Legal · Privacy
Privacy policy.
What personal data LUMA Creative processes, why and for how long: the contact form, cookies, security logs, who receives the data and your rights under GDPR.
The short version
- We process only what you send us through the contact form, plus the technical data without which the site cannot be run securely.
- We do not measure traffic and run no advertising or tracking scripts. The only things stored in your browser are your own choices, such as language and cookie consent.
- The website, its admin and the database run on our server in Slovakia. E-mail passes through Google Workspace. The Google map on the contact page loads only when you click it.
- We do not sell your data and do not use it for advertising.
- You can ask at any time what we hold about you and have it corrected or deleted. We reply within a month at the latest.
Who processes your data
The controller, meaning the one who decides why and how your data is processed, is:
Peter Kapusník, a sole trader (natural person in business), trading as LUMA CreativePlace of business: Slatinská 5024/28, 821 07 Bratislava-Vrakuňa, SlovakiaCompany ID (IČO): 32104006 · Tax ID (DIČ): 1025553133 · not registered for VATRegistration: registered in the Trade Register of the Bratislava District Office under No. 102-11292E-mail: peter.kapusnik@lumacreative.online · phone: +421 911 030 090We have not appointed a data protection officer, as the law does not require one for processing of this scale. For anything concerning your data, contact us directly at the e-mail or phone number above.
We follow Regulation (EU) 2016/679 (the GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection.
What we process, why and for how long
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Answering your enquiry from the contact form and preparing a quote | name, e-mail, phone, subject, message, page language | Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract | if no contract follows, we keep the enquiry for no more than 1 year from receipt and then delete it |
| Protecting the form against spam | the IP address the enquiry came from (stored with the enquiry) | Art. 6(1)(f) — legitimate interest in preventing abuse | same as the enquiry |
| The contract and its performance, if we start working together | identification and contact details, billing details, project correspondence | Art. 6(1)(b); for invoices Art. 6(1)(c) — legal obligation | for the term of the contract; invoices and accounting records 10 years under the Accounting Act; the rest until limitation periods expire |
| Website security and protection against bulk downloading | IP address, time, requested URL, browser details (User-Agent); for a third-party site loading our files, its domain | Art. 6(1)(f) — legitimate interest in secure operation | rate-limit counters in server memory only, 15 minutes at most; server logs for no more than 30 days |
| Investor area | login cookie, IP address on login attempts | Art. 6(1)(f) | cookie 30 days; attempt counter 15 minutes |
| Remembering your choices | cookie consent, chosen language | Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications — strictly necessary cookies | see Cookies |
When you send an enquiry, it is stored in our admin and reaches us by e-mail. You receive an automatic confirmation that it arrived, and another e-mail once we mark it as handled. Your e-mail address is written to the server log on sending; if delivery fails, the enquiry text is written there too so that it is not lost.
Providing your data is voluntary. Without a name, e-mail and phone number we cannot reply to an enquiry, which is why the form requires them.
Who else receives the data
We do not sell or lend your data for marketing. It reaches only those without whom the site and e-mail could not work:
- Websupport s. r. o. (Slovakia) — runs the server hosting the website, admin and database. It is our processor.
- Google (Google Workspace) — our mailbox and outgoing mail. Your enquiry to us and our confirmation to you pass through Google. It is our processor.
- Brevo (Sendinblue SAS, France) — fallback sending of automatic e-mails from the admin if Google mail fails. It is our processor.
- Google (Google Maps) — for the map on the contact page, if you choose to show it, as an independent controller; see below.
- Bookkeeping: we keep invoices and accounting records for 10 years, as the Slovak Accounting Act requires. Where an external accountant processes them for us, they do so as our processor under a contract.
- Public authorities, where the law requires it.
Transfers outside the European Union
The server, database and admin are in Slovakia. Data can leave the EU only through Google: both e-mail and the map (if you choose to show it) run on its infrastructure, which may process data in the USA as well. Such transfers are covered by the EU-U.S. Data Privacy Framework, to which Google has committed, and by the European Commission's standard contractual clauses. We make no other transfers to third countries.
The map on the contact page
The contact page has a space for a Google map that does not load by itself — you see only our address and a Show map (Google) button. Only when you click it does your browser connect directly to Google and send it your IP address, browser details and the page address, and Google may set its own cookies. Google is responsible for this processing as an independent controller under its privacy policy. Until you click the button, Google receives nothing about your visit to the contact page; our address is also given in the text, and the Open in Google Maps link takes you to the map directly.
Cookies and browser storage
The site stores only strictly necessary data in your browser, written by us, and these need no consent. The cookie bar also has Analytics and Marketing categories. Cookies and scripts in them may run only once you consent to them in the bar. At present no analytics or advertising tool runs on the site; if we add one, we will list it here with its name, provider and retention period.
| Name | Category | Purpose | Lifetime |
|---|---|---|---|
luma_cookies | Essential | your choice in the cookie bar | 183 days (six months) |
luma_jazyk | Essential | the language you picked in the switcher | 1 year |
luma_investor | Essential | login to the investor area, only under /investor | 30 days |
luma_zlava_zavreta | Essential | so a closed offer window does not reappear (only while an offer is running) | number of days set for the offer |
luma_toast, luma_cta (session storage) | Essential | a dismissed notice or call-to-action bar | until the tab is closed |
| Google cookies | Third party | the map on the contact page — only if you click to show it | set by Google |
You can change your choice at any time with the Cookies button in the footer of every page, or right here. You can also delete cookies in your browser settings; the bar will then appear again.
Your rights
Regarding the data we hold about you, you may at any time ask for:
- access — what we process about you and a copy of it (Art. 15 GDPR),
- rectification of inaccurate or incomplete data (Art. 16),
- erasure, where we no longer need the data or process it unlawfully (Art. 17),
- restriction of processing while a dispute about its accuracy or lawfulness is resolved (Art. 18),
- portability — data you gave us under a contract, in a common machine-readable format (Art. 20),
- objection to processing based on legitimate interest (Art. 21),
- withdrawal of consent where processing relies on consent; withdrawal does not affect what happened before.
Just write to peter.kapusnik@lumacreative.online or call +421 911 030 090. We handle requests free of charge and within one month at the latest; for a complex request we may extend this by two further months and will tell you why. So that we never hand your data to someone else, we may verify that it is really you.
Complaints. If you believe we handle your data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. We would appreciate hearing from you first, though — most things we can sort out straight away.
How we protect the data
- The whole site is served over an encrypted connection (HTTPS).
- Neither the database nor the admin is reachable directly from the internet; the admin can only be opened through the website and after logging in. Enquiries are visible only to logged-in LUMA staff.
- Forms are protected by a one-time token and a submission limit, the site by limits on requests from a single address.
- Database backups: kept for no more than 30 days, with access limited to LUMA.
Automated decision-making
We make no automated decisions about anyone and do no profiling. Every enquiry is read and answered by a person.
Changes to this policy
We update this text whenever the way we process data changes — for instance when a new tool is added. The version with the effective date shown at the top of the page applies.
The terms under which we build and run websites for you are in our terms and conditions.
