LumessaPrivacy
What this covers
This notice covers this website — getlumessa.com — and nothing else. Four things happen here that involve personal data: you can ask to be told when Lumessa is released, our host keeps a record of requests to the site, you can write to us, and you can telephone us.
The Lumessa app is not released. When it is, a fuller notice covering it will replace this one, and it will be published before the app is available rather than alongside it.
Who we are
Lumessa Limited, a company registered in England and Wales, company number 17335480, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the controller of the personal data described below.
Write to hello@getlumessa.com, or telephone 020 3355 8301.
We are registered with the Information Commissioner's Office under reference ZC219318.
The short version
You can read every page of this site without telling us anything about yourself. We set no cookies, no analytics of ours runs in your browser, and the site makes no request to any third party — the fonts, the images and the short recording on the home page are all served from this domain, and there is no tag manager, no third-party video player and no advertising code anywhere on it. That is why there is no consent banner: there is nothing to consent to.
Two things sit outside that, and both are described below. Our host keeps a technical record of every request to the site. And if you use the launch-notification field, submitting it sends your address to MailerLite — which is what the field is for.
If you give us your email address for the launch notification, we use it once, for that, and for nothing else.
If you ask to be told when Lumessa is released
What we hold: the email address you give us, the date and time recorded against it, and the internet (IP) address your browser was using. The time and that address together are the record that consent was given.
Why: to send you one message when Lumessa is released.
Our lawful basis: your consent. You give it by entering the address and then following the link in the confirmation email we send. Until you follow that link the address is not used for anything, and if you never follow it, nothing is ever sent to it.
We keep the record of your confirmation for as long as we hold the address, because it is how we would show that consent was given.
How long: until the launch message has been sent and the list is closed, or until you unsubscribe, whichever comes first. If Lumessa is not released and the list is no longer being kept for a reason, we will write once to say so and then delete it.
Who processes it: MailerLite (UAB MailerLite, Lithuania), which stores the list and sends the message on our instructions. MailerLite is established in the European Union, and uses its own suppliers to run the service it provides to us.
What we do not do: we do not send tracking pixels, and open and click tracking are switched off in the provider's settings — so we do not know whether you opened the message. We do not sell the list, share it, or use it for anything other than the message described above. Unsubscribing works on the first click, without a login and without a preference page.
When you visit this site
The site is hosted by Cloudflare, which records the technical details of each request: the IP address it came from, the time, the page requested, and the browser and operating system reported. An IP address is personal data, which is why this section exists.
Why: to keep the site available and to defend it against attack and abuse.
Our lawful basis: our legitimate interests in the security and availability of our own website. We have considered whether that overrides your interests and take the view that it does not intrude on them: the records are technical, are not linked to anything else, are not used to build any picture of you, and are not read at all unless something goes wrong.
How long: these records sit with Cloudflare and are deleted after a short period that Cloudflare sets rather than we do. We have not switched on any longer retention, and we keep no copy of our own.
If you write to us
We hold your address and what you wrote, for as long as it takes to deal with it and for 24 months afterwards.
Our lawful basis: our legitimate interest in answering people who write to us.
How it reaches us: mail addressed to hello@getlumessa.com is forwarded to our mailbox by Cloudflare Email Routing. Cloudflare states that it does not store or read the contents of the mail it forwards; it checks for phishing and passes the message on.
Where it is then held: our mailbox is Gmail, provided to us by Google LLC in the United States, which stores and delivers the message.
If you telephone us
The number on this site rings to voicemail, and the greeting asks you to write to us instead. If you do leave a message, we hold the recording, the number you called from and the time of the call, for as long as it takes to deal with what you called about and for 24 months afterwards.
Our lawful basis: our legitimate interest in answering people who contact us.
Who processes it: Yay.com (YayYay Limited, a company registered in England and Wales, company number 08738610), which takes the message and holds it until we delete it.
Sharing
We do not sell personal data and we do not share it for advertising. The organisations that handle it are MailerLite, Cloudflare, Google and Yay.com, named above — together with the suppliers each of them uses to run its own service. We would also disclose data where the law required us to.
Where your data is held
MailerLite is established in the European Union and the list is held there. Some of the suppliers MailerLite uses to run its service are outside the United Kingdom and the European Union, and its contract with us covers those transfers.
Yay.com, which takes messages left on our telephone number, is in the United Kingdom.
Google and Cloudflare are both United States companies operating global networks, so mail sent to us is held in the United States, and technical records of requests to this site may be processed outside the United Kingdom. Google LLC holds a current certification under the UK Extension to the EU–US Data Privacy Framework, which is the route we rely on for it. Where a transfer is not covered by an adequacy finding or that Framework, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Keeping it safe
The site is served only over an encrypted connection, and your address travels to MailerLite over one. Mail to us is carried over an encrypted connection wherever the sending service supports it. Access to the list and to the mailbox is limited to the people at Lumessa Limited who need it, which at present is one person, on an account protected by two-step verification.
Your rights, and how to use them
You can ask us to give you a copy of the personal data we hold about you, to correct it, to delete it, to restrict what we do with it, or to give it to you in a portable form. You can object to processing we carry out on the basis of our legitimate interests. Where we rely on your consent, you can withdraw it at any time — for the launch list, unsubscribing does exactly that.
To make any of these requests, write to hello@getlumessa.com. You do not need an account and there is nothing to log in to. It costs nothing, and we will respond within one month of receiving your request, which is the period the law gives us.
You do not need to use any particular words. An email saying "please delete everything you have about me" is a valid request and we will treat it as one.
Deletion has its own page, written for someone who no longer has the app or the device: deleting your account and your data.
Complaints
If you are unhappy with how we have handled your personal data, tell us first at hello@getlumessa.com and we will look into it.
You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. If you are in the European Union you may instead complain to the supervisory authority in your own country.
Age
The launch-notification list is not intended for children under 13, and we ask that you do not give us an address if you are younger than that.
Changes
If what we do changes, this notice changes with it, and the date at the top changes too. When the Lumessa app is released this notice is replaced by a fuller one covering the app as well as the website.