Privacy policy: launch-notification list

1. Controller

LUMA Sp. z o.o. (Poland), ul. Gawronia 15, 04-785 Warsaw, KRS 0001244636, tax ID (NIP) 9522285489. Data contact: support@lumasoft.pl. [Data Protection Officer: not appointed / DPO details. VERIFY]

2. Data and purposes

We collect your email address, the date and time of sign-up and confirmation, the version of the consent text, [the IP address logged at sign-up, if the provider logs it, VERIFY] and a source tag (the channel through which you reached the page). Purposes: (a) sending a confirmation email; (b) telling you about the planner launch and a possible test invitation, a few messages at most until launch; (c) measuring interest in the product (aggregate statistics, not assessing you); (d) proving that consent was given.

We do not ask about diagnosis, treatment or health, and ask you not to include it in replies. We understand that signing up to a list on this topic may suggest something about you; therefore we do not combine your address with other data, do not profile you and do not share it with advertisers.

3. Legal basis

Your consent (Art. 6(1)(a) GDPR) and, to the extent the sign-up itself might reveal health information, explicit consent (Art. 9(2)(a) GDPR); sending messages is also based on your consent to electronic communications. For keeping proof of consent and a list of people who unsubscribed: legitimate interest (Art. 6(1)(f)), i.e. accountability and not messaging you after you withdraw. Cookie-free visit statistics: legitimate interest (measuring reach).

4. Recipients

Email delivery provider: Brevo (Sendinblue SAS, France), as processor under a data processing agreement; data hosted in the EU [VERIFY]. Hosting and page statistics provider: Cloudflare, Inc. [VERIFY: DPF/SCC status, region]. Two authorised Luma staff have access. We do not sell data or pass it to anyone else.

5. Transfers outside the EEA

[VERIFY: Option A: list data stays within the EEA. Option B: some sub-processors of our providers (including Cloudflare, Inc., USA) process data in the US under the EU-US Data Privacy Framework adequacy decision or standard contractual clauses; write to us for a copy of the safeguards.]

6. Retention

Unconfirmed sign-ups are deleted after 7 days. Confirmed: until launch or until you unsubscribe, at most 12 months from sign-up (then we ask whether you wish to stay). If we drop the project we delete the list within 14 days of the decision and tell you. After you unsubscribe we keep only a minimal record (hashed address, consent and withdrawal dates) for [3 years, VERIFY] to defend legal claims and avoid messaging you again.

7. Your rights

Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (an "Unsubscribe" link in every message or email to support@lumasoft.pl); withdrawal does not affect earlier lawful processing. Providing your email is voluntary; without it we cannot sign you up. We take no solely automated decisions and do not profile you.

8. Complaint

You may lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland [VERIFY: current address, uodo.gov.pl], or with the supervisory authority in your country of residence.

9. Cookies and statistics

The site uses no cookies and no browser local storage. We count visits with a tool that stores nothing on your device [VERIFY]. The source tag in the URL (?s=) identifies a channel, not you.