Privacy Policy

1. Data Controller

The data controller responsible for the processing of personal data described in this Privacy Policy is:

Lumenwise OÜ
Registry code: 16102381
Tiskrevälja tn 59-12, 13516 Tallinn, Republic of Estonia
Email: info@lumenwise.ee

For all data protection matters, you may contact us at the email address above.

2. Scope of This Policy

This Privacy Policy explains how Lumenwise OÜ collects, uses, stores, and protects personal data in connection with the website located at lumenwise.ee (the "Website") and any email communications initiated by you. This policy is provided in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

This Privacy Policy should be read together with our Terms and Conditions.

3. Data We Do Not Collect

We designed this Website to respect your privacy by default. The Website:

• Does not use cookies of any kind (no session cookies, no tracking cookies, no third-party cookies);
• Does not use analytics services (no Google Analytics, no Matomo, no similar tools);
• Does not use tracking technologies (no pixels, no fingerprinting, no beacons);
• Does not make requests to third-party servers — all fonts, styles, and assets are self-hosted on our own infrastructure;
• Does not collect or process any personal data through passive use of the Website.

As a result, simply visiting and browsing this Website does not result in any processing of your personal data by Lumenwise OÜ.

4. Data We May Process

We process personal data only when you voluntarily contact us. The following table describes the categories of data, purposes, and legal bases:

Data category	Purpose	Legal basis (GDPR)	Retention period
Name, email address, and content of your email	To respond to your enquiry and, where applicable, to take pre-contractual steps at your request	Art. 6(1)(b) — performance of a contract or pre-contractual measures at the data subject's request	24 months after the last communication, unless a contractual relationship is established (in which case, the applicable contract retention period applies)
Any additional personal data you voluntarily include in your correspondence	To understand and respond to the context of your enquiry	Art. 6(1)(b) — pre-contractual measures	Same as above

We do not use your personal data for marketing, profiling, automated decision-making, or any purpose other than those stated above.

5. Data Sharing and Transfers

Lumenwise OÜ does not sell, rent, or trade your personal data to any third party.

Your personal data may be disclosed only in the following limited circumstances:

• Legal obligation: where required by applicable law, regulation, or legal process (e.g., a court order or request from a competent supervisory authority);
• Professional advisors: to our legal or financial advisors, who are bound by professional confidentiality obligations;
• Email infrastructure: our email service processes your communications. Email data may transit through servers located in the European Economic Area (EEA). We do not use email providers that transfer data outside the EEA without adequate safeguards under GDPR Chapter V.

No personal data is transferred to countries outside the European Economic Area (EEA) in connection with this Website.

6. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Right of access (Art. 15) — You have the right to obtain confirmation as to whether personal data concerning you is being processed, and to access that data.
• Right to rectification (Art. 16) — You have the right to request correction of inaccurate personal data.
• Right to erasure (Art. 17) — You have the right to request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to restriction of processing (Art. 18) — You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability (Art. 20) — You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21) — You have the right to object to the processing of your personal data at any time. Where we process data based on legitimate interests, we will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3)) — Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right not to be subject to automated decision-making (Art. 22) — We do not engage in automated decision-making or profiling.

To exercise any of these rights, please contact us at info@lumenwise.ee. We will respond to your request within 30 days, as required by law. There is no fee for exercising your rights, except in cases of manifestly unfounded or excessive requests.

7. Data Security

Lumenwise OÜ implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encryption of email communications where supported by the recipient's email provider (TLS);
• Access controls limiting personal data access to authorised personnel only;
• Regular review of data processing practices and security measures.

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Lumenwise OÜ will notify the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) within 72 hours of becoming aware of the breach, in accordance with Art. 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with Art. 34 GDPR.

9. Supervisory Authority

If you believe that our processing of your personal data violates applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Republic of Estonia
Phone: +372 627 4135
Email: info@aki.ee
Website: www.aki.ee

If you are resident in another EU/EEA Member State, you may also lodge a complaint with the supervisory authority in your country of residence.

10. Hosting and Server Logs

This Website is hosted on Vercel Inc. infrastructure. Vercel may process limited server log data (such as IP addresses and request timestamps) for the purposes of maintaining service availability and security. This processing is carried out by Vercel as a data processor under standard contractual clauses. For details, please refer to Vercel's Privacy Policy.

Lumenwise OÜ does not access, store, or process these server logs and has no technical means to identify individual visitors to the Website.

11. Children's Privacy

This Website is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be indicated by updating the version number and "Last updated" date at the top of this page. Material changes will be communicated through a prominent notice on the Website. We encourage you to review this Privacy Policy periodically.

13. Contact

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact:

Lumenwise OÜ
Tiskrevälja tn 59-12, 13516 Tallinn
Email: info@lumenwise.ee
Registry code: 16102381
Republic of Estonia