GDPR notice.
Our compliance posture under the EU/UK General Data Protection Regulation. The plain-language version of how we handle your rights.
Who's the controller
Lumi d.o.o., Belgrade, is the data controller for everything booked through the consumer app and salon dashboard. Our salon partners are independent controllers for their own customer relationship — we're a processor on their behalf for that relationship. The two roles are documented in the salon's onboarding agreement.
Lawful basis for processing
Performance of contract: to deliver the booking you requested. Legitimate interests: fraud prevention, platform safety, product improvement (anonymised aggregate analytics). Consent: where we ask for it (rare — peer benchmarks for salon owners is the only example). We do not rely on consent for anything we'd otherwise be obliged to do.
Your rights under GDPR
Access · Rectification · Erasure ('right to be forgotten') · Restriction of processing · Portability · Objection · Withdraw consent (where consent is the basis) · Lodge a complaint with a supervisory authority. All of these are real; none of them are theoretical.
How to exercise them
Email [email protected] with the subject 'Privacy request — [your right]'. We respond inside 30 days, usually inside 7. We don't charge a fee. We may ask you to verify your identity if the request is sensitive (e.g. a full export); we won't ask if it isn't.
International transfers
Our database is hosted by Supabase in Frankfurt (eu-central-1). Some operational vendors (Stripe, Resend, Twilio) process data in the US under Standard Contractual Clauses or Data Privacy Framework adequacy. We don't transfer to jurisdictions without an adequacy decision or SCCs.
Peer benchmarks (salon owners)
Salons can opt into our peer-benchmark feature, which compares their performance against an anonymised median of their vertical and city. We use k-anonymity ≥ 5 (no comparison ever shows fewer than 5 salons in the bucket). Salons are never named. Opting in is reversible at any time. The implementation lives in `docs/INSIGHTS.md` if you want detail.
Complaints
If you believe we've mishandled your data and we haven't resolved it to your satisfaction, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection (Republic of Serbia) or your local supervisory authority in the EU/UK.