Privacy Policy

01Scope

This policy covers lumivc.com and any email correspondence arising from it. It does not cover third-party sites we link to, or the separate confidential processes that apply to prospective investors and portfolio companies, which are governed by their own agreements and disclosures.

For the purposes of the EU and UK General Data Protection Regulation, Lumi Partners is the data controller for the information described here.

02Information we collect

This is a static informational website. We do not operate accounts, forms, payment processing, or advertising technology on it.

Collected automatically

• Technical and log data — IP address, browser type and version, device and operating system, referring page, pages requested, and timestamps. This is processed by our hosting and network provider to deliver the site and protect it from abuse.
• Security signals — data used to detect bots and malicious traffic, including short-lived security cookies.
• Aggregate analytics — only if you consent. Where used, our analytics are privacy-preserving, measure page views and referrers in aggregate, and do not build profiles or track you across other sites.

Provided by you

• Contact details and correspondence — your name, email address, organisation, and the content of any message you send us at info@lumivc.com or another Lumi address.
• Business information — where you contact us as a founder, investor, or journalist, any materials you choose to share.

We do not knowingly collect information from children, and we do not seek sensitive categories of personal information through this website.

03How we use information

• To deliver, secure, and maintain the availability of this website.
• To respond to enquiries and correspond with you.
• To evaluate investment opportunities and manage relationships with founders, investors, and advisers.
• To understand, in aggregate, how the site is used so we can improve it — subject to your consent.
• To comply with legal, regulatory, tax, and anti-money-laundering obligations.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not use it to train machine-learning models.

04Legal bases (EU / UK)

• Legitimate interests — operating and securing the site, responding to enquiries, and conducting our investment business, where these are not overridden by your rights.
• Consent — optional analytics cookies. You may withdraw consent at any time.
• Legal obligation — regulatory, tax, and record-keeping requirements.
• Contract — where processing is necessary to take steps at your request before entering into an agreement.

05Sharing and disclosure

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We disclose personal information only to:

• Service providers acting on our instructions under written agreements — principally our website host and network security provider, and our email and productivity providers.
• Professional advisers — legal, accounting, and compliance advisers, where necessary.
• Authorities — where required by law, regulation, or valid legal process, or to protect our rights and the safety of others.

06Cookies and similar technologies

We use two categories only:

• Strictly necessary — required for the site to function and stay secure, including our network provider's bot-management cookie and a local record of your own privacy choices. These do not require consent.
• Analytics — off unless you opt in, and privacy-preserving where enabled.

We set no advertising, retargeting, or cross-site tracking cookies. You can change your choices at any time.

07Retention

Server and security logs are retained for a short period by our hosting provider, typically measured in days, and then deleted or aggregated. Correspondence is retained for as long as needed for the relationship and thereafter as required for legal, regulatory, and record-keeping purposes. Your privacy preferences are stored locally in your own browser until you clear them.

08Your rights (EU / UK)

If you are in the European Economic Area or the United Kingdom, you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Have inaccurate data corrected, and in certain cases have data erased.
• Restrict or object to processing, including processing based on legitimate interests.
• Receive your data in a portable format where processing is based on consent or contract.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with your national supervisory authority, or with the UK Information Commissioner's Office.

To exercise any of these rights, email info@lumivc.com. We respond within one month, as required.

09Your rights (California)

Under the California Consumer Privacy Act as amended by the CPRA, California residents have the right to:

• Know what personal information we collect, the purposes for collecting it, and the categories of recipients.
• Access the specific pieces of personal information we hold about you.
• Delete personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information.
• Limit the use of sensitive personal information.
• Non-discrimination — we will not treat you differently for exercising any of these rights.

Categories collected

In the preceding twelve months we have collected identifiers (IP address; and, if you contact us, name, email, and organisation), internet activity information (pages requested and referrers), and the content of any correspondence you send us. These are collected for the business purposes set out in section 3, and disclosed only to the service providers described in section 5.

Making a request

Email info@lumivc.com with the subject line "California privacy request". We will confirm receipt within ten business days and respond within forty-five days, extendable once where permitted. We will verify your request against information already in our possession; we may ask for confirmation of the email address used to correspond with us. An authorised agent may submit a request with written permission.

10International transfers

Lumi operates from offices in San Francisco, London, Helsinki, and Tokyo, and our providers operate global infrastructure. Personal information may therefore be processed outside your country of residence, including in the United States. Where data is transferred out of the EEA or the UK, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with appropriate safeguards.

11Security

The site is served over HTTPS and protected by our network provider's security controls. We limit access to correspondence to those within Lumi who need it. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security; please do not send confidential material to us by unencrypted email without arranging it first.

12Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision, and material changes will be noted here.

13Contact

For any privacy question, or to exercise a right described above, contact us at info@lumivc.com. If you are in the EEA or UK and are not satisfied with our response, you may complain to your local supervisory authority.