Privacy Policy

1. Introduction

Luminos ("we", "us", "our") is committed to handling personal data with care and transparency. This Privacy Policy explains what personal information we collect, how we use it, and the rights you have in relation to your data.

This policy applies to all services delivered by Luminos, including our website at lumiinoos and any direct client engagements. If you have questions about how we handle your data, please contact us at privacy@lumiinoos.

2. Data We Collect

We collect personal data in the following ways:

• Contact forms: Name, email address, phone number, and any message content submitted via our website
• Engagement communications: Emails and messages exchanged during a client engagement
• Analytics: Website usage data such as pages visited, session duration, and browser type — collected in aggregate, not individually identified
• Cookies: Preferences and session data stored in your browser (see Section 5)

We do not collect sensitive personal data (such as financial account details, identification numbers, or health information) through our website.

3. How We Use Your Data

Personal data collected is used for the following purposes:

• Responding to enquiries submitted via our contact form
• Managing and delivering client engagements
• Sending project-related communications
• Improving our website based on aggregate usage patterns
• Complying with legal or regulatory obligations

We do not use your data for unsolicited marketing communications. If you receive a follow-up from us, it will be directly related to an enquiry or engagement you initiated.

Legal basis for processing: Consent (for contact form submissions), legitimate interest (for improving our services), and contractual obligation (for active engagements).

4. Data Sharing & Third Parties

We do not sell, rent, or trade personal data. Data may be shared with:

• Service providers: Tools used to operate our website and communications (e.g., hosting providers, email services) — bound by data processing agreements
• Analytics services: Aggregate, anonymised usage data may be processed by third-party analytics tools
• Legal requirements: Where required by Malaysian law or competent authority

Any third parties we work with are required to handle data in accordance with applicable data protection standards.

5. Cookies

Our website uses cookies to improve the browsing experience and understand usage patterns. Cookie types include essential cookies required for site functionality, and optional analytics and preference cookies. You can manage your cookie preferences at any time via our Cookie Policy page.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected:

• Contact enquiries: Up to 12 months from last communication, unless an engagement is initiated
• Client engagement data: Up to 3 years after engagement completion, as required for business records
• Analytics data: Rolling 26-month window in aggregate form

After the retention period, data is securely deleted or anonymised.

7. Data Protection Measures

We take reasonable technical and organisational steps to protect personal data, including:

• Encrypted transmission (TLS/HTTPS) for all data submitted via our website
• Restricted access to personal data within our team on a need-to-know basis
• Regular review of data handling practices
• Data processing agreements with any third-party service providers

In the event of a personal data breach affecting your rights and freedoms, we will notify you and, where required, the relevant authority within the timelines required under Malaysian law.

8. Your Rights

Under the Malaysian Personal Data Protection Act 2010 (PDPA), you have the following rights in relation to personal data we hold about you:

• Right of access: Request a copy of the personal data we hold about you
• Right of correction: Request that inaccurate or incomplete data be corrected
• Right to withdraw consent: Where processing is based on consent, you may withdraw at any time
• Right to prevent processing: Object to processing that causes or is likely to cause damage or distress
• Right to prevent direct marketing: Opt out of any marketing communications

To exercise any of these rights, contact us at privacy@lumiinoos. We will respond within 21 days as required under the PDPA.

9. Children's Privacy

Our services are directed at organisations and individuals aged 18 and above. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that data from a minor has been submitted, we will delete it promptly.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any external site you visit.

11. Governing Law

This Privacy Policy is governed by the Personal Data Protection Act 2010 (PDPA) of Malaysia. Any disputes arising from this policy shall be subject to the jurisdiction of Malaysian courts.

If you have concerns about how your data is handled, you may raise a complaint with the Department of Personal Data Protection Malaysia (JPDP).

12. Policy Updates

We may update this Privacy Policy from time to time. Where changes are material, we will update the "Last updated" date at the top of this page. Continued use of our website following any update constitutes acceptance of the revised policy.

13. Contact

For any privacy-related questions or to exercise your rights:

• Email: privacy@lumiinoos
• Address: Luminos, 29 Jalan Telawi, Bangsar, 59100 Kuala Lumpur, Malaysia
• Phone: +60 3-7164 3289