Privacy policy
Last updated: 11 July 2026
This policy explains in plain language what personal data the lumasoft.pl site collects, why and on what basis, who we entrust it to, and what rights you have. The controller is LUMA Sp. z o.o. (the "LumaSoft" brand).
Who is responsible for your data
LumaSoft — the company that runs this site — is responsible for your personal data. We decide why and how the data is processed (we are the controller under the GDPR):
- Name: LUMA Sp. z o.o.
- Address: ul. Gawronia 15, 04-785 Warszawa, Poland
- NIP (Tax ID) 9522285489 · REGON 544875680 · KRS 0001244636
- E-mail: [email protected]
We have not appointed a Data Protection Officer. For any data-protection matters, contact [email protected].
What data we collect and why
We collect only the data we genuinely need, in three situations:
Contact form and e-mail
The name, e-mail address and message you type yourself. We use them solely to reply to your enquiry. We deliver form messages through Cloudflare Pages Functions and Microsoft Graph to the [email protected] mailbox (Microsoft 365).
Visit statistics (Google Analytics 4)
Google Analytics 4 (measurement ID G-3GCCV2HXEH) runs in Google Consent Mode v2. Before you give consent the Google tag is loaded, but it stores no cookies and no identifiers — only anonymous, cookieless measurements (cookieless pings) are sent. Only after you click “Accept” is full measurement with cookies enabled (anonymous statistics, e.g. which pages you view). Advertising features are turned off. You can change your choice at any time via “Cookie settings” in the footer.
Technical logs
Our hosting provider (Cloudflare) records standard server logs: IP address, browser type (user-agent), time and the address of the page visited. They serve security and the correct operation of the site.
On what basis
Every processing has a basis in the GDPR. In brackets we explain it in human terms:
| Data | Purpose | Legal basis |
|---|---|---|
| Contact form and e-mail | Handling your enquiry and correspondence | Art. 6(1)(f) GDPR (our legitimate interest — replying to your message). |
| Google Analytics 4 | Anonymous site traffic statistics | Art. 6(1)(a) GDPR (your consent) and Art. 173 of the Polish Telecommunications Law (storing information on your device). |
| Technical logs | Security and correct operation of the site | Art. 6(1)(f) GDPR (our legitimate interest — protecting and running the site). |
Who we share data with
We do not sell your data and do not send you marketing. We use trusted providers that process data solely on our documented instructions:
- Microsoft — mail and delivery of form messages (Microsoft 365 and Microsoft Graph).
- Google — visit statistics (Google Analytics) in Consent Mode v2; cookies and full measurement run only after your consent.
- Cloudflare — hosting, content delivery network (CDN) and site security.
Data may be transferred outside the EEA (including to the USA) under the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC). Microsoft, Google and Cloudflare are participants in the Data Privacy Framework.
We serve fonts from our own server (we do not use Google Fonts) and we use no other tracking tools.
How long we keep it
We keep data only for as long as needed for the purpose we collected it for:
| Data | Retention period |
|---|---|
| Correspondence (form, e-mail) | for the time needed to handle the enquiry and then for up to 24 months (until any claims become time-barred) |
| Google Analytics 4 | up to 14 months (per the setting in Google Analytics) |
| Technical logs (Cloudflare) | short-term, per Cloudflare’s retention policy, solely for security purposes |
Your rights
In connection with the processing of your data you have the right to:
- access your data and obtain a copy,
- rectify (correct) your data,
- erase your data (the "right to be forgotten"),
- restrict processing,
- object to processing,
- data portability,
- withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
To exercise these rights, write to us at [email protected].
You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, Poland.
Cookies and analytics
We use two kinds of cookies:
- necessary — they remember your cookie-consent choice;
- analytics — Google Analytics; cookies stored only after your consent (Google Consent Mode v2).
We do not use advertising or marketing cookies.
You can withdraw your analytics consent at any time — through your browser settings and by reopening the consent banner after clearing this site’s data. Withdrawing consent does not affect data collected earlier.
Do you have to provide data
Providing data in the form is voluntary, but without it we cannot answer your enquiry.
We do not make decisions about you solely by automated means and we do not profile you (Art. 22 GDPR).
Changes to this policy
We may update this policy when our tools or the law change. You will always find the current version on this page, and we state the date of the last change at the top and bottom of the document.
Contact
For any matter regarding your personal data, write to us at: [email protected]
Last updated: 11 July 2026