Privacy policy
Last updated: 6 November 2026
This policy explains in plain language what personal data the www.lumasoft.org site collects, why and on what basis, who we entrust it to, and what rights you have. The controller is LUMA Sp. z o.o. (the "LumaSoft" brand).
Who is responsible for your data
LumaSoft — the company that runs this site — is responsible for your personal data. We decide why and how the data is processed (we are the controller under the GDPR):
- Name: LUMA Sp. z o.o.
- Address: ul. Gawronia 15, 04-785 Warszawa, Poland
- NIP (Tax ID) 9522285489 · REGON 544875680 · KRS 0001244636
- E-mail: Biuro@lumasoft.pl
We have not appointed a Data Protection Officer. For any data-protection matters, contact Biuro@lumasoft.pl.
What data we collect and why
We collect only the data we genuinely need, in five situations:
Contact form and e-mail
The name, e-mail address and message you type yourself. We use them to reply to your enquiry (the exception is the Lumapanel waitlist, described below). We deliver form messages through Cloudflare Pages Functions and Microsoft Graph to the Biuro@lumasoft.pl mailbox (Microsoft 365).
Lumapanel waitlist
If you send the form on the Lumapanel page asking to be told when the panel becomes available, we keep your name and e-mail address to send you information about the Lumapanel launch. The basis is your consent, which you give by submitting the waitlist form. You can withdraw it at any time by writing to Biuro@lumasoft.pl. The data travels the same way as contact form messages (Cloudflare Pages Functions, Microsoft Graph, the Biuro@lumasoft.pl mailbox).
Form counting
When a form is submitted we record only an aggregate counter (day, form type — contact or Lumapanel waitlist — and optionally the campaign source), without name, e-mail, IP address or cookies. Basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing how many enquiries the site generates). Counters are kept in Cloudflare for up to 24 months.
Visit statistics (Google Analytics 4)
Google Analytics 4 (measurement ID G-3GCCV2HXEH) runs in the basic mode of Google Consent Mode v2: until you give consent, the Google tag is not loaded at all and no data reaches Google. Only after you click “Accept” do we load the tag and enable measurement with cookies (anonymous statistics, e.g. which pages you view). Advertising features are turned off. You can change your choice at any time via “Cookie settings” in the footer — once you withdraw consent, measurement is switched off.
Technical logs
Our hosting provider (Cloudflare) records standard server logs: IP address, browser type (user-agent), time and the address of the page visited. They serve security and the correct operation of the site.
On what basis
Every processing has a basis in the GDPR. In brackets we explain it in human terms:
| Data | Purpose | Legal basis |
|---|---|---|
| Contact form and e-mail | Handling your enquiry and correspondence | Art. 6(1)(f) GDPR (our legitimate interest — replying to your message). |
| Google Analytics 4 | Anonymous site traffic statistics | Art. 6(1)(a) GDPR (your consent) and Art. 399 of the Polish Electronic Communications Law (storing information on your device). |
| Technical logs | Security and correct operation of the site | Art. 6(1)(f) GDPR (our legitimate interest — protecting and running the site). |
| Lumapanel waitlist | Keeping the contact details of people who asked to be notified, and sending them information about the Lumapanel launch | Art. 6(1)(a) GDPR (your consent — given by submitting the waitlist form; you can withdraw it at any time by writing to Biuro@lumasoft.pl). |
| Form counter | Aggregate statistics of how many forms are submitted (day, form type, campaign source) — without name, e-mail, IP address or cookies | Art. 6(1)(f) GDPR (our legitimate interest in knowing how many enquiries the site generates). |
Who we share data with
We do not sell your data and do not send you marketing — apart from information about the Lumapanel launch, if you ask for it. We use trusted providers that process data solely on our documented instructions:
- Microsoft — mail and delivery of form messages (Microsoft 365 and Microsoft Graph).
- Google — visit statistics (Google Analytics) in the basic mode of Consent Mode v2; we load the Google tag and send data to Google only after your consent.
- Cloudflare — hosting, content delivery network (CDN), site security and storage of the aggregate form counters (no personal data).
Data may be transferred outside the EEA (including to the USA) under the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC). Microsoft, Google and Cloudflare are participants in the Data Privacy Framework.
We serve fonts from our own server (we do not use Google Fonts) and we use no other tracking tools.
How long we keep it
We keep data only for as long as needed for the purpose we collected it for:
| Data | Retention period |
|---|---|
| Correspondence (form, e-mail) | for the time needed to handle the enquiry and then for up to 24 months (until any claims become time-barred) — except Lumapanel waitlist sign-ups (see below) |
| Google Analytics 4 | up to 14 months (per the setting in Google Analytics) |
| Technical logs (Cloudflare) | short-term, per Cloudflare’s retention policy, solely for security purposes |
| Lumapanel waitlist | until the Lumapanel launch information is sent or you withdraw consent, whichever comes first |
| Form counter (Cloudflare) | up to 24 months |
Your rights
In connection with the processing of your data you have the right to:
- access your data and obtain a copy,
- rectify (correct) your data,
- erase your data (the "right to be forgotten"),
- restrict processing,
- object to processing,
- data portability,
- withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
To exercise these rights, write to us at Biuro@lumasoft.pl.
You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, Poland.
Cookies and analytics
We use two kinds of cookies:
- necessary — they remember your cookie-consent choice;
- analytics — Google Analytics; the Google tag is loaded and cookies are stored only after your consent (Google Consent Mode v2, basic mode).
We do not use advertising or marketing cookies.
You can withdraw your analytics consent at any time — via “Cookie settings” in the footer, through your browser settings, or by reopening the consent banner after clearing this site’s data. Withdrawing consent does not affect data collected earlier.
Do you have to provide data
Providing data in the form is voluntary, but without it we cannot answer your enquiry or let you know about the Lumapanel launch.
We do not make decisions about you solely by automated means and we do not profile you (Art. 22 GDPR).
Changes to this policy
We may update this policy when our tools or the law change. You will always find the current version on this page, and we state the date of the last change at the top and bottom of the document.
Contact
For any matter regarding your personal data, write to us at: Biuro@lumasoft.pl
Last updated: 6 November 2026