01 Introduction
This Privacy Policy is published in accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). It explains how we handle your personal data when you use Lumex. Please read it together with our Terms & Conditions and Cookie Policy.
02 Who we are
Lumex is operated by Webority Technologies Private Limited (CIN: U72900HR2019PTC079747), a company incorporated in India with its registered office at 629-634, Vipul Trade Centre, Sector-48, Sohna Road, Gurugram, Haryana 122018, India ("Webority", "Lumex", "we", "us", "our").
Lumex is a software platform for IEC 62305 lightning risk assessment. It is a tool used by qualified professionals; it does not perform the assessment for you, and it does not replace the engineer who signs the report. For the data you hold about your own clients inside Lumex, you are the data fiduciary (controller) and we act as a data processor on your behalf; a Data Processing Agreement reflecting this is available to you on request at privacy@lumex.zone.
03 Personal data we collect
- Account & identity data: your name, work email, phone number and password (stored only as a salted hash).
- Firm & business data: your firm's name, address, GSTIN, logo and team-member details.
- Assessment data you upload: building geometry, project, site and zone records, drawings, single-line diagrams, site photos and other documents you attach to an assessment.
- Billing data: plan, credits, invoices and payment metadata. Card and bank details are handled by our payment processor; we do not store full card numbers.
- Usage & technical data: log data, device and browser information, and actions recorded in our audit trail.
- Communications: messages you send to support and your contact preferences.
04 How we use your data
We use your data for the purposes below, and each purpose has its own legal basis. Where we rely on consent, your consent is explicit, granular, purpose-bound and revocable, and you can withdraw it at any time without affecting processing already carried out.
| What we do | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and run your workspace, compute assessments, generate reports | To deliver the service you signed up for | Performance of a contract |
| Manage your team, roles and access | So the right people can use your workspace | Performance of a contract |
| Take payment and issue invoices | To bill you and meet tax law | Performance of a contract; legal obligation |
| Provide support and answer your messages | To help you use the product | Performance of a contract |
| Keep the platform secure, prevent fraud, maintain the audit trail | To protect your data and ours | Legitimate interests; legal obligation |
| Improve the product from usage patterns | To make the service better | Legitimate interests |
| Send service-related messages about your account | So you know about billing, security and changes | Performance of a contract |
| Analytics on how the website is used | To understand what is useful | Consent |
| Keep records the law requires us to keep | Tax, accounting and statutory obligations | Legal obligation |
Where we rely on legitimate interests, we have weighed those interests against your rights and you can object at any time by writing to privacy@lumex.zone.
06 How we share your data
We share data only as needed to run the service: within your workspace, according to the role each team member holds; with the sub-processors listed below, who act on our instructions under written confidentiality and data-processing agreements; and where required by law or to protect our rights. If Webority is involved in a merger or acquisition, data may transfer under the same protections.
| Sub-processor | What it does | Where |
|---|---|---|
| Microsoft Azure | Cloud hosting, database and file storage | India |
| Razorpay | Payment processing and invoicing | India |
| SendGrid (Twilio) | Transactional email delivery | United States |
| Google (Analytics 4, Tag Manager) | Website analytics, consent-gated | United States |
| Microsoft Clarity | Website analytics, consent-gated. In the portal, masked session replay for signed-in users under these terms: pages and clicks are recorded, every text and input is hidden | United States |
We give at least 30 days' notice before adding or replacing a sub-processor, so you have time to object. Analytics sub-processors receive website usage data only. The portal session replay is masked before it is recorded, so no assessment or client data is readable in it.
We do not sell, rent or lease your personal data to anyone, and we do not use advertising cookies or cross-site tracking.
07 Where your data is stored
Your data is hosted on Microsoft Azure, with India-based hosting used where applicable. Each workspace's data is logically isolated through strict multi-tenant scoping, so one customer's data is not accessible to another.
If you are in the European Economic Area or the United Kingdom, your data may be transferred to and processed in India. As India is not currently the subject of an EU or UK adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and, for UK data, the UK International Data Transfer Addendum), together with the technical and organisational safeguards described in section 09, as the legal basis for that transfer. A copy of the relevant clauses is available on request.
08 How long we keep your data
We keep each kind of data for a set period, then delete or anonymise it. Where the law requires us to keep something longer, the legal period wins.
| Data | How long we keep it |
|---|---|
| Account, workspace, project, assessment and report data | For the life of the account, then 90 days after closure |
| Invoices and tax records | 8 years, as required by Section 36 of the CGST Act |
| Audit trail and security logs | 12 months |
| Support tickets and correspondence | 24 months |
| Backups | 35 days on a rolling cycle, after which they are overwritten |
The 90-day window after closure exists so an account reopened by mistake, or closed in error, can be recovered. Deletion requested through Data Deletion is actioned sooner, subject only to the statutory records above.
09 Security
We protect your data with TLS 1.3 in transit, AES-256 at rest, role-based access controls, tenant isolation and an append-only audit log of sensitive actions. No system can be guaranteed perfectly secure, but we work continuously to protect your information.
If a personal data breach occurs, we will tell you without undue delay once we become aware of it, with what we know about the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the steps we are taking. Where you are the controller and we are your processor, that notice is what lets you meet your own reporting deadline. We notify supervisory authorities where the law requires it.
10 Your rights & how to use them
Subject to applicable law, you can access your data, correct it, request its erasure, withdraw consent, nominate a representative, and raise a grievance. To exercise any right, email privacy@lumex.zone; we aim to respond within 7 days. To request erasure, see Data Deletion.
11 Cookies
We use strictly-necessary cookies to keep you signed in and the site working, and preference cookies to remember your choices. With your consent, we also use analytics cookies to measure how the site is used, through Google Analytics 4, Google Tag Manager and Microsoft Clarity, governed by Google Consent Mode and our cookie consent banner. We additionally use Ahrefs, a cookieless analytics tool that sets no cookies. A cookie banner lets you accept or reject non-essential cookies, and you can change your choice at any time. We do not use advertising cookies to build profiles or to track you across unrelated websites. Full detail is in our Cookie Policy.
12 Children
Lumex is a professional tool and is not intended for anyone under 18. We do not knowingly collect data from children.
13 Users in the EEA & UK (GDPR)
If you are in the European Economic Area or the United Kingdom, you have the rights granted under the GDPR / UK GDPR: access, rectification, erasure, restriction of processing, data portability, objection, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The legal bases in section 05 describe how and why we process your data, and section 07 describes how we safeguard international transfers. You can withdraw consent at any time without affecting processing already carried out.
You also have the right to lodge a complaint with your supervisory authority. If you are in the EEA you can find yours via the European Data Protection Board; in the UK, the Information Commissioner's Office (ICO).
Representative under Article 27. We have not yet appointed a representative in the European Union or the United Kingdom, and we do not currently direct marketing at those regions. If you are in the EEA or the UK and use Lumex, you can reach us directly at privacy@lumex.zone and we will handle your request under the GDPR or UK GDPR as set out above. We will publish representative details here before we begin marketing into those regions.
14 California residents (CCPA)
If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of any "sale" of personal information. We do not sell your personal information. We will not discriminate against you for exercising these rights.
15 Changes to this policy
We may update this Privacy Policy from time to time. We give at least 15 days' notice before any material change takes effect, and the "Last updated" date above always reflects the current version.
16 Grievance Officer & contact
In line with the Information Technology Act, 2000 and the DPDP Act, 2023, our Grievance Officer is Mr. Navneet Singh. Write to him at grievanceofficer@lumex.zone or privacy@lumex.zone, at Webority Technologies Private Limited (CIN: U72900HR2019PTC079747), 629-634, Vipul Trade Centre, Sector-48, Sohna Road, Gurugram, Haryana 122018, India, or by phone on +91 95990 06518.