1. Who we are
This notice explains how Lumifrik Holdings Ltd. ("Lumifrik", "we", "us") collects and uses personal data when you visit lumifrikholdings.com (the "website") or contact us through it.
Lumifrik Holdings Ltd. is a company registered in Ireland, with its registered office in Dublin. It is the controller of the personal data described in this notice, which means it decides how and why that data is used.
We handle personal data in line with the EU General Data Protection Regulation (GDPR), the Irish Data Protection Acts 1988 to 2018 and, for cookies, the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011.
Questions about this notice or your personal data: email contact@lumifrikholdings.com, or use our contact form and choose "Privacy and data protection".
2. The data we collect
We only collect personal data that you give us, or that your device sends when you use the website.
- Contact form: your name, email address, organisation (optional), the type of enquiry and your message.
- Investor enquiry form: your name, organisation, role (optional), email address, country, investor type, area of interest, message (optional), and your confirmation that you are contacting us as, or on behalf of, a qualified, institutional or professional investor.
- Emails you send us directly: your email address and anything you include.
- Technical data: when you load a page, your browser sends your IP address and details such as your browser type and the page requested. Our hosting provider records this in server logs. When you submit a form, we keep a pseudonymised (hashed) version of your IP address for up to 24 hours to prevent abuse.
- Cookies and similar technologies: see section 9.
Please do not send us special category data (such as health information) or confidential information through our forms. If you give us information about another person, please make sure they have seen this notice.
Giving us your details is voluntary, but we need the information marked as required on our forms to respond to you.
3. How and why we use your data
We use your personal data for the purposes below, each with a lawful basis under Article 6 of the GDPR.
| Purpose | Data | Lawful basis |
|---|---|---|
| Responding to your enquiry and following it up | Form or email contents | Our legitimate interests in responding to people who contact us (Art. 6(1)(f)) or, where you ask about a possible agreement with us, steps taken at your request before entering into a contract (Art. 6(1)(b)) |
| Assessing investor enquiries and, if we both wish to proceed, preparing for due diligence | Investor form contents | Steps taken at your request before entering into a contract (Art. 6(1)(b)), and our legitimate interests in dealing only with eligible investors (Art. 6(1)(f)) |
| Keeping the website and its forms secure, and preventing spam and abuse | Technical data, form session cookie, hashed IP address | Our legitimate interests in protecting our website and the people who use it (Art. 6(1)(f)) |
| Remembering your cookie choices | Your consent choice, stored in your browser | Our legal obligation to obtain and respect your consent to cookies (Art. 6(1)(c)) |
| Analytics, only if we introduce it and only if you agree | How you use the website | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Complying with the law, and establishing or defending legal claims | Any of the above, as needed | Our legal obligations (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights and interests. You can object to this use of your data at any time (see section 8).
If you go on to due diligence as an investor, we will collect further information for know-your-customer (KYC) and anti-money-laundering checks. We will give you separate information about that processing at the time.
We do not sell your personal data. We do not use it for automated decision-making or profiling, and we do not send you marketing unless you ask us to.
4. Who we share your data with
- Our group companies: where your enquiry concerns a subsidiary, for example SARF-X or Lumifrik Technologies, we share it with that company so it can respond.
- Service providers acting for us: Hostinger, which hosts our website and email. Service providers may only use your data on our instructions and under a data processing agreement.
- Professional advisers, such as lawyers and auditors, who are bound by duties of confidentiality, where this is necessary.
- Authorities, regulators and courts, where the law requires it or to protect our legal rights.
We do not share your personal data with anyone else.
5. International transfers
Some of our group companies are outside the European Economic Area (EEA), for example in Ghana, Guinea and Togo, and our service providers may process data outside the EEA. These countries may not offer the same level of protection as the EU.
When personal data is transferred outside the EEA, we make sure appropriate safeguards are in place, such as the European Commission's standard contractual clauses, or that another lawful basis for the transfer applies. You can ask us for more information about these safeguards using the contact details in section 12.
6. How long we keep your data
- Enquiries and related correspondence: for as long as we need to deal with your enquiry, then for up to 24 months after our last contact with you. If a business relationship develops, we keep the data for the length of that relationship and for any further period the law requires.
- Investor due diligence records: for the periods required by applicable anti-money-laundering law.
- Hashed IP addresses used to prevent abuse: deleted automatically within 24 hours.
- Form session data: the cookie is deleted when you close your browser, and the matching data on our server shortly afterwards.
- Server logs: kept by our hosting provider for a limited period for security and troubleshooting.
- Your cookie choices: stored in your browser for six months.
When we no longer need personal data, we delete it or make it anonymous.
7. How we protect your data
We use encrypted connections (HTTPS) across the website, protection against forged form submissions and automated abuse, restricted access to our mailboxes and hosting accounts, and data processing agreements with our service providers.
No system is completely secure, but we work to protect your data. If a personal data breach occurs, we will notify the Data Protection Commission and, where required, you, in line with the GDPR.
8. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased, in certain circumstances;
- restrict how we use your data, in certain circumstances;
- object to our use of your data where we rely on legitimate interests;
- receive the data you gave us in a portable format, where we process it by automated means on the basis of consent or a contract; and
- withdraw your consent at any time, where we rely on consent. This does not affect any use of your data before you withdrew it.
To exercise any of these rights, contact us using the details in section 12. We may need to confirm your identity first. We will reply within one month. For complex requests we may extend this by up to two further months, and we will tell you if we do. Exercising your rights is free, unless a request is clearly unfounded or excessive.
If you live outside the EU, the data protection law of your country may give you further rights, for example Ghana's Data Protection Act, 2012 (Act 843), the Nigeria Data Protection Act 2023, or Togo's Law No. 2019-014 of 29 October 2019 on the protection of personal data. We will respect those rights.
9. Cookies
We use only strictly necessary cookies and similar technologies, and we ask for your consent before using any others. Our Cookie Policy lists them and explains how to change your choices.
10. Children
Our website is intended for businesses, institutions and professional investors. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
11. Changes to this notice
We may update this notice from time to time. The date at the top shows when it last changed. If we make significant changes, we will highlight them on the website.
12. Contact and complaints
For any question about this notice, or to exercise your rights, email contact@lumifrikholdings.com or use our contact form and choose "Privacy and data protection".
You also have the right to complain to a data protection supervisory authority. In Ireland this is the Data Protection Commission:
Data Protection Commission21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie
You can also complain to the supervisory authority in the EU country where you live or work. We would appreciate the chance to deal with your concern first, so please contact us before you do.