Legal

Privacy Policy

Last updated: October 2026

1. Who we are

Lumiera Strategy OÜ (“Lumiera”, “we”, “us”) is the controller of your personal data, which means we decide how and why it is used.

This policy applies to people who visit lumiera.ai, contact us, enquire about or apply for our programmes, or otherwise deal with us as business contacts. The terms of a signed client engagement govern personal data we process under that engagement.

For any privacy question or request, contact hello@lumiera.ai.

2. What personal data we collect

Source

Personal data

Information you give us through forms, bookings, applications, diagnostics and correspondence

Name, work email, company, role, and your answers and messages

Your use of our website

IP address, browser and device type, pages visited and referring page

Publicly available professional sources

Name, role, employer and professional profile

You are not obliged to provide personal data, but we need your name and email address to respond to you.

3. Why we use personal data

Purpose

Legal basis under GDPR Art. 6(1)

Responding to enquiries and arranging calls

Taking steps at your request before a contract (b), or our legitimate interest in answering business correspondence (f)

Assessing applications and diagnostics

Taking steps at your request before a contract (b)

Preparing for meetings and identifying relevant business contacts

Our legitimate interest in developing our business (f)

Sending you information about our services

Your consent (a), or our legitimate interest where electronic marketing rules allow it (f)

Operating and securing our website

Our legitimate interest in a secure, working website (f)

Keeping accounting and tax records

Our legal obligation (c)

Establishing, exercising or defending legal claims

Our legitimate interest in protecting our rights (f)

4. Cookies and similar technologies

We use only cookies and similar technologies that are strictly necessary to run and secure the website. We do not use analytics or advertising cookies.

Embedded forms and booking calendars may set cookies they need to work when you open them.

5. AI tools

We use AI tools to support our work, such as drafting and summarising correspondence. These providers act only on our instructions and must not use your personal data to train their models. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing, including AI.

6. Who we share personal data with

We share personal data only where necessary, with:

  • service providers acting on our instructions, such as providers of website hosting, email, forms and scheduling, relationship management, AI tools and payments

  • professional advisers, such as accountants, lawyers and insurers, who are bound by confidentiality

  • a buyer or successor if we merge with another business, are acquired or sell our business

  • public authorities, where the law requires it

7. International transfers

Some of our service providers process personal data outside the European Economic Area (EEA). We protect each such transfer with one of these safeguards:

  • a European Commission decision that the destination offers adequate protection, including the EU-US Data Privacy Framework for certified recipients (Art. 45 GDPR)

  • the European Commission’s Standard Contractual Clauses (Art. 46 GDPR)

To request information about the safeguard that applies, contact hello@lumiera.ai.

8. How long we keep personal data

Personal data

How long we keep it

Enquiries, bookings and applications that do not lead to an engagement

24 months after last contact

Diagnostic answers

24 months after submission, then anonymised

Marketing contact details

Until you unsubscribe or object; we then keep only your email address, to avoid contacting you again

Invoices and accounting records

7 years from the end of the financial year, as the Estonian Accounting Act requires

Personal data needed for a legal claim

Until the claim is resolved and any limitation period has expired

9. Your rights

Under the GDPR, you have the right to:

  • access your personal data and receive a copy

  • have inaccurate or incomplete personal data corrected

  • have your personal data deleted

  • restrict how we use your personal data

  • receive personal data you gave us in a machine-readable format

  • object to our use of your personal data based on legitimate interest, and to direct marketing at any time

  • withdraw your consent at any time, without affecting our use of your personal data before you withdrew it

To exercise any of these rights, contact hello@lumiera.ai.

10. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse, and we limit access to people who need it.

11. Changes to this policy

We may update this policy. The date below shows when we last updated it.

12. Complaints

If you have a concern, please contact us first at hello@lumiera.ai. You also have the right to complain to a data protection authority, in particular in the EEA country where you live or work, or where you believe the breach took place. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee.