Privacy notice
Last updated 1 November 2026
1. Who we are
Lumela (“we”, “us”, “our”) is the controller of the personal data described in this notice. If you have a question about this notice or about how we handle your personal data, email info@lumela.co.uk.
2. What this notice covers
This notice explains how we handle personal data where we decide why and how it is used. It covers:
- visitors to our website at www.lumela.co.uk;
- people who book a walkthrough with us;
- people at organisations we contact, or who contact us, about our services;
- people who use our service on behalf of a customer organisation; and
- people who apply to work with us.
It does not cover the personal data held inside our customers’ own systems, which our service reads on their behalf. See section 8.
3. Website visitors and bookings
| What we collect | Why | Lawful basis |
|---|---|---|
| Your IP address, browser type, the pages you view and when, recorded in our hosting provider’s server logs | To keep the site available and secure, and to look into faults and abuse | Legitimate interests: running and protecting our own website |
| When you book a walkthrough: your name, email address, the time you pick and anything you write in the booking form | To arrange the call and hold it | Legitimate interests: answering a request you made to us |
| Anything you send us by email | To answer you | Legitimate interests: responding to an enquiry addressed to us |
Bookings are handled for us by Cal.com, which stores the booking and sends the calendar invitation. We use no advertising cookies or analytics on our website. Our cookie notice explains the cookies the booking calendar sets.
Server logs are kept by our hosting provider for no more than 30 days and then deleted. Booking details are kept for as long as we are in conversation with you, and for no more than 24 months after our last contact.
4. Business contacts and prospective customers
We market our services to organisations. To do that, we hold limited business contact information about people who work at them.
What we hold: name, job title, employer, business email address, business telephone number, the employer’s publicly filed company information, and a record of our contact with you and your response.
Where we get it. Most of it does not come from you. We obtain it from:
- the Companies House public register, including the register of directors;
- published job advertisements, including those available through the Reed jobs API;
- the UK Research and Innovation Gateway to Research database of publicly funded projects;
- your employer’s own public website; and
- information you give us directly, for example at an event or by replying to us.
Why we hold it. To find organisations that may benefit from our service, to contact the right person there, to keep a record of who has asked not to be contacted, and to manage our own sales records.
Lawful basis. Legitimate interests, specifically our interest in promoting our business to other businesses likely to be interested in it. We have carried out and written down an assessment balancing that interest against your rights. You can ask us for a summary of it.
Where we rely on consent instead. Where the organisation is a sole trader or an unincorporated partnership, electronic marketing needs your prior consent under the Privacy and Electronic Communications Regulations 2003. We do not send marketing email to such organisations without it.
How long we keep it. For as long as the organisation remains a realistic prospect, and no longer than 24 months from our last meaningful contact with you, after which it is deleted. If you ask us to stop contacting you, we keep the minimum record needed to honour that request, normally your email address on a suppression list, indefinitely. Deleting it would mean contacting you again by mistake.
You can stop this at any time. See section 9.
5. Users of our service
Where your employer is our customer and you have an account with our service, we hold:
| What we collect | Why | Lawful basis |
|---|---|---|
| Your name, work email address and the organisation you belong to | To create and authenticate your account and decide what you may see | Legitimate interests: providing the service our customer has contracted for |
| Your role in the workspace, and the invitations you sent or accepted | To administer access and keep an accurate record | Legitimate interests, as above |
| Records of your sign-ins and of significant administrative actions | Security, and investigating problems | Legitimate interests: protecting our service and our customers’ data |
Sign-in is handled for us by Clerk. We never receive or store your password. We keep this data while your account is active and for 90 days after your employer’s contract ends, after which it is deleted along with the rest of that customer’s data.
6. Job applicants
If you apply to work with us we hold your application, CV, correspondence and interview notes, on the basis of our legitimate interest in assessing candidates and taking steps at your request before entering a contract. We keep unsuccessful applications for six months and then delete them, unless you agree to us keeping them longer.
7. Who we share personal data with
We share personal data with the suppliers who help us run the business, each bound by a written contract that limits what they may do with it. Today they are:
- Vercel, which hosts this website;
- Cal.com, which runs walkthrough bookings;
- Google, which provides our email; and
- Clerk, which handles sign-in to our service.
We also disclose personal data where the law, a court or a regulator requires it, and to our professional advisers where they need it to advise us.
We do not sell personal data, and we do not share it for anyone else’s marketing.
8. Data inside our customers’ systems
Our service reads data from systems our customers already use, such as email, customer relationship management, service desk and source control, and turns it into measurements of how much AI-assisted work they do and what it returns.
That data includes personal data about our customers’ own staff and contacts. For that data our customer is the controller and we are the processor. We process it only on our customer’s documented instructions, under a written data processing agreement. This means:
- Our customer, not us, decides what is collected and why.
- If you work for one of our customers and want to know what is held about you, or to exercise your rights, contact your employer. We will help them respond.
- Our service is built to hold as little as it can. From email accounts we request message metadata only (sender, recipient, subject and timestamps), never message content. Individuals appear in reports under labels such as “Rep A”, not by name.
We have assessed the data protection implications of this processing in a data protection impact assessment, which we share with customers.
9. Your rights
Under the UK GDPR you have the right to:
- be told how your personal data is used, which is what this notice is for;
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict how we use your data while a concern is resolved;
- object to processing carried out on the basis of legitimate interests;
- receive certain data in a portable format; and
- not be subject to a decision based solely on automated processing which has legal or similarly significant effects. We do not make such decisions.
Objecting to marketing is absolute. If you tell us you don’t want to be contacted, we stop, immediately and for good, and we don’t weigh that against anything. Click the unsubscribe link in any email we send, reply asking us to stop, or write to info@lumela.co.uk. We add your address to a suppression list so our own research doesn’t pick it up again.
To exercise any other right, email info@lumela.co.uk. We will respond within one month, at no charge. We may ask for information to confirm who you are, which we then delete.
10. Transfers outside the United Kingdom
Some of our suppliers are based outside the UK, mainly in the United States and the European Economic Area. Where personal data goes outside the UK we rely on one of:
- the UK adequacy regulations, where the country is recognised as protecting data adequately, which covers the EEA;
- the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it; or
- the International Data Transfer Agreement issued by the Information Commissioner, or the EU standard contractual clauses with the UK Addendum, together with an assessment of the risks of the transfer.
You can ask us for a copy of the safeguards that apply.
11. How we protect personal data
We encrypt data in transit and encrypt stored credentials. Access is limited to the people who need it and protected by multi-factor authentication. We can share a security overview with customers on request.
No system is perfectly secure. If a breach is likely to put your rights and freedoms at high risk, we will tell you without undue delay, and we will report qualifying breaches to the Information Commissioner within 72 hours of becoming aware of them.
12. Changes to this notice
We will update this notice when how we handle personal data changes. The date at the top shows when it was last revised. Where a change is significant we will tell the people it affects directly.
13. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at info@lumela.co.uk so we can put it right.
You can also complain to the UK supervisory authority, the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113, ico.org.uk.