01 Introduction
This Privacy Policy is published in accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). It explains how we handle your personal data when you use Lumex. Please read it together with our Terms of Service and Cookie Policy.
02 Who we are
Lumex is operated by Webority Technologies Private Limited, a company incorporated in India with its registered office at 629-634, Vipul Trade Centre, Sector-48, Sohna Road, Gurugram, Haryana 122018, India ("Webority", "Lumex", "we", "us", "our").
Lumex is a software platform for IEC/EN 62305 lightning risk assessment. It is a tool used by qualified professionals; it does not perform the assessment for you, and it does not replace the engineer who signs the report. For the data you hold about your own clients inside Lumex, you are the data fiduciary (controller) and we act as a data processor on your behalf; a Data Processing Agreement reflecting this is available to you on request at [email protected].
03 Personal data we collect
- Account & identity data: your name, work email, phone number and password (stored only as a salted hash).
- Firm & business data: your firm's name, address, GSTIN, logo and team-member details.
- Assessment data you upload: building geometry, project, site and zone records, drawings, single-line diagrams, site photos and other documents you attach to an assessment.
- Billing data: plan, credits, invoices and payment metadata. Card and bank details are handled by our payment processor; we do not store full card numbers.
- Usage & technical data: log data, device and browser information, and actions recorded in our audit trail.
- Communications: messages you send to support and your contact preferences.
04 How we use your data
We use your data to provide and run the service: creating your workspace, computing assessments and generating reports; to manage your team, roles and access; to process payments and issue GST-compliant invoices; to provide support; to keep the platform secure and prevent fraud; to improve the product; to send you service-related communications; and to meet our legal obligations.
05 Consent & legal bases
Where we rely on consent, your consent is explicit, granular, purpose-bound and revocable. We also process data where it is necessary to perform our contract with you, to comply with the law, or for our legitimate interests in running and securing the service. You can withdraw consent at any time, though some features may stop working as a result.
06 How we share your data
We share data only as needed to run the service: within your workspace, according to the role each team member holds; with service providers (cloud hosting, payment processing, email and analytics) who act on our instructions under written confidentiality and data-processing agreements; and where required by law or to protect our rights. If Webority is involved in a merger or acquisition, data may transfer under the same protections.
We do not sell, rent or lease your personal data to anyone, and we do not use advertising cookies or cross-site tracking.
07 Where your data is stored
Your data is hosted on Microsoft Azure, with India-based hosting used where applicable. Each workspace's data is logically isolated through strict multi-tenant scoping, so one customer's data is not accessible to another.
If you are in the European Economic Area or the United Kingdom, your data may be transferred to and processed in India. As India is not currently the subject of an EU or UK adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and, for UK data, the UK International Data Transfer Addendum), together with the technical and organisational safeguards described in section 09, as the legal basis for that transfer. A copy of the relevant clauses is available on request.
08 How long we keep your data
We keep your data for as long as your account is active and for as long as needed to provide the service. After closure, we delete or anonymise your data except where we must retain it by law, for example, tax invoices for eight years under Section 36 of the CGST Act. See our Data Deletion page to request erasure.
09 Security
We protect your data with TLS 1.3 in transit, AES-256 at rest, role-based access controls, tenant isolation and an append-only audit log of sensitive actions. No system can be guaranteed perfectly secure, but we work continuously to protect your information and will notify you and the authorities of a breach where the law requires.
10 Your rights & how to use them
Subject to applicable law, you can access your data, correct it, request its erasure, withdraw consent, nominate a representative, and raise a grievance. To exercise any right, email [email protected]; we aim to respond within 7 days. To request erasure, see Data Deletion.
11 Cookies
We use strictly-necessary cookies to keep you signed in and the site working, and preference cookies to remember your choices. With your consent, we also use analytics cookies to measure how the site is used, through Google Analytics 4, Google Tag Manager and Microsoft Clarity, governed by Google Consent Mode and our cookie consent banner. We additionally use Ahrefs, a cookieless analytics tool that sets no cookies. A cookie banner lets you accept or reject non-essential cookies, and you can change your choice at any time. We do not use advertising cookies to build profiles or to track you across unrelated websites. Full detail is in our Cookie Policy.
12 Children
Lumex is a professional tool and is not intended for anyone under 18. We do not knowingly collect data from children.
13 Users in the EEA & UK (GDPR)
If you are in the European Economic Area or the United Kingdom, you have the rights granted under the GDPR / UK GDPR: access, rectification, erasure, restriction of processing, data portability, objection, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The legal bases in section 05 describe how and why we process your data, and section 07 describes how we safeguard international transfers. You can withdraw consent at any time without affecting processing already carried out.
You also have the right to lodge a complaint with your supervisory authority. If you are in the EEA you can find yours via the European Data Protection Board; in the UK, the Information Commissioner's Office (ICO).
14 California residents (CCPA)
If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of any "sale" of personal information. We do not sell your personal information. We will not discriminate against you for exercising these rights.
15 Changes to this policy
We may update this Privacy Policy from time to time. We give at least 15 days' notice before any material change takes effect, and the "Last updated" date above always reflects the current version.
16 Grievance Officer & contact
In line with the Information Technology Act, 2000 and the DPDP Act, 2023, our Grievance Officer is Mr. Navneet Singh. Write to him at [email protected] or [email protected], at Webority Technologies Private Limited, 629-634, Vipul Trade Centre, Sector-48, Sohna Road, Gurugram, Haryana 122018, India, or by phone on +91 95990 06518.