Privacy Policy

This Privacy Policy explains how we collect, use, and protect your personal data when you visit the Lumin website (the “Website”) or contact us through it. We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.

Please also read our Terms of Service and Cookie Policy, which apply together with this Privacy Policy.

Data controller

The controller of your personal data is:

(hereinafter “Lumin”, “we”, “us”, or “our”). PIXION d.o.o. is the developer and operator of Lumin, a behavior-driven test management service.

What data we collect

Contact form data

When you request early access or send us a message through the contact form, we collect your name and work email address, and — if you provide them — your company name and team size, together with your message and whether you asked us to send you a Gherkin audit report.

Bot-protection data

The contact form is protected by Cloudflare Turnstile, which processes your IP address and technical signals from your browser to check that the submission comes from a person. When you submit the form, our servers pass your IP address to Cloudflare to verify the result, and use it briefly to limit repeated submissions from the same address.

Technical data

Like most websites, our hosting provider automatically processes standard technical information when you load a page, such as your IP address, browser type, the page requested, and the time of the request. Headings on the Website use a typeface served by Adobe Fonts, so your browser also requests it from Adobe, which receives your IP address and browser information in the process.

Cookies and analytics

The Website uses essential browser storage to remember your cookie preferences and, only with your consent, Google Analytics cookies to understand how the Website is used. Until you accept, Google Analytics is not loaded and receives nothing. See our Cookie Policy for the full list. We do not use advertising cookies.

Error reports

If a page breaks in your browser, the Website sends us a technical report through Sentry: what went wrong, the page address, and your browser and operating system. It does not include your name, email or IP address. If you have accepted analytics cookies, the report also includes a short replay of the minute before the error, with all text, form inputs and images hidden.

The Website has no user accounts and does not collect payment details. We do not use your data for automated decision-making or profiling.

Purposes and legal bases of processing

• Responding to your enquiry — replying to your message, arranging early access, and sending the Gherkin audit report if you asked for it. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
• Security and abuse prevention — protecting the contact form from spam and automated submissions. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
• Operating the Website — delivering pages and fonts and keeping the Website available and secure. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
• Analytics — understanding how visitors use the Website so we can improve it. Legal basis: consent (Art. 6(1)(a) GDPR).
• Error monitoring — finding and fixing errors on the Website. Legal basis: legitimate interests in a working Website (Art. 6(1)(f) GDPR); consent for the replay attached to an error report (Art. 6(1)(a) GDPR).
• Legal compliance — complying with legal obligations and protecting our legal rights. Legal basis: legal obligation (Art. 6(1)(c) GDPR) and legitimate interests.

Third parties who process your data

We share personal data only with service providers (processors) who help us operate the Website, under data processing agreements, and only to the extent necessary:

We do not sell your personal data, and we do not share it with third parties for their own advertising purposes. We may disclose data to legal advisors, auditors or public authorities where required by law.

International data transfers

We store and protect personal data in accordance with EU legal requirements, including the GDPR. Some of our providers may transfer data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions (e.g. the EU–US Data Privacy Framework).

Data retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy:

• Contact form submissions are kept for up to 1 year from receipt of the message, or longer if legal proceedings are initiated.
• IP addresses used to limit repeated submissions are held only in memory, for a few minutes.
• Technical data processed by our hosting and font providers is retained according to their own retention periods.
• Google Analytics data is kept for no longer than 14 months.
• Error reports are kept for up to 90 days.
• Your cookie preferences are stored in your browser for 12 months, after which we ask again.

How we keep your data safe

We have implemented appropriate technical and organizational measures to protect personal data. The Website is served only over HTTPS/TLS with a strict set of security headers, the contact form is protected against automated abuse, and we restrict access to personal data to personnel who have a business reason to access it. Our Security page has more detail.

Your data protection rights

You can exercise the following rights at any time by contacting us:

• Right of access — obtain information about the categories of data we process about you, the purposes, the third parties it was disclosed to, and how long it will be retained.
• Right to rectification — have inaccurate personal data about you corrected.
• Right to erasure (“right to be forgotten”) — have your personal data deleted.
• Right to restriction — ask us to restrict the processing of your personal data in certain circumstances.
• Right to object — object to processing based on our legitimate interests.
• Right to data portability — receive a copy of the data you provided to us in a structured, machine-readable format and, where technically feasible, have it transmitted to another service.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing. For analytics cookies, you can do this from Cookie settings in the footer.

To exercise your rights, email privacy@lumintest.com or write to PIXION d.o.o., Rudeška cesta 179, 10000 Zagreb, Croatia (with the note “personal data protection”). We will respond to your request within one month; this term may be extended where permitted by applicable law. We may request specific information from you to confirm your identity where necessary and reasonable. You do not need to pay a fee to exercise your rights, but we may charge a reasonable fee or refuse a request that is clearly unfounded, repetitive, or excessive.

Children

The Website is not intended for children. We do not knowingly collect personal data of persons under the age of 16. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it.

Changes to this Privacy Policy

We will update this Privacy Policy from time to time. Changes will be posted on this page, and the “Last updated” date at the top indicates the latest revision.

Complaints

If you have any concerns about our use of your personal data, please contact us first at privacy@lumintest.com — we will do our best to resolve them. You also have the right to lodge a complaint with a supervisory authority: in Croatia, the Croatian Personal Data Protection Agency (AZOP, azop.hr), or the data protection authority of your EEA country of residence (list available at edpb.europa.eu).