Privacy Policy

Lúmina W S.A.S, identified in Colombia, is the Controller responsible for processing the personal data collected through its digital and commercial channels.

• Website: luminaw.co
• Contact email: contact@luminaw.co
• Domicile: Medellín, Antioquia, Colombia.
• WhatsApp: +57 310 828 3088

We collect only the data necessary for the purposes described.

Contact and commercial data

• Name, company, role, email address and phone number.
• Message or need described in the form.
• Information exchanged during the commercial conversation (proposals, calls, emails).

Contractual and billing data

• NIT or identity document, address, tax data.
• Electronic invoicing information.

Technical and browsing data

• IP address, browser type, operating system, pages viewed and time spent.
• Information provided by analytics cookies (see Cookies Policy).

Sensitive Data in Projects

When the execution of a Project requires the processing of sensitive data, such as data relating to animal health, biometric, financial, minors or special categories under Ley 1581 de 2012, Lúmina W requests the prior signing of a Security and Processing Annex that details additional technical, organizational and contractual measures to protect that information.

Personal data is processed for the following purposes:

• Handle commercial inquiries received by form, email, WhatsApp or other channels.
• Prepare proposals and quotes according to the requested scope.
• Execute and manage contracts for professional services and Lúmina W SaaS products.
• Comply with legal, accounting and tax obligations (electronic invoicing, tax reporting, document retention).
• Send operational communications related to active projects or services (notices, updates, support).
• Measure and improve the website through aggregated and anonymized analytics.
• Send commercial communications only when the data subject has expressly authorized receiving them.
• Provide Retainer services for technical support, platform evolution and corrective maintenance under a fixed monthly hours model.

We do not sell, rent or transfer personal data to third parties for marketing purposes.

The processing of personal data by Lúmina W relies on the following legal bases:

• Consent of the data subject, granted by submitting the contact form, subscribing to communications or accepting the cookies policy.
• Contract performance, when processing is necessary for the provision of the contracted Service or the preliminary negotiations.
• Compliance with legal obligations, in tax, accounting, labor and commercial matters.
• Legitimate interest of Lúmina W to ensure the operation, security and improvement of the site and the services, always weighed against the rights of the data subject.

Personal data is retained only for the time necessary to fulfill the purposes for which it was collected and to meet legal obligations:

Prospects and inquiries not converted

Up to 24 months after the last contact, unless a deletion request is made earlier.

Project data

Code, documentation, architecture and configurations: 90 days after the Project closes to allow download and transition. Once the period expires, it is removed from Lúmina W production systems.

Personal and Billing Data

Name, email, NIT, invoices and contractual documents: throughout the contractual relationship and up to 10 years afterward, in accordance with the accounting, tax and commercial retention obligations in force in Colombia.

Retainer data

History of changes, improvements and support: throughout the term of the Retainer and up to 2 years after its termination.

Browsing data

Aggregated and anonymized, retained according to the configured analytics tools (see Cookies Policy).

Marketing communications

Until the data subject revokes their consent.

Once the periods expire, the data is deleted, anonymized or archived as appropriate and in accordance with the security standards in force.

Lúmina W may share personal data with Data Processors that provide services under contract, exclusively for the purposes described. These include:

• Cloud infrastructure providers (AWS, Google Cloud, Cloudflare or equivalents).
• Transactional and commercial email platforms configured for sending messages.
• Analytics tools (Google Analytics or another privacy-friendly tool).
• Form platform (Formspree for the site contact form submissions).
• Accountants and legal advisors in the fulfillment of regulatory obligations.

Each Processor acts under documented instructions from Lúmina W and contractually commits to observe equivalent security and confidentiality standards.

In accordance with Ley 1581 de 2012, the data subject has the right to:

• Know the personal data that Lúmina W processes.
• Update and rectify partial, inaccurate, incomplete or outdated data.
• Request proof of the authorization granted for processing.
• Be informed about the use given to their personal data.
• Submit inquiries and complaints to Lúmina W or to the Superintendence of Industry and Commerce (SIC).
• Revoke the authorization and/or request the deletion of the data, when there is no legal or contractual duty to retain it.
• Access their personal data free of charge.

How to exercise these rights

Requests are channeled to the email contact@luminaw.co, indicating name, identity document, description of the request and contact details. Lúmina W will respond within the legal timeframes:

• Inquiries: up to ten (10) business days.
• Complaints: up to fifteen (15) business days, extendable by eight (8) more when justified.

Lúmina W applies reasonable and proportionate technical, human and administrative measures to protect personal data against loss, unauthorized access, alteration or misuse. These measures include, among others:

• Encryption in transit (TLS/HTTPS) on the site, forms and APIs.
• Encryption at rest in the stores that support it.
• Role-based access control and multifactor authentication for internal systems.
• Activity logs and periodic security reviews.
• Training for the team on privacy and security best practices.
• Incident response procedures with notification to the data subject and the SIC when applicable.

Personal data is hosted on infrastructure located in the United States, through specialized providers such as Railway, Netlify, AWS or other cloud services designated for each Project. The Client may request a specific geographic location according to their regulatory compliance requirements.

Lúmina W requires that any Data Processor located outside Colombia offer adequate protection levels in accordance with Colombian regulations, through standard contractual clauses or equivalent certification (e.g.: SOC 2, ISO 27001, AWS/Google Cloud standards).

The data subject acknowledges and authorizes these transfers by accepting this Policy. Upon request, Lúmina W will provide specific information about the destination countries, the safeguards applied and the providers used.

For questions, inquiries, complaints, exercise of rights or requests related to this Policy, the data subject may reach out to:

• Email: contact@luminaw.co
• WhatsApp: +57 310 828 3088

If the data subject considers that their rights have not been satisfactorily addressed, they may file a complaint with the Superintendence of Industry and Commerce (SIC) in the exercise of its personal data protection powers.

Changes to this Policy

Lúmina W may update this Policy to reflect regulatory changes or adjustments to its processes. Substantial modifications will be communicated through the website and, where applicable, through direct notification to the affected data subjects.