Privacy Policy

Effective Date: October 1, 2024

This Privacy Policy outlines how Lumiotech Private Limited ("Company", "we", "us", "our") collects, uses, stores, and protects ("processes") your digital personal data in compliance with the Digital Personal Data Protection (DPDP) Act, 2023, and other applicable Indian laws.

Depending on the specific platform and Services provided, Lumiotech may act as either a "Data Fiduciary" (determining the purpose and means of processing) or a "Data Processor" (processing data on behalf of a Data Fiduciary). By providing your free, specific, informed, unconditional, and unambiguous consent, you agree to the collection and use of information in accordance with this policy. We will not use or share your information with anyone except as described in this Privacy Policy.

Information Collection and Use

The types of information we may collect include:

• "Personal Data": Information that can identify you personally, such as name and email
• "Usage Data": Information about how you use our services
• "Cookies": Small pieces of data stored on your device
• "Log Data": Information automatically collected when using our services

1. Definitions

For the purpose of this Policy:

• "Personal Data" (or Digital Personal Data) means any data about an individual who is identifiable by or in relation to such data
• "Data Principal" means the individual to whom the personal data relates
• "Data Fiduciary" means any person who alone or in conjunction with others determines the purpose and means of processing of personal data
• "Corporate Data" means any information related to business operations, including but not limited to financial records, operational data, and proprietary information
• "User" refers to any individual or entity accessing or using our Services

2. Information We Collect

2.1 Platform-Specific Information

Depending on the platform you use, we collect:

2.2 Automatically Collected Information

Our systems automatically collect:

• Device information (IP address, browser type, operating system)
• Usage statistics and patterns
• Performance metrics
• Error logs and crash reports
• Authentication data

3. Legal Basis for Processing

We process your information based on:

• Extracted, free, specific, informed, and unambiguous consent
• For certain legitimate uses (such as medical emergencies or employment purposes)
• Legal compliance requirements
• Contractual obligations
• Public interest (for defense and law enforcement platforms)

4. Use of Information

We use collected information for:

• Service improvement and optimization
• Security and fraud prevention
• Regulatory compliance
• Customer support

5. Data Storage and Security

We implement comprehensive security measures including:

• Data encryption (in transit and at rest)
• Access controls and authentication
• Regular security audits
• Intrusion detection systems
• Disaster recovery procedures

All data is stored on servers located in India in compliance with data localization requirements. For lumioSentry, additional security measures equivalent to IL6 standards are implemented.

6. Data Sharing and Disclosure

We may share information with:

• Government authorities and regulators (RBI, SEBI, etc.)
• Law enforcement agencies (upon valid request)
• Auditors and professional advisors
• Service providers (with appropriate safeguards)
• Partner organizations (with user consent)

7. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your experience and collect information about how you use our site.

7.1 What Are Cookies?

Cookies are small text files that are stored on your device when you visit a website. They are widely used to make websites work more efficiently and provide information to the owners of the site.

7.2 Types of Cookies We Use

7.3 Managing Cookies

You can manage your cookie preferences through our Cookie Consent Banner or by adjusting your browser settings. Most web browsers allow you to control cookies through their settings preferences. However, restricting cookies may impact your experience and limit some functionality.

7.4 Third-Party Cookies

Some cookies are placed by third parties on our behalf. These third-party services may set cookies on your device. Please review their respective privacy policies for more information about their data practices.

8. Data Principal Rights

In accordance with the DPDP Act, 2023, Data Principals have the right to:

• Right to Information: Obtain a summary of personal data being processed and the processing activities undertaken
• Right to Correction, Completion, and Updating: Request correction of inaccurate or misleading data, completion of incomplete data, and updating of data
• Right to Erasure: Request the erasure of your personal data when it is no longer required for the purpose for which it was processed
• Right of Grievance Redressal: Access readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager
• Right to Nominate: Nominate any other individual to exercise your rights in the event of death or incapacity
• Right to Withdraw Consent: Withdraw your consent at any time, with the ease of withdrawal comparable to that of providing consent

9. Data Retention

We retain data for:

• Active accounts: Duration of service usage, after which it is erased as per the DPDP Act
• Financial records: 8 years (as per Companies Act)
• Security logs: 5 years, or up to 180 days for specific system logs (CERT-In)
• Analytics data: 3 years
• Backup data: 1 year

10. International Data Transfers

While our primary operations and data storage are in India, any international data transfers are conducted with appropriate safeguards and in compliance with applicable laws, to countries not restricted by the Central Government.

11. Children's Privacy

Our services are not intended for users under 18 years of age. We do not knowingly collect or process data from children. If required, verifiable parental consent would be obtained before processing.

12. Updates to Privacy Policy

We may update this Policy periodically. Users will be notified of significant changes through our platforms or email. Continued use of our Services after changes constitutes acceptance of the updated Policy.

13. Grievance Redressal

For privacy concerns or to exercise your rights, contact our Grievance Officer:

We will acknowledge your request within 48 hours and resolve it within 30 days.

In certain circumstances, we won't be able to fulfill your data deletion request, such as if the information is required to comply with legal obligations.