We respect your privacy and only use personal data where we have a clear reason and a lawful basis to do so. This policy explains what we collect, why, how long we keep it, and how you can exercise your rights. If anything is unclear, contact us at info@lumivodigital.eu.
1. Who we are
The data controller responsible for your personal data is:
We are not required to appoint a Data Protection Officer. For any privacy question or request, please contact us at the email address above.
2. What this policy covers
This policy applies to personal data we process when you visit our website, fill in our consultation form, email or call us, or become a client of our website development, SEO, social media management, automation, system design and CRM services. It does not cover personal data we process on behalf of our clients; see section 11.
3. Personal data we collect
Information you give us
- Consultation form: your name, business name, email address, phone number (optional), website or social media page, industry, country and city, the services you are interested in, the challenges you describe, team size, preferred start time, and your preferred date and time for a meeting.
- Communication: the content of emails, messages and calls you have with us, and notes from consultation meetings.
- Clients: contact details of your representatives, contract and billing details, and information you share with us to deliver the agreed services.
Information collected automatically
- Technical data: IP address, browser type, device and operating system, and the date and time of your visit, recorded by our hosting and security provider in server logs.
- Language preference: the language you choose is saved in your browser so the site stays in that language (see section 9).
Please do not include sensitive information (for example health, religion or political opinions) in the form or in messages to us. We do not need it, and we do not intentionally collect special categories of personal data.
4. Why we use it and our legal basis
We only process personal data where the GDPR allows it. The table below explains each purpose and its legal basis under Article 6(1) GDPR.
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and arranging a consultation | Steps taken at your request before entering a contract (Art. 6(1)(b)); where you tick the consent box, also your consent (Art. 6(1)(a)) |
| Providing our services and managing the client relationship | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Keeping our website secure, preventing abuse and fixing technical problems | Our legitimate interest in a safe, working website (Art. 6(1)(f)) |
| Following up on an enquiry within a reasonable time, and defending legal claims | Our legitimate interests (Art. 6(1)(f)) |
| Sending newsletters or marketing emails | Only with your consent (Art. 6(1)(a)); you can unsubscribe at any time |
Where we rely on legitimate interests, we have balanced those interests against your rights and you can object at any time (section 8). Where we rely on consent, you can withdraw it at any time without affecting processing that took place before. We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
5. Who we share it with
We never sell your personal data. We only share it where necessary, with:
- Service providers (processors) who act on our instructions under a data processing agreement, including:
- Cloudflare, Inc.: website hosting, DNS, security and bot protection (Turnstile)
- Zoho Corporation: business email (EU data centre)
- Google: email and productivity tools
- Brevo (Sendinblue SAS, France): delivery of the emails sent through our website’s contact form
- Our team members and contractors, who only access what they need to do their work and are bound by confidentiality.
- Professional advisers, such as accountants and lawyers, under a duty of confidentiality.
- Public authorities, where we are legally required to do so.
- A buyer or successor if our business is reorganised or sold, in which case your data stays protected under this policy.
6. Transfers outside the EEA
Some of our service providers and team members are located, or may access data, outside the European Economic Area. When this happens, we make sure your data stays protected by using at least one of the safeguards set out in Chapter V GDPR: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the recipient is certified), or the European Commission’s Standard Contractual Clauses together with additional measures where needed. You can ask us for more information about these safeguards.
7. How long we keep it
- Enquiries that do not lead to a contract: up to 12 months after our last contact, then deleted.
- Client data: for the duration of our contract and up to 3 years after it ends, to handle questions or legal claims.
- Accounting documents: 7 years, as required by the Estonian Accounting Act.
- Marketing consent: until you withdraw it or unsubscribe.
- Server logs: for a short period set by our hosting provider, usually no longer than needed for security.
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification of inaccurate or incomplete data.
- Erasure of your data, where there is no longer a valid reason to keep it.
- Restriction of processing in certain situations.
- Data portability: receiving your data in a structured, machine-readable format.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, email info@lumivodigital.eu. It is free of charge. We will reply within one month; for complex requests this may be extended by up to two further months, and we will tell you if so. We may ask you to confirm your identity before acting on a request, to protect your data.
9. Cookies and local storage
We do not use advertising or tracking cookies, and we do not currently use analytics. Our website only uses:
- Language preference: stored in your browser’s local storage when you choose a language, so the site remembers it. It never leaves your device and you can clear it at any time in your browser settings.
- Security cookies: our hosting provider Cloudflare may set strictly necessary cookies to protect the site against bots and attacks.
These are strictly necessary for the website to work as you request, so they do not require consent. If we ever introduce analytics or marketing cookies, we will ask for your consent first and update this policy.
10. How we protect your data
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS/TLS), access limited to people who need it, strong passwords and two-factor authentication, and data processing agreements with our providers. No method of transmission or storage is completely secure, but we work to protect your data and review our measures regularly. If a personal data breach occurs that is likely to put your rights at risk, we will notify the supervisory authority within 72 hours where required, and inform you without undue delay where the risk is high.
11. Data we process for clients
When we build websites, manage social media, or set up automations and CRM systems for clients, we may process personal data of our clients’ customers on their behalf. In that case our client is the data controller and we act as a data processor under Article 28 GDPR. That processing is governed by a separate data processing agreement with the client, not by this policy. If you are a customer of one of our clients, please contact that business directly.
12. Children
Our services are intended for businesses and adults. Our website is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.
13. Links to other websites
Our website may link to other websites and social media platforms. We are not responsible for their content or privacy practices. Please read their privacy policies before sharing any personal data with them.
14. Changes to this policy
We may update this policy when our services, providers or legal requirements change. The latest version is always published on this page with its “last updated” date. If we make significant changes that affect how we use your data, we will let you know where appropriate.
15. Complaints and contact
If you have a concern, please contact us first at info@lumivodigital.eu. We will do our best to resolve it.
You also have the right to lodge a complaint with a data protection supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee. You can also contact the authority in the EU country where you live or work, for example the Swedish Authority for Privacy Protection (IMY), www.imy.se.
This policy is governed by the laws of the Republic of Estonia and applicable European Union law. Nothing in this policy limits your rights under the GDPR.
Questions about your data?
We usually reply within one working day.