Privacy Policy

This Privacy Policy explains how LUMINAREX LLC (“Luminarex”, “we”, “us” or “our”) collects, uses, discloses, stores and otherwise processes personal data when you visit our websites, submit enquiry forms, request demos or otherwise interact with our products and services, including the LIO platform.

We designed this Policy to meet core requirements applicable in the European Economic Area and United Kingdom (including the GDPR and UK GDPR), the United States (including the California Consumer Privacy Act as amended by the CPRA and similar state laws), and the Middle East (including Qatar Law No. 13 of 2016 on Personal Data Privacy Protection and comparable frameworks in the GCC). Where local law provides stronger protections, those protections apply.

By using our websites or submitting personal data to us, you acknowledge that you have read this Policy. Where processing is based on consent, we will ask for that consent separately (for example, via form checkboxes or cookie preferences).

1. Who is responsible for your data

The data controller (and, where applicable under Middle East law, the data controller / personal data controller) is:

For privacy requests, please use the contact details in Section 15. If we appoint a data protection officer or EU/UK representative, we will publish those details here.

2. Scope

This Policy applies to personal data processed in connection with:

• Our public websites and landing pages (including luminarex.io / related domains)
• Online forms (demo requests, contact and enquiry forms)
• Email, telephone and messaging communications with us
• Cookies and similar technologies (see our Cookie Policy)

If you use LIO or other services under a separate contract, that contract (and any related data processing agreement) may contain additional terms for customer content and end-user data you upload. This website Policy does not replace those contractual terms.

3. Personal data we collect

Depending on how you interact with us, we may process the following categories:

3.1. Data you provide directly

• Identity and contact details: name, email address, telephone number, company/organisation (if provided)
• Enquiry content: message text, description of tasks, product interest, preferred language
• Consent records: privacy/cookie consent choices and timestamps
• Correspondence: emails, call notes and support-related communications

3.2. Data collected automatically

• Technical and usage data: IP address, device/browser type, operating system, referring URL, pages visited, timestamps, approximate location derived from IP
• Cookie and analytics identifiers (for example Google Analytics and Yandex Metrica), subject to your cookie choices
• Security logs used to detect abuse, fraud or attacks

3.3. Data from third parties

We may receive limited information from service providers (hosting, email delivery, analytics) or, if you interact with us via business partners, from those partners — only as needed to respond to your request or operate our services.

3.4. Sensitive data

We do not intentionally collect special categories of personal data (such as health, biometric, religious or political data) or data about children through our public websites. Please do not submit such information via our forms.

4. Purposes and legal bases

We process personal data only for specified, legitimate purposes. Under the GDPR/UK GDPR (and analogous Middle East principles of purpose limitation and lawful processing), our legal bases include:

Under Qatar PDPL and similar Middle East laws, we process personal data on lawful grounds such as consent, performance of a contract, compliance with legal obligations, and other bases permitted by applicable law, and we apply principles of transparency, purpose limitation, data minimisation, accuracy, security and limited retention.

Where we rely on legitimate interests, we balance those interests against your rights and expectations. You may object to such processing as described in Section 10.

5. Cookies and similar technologies

We use cookies and similar technologies to operate the site, remember preferences and — with your consent where required — measure traffic and improve performance. Details of cookie types, providers, retention and how to manage choices are set out in our Cookie Policy.

In the EEA/UK and other jurisdictions that require it, non-essential cookies (including analytics) are loaded only after you give consent via our cookie banner. You can change or withdraw consent at any time.

6. How we share personal data

We do not sell personal data for money. We may disclose personal data to:

• Service providers (processors) — hosting, email delivery, IT security, analytics and similar vendors acting on our instructions under appropriate contracts
• Professional advisers — lawyers, auditors or consultants where needed
• Authorities — courts, regulators or law-enforcement bodies when required by law or to protect rights, safety and security
• Corporate transactions — in connection with a merger, acquisition or restructuring, subject to appropriate safeguards

We require processors to protect personal data and to process it only for specified purposes. We do not permit unrestricted onward sharing for third-party advertising based on data you submit through our enquiry forms.

7. International transfers

Luminarex is established in Qatar and may process or store personal data in Qatar, the EEA/UK, the United States, Russia or other countries where our service providers operate. Transfer destinations may therefore differ from your country of residence.

Where EU/UK law applies to a transfer of personal data outside the EEA/UK, we use appropriate safeguards, which may include:

• European Commission / UK adequacy decisions (where available)
• Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum
• Other transfer tools permitted by applicable law

Where Middle East law restricts cross-border transfers (including Qatar PDPL requirements on transfers and, where applicable, notifications or permits), we take steps to comply with those rules before transferring personal data abroad.

8. Retention

We keep personal data only as long as necessary for the purposes described in this Policy, or as required by law. Typical periods:

• Enquiry and demo forms: up to 24 months after the last meaningful contact, unless a longer period is needed for a contract or dispute
• Contract and billing records: for the term of the relationship plus the statutory limitation / accounting period
• Cookie consent records: typically up to 12 months (or as stated in the Cookie Policy)
• Security and server logs: for a limited period needed for security and troubleshooting
• Analytics identifiers: according to the provider settings described in the Cookie Policy

When retention ends, we delete or irreversibly anonymise the data, unless we must keep it longer to comply with legal obligations or establish/defend legal claims.

9. Security

We implement technical and organisational measures appropriate to the risk, which may include access controls, encryption in transit where applicable, secure hosting, least-privilege access, staff confidentiality obligations and monitoring for unauthorised access.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that poses a risk to individuals, we will notify regulators and affected persons as required by applicable law (including GDPR and Qatar PDPL notification duties where they apply).

10. Your rights — European Economic Area and United Kingdom

If the GDPR or UK GDPR applies to you, you have the right to:

• Access your personal data and obtain a copy
• Rectify inaccurate or incomplete data
• Erase data (“right to be forgotten”) in certain cases
• Restrict processing in certain cases
• Data portability (receive data in a structured, commonly used, machine-readable format) where processing is based on consent or contract and carried out by automated means
• Object to processing based on legitimate interests, and to direct marketing
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not use such decision-making on our public websites)
• Lodge a complaint with a supervisory authority in your country of residence or work (for example, your local EU DPA or the UK ICO)

To exercise these rights, contact us using Section 15. We may need to verify your identity before responding. We aim to respond within one month (extendable where permitted by law).

11. Your rights — United States

Depending on your state of residence (including California, Virginia, Colorado, Connecticut, Utah and other states with comprehensive privacy laws), you may have rights to:

• Know / access the categories and specific pieces of personal information we collected about you
• Know the categories of sources, purposes of use, and categories of third parties with whom we disclose personal information
• Correct inaccurate personal information
• Delete personal information, subject to legal exceptions
• Opt out of “sale” or “sharing” of personal information for cross-context behavioural advertising, and of targeted advertising, where those concepts apply
• Limit the use and disclosure of sensitive personal information (we do not intentionally collect sensitive personal information via our public website forms)
• Non-discrimination for exercising privacy rights
• Appeal a decision denying a consumer rights request, where state law provides an appeal right

11.1. Notice at collection (California and similar laws)

In the past 12 months we may have collected the categories of personal information described in Section 3 (identifiers, commercial/enquiry information, internet/electronic activity, and professional information if you provide a company name). We collect them for the purposes in Section 4. We disclose personal information to service providers as described in Section 6.

11.2. Sale, sharing and targeted advertising

We do not sell personal information for monetary consideration. Certain analytics or advertising cookies may constitute “sharing” or “targeted advertising” under some US state laws. You can opt out by rejecting non-essential cookies in our cookie banner, adjusting preferences via “Manage cookies”, or using browser/OS controls. Where required, we honour Global Privacy Control (GPC) signals as an opt-out of sale/sharing.

11.3. How to submit a US privacy request

Email info@luminarex.io with the subject line “US Privacy Request” and specify the right you wish to exercise. You may use an authorised agent where permitted by law; we may require proof of authorisation and identity verification. We will respond within the timeframes required by applicable state law (generally 45 days, extendable once where permitted).

12. Your rights — Middle East (including Qatar)

If Qatar Law No. 13 of 2016 on Personal Data Privacy Protection (PDPL) or another applicable Middle East privacy law applies to you, you generally have the right to:

• Be informed about the processing of your personal data
• Access your personal data
• Request correction of inaccurate personal data
• Request erasure or cessation of processing in circumstances provided by law (including where consent is withdrawn or processing is no longer necessary)
• Object to processing in certain cases
• Withdraw consent where processing is based on consent
• Lodge a complaint with the competent authority in Qatar (or the relevant GCC supervisory body where another local law applies)

We process personal data in line with PDPL principles, including fairness, transparency, purpose limitation, adequacy, accuracy, security and accountability. Where consent is required, it will be clear, specific and freely given; you may withdraw it without affecting prior lawful processing.

If you are located in another Middle East jurisdiction with its own personal data law (for example, UAE Federal Decree-Law No. 45 of 2021, Saudi Personal Data Protection Law, or Bahrain Law No. 30 of 2018), we will honour rights available to you under that law when it applies to our processing.

13. Children

Our websites and services are directed to businesses and adults. We do not knowingly collect personal data from children under 16 (EEA/UK), under 13 (COPPA / United States), or under the minimum age set by applicable Middle East law. If you believe a child has provided personal data to us, contact us and we will take appropriate steps to delete it.

14. Changes to this Policy

We may update this Privacy Policy from time to time to reflect legal, technical or business changes. The “Last updated” date at the top will be revised when changes are posted. For material changes, we may provide additional notice on the website or by email where appropriate. Continued use of the website after an update constitutes acknowledgment of the revised Policy, except where consent is required by law for a new processing activity.

15. Contact us

For privacy questions, requests to exercise your rights, complaints or data breach notifications, contact: