Privacy Policy

The data controller is LumiSoft Oy (Business ID 3611454-4), registered domicile Espoo, Finland. You can reach us at info@lumisoft.fi.

We are the controller for personal data we process for our own purposes: running this website, answering business enquiries, managing relationships with clients and prospective clients, and business administration such as invoicing and accounting. When we process personal data on behalf of a client, our role is different. See section 11.

Because LumiSoft Oy is established in Finland, we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law. We apply the same practices to everyone, whichever country you are in. Where the privacy law of another country applies to us, we also take it into account. Section 9 explains how that affects your rights.

Depending on how you interact with us, we process the following categories of personal data:

• Contact form: your name, email address, the project type you select and the message you write. All four are required to send the form. There is no phone number field.
• Email and other correspondence: your name, email address, company, role, phone number if you share it, and the content of our communication, including project requirements and proposals.
• Client and prospective client relationships: contact persons' names, work email addresses, phone numbers, company names and roles, project and business requirements, and correspondence.
• Billing and contractual information: billing details, contract terms, invoices and payment records. These are mostly business information, but they can identify individuals such as contact persons or sole traders.
• Technical data: IP address, browser and device information, the pages requested and the time of the request, collected automatically by our hosting infrastructure when you visit the site. Used to deliver the site and keep it secure.
• Website analytics data (only if you accept analytics): pseudonymous identifiers, pages viewed, which sections of a page were viewed, whether a contact form was submitted or the email link clicked, and approximate location, device and browser details.
• Preferences stored on your device: your theme, language and cookie choices. See section 4.

Where the data comes from. Mostly directly from you. If you work for a client or prospective client, we may receive your contact details from your employer or organisation. Technical and analytics data is collected automatically from your device.

Is providing data required? The contact form fields are needed so that we can respond; without them we cannot process your request. Contractual and billing information is needed to enter into and perform a contract and to meet our accounting obligations. Providing analytics data is always optional. Please do not send us sensitive personal data (for example health information) through the form or by email.

Under the GDPR, we need a legal basis for each way we use personal data. Ours are:

Enquiries do not require your consent: we answer them because you asked us to. When we rely on legitimate interests, we have weighed them against your rights and you may object (section 9). We do not use your data for purposes incompatible with those above.

The website's own code does not set cookies. It uses your browser's local storage for the following, which are needed to remember your choices:

Optional analytics, only with your consent. If you press "Accept analytics", we load two analytics tools:

• Google Analytics 4 (Google Ireland Limited / Google LLC) sets the cookies _ga and _ga_G-7Y8NKGWZ8S, which by Google's default last up to two years. We have enabled IP anonymisation, turned off Google signals and ad personalisation, and denied advertising storage. We record page views, which page sections were viewed, contact form submissions (with the project type) and email link clicks.
• Vercel Web Analytics (Vercel Inc.) measures page views and aggregated visitor information such as country, device and browser. According to Vercel's documentation it does not use cookies.

Before you accept, neither tool is downloaded and no analytics data is sent. "Accept analytics" and "Reject" are equally prominent on the first screen. If you reject or ignore the banner, only the items in the table above are used. We do not use advertising, marketing or social media tracking cookies or pixels.

Changing or withdrawing consent. You can change your choice at any time with the "Cookie settings" button shown at the bottom left of every page, or here. If you withdraw consent, tracking stops and we remove Google Analytics cookies from your browser. Withdrawal does not affect processing done before it.

Our hosting provider (section 5) may use technical mechanisms to deliver and secure the site that are not visible in our code. We have not been able to verify these from our source code.

We share personal data only when needed for the purposes in section 3. The main recipients are:

Providers acting as our processors may only process personal data on our instructions and under data processing terms as required by Article 28 GDPR. Independent controllers handle data under their own privacy policies. Fonts and images on this website are served from our own domain, and the website runs no advertising or marketing trackers; we do not use visitor data for advertising. Our website links to LinkedIn; once you leave our site, LinkedIn's own privacy policy applies.

LumiSoft works with clients internationally and uses service providers that operate in several countries. Your personal data may therefore be processed outside the country where you live, including in Finland, other EU/EEA countries and the United States. Some providers above are based in the United States. We have not verified where each provider stores or accesses data, so we do not claim that it stays in any particular country or region.

Transfers from the EU/EEA. Because we are established in Finland, GDPR Chapter V applies when personal data is transferred outside the EU/EEA. Such a transfer must rest on a safeguard: an adequacy decision of the European Commission (for the United States, the EU–US Data Privacy Framework covers certified recipients), Standard Contractual Clauses, or another mechanism the GDPR allows. Standard Contractual Clauses do not on their own make every transfer lawful; where required, the circumstances of the transfer must also be assessed.

Other countries. If a privacy law outside the EU/EEA restricts transfers of the data and applies to us, we handle the transfer in line with that law. To ask which safeguards apply to a particular provider or transfer, write to info@lumisoft.fi.

We keep personal data only as long as needed for the purpose it was collected for, and as long as the law requires:

When the retention period ends, we delete or anonymise the data, unless a legal obligation or a legal claim requires us to keep it longer.

We protect personal data with technical and organisational measures that are appropriate to the risk. These include encrypted connections (HTTPS) to our website, limiting access to personal data to people who need it for their work, and choosing service providers with care. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs, we will notify the authorities and the people affected as the law requires.

Wherever you are, you may contact us with questions or requests about your personal information. Which legal rights you have, and how far they reach, depends on the law that applies to you and on the circumstances of the processing; they are not absolute. Under the GDPR, which applies to our processing, you have the following rights:

• Access: to get confirmation of whether we process your personal data, and a copy of it with related information.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have data deleted, for example when it is no longer needed or you withdraw consent. We cannot delete data we must keep by law, such as accounting records, or that we need to handle legal claims.
• Restriction: to ask us to limit processing in certain situations, for example while we check a request.
• Portability: to receive data you provided to us in a structured, commonly used format when we process it based on consent or contract by automated means.
• Objection: to object at any time, on grounds relating to your situation, to processing based on our legitimate interests. We will stop unless we show compelling legitimate grounds or need the data for legal claims.
• Withdraw consent: at any time, for example for analytics (section 4), without affecting earlier processing.
• Complain to a supervisory authority: see section 10.

The laws of other countries, for example the United Kingdom, Switzerland or some U.S. states, may give you similar or different rights. If you tell us where you live, we will consider the law that applies to your request. If a right is not available under that law, we may decline the request and will explain why.

Send your request to info@lumisoft.fi, whichever country you are in. We may ask for information needed to confirm your identity. Under the GDPR we respond without undue delay and in any case within one month of receiving the request. Where necessary because of the complexity or number of requests, this can be extended by up to two further months, and we will tell you if so. If another law sets a different deadline for your request, we will tell you which one applies. Requests are normally free of charge.

You have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi, P.O. Box 800, FI-00531 Helsinki. You may also contact the authority in the country where you live or work, for example one of the EU/EEA data protection authorities or the UK Information Commissioner's Office. Compliance with cookie rules is supervised in Finland by the Finnish Transport and Communications Agency Traficom (kyberturvallisuuskeskus.fi). We would appreciate the chance to resolve your concern first.

LumiSoft as controller. For the processing described in this policy, such as enquiries, client relationship management and invoicing, LumiSoft decides why and how personal data is processed.

LumiSoft as processor. When we build or operate software and AI solutions for a client and handle personal data on the client's behalf, the client is the controller and we process that data only according to the client's documented instructions. This is governed by the client contract and, where required by Article 28 GDPR, a Data Processing Agreement. The client's own privacy information applies to that processing, and requests about it should be sent to the client. If you send us such a request, we will forward it to the client where we can identify them.

This website policy does not replace a Data Processing Agreement and does not describe the details of individual client projects.

We do not make decisions about you based solely on automated processing that has legal or similarly significant effects (GDPR Article 22), and we do not profile visitors of this website for such decisions. This website does not send your contact form messages or other personal data to AI models; messages go to our email and are read by our team. Analytics produces aggregated statistics about website use.

AI systems we build for clients are the responsibility of those clients as controllers, as described in section 11. If we begin to use AI tools to process personal data for our own purposes, we will update this policy.

We update this policy when our practices or the law change. The date of the latest update is shown at the top of this page. If we make material changes, such as adding a new analytics tool, we will make them visible on the website, and where consent is required we will ask for it again.

LumiSoft Oy, Business ID 3611454-4, registered domicile Espoo, Finland. Email: info@lumisoft.fi. Website: lumisoft.fi.