Cookie Policy

1. What are cookies?

Cookies are small text files placed on your device by a website you visit. They are widely used to make websites work correctly, improve performance, and provide information to website owners.

Cookies can be first-party (set by us directly) or third-party (set by our service providers). They can be session cookies (deleted when you close your browser) or persistent cookies (stored for a set period or until you delete them).

Similar technologies such as web beacons, pixels, and local storage may also be used and are covered by this policy.

2. Cookies we use

We have categorised the cookies used across our Services below. Essential cookies cannot be disabled as they are required for the Services to function. All other categories require your consent, which is collected via the cookie banner displayed on your first visit to our website. You can change your preference at any time — see section 6.

3. Legal basis for processing

We process personal data collected through cookies on the following legal bases:

• Strictly necessary cookies

  GDPR: Article 6(1)(b) GDPR — processing necessary for the performance of a contract (i.e. providing the Luminar Works service you have subscribed to).

  POPIA: Section 11(1)(b) POPIA — processing is necessary to carry out actions for the conclusion or performance of a contract.

• Analytics cookies

  GDPR: Article 6(1)(a) GDPR — your explicit consent, which you may withdraw at any time. Analytics cookies are not activated without consent.

  POPIA: Section 11(1)(a) POPIA — your explicit consent. Analytics cookies are not activated without consent. Consent may be withdrawn at any time by updating your cookie preferences.

4. Your rights — GDPR (EU/UK data subjects)

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights in relation to personal data processed through cookies:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data where there is no overriding legitimate purpose for retaining it.
• Right to restrict processing: Ask us to pause processing of your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to object: Object to processing based on legitimate interests (including analytics).
• Right to withdraw consent: Where we rely on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: Lodge a complaint with your national supervisory authority. In South Africa, this is the Information Regulator (see section 5). In the EU/UK, contact your local Data Protection Authority or the UK ICO (ico.org.uk).

5. Your rights — POPIA (South African data subjects)

If you are located in South Africa, you have the following rights under POPIA as a data subject:

• Right to be notified: Be notified that your personal information is being collected and the purpose for which it is being collected (this policy fulfils that obligation).
• Right of access: Request details of the personal information we hold about you and how it is being used.
• Right to correction or deletion: Request that we correct, destroy, or delete personal information that is inaccurate, irrelevant, excessive, out of date, misleading, or obtained unlawfully.
• Right to object: Object to the processing of your personal information on reasonable grounds.
• Right to lodge a complaint: Lodge a complaint with the Information Regulator of South Africa.

6. Managing your preferences

You can control and manage cookies in several ways. Note that disabling certain cookies may impact the functionality of our Services.

7. Third-party processors

The following third parties may process personal data collected through cookies on our Services. Each operates under their own privacy policy and, where required, has entered into a Data Processing Agreement with us.

8. International data transfers

Some of our third-party processors, including Microsoft, operate globally and may process data outside of South Africa and the EEA. Where such transfers occur, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission for EEA transfers.
• Binding corporate rules or equivalent mechanisms for transfers to processors in countries without an adequacy decision.
• For South African data: transfers are made in compliance with section 72 of POPIA, which requires that the recipient country, territory, or international organisation provides an adequate level of protection.

9. Changes to this policy

We may update this Cookie Policy from time to time to reflect changes in technology, legislation, or our data practices. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email or by displaying a prominent notice on our website.

We encourage you to review this policy periodically. Your continued use of the Services after any changes constitutes your acknowledgement of the updated policy.

10. Contact us

If you have any questions about this Cookie Policy, wish to exercise any of your rights, or want to raise a concern about how we use your data, please contact us:

You may also review our Privacy Policy for a full account of how we handle personal data across all our Services.