Article 5 of CNIL Guidelines No. 2020-091 of 17 September 2020 (purpose strictly limited to audience measurement for the exclusive account of the publisher, absence of global tracking, absence of cross-referencing with other processing and absence of transmission to third parties).
  • Marketing and advertising Cookies. These cookies, placed by MUI or by third parties, make it possible in particular to measure the effectiveness of advertising campaigns and to offer content tailored to areas of interest. These cookies are placed only after prior consent has been obtained.

Upon the first visit to the Website, a dedicated banner allows the User:

  • (i) to accept all Cookies;
  • (ii) to refuse non-essential Cookies;
  • (iii) to configure their choices by category. Preferences may be modified at any time via the cookie management module available on the Website.

Refusal of non-essential Cookies does not prevent access to the Website, but may limit certain functionalities.

For further information on the cookies used, the User is invited to consult the cookies notice available at https://mui.com/legal/cookies/ .

ARTICLE 6. Security of personal data

In accordance with Article 32 of the GDPR, MUI implements appropriate technical and organizational measures in order to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of Users.

As no information system can guarantee absolute security, MUI cannot ensure that the collection, transmission and storage of Personal Data will be entirely secure in all circumstances. In particular, MUI cannot be held liable for the security of data transmitted via networks beyond its control, in particular the Internet or wireless networks.

The security of login credentials also falls within the User’s responsibility, in particular as regards the confidentiality of access, the protection of passwords and the limitation of access to the devices used. In the event of suspected compromise of the account, MUI must be informed as soon as possible at contact@mui.com .

ARTICLE 7. Rights of Users

In accordance with the Regulations, and in particular Articles 15 to 22 of the GDPR, Users have the following rights:

  • Right of access to the Personal Data concerning them (Art. 15 GDPR);
  • Right to rectification of inaccurate or incomplete data (Art. 16 GDPR);
  • Right to erasure of the data (Art. 17 GDPR);
  • Right to restriction of processing (Art. 18 GDPR);
  • Right to data portability (Art. 20 GDPR);
  • Right to object to processing (Art. 21 GDPR), which applies in particular to processing based on MUI’s legitimate interest, including the server-side telemetry processing described in Article 1.4;
  • Right to withdraw consent at any time where the processing is based on consent, without affecting the lawfulness of processing based on consent carried out prior to such withdrawal (Art. 7(3) GDPR);
  • Right to give directions regarding the retention, erasure and communication of data after death (Art. 85 of the French Act of 6 January 1978 as amended);
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

These rights may be exercised by contacting MUI at contact@mui.com , or by postal mail addressed to: MATERIAL-UI, to the attention of the Privacy Officer, 128 rue La Boétie, 75008 Paris, France.

In accordance with Article 12(3) of the GDPR, MUI has a period of one (1) month from receipt of the request to respond to it. This period may be extended by two (2) months in the event of complexity or a high number of requests.

MUI may be required to ask the User to provide proof of their identity before acting on their request.

The User may at any time object to receiving marketing and promotional communications, by any of the following means:

  • (i) by modifying the preferences of their client account;
  • (ii) by clicking on the unsubscribe link included in each communication;
  • (iii) by contacting MUI at contact@mui.com .

Withdrawal of consent to promotional communications does not prevent MUI from sending non-promotional communications relating to the performance of the contract (service information, billing, support).

ARTICLE 8. Minors’ privacy

The services offered by MUI are intended for a professional audience and are not specifically designed for persons who have not reached the legal age of majority. MUI does not knowingly collect Personal Data concerning minors.

Should MUI become aware that Personal Data concerning a minor have been collected without the required consent, MUI undertakes to take all appropriate measures to delete such data as soon as possible.

Parents or legal representatives may contact MUI at contact@mui.com in order to request such deletion.

ARTICLE 9. Transfers of personal data outside the European Union

In order to ensure the operation of its services, and given the international dimension of its business, MUI uses technical service providers whose infrastructures are located within the European Union and, for some of them, outside the European Union.

Part of the Personal Data is processed and stored within the European Union or the European Economic Area, in particular as regards the hosting of the online store, the processing of card payments, the receipt of bank transfers, customer support, product analytics, accounting and payroll, and the human resources information system.

Other Personal Data are transferred outside the European Union, principally to the United States of America, in respect of the hosting of the application services and of the telemetry endpoint, the authentication of client accounts, certain payment services, business identification and prospecting, audience measurement, the artificial intelligence features described in the dedicated privacy policy, monitoring and error reporting, and applicant tracking.

The location of each provider is set out, and kept up to date, at https://mui.com/legal/subprocessors/ .

Where Personal Data are transferred outside the European Union, MUI frames such transfers by means of the appropriate safeguards provided for in Chapter V of the GDPR, namely:

  • an adequacy decision adopted by the European Commission in respect of the third country concerned or, as regards the United States of America, the adequacy decision of 10 July 2023 adopted under the EU-US Data Privacy Framework, which applies only to providers certified under that framework and for the scope of data covered by their certification;
  • the standard contractual clauses adopted by the European Commission, in the module corresponding to the capacity of each party, together, where necessary, with supplementary measures intended to ensure a level of protection substantially equivalent to that ensured within the European Union;
  • or any other transfer mechanism provided for by the Regulations.

Users may obtain a copy of the safeguards applicable to the transfers concerning them, or details of where they have been made available, upon request addressed to sales@mui.com, in accordance with Articles 13(1)(f) and 15(2) of the GDPR.

ARTICLE 10. Amendment of the privacy policy

This Policy may be amended at any time in order to take account of legal, regulatory, case-law, technical or operational developments affecting the processing of Personal Data implemented by MUI.

MUI shall update the “last updated” date appearing at the top of this Policy and shall publish the updated version on the Website.

Where the amendments made are substantial and likely to have a significant impact on the rights or obligations of Users, MUI shall implement reasonable means of information, in particular through the display of a message on the Website or, where appropriate, through the sending of a notification.

ARTICLE 11. Right to lodge a complaint

MUI undertakes to process Personal Data in compliance with the applicable Regulations and, in particular, the GDPR. For any question, request or complaint, the User is invited to contact MUI in priority at contact@mui.com .

Without prejudice to any other administrative or judicial remedy, the User has the right to lodge a complaint with the competent supervisory authority for the protection of personal data. Given the international dimension of MUI’s business, the competent authorities may in particular be:

  • for France and the European Union, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, https://www.cnil.fr ;
  • for the United Kingdom, the Information Commissioner’s Office (ICO), https://ico.org.uk ;
  • for Switzerland, the Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch ;
  • for the United States of America, State attorneys general may be called upon; for the State of California, jurisdiction is shared with the California Privacy Protection Agency (CPPA), https://cppa.ca.gov .

MUI nevertheless favours, wherever possible, prior discussion so as to allow the amicable resolution of any difficulty relating to the processing of Personal Data.

ARTICLE 12. Applicable foreign laws

Given the international dimension of the services offered by MUI, Users residing in jurisdictions where the GDPR does not apply may also benefit from the protections afforded by the applicable local laws. For information:

For the exercise of their rights under these laws, Users may contact MUI at contact@mui.com .

Last update: October 26th, 2026.