Privacy policy

1. Controller

LUMORIA LLC, identification number 405860992 (registered with the National Agency of Public Registry, Georgia), Kukuri Gogiashvili I lane N8, floor N3, apartment N44, Saburtalo district, Tbilisi, Georgia, is the controller for the personal data described in this policy. For privacy questions, contact finance@lumoria.cloud.

2. Data we process as controller

Customers and prospective customers

• Name, business name, email address and phone number.
• Business details needed to connect Lumoria, such as your phone number, appointment system and website.
• Subscription and billing status. Payment details are processed by 2Checkout (Verifone) and do not reach us.
• Messages you send us and support history.
• Dashboard login data and usage logs needed for security.

Visitors of lumoria.cloud

When you visit this website, our hosting provider processes technical data such as your IP address and browser type to deliver the pages and protect against abuse. This website does not use tracking or advertising cookies.

3. Purposes and legal bases

• Providing the subscription, onboarding and support: performance of a contract (Article 6(1)(b) GDPR).
• Billing and administration: legal obligation (Article 6(1)(c)) and performance of a contract.
• Security, fraud prevention and improving the service: legitimate interest (Article 6(1)(f)).
• Answering questions you send us: legitimate interest or steps prior to a contract.

4. Data we process on behalf of our customers

When a business uses Lumoria, we process personal data of its customers, callers and website visitors, such as names, phone numbers, email addresses, appointment data, text messages and chat conversations. For this data, the business is the controller and we act as its processor under Article 28 GDPR. We process this data only on the instructions of the business and only to run the service. A data processing agreement is available on request. If you are a customer of a business that uses Lumoria, please contact that business first to exercise your rights.

5. Payments

Orders are processed by 2Checkout (Verifone), our authorized reseller and merchant of record. 2Checkout processes your payment and billing data as an independent controller under its own privacy policy. We receive confirmation of your order and subscription status, but never your full card or bank details.

6. Where data is stored

We store personal data on servers in the European Union. If a service provider processes data outside the European Economic Area, we make sure appropriate safeguards are in place, such as the Standard Contractual Clauses of the European Commission.

7. Sharing with others

We never sell personal data. We share data only with service providers that we need to run Lumoria, such as hosting, telephony and text messaging, email and support providers, and only to the extent required. These providers act as our processors and are bound by a data processing agreement. We may also share data when required by law.

8. Retention

• Account and customer data: for the duration of the subscription and up to 90 days after it ends, unless a longer period is required by law.
• Data processed on behalf of a business: deleted or returned within 90 days after the subscription ends, or earlier on request.
• Billing records: as long as required by tax and accounting law.
• Support emails: up to two years after the last contact.

9. Security

We take appropriate technical and organizational measures to protect personal data, including encrypted connections, access control and the principle of least privilege. If a personal data breach occurs that affects you, we will inform you and, where required, the supervisory authority.

10. Your rights

Under the GDPR you have the right to:

• access your personal data;
• have incorrect data corrected;
• have your data erased;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent.

To exercise your rights, email finance@lumoria.cloud. We respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority, for example in the country where you live or work.

11. Changes

We may update this policy. The date at the top of this page shows the latest version. If changes are material, we inform our customers by email.