Privacy Policy

1. Who we are

The data controller responsible for your personal information is:

Our designated Information Officer (as required under POPIA) can be contacted at the same email address. As Luminar Works does not have an establishment in the European Union, EU data subjects may also direct enquiries to the above address in accordance with GDPR Article 27.

2. Data we collect

We collect personal information only to the extent necessary to provide our Services. The categories of data we collect include:

We do not collect special category data (health, biometric, racial or ethnic origin, religious beliefs, etc.) unless you explicitly provide it in a support communication.

3. How we use your data

We use your personal information for the following purposes:

• Providing, operating, and improving the Luminar Works platform
• Creating and managing your account
• Processing payments and managing your subscription
• Sending transactional emails (account confirmations, invoices, password resets)
• Responding to support requests and enquiries
• Monitoring platform security and preventing fraud
• Analysing usage patterns to improve our product (with your consent)
• Sending marketing communications where you have opted in
• Complying with legal and regulatory obligations

4. Legal basis for processing

We only process your personal data where we have a lawful basis to do so. The table below maps each processing activity to its legal basis under GDPR and POPIA.

5. Sharing your data

We do not sell your personal data. We share it only with the following categories of third parties, and only to the extent necessary for the purposes described in this policy:

We may also disclose your information where required by law, court order, or regulatory authority, or to protect the rights, property, or safety of Luminar Works, our customers, or others.

6. International data transfers

Some of our processors operate outside South Africa and the EEA. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:

• EU Standard Contractual Clauses (SCCs) for transfers from the EEA.
• Adequacy decisions where applicable.
• Compliance with section 72 of POPIA for transfers of South African personal information to foreign countries — we only transfer to recipients that maintain an adequate level of protection.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our standard retention periods are:

8. Your rights — GDPR (EU/UK data subjects)

If you are located in the EEA or United Kingdom, you have the following rights under the GDPR:

• Right of access: Request a copy of the personal data we hold about you (Art. 15).
• Right to rectification: Ask us to correct inaccurate or incomplete data (Art. 16).
• Right to erasure: Request deletion of your data where there is no overriding legitimate purpose for retaining it (Art. 17).
• Right to restrict processing: Ask us to pause processing of your data in certain circumstances (Art. 18).
• Right to data portability: Receive your data in a structured, machine-readable format (Art. 20).
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes (Art. 21).
• Right to withdraw consent: Where we rely on consent, withdraw it at any time without affecting the lawfulness of prior processing (Art. 7(3)).
• Right to lodge a complaint: Lodge a complaint with your national Data Protection Authority or the UK ICO (ico.org.uk).

9. Your rights — POPIA (South African data subjects)

If you are located in South Africa, you have the following rights under POPIA:

• Right to be notified: Be informed when your personal information is collected and the purpose for which it is used.
• Right of access: Request confirmation of and access to the personal information we hold about you (s.23).
• Right to correction or deletion: Request correction, destruction, or deletion of inaccurate, irrelevant, or unlawfully obtained information (s.24).
• Right to object: Object at any time, on reasonable grounds, to the processing of your personal information (s.11(3)).
• Right to lodge a complaint: Complain to the Information Regulator of South Africa at inforeg@justice.gov.za or inforegulator.org.za.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include encryption in transit (TLS), access controls, and regular security reviews.

For a full overview of our security practices, please visit our Security page.

11. Children's privacy

Our Services are not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@luminarworks.com and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the effective date at the top of this page and notify you by email or via a prominent notice on our website.

13. Contact us

To exercise your rights, ask questions about this policy, or raise a concern about how we handle your data:

You may also review our Cookie Policy for information specific to cookies and tracking technologies.