1. Identity and address of the Data Controller
The party responsible for processing your personal data is Lumora Consulting S.A.S. ("Lumora"), a senior software development studio located at Av. Ricardo Margáin Zozaya 335, Zona Santa Engracia, C.P. 66265, San Pedro Garza García, Nuevo León, Mexico. Its Federal Taxpayer Registry (RFC) is LCO1901296F2.
For any matter related to your personal data or to this Privacy Notice, you may contact us at contacto@lumora.com.mx, through our website https://lumora.com.mx, or by WhatsApp at +52 81 3156 0416. The address contacto@lumora.com.mx is our official channel for handling privacy requests.
2. Personal data we collect
We only collect the data you provide directly and voluntarily when you write to us through the contact channels published on the site (mainly WhatsApp). Our website has no forms, and we do not collect data covertly or through advertising profiling. The categories of data are as follows:
- WhatsApp contact: your name and phone number as they appear on WhatsApp, and the content of the message you choose to send us.
- Business relationship: contact and invoicing data (legal name, tax ID, tax address, email) that you provide if you engage our services.
- Data arising from subsequent communication with you (for example, what you share by email or WhatsApp during a commercial or project conversation).
3. We do not collect sensitive data
Lumora does not request or collect sensitive personal data as defined by the LFPDPPP, that is, data that could reveal racial or ethnic origin, health status, genetic information, religious, philosophical or moral beliefs, union membership, political opinions or sexual preference. We ask that you not include this type of information in the messages you send us.
4. Purposes of processing
Primary purposes (necessary for the relationship with Lumora): to address and respond to your requests, quotes and inquiries; to provide and follow up on our software development services; to manage the contractual and commercial relationship; and, where applicable, to carry out invoicing and comply with applicable tax and legal obligations.
Secondary purposes (not necessary, require your consent, and you may refuse): sending you occasional communications about Lumora's services, content or news. If you do not wish your data to be used for these purposes, you may say so at any time by writing to contacto@lumora.com.mx or replying through the same channel we used to contact you; your refusal does not affect the provision of the primary services.
5. Legal basis and consent
The processing of your data is based on Articles 8, 16 and 17 of the LFPDPPP. By providing us your data when you write to us on WhatsApp or through any other contact channel, and not objecting to this Privacy Notice, you grant your consent to the processing described herein. For secondary purposes, your consent is deemed granted on a tacit basis if you do not express your refusal as set out above.
If you visit us from the European Union or European Economic Area, the processing of your data also adheres, where applicable, to the principles of the General Data Protection Regulation (GDPR), including the consent and legitimate-interest bases for responding to your requests.
6. Transfers and processors (third parties)
To operate our site and handle your messages, Lumora relies on technology providers acting as data processors: the WhatsApp messaging service (operated by Meta Platforms, Inc., which also processes your data under its own terms and privacy policy) and web hosting and infrastructure services (for example, Vercel). These providers may store or transmit data on servers located outside Mexico, mainly in the United States, solely to provide us with such services. We do not sell or transfer your personal data to third parties for marketing purposes.
Lumora does not sell, rent or trade your personal data. We do not transfer data to third parties for purposes other than those described in this Notice, except where necessary to comply with a legal obligation or a request from a competent authority, in accordance with Article 37 of the LFPDPPP, in which cases your consent is not required.
7. Data retention
We retain your personal data only for as long as necessary to fulfill the purposes described and applicable legal obligations. Contact-message data is kept for the duration of handling your request and the commercial relationship; invoicing data is kept for the periods required by Mexican tax law. Once the purpose is fulfilled or your cancellation request is processed, the data is blocked and subsequently deleted in accordance with the law.
8. Security measures
Lumora has implemented reasonable administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing, including the use of encrypted connections (HTTPS) on our site, restricted access to information, and the selection of providers offering adequate security guarantees. No system is completely infallible; in the event of a security breach that significantly affects your rights, we will notify you in accordance with the LFPDPPP.
9. ARCO rights and how to exercise them
As the data owner, you have the right at any time to exercise your ARCO rights:
- Access: to know what personal data we hold about you and how we use it.
- Rectification: to request correction of your data when it is inaccurate or incomplete.
- Cancellation: to request that we delete your data when you consider it is not needed for the stated purposes.
- Objection: to object to the processing of your data for specific purposes.
10. ARCO request procedure
To exercise any of your ARCO rights, or to revoke your consent, send a request to contacto@lumora.com.mx stating: (i) your name and a means to communicate our response; (ii) documents proving your identity (or, where applicable, legal representation); (iii) a clear description of the data in respect of which you seek to exercise a right; and (iv) any element that helps locate the data.
We will respond to your request within the timeframes set out by the LFPDPPP (generally a maximum of 20 business days to communicate the decision and 15 business days to make it effective, where applicable). Exercising these rights is free of charge; only shipping or document-reproduction costs may apply, under the terms provided by law.
11. Cookies, local storage and changes to this Notice
Our site does not use advertising or marketing cookies. The only storage in your browser is a localStorage key named 'lumora-lang', strictly necessary to remember your language preference. For more detail, see our Cookie Policy, which forms an integral part of this Notice.
Lumora may update this Privacy Notice at any time to reflect legal, operational, or practice changes. Modifications will be published at https://lumora.com.mx, indicating the date of the last update. We recommend reviewing it periodically.
If you believe your right to the protection of personal data has been infringed, or that the processing involved a breach of applicable law, you may turn to the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), www.inai.org.mx. We encourage you to contact us first at contacto@lumora.com.mx to address your concern.