Privacy policy
This policy explains what personal data we process when you use luma-si.pl, why we process it and what rights you have. It fulfils the information obligation under Article 13 of the General Data Protection Regulation (EU) 2016/679 (GDPR).
1. Data controller
The controller of your personal data is Luma Systemy Informatyczne Sp. z o.o., ul. Błękitna 13, 62-004 Czerwonak, Poland, tax ID (NIP) 7773448858, KRS 0001179015. For any data protection matters, contact us at [email protected], by phone at 696 768 675 or by post at our registered address. We have not appointed a data protection officer.
2. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Responding to enquiries sent via the form, email or phone | name, email address, message; optionally: company, phone | Art. 6(1)(f) GDPR – our legitimate interest in communicating with people who contact us; Art. 6(1)(b) GDPR – where the enquiry concerns entering into a contract | up to 12 months from the last contact; if a contract is concluded – for its duration and the limitation period for claims |
| Protecting the form against abuse (spam, attacks) | a hash of the IP address – the address itself is not stored | Art. 6(1)(f) GDPR – website security | a few minutes (temporary file) |
| Operating, securing and delivering the website | IP address, date and time, page address, browser type (technical logs) | Art. 6(1)(f) GDPR – security and continuity of the website | short term, according to the hosting and CDN providers' settings |
| Establishing, exercising or defending legal claims | correspondence data | Art. 6(1)(f) GDPR | until claims become time-barred |
Providing data in the form is voluntary but necessary for us to reply. We do not make automated decisions about you or profile you.
3. Recipients
We share data only with service providers who process it on our behalf under data processing agreements and on our instructions:
- Domena.pl sp. z o.o. (Poland) – website hosting and sending form notifications;
- Cloudflare, Inc. – content delivery network (CDN), connection encryption, attack protection and DNS;
- Microsoft Ireland Operations Ltd. – Microsoft 365 email, where we receive enquiries.
Data may be disclosed to public authorities only where required by law.
4. Transfers outside the European Economic Area
Cloudflare, Inc. may process data (in particular IP addresses) in the United States. Such transfers are based on the European Commission's adequacy decision (EU-US Data Privacy Framework) and, additionally, on the Standard Contractual Clauses approved by the European Commission. Microsoft stores Microsoft 365 service data within the European Union (EU Data Boundary); any transfers rely on the same safeguards. You can obtain a copy of these safeguards by contacting us.
5. Your rights
You have the right to:
- access your data and obtain a copy,
- rectify your data,
- erase your data,
- restrict processing,
- data portability – where we process data under a contract,
- object to processing based on legitimate interest, on grounds relating to your particular situation.
To exercise your rights, email [email protected]. We will respond without undue delay and within one month at the latest. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority in your country of residence.
6. Security
Connections to the website are encrypted (HTTPS, TLS 1.2 or newer) all the way to the server. Copies of form submissions are stored on the server only in encrypted form, and the key needed to read them is kept off the server. Only authorised persons have access to the data.
7. Cookies and analytics
This website does not use analytics or marketing cookies and does not use tracking tools (such as Google Analytics or advertising pixels). Our security provider Cloudflare may, in specific situations, set a technical cookie needed to distinguish human visitors from automated attacks (e.g. __cf_bm, valid for up to 30 minutes). It is strictly necessary for the secure operation of the website and does not require consent.
8. Changes
We may update this policy, for example when our providers or the law change. The current version, with its effective date, is always available on this page.