Privacy Policy

Lumis Studios (“Lumis Studios”, “we”, “us”, or “our”) is a software studio based in Nairobi, Kenya. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit lumisstudios.site (the “Site”) or get in touch with us.

For the purposes of Kenya’s Data Protection Act, 2019, Lumis Studios is the data controller responsible for the personal data described in this policy. If you have any questions, you can reach us at studioslumis@gmail.com.

We only collect the personal data we need to respond to you and to keep the Site running well:

• Information you give us through the contact form — your name, email address, the subject of your message, and the contents of your message.
• Information you give us directly — anything you choose to share when you email us or message us on WhatsApp.
• Usage data — anonymised, aggregate analytics about how visitors use the Site (for example, pages viewed and approximate region), collected through Vercel Analytics. This data is collected without cookies and is not used to identify you personally.
• Technical data — standard server and request information (such as IP address and browser type) that is processed automatically when any website is served.

We use the personal data we collect to:

• Respond to your enquiries and communicate with you about a potential or ongoing project.
• Provide, maintain, and improve the Site and our services.
• Understand, in aggregate, how the Site is used so we can make it faster and more useful.
• Comply with our legal obligations and protect against fraud or misuse.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

Under the Data Protection Act, 2019, we rely on the following lawful bases:

• Consent — when you voluntarily submit the contact form or otherwise reach out to us.
• Legitimate interest — to operate, secure, and improve the Site, in a way that does not override your rights and freedoms.
• Legal obligation — where we are required to retain or disclose data by law.

We use a small number of trusted providers to operate the Site. These act as data processors on our behalf and are only permitted to use your data to provide their service to us:

• Resend — delivers the email generated when you submit the contact form to our inbox.
• Vercel — hosts the Site and provides privacy-friendly, cookieless analytics.
• Google (Gmail) — hosts the inbox where we receive and store your enquiries.

Some of these providers may process data on servers located outside Kenya. Where that happens, we take reasonable steps to ensure your data continues to receive an adequate level of protection.

We keep enquiry data (the messages you send us and our correspondence with you) only for as long as needed to respond to you and to manage any resulting relationship, after which it is deleted or anonymised. Aggregate analytics data is retained in non-identifiable form. We will not keep your personal data for longer than is necessary for the purposes set out in this policy.

Under the Data Protection Act, 2019, you have the right to:

• Be informed about how your personal data is used.
• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data where there is no lawful reason for us to keep it.
• Object to or request that we restrict certain processing.
• Withdraw your consent at any time, where processing is based on consent.

To exercise any of these rights, email us at studioslumis@gmail.com and we will respond within a reasonable time. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

The Site is served over HTTPS, and we rely on reputable providers with their own security measures. While no method of transmission or storage is completely secure, we take reasonable technical and organisational steps to protect your personal data against unauthorised access, loss, or misuse.

The Site is intended for businesses and professionals. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review it periodically.

If you have any questions about this Privacy Policy or how we handle your personal data, contact us at studioslumis@gmail.com or write to us in Nairobi, Kenya.