Privacy policy
Last updated: 1 October 2026
This policy explains what personal data Lumias SIA collects through lumias.studio, why we collect it and what you can ask us to do with it. We collect as little as we can get away with.
Who we are
Lumias SIA ("Lumias", "we", "us") is a software studio registered in Latvia, registration number 50203680421, registered address Stārķu iela 4-37, Riga, LV-1084, Latvia. We are the controller of the personal data described in this policy.
You can reach us at support@lumias.studio or +371 26429597 with any question about this policy or your data.
What we collect
Contact enquiries. The name, email address, any company details, phone number and message you submit through the contact form. They are delivered to our business mailbox by email, so we can reply and keep track of the conversation.
Analytics. Statistics about which pages and sections are viewed, collected through Google Analytics only if you accept analytics cookies. Your IP address is shortened before it is used for analytics, and we do not use this data to identify you.
Technical data. Our hosting and content delivery providers process the request data needed to serve the site, such as IP address and user agent, for security and delivery purposes.
We do not ask for health data or any other special category of personal data through this site. Please do not include patient information in the contact form.
Why we use it
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| To answer your enquiry and carry out any engagement that follows from it | Contact enquiries | Our legitimate interest in responding to a request you made (Art. 6(1)(f)); performance of a contract once there is one (Art. 6(1)(b)) |
| To understand how the site is used and improve it | Analytics | Your consent, given or withheld in the cookie banner and changeable at any time (Art. 6(1)(a)) |
| To keep the site secure, stop spam and abuse, and deliver pages | Technical data | Our legitimate interest in running a secure, working website (Art. 6(1)(f)) |
| To meet our legal and accounting obligations where a business relationship starts | Contact and engagement records | Legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
Who else sees it
These providers process data on our behalf, under data processing terms that bind them to our instructions.
| Provider | What it does | Data | Where |
|---|---|---|---|
| Amazon Web Services | Hosts this website, and receives the contact form and delivers it to us by email | Technical data, contact enquiries | EU (Stockholm region) |
| Google Workspace | Stores the message in our business mailbox | Contact enquiries | Google data centers worldwide, including the USA |
| Cloudflare (Turnstile) | Checks that a person rather than a bot is sending the contact form; does not use cookies for tracking | Technical data | Cloudflare's global network, including the USA |
| Google LLC (Google Analytics) | Page and section statistics, only if you accepted analytics cookies | Analytics | Google data centers worldwide, including the USA |
Cloudflare also uses the Turnstile signals, as an independent controller, to improve its bot detection. That use is covered by Cloudflare's own Turnstile privacy notice.
Where data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses.
We may also disclose data where the law requires it, for example to a public authority with a valid request.
We do not sell personal data, and we do not share it for advertising purposes.
How long we keep it
| Data | Kept for |
|---|---|
| Contact enquiries | As long as the conversation is relevant, then up to three years, so we can pick up where we left off |
| Records of a business relationship | As long as Latvian accounting and tax law requires |
| Analytics | Up to 14 months in Google Analytics, then only in aggregated form |
| Technical data | 90 days in our hosting and delivery providers' logs |
Your rights
Under the GDPR you can:
- ask for a copy of your data, and receive data you gave us in a portable format;
- ask us to correct or erase it, or to restrict how we use it;
- object to processing based on legitimate interest;
- withdraw a consent you gave at any time, for analytics through the "Cookie settings" link in the footer. Withdrawing does not affect processing that happened before.
Write to support@lumias.studio or by post to Lumias SIA, Stārķu iela 4-37, Riga, LV-1084, Latvia, and we will answer within one month. We may ask you to confirm your identity first.
You also have the right to complain to the Latvian Data State Inspectorate (Datu valsts inspekcija), www.dvi.gov.lv, or to the supervisory authority in the EU country where you live or work.
Children
This site is meant for professionals and businesses. We do not knowingly collect data from anyone under 18.
Changes to this policy
We will update this page when what we collect or how we use it changes, and change the "Last updated" date at the top.