Privacy policy
1. Who this policy covers
The policy applies to the processing where LUMMI itself decides the purpose. When a company uses the LUMMI platform to process information about its employees, customers or other individuals, that company is generally the data controller, while LUMMI is the data processor.
LUMMI Systems ApSCompany reg. no. (CVR) 46738896Tømrervej 74600 KøgeDenmarkkontakt@lummi.dk+45 43 14 40 50We may process information about the following groups:
- visitors to lummi.dk and other LUMMI sites
- people who book a demonstration, create a trial account or request a quote
- customers, prospective customers, suppliers and their contact persons
- administrators and other users of the LUMMI platform
- people who contact sales, support or administration
- recipients of news, product information and other marketing
- applicants for open positions at LUMMI.
2. What information we process
We only process information that is relevant to the specific relationship and the purpose it was collected for. This may include:
| Category | Examples |
|---|---|
| Identity and contact | Name, workplace, job title, phone number, e-mail address and preferred language. |
| Company information | Company name, VAT/registration number, industry, address, billing details and contractual relationship. |
| Account and use | User ID, role, access rights, login history, chosen settings and activity in the platform. |
| Sales and communication | Enquiries, meeting notes, quotes, consents, marketing preferences and correspondence. |
| Support | Case description, messages, attachments, screenshots, technical information and case resolution. |
| Payment | Invoice number, subscription, payment status and limited payment details. Card details are normally processed by the payment provider. |
| Technical information | IP address, device, browser, operating system, timestamps, security logs and cookie ID. |
| Recruitment | CV, application, education, experience, references and information from interviews. |
We ask you not to send us sensitive information or a national ID number unless it is necessary, lawful and expressly agreed. If a support request contains customer data, we process it under the customer’s instructions and the applicable data processing agreement.
3. Where the information comes from
We most often receive information directly from you or the company you work for. We may also receive information from:
- other users or administrators in your organisation
- publicly available company registers and professional networks
- partners, when they are lawfully allowed to share the information with us
- our website, platform and security systems through your use of them
- cookie and analytics providers, when you have given the necessary consent.
4. Purpose and legal basis
| Purpose | Legal basis |
|---|---|
| Answering enquiries, booking demonstrations and preparing quotes | Our legitimate interest in communicating with prospective customers, Article 6(1)(f), or necessary steps prior to entering into a contract, (b). |
| Creating and administering customer relationships, subscriptions and user access | Performance of a contract, (b), and legitimate interest in administering business customers, (f). |
| Providing support, operations and security | Performance of a contract, (b), and legitimate interest in a stable and secure service, (f). |
| Invoicing, accounting and documentation | Legal obligation, (c), and performance of a contract, (b). |
| Developing and improving products and the customer journey | Legitimate interest in product development and statistics, (f). Where cookies or similar technologies require it, we rely on consent, (a). |
| Sending electronic marketing | Consent, (a), and the Danish Marketing Practices Act. You can withdraw your consent at any time. |
| Preventing misuse, documenting incidents and handling claims | Legitimate interest in security, legal claims and protecting the business, (f). |
| Recruitment | Steps prior to a possible employment contract, (b), and legitimate interest in recruitment, (f). Special categories of data are only processed with a separate legal basis. |
When we base processing on a legitimate interest, we have assessed that our interest does not override your rights and freedoms. You can object to such processing as described in section 10.
5. LUMMI as data processor
Customers can use LUMMI for, among other things, sales, finance, quality, planning, and handling enquiries and cases. In doing so, the customer’s own information about employees, contact persons, work schedules, documentation and communication may be processed in the platform.
The customer determines the purposes of this processing and is responsible for the legal basis, the duty to inform, and user access. LUMMI does not use customer data for its own marketing purposes and processes it only on documented instructions. This relationship is governed by LUMMI’s data processing agreement.
If you wish to exercise rights regarding information that your employer or another LUMMI customer has registered about you, you should generally contact that company. We assist the customer in answering the request when relevant.
6. Cookies and similar technologies
We use necessary technologies to make the website and login work and to protect our services. With your consent, we may also use statistics and marketing technologies to understand the use of our sites and improve our communication.
You can choose, change or withdraw your consent through the cookie settings on the website. The current cookie declaration shows the name, provider, purpose and lifetime of each cookie. Necessary cookies cannot be deselected if the service is to function.
7. Recipients and suppliers
We only share personal data when necessary and lawful. Recipients may include:
- providers of hosting, operations, backup, security and monitoring
- providers of e-mail, SMS, customer service, CRM, analytics and payment solutions
- auditors, legal advisors and other professional advisors
- public authorities, when we are legally obliged to
- a buyer or advisor in connection with a business transfer, under appropriate confidentiality.
Suppliers that process information on our behalf are subject to written data processing obligations. We do not sell personal data.
8. Transfers outside the EU and EEA
Some suppliers may be established outside the EU and EEA or provide support from there. Such a transfer only takes place when a lawful transfer mechanism exists, for example an adequacy decision or the European Commission’s standard contractual clauses, and after any necessary supplementary safeguards have been assessed.
You can contact us for information about the relevant transfer mechanism and, where possible, a copy of the safeguards used.
9. How long we keep information
We do not keep information for longer than necessary. The specific period depends on the purpose, the agreement, our documentation needs and the law.
| Information | Basis for deletion |
|---|---|
| Sales dialogues and quotes | Once the dialogue is no longer current, normally no later than 3 years after the last substantive contact, unless a claim or a specific agreement requires longer retention. |
| Customer and subscription information | For the duration of the customer relationship and afterwards for as long as the information is necessary for the agreement, documentation or a legal claim. |
| Accounting records | Generally 5 years from the end of the financial year the records relate to, as required by bookkeeping rules. |
| Support requests | Normally up to 3 years after the case is closed, unless the content must be deleted sooner or kept longer for an agreement, security, or a claim. |
| Marketing consent | Until the consent is withdrawn. Documentation of consent and opt-out may be kept afterwards for as long as necessary to document compliance. |
| Job applications | Normally up to 6 months after recruitment is concluded, unless you consent to longer retention or a claim makes retention necessary. |
| Security logs | For a period set according to the purpose and risk of the log. The period is limited and reassessed on an ongoing basis. |
| Cookies | As stated in the current cookie declaration and your consent. |
When the need for retention ends, we delete or anonymise the information. Information in backups disappears through the controlled overwrite cycle and is protected against ordinary use until then.
10. Your rights
Depending on the circumstances, you have the right to:
- obtain access to the information we process about you
- have inaccurate or incomplete information corrected
- have information deleted when the conditions are met
- have the processing restricted
- receive certain information in a structured, commonly used and machine-readable format
- object to processing based on legitimate interests, and always to direct marketing
- withdraw a consent, without affecting processing already lawfully carried out.
We may ask for information necessary to confirm your identity. We respond without undue delay, generally no later than one month after receipt. The deadline may be extended for complex cases in accordance with the rules.
11. Security
We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and access. The measures include, as needed, access control, encryption, logging, backup, vulnerability management, contingency planning, supplier control and staff instruction.
No internet-based service can guarantee complete security. If we identify a breach, we handle and document the incident and make the necessary notifications.
12. Complaints
You are welcome to contact us first if you are unhappy with our processing. You also have the right to complain to Datatilsynet, the Danish data protection authority:
Datatilsynet (the Danish Data Protection Agency)Carl Jacobsens Vej 352500 Valby, DenmarkPhone +45 33 19 32 00E-mail dt@datatilsynet.dkwww.datatilsynet.dk13. Changes to this policy
We may update this policy when our processing, services or the law changes. The current version is published on lummi.dk with a version date. In the event of material changes, we will inform you in an appropriate way, for example on the website, in the platform, or directly to relevant contact persons.