Privacy policy.

Controller and contact

The controller responsible for this policy is 3-101-957266 SOCIEDAD ANÓNIMA, corporate identification number 3-101-957266, domiciled in San José, Costa Rica, and operating under the trade name Luma Solutions.

To exercise data rights or ask a privacy question, write to esteban.jimenez@lumasolutions.tech. We may request reasonable information to verify the identity of the person making the request.

Information we may collect

Depending on the interaction or service, we may process the following categories:

• contact and business-relationship data, such as name, company, role, email, telephone number, and country;
• inquiries, communications, requests, proposals, and project context;
• answers, score, priorities, and Operational Assessment result when you request delivery by email, as well as the email used to deliver practical resources you voluntarily request;
• administrative, contractual, and billing data required for a business relationship;
• client data processed while providing a service, in accordance with client instructions and the applicable agreement; and
• non-content technical data, such as security events, errors, performance, availability, device, approximate country, and aggregated usage metrics.

We do not intentionally request passwords, private keys, access secrets, sensitive data, or information about minors through public forms. If a project requires special categories of information, it must be assessed and documented in advance through a specific agreement.

Purposes of processing

We may use information to:

• answer inquiries and deliver requested results;
• coordinate assessments, meetings, and evaluations;
• prepare proposals, contracts, invoices, and provide contracted services;
• authenticate access, maintain continuity, provide support, and protect systems;
• follow documented client instructions and comply with legal obligations;
• prevent abuse, fraud, unauthorized access, or incidents; and
• measure website operation in aggregate and improve the experience.

We do not use personal data for behavioral advertising and do not sell personal-data databases.

Consent and whether information is required

Where required by law, we will obtain express, informed, and verifiable consent before collecting, using, or transferring personal data. Consent may be withdrawn through the same channel or by writing to the privacy contact, without retroactive effect on processing that was already lawful.

Completing public forms is voluntary. If you do not provide information marked as necessary, we may be unable to send the requested result, respond through the selected channel, or evaluate the request. Declining to provide contact data does not prevent you from reading public website content or seeing the assessment result on screen.

Where Luma Solutions processes data on behalf of a client, the client is responsible for having the authorizations, notices, and other legal grounds necessary to share the data and instruct its processing.

Client data and technical service data

The client retains whatever rights it holds in the information, files, databases, content, and other materials it provides to Luma Solutions. In addition, to the extent permitted by law and subject to applicable third-party rights, the client owns the data, content, inputs, and results created or generated specifically for the client by the client, Luma Solutions, or the services. This does not grant the client rights in Luma Solutions infrastructure, software, tools, reusable components, or other intellectual property used to provide the service or generate those results, except for the usage rights expressly stated in the applicable proposal or contract.

Luma Solutions does not acquire ownership of that data and will not use it for independent commercial purposes, to benefit other clients, to train or improve models, or for any other purpose unrelated to the service provided to the client. We may process it only as necessary to provide, protect, maintain, and support the service, follow the client's instructions, or comply with legal obligations. This restriction applies to client data and materials: it does not prevent Luma Solutions from applying general knowledge, experience, techniques, patterns, methodologies, non-client-specific improvements, and know-how in abstract and generalized form, provided that Luma Solutions does not use, disclose, reproduce, memorize as a reusable asset, or make identifiable any client data, confidential information, content, results, or client-owned materials.

Luma Solutions retains rights in non-content technical and operational data automatically generated by its own services and software, such as system telemetry, performance metrics, availability, resource consumption, errors, and security events. To the extent a technical record contains personal data, client content, proprietary information, inputs, or results, those elements will continue to be treated as client data under this policy. Luma Solutions may use the remaining technical data solely to operate, secure, maintain, and improve its services.

Forms, email, and WhatsApp

This site may include voluntary forms, for example to email you the result of the Operational Assessment or practical resources you request, such as a follow-up guide and template. The authorization required to deliver each report or resource is presented separately from the options to request a conversation with Esteban or receive occasional content. We do not treat a material request as automatic permission for other emails.

If you request a conversation, we may contact you about the related result or resource to coordinate it. If you authorize occasional content, we may send practical ideas related to operational capacity, automation, and AI. You may withdraw either authorization at any time by replying to the email or writing to the privacy contact.

Do not share passwords, access credentials, API keys, sensitive financial data, or confidential information through open channels.

Automated assessments

The Operational Capacity Assessment automatically calculates an indicative score and recommendations from the selected answers. It does not produce legal effects, determine access to credit, employment, or essential services, or replace professional assessment. You may request an explanation or human review by writing to the contact identified in this policy.

In contracted services, we will not make solely automated decisions that produce legal or similarly significant effects on individuals unless supported by documented instructions, a valid legal basis, appropriate controls, and a specific agreement with the client.

Luma Solutions' role and processing on behalf of a client

Luma Solutions acts as a controller when it determines the purposes and means of processing, for example for business contacts, the assessment, billing, and security of its own systems.

Where a client determines the purpose of processing and Luma Solutions processes data only to provide the service and follow documented instructions, Luma Solutions acts as a processor. In those cases, responsibilities, data categories, duration, security measures, subprocessors, assistance, return, and deletion must be established in the applicable agreement or data processing agreement.

Recipients, subprocessors, and international transfers

Information may be accessible only as needed to authorized Luma Solutions personnel; infrastructure, hosting, email, analytics, support, security, and AI-model providers; professional advisers subject to confidentiality; and authorities where a valid legal obligation applies.

Some providers may process information outside Costa Rica or the client's country. Before a transfer, we will obtain informed consent where required by Costa Rican Law No. 8968 or use another valid legal mechanism. For data subject to the GDPR or other international laws, we will implement the required data processing agreement, Standard Contractual Clauses, or other safeguards where applicable.

Material subprocessors, their function, and relevant locations will be identified in the contract, processing annex, or service documentation. Luma Solutions will require confidentiality, security, purpose limitation, and return or deletion obligations to the extent applicable to the provider and contracted service.

Use of cloud AI models

Some contracted services may use artificial intelligence models operated by third parties outside the server or infrastructure assigned to the client. In those cases, the input data required for processing is transmitted to the model provider, and the generated response is returned to the environment assigned to the client.

Luma Solutions commits to configuring the systems under its control so that persistent operational copies of input and output data it directly manages are stored within the infrastructure assigned to the client. Necessary exceptions, such as transient processing, protected backups, security logs, or expressly agreed support systems, must be purpose-limited, retain the protections applicable to client data, and be documented in the applicable agreement or annex. Once information is transmitted to the model provider, technical processing occurs within systems that Luma Solutions does not operate or directly control.

We select and configure services with the goal of using options that do not use the information to train models and that reduce or disable retention when the provider allows it. Even so, unless the provider makes a specific contractual commitment, Luma Solutions cannot guarantee zero retention or independently verify all internal processing performed by that provider. The provider's identity and type of processing must be identified in the proposal, contract, or annex where the service processes client data.

If the client requires contractually backed zero retention, the client must disclose that requirement before the service begins. Meeting that requirement may require an enterprise plan or a direct agreement with the model provider, subject to availability, terms, negotiation, and additional costs. Zero retention will be considered guaranteed only when it is expressly included in a binding agreement with the applicable provider.

Cookies and analytics

We use Plausible Analytics to understand general site usage and improve the experience: visited pages, traffic sources, device, approximate country, and relevant clicks such as WhatsApp, email, or diagnosis actions. Plausible does not use cookies, does not sell personal data, and presents aggregated metrics.

We do not use this analytics setup to identify individual visitors. If we activate tools with non-essential cookies in the future, we will update this policy before using them.

Third-party services

Some links may open external services such as WhatsApp, Instagram, LinkedIn, or email. Those services have their own privacy policies and terms of use.

Security and incidents

We apply technical and organizational measures that are reasonable and proportionate to the nature of processing, which may include access controls and least privilege, authentication, encryption in transit where available, updates, backups, event logging, environment separation, and confidentiality commitments. No connected system can guarantee absolute security.

Following a confirmed incident, we will seek to contain it, investigate its scope, preserve evidence, and implement corrective measures. Where we act as a processor, we will notify the client controller without undue delay and provide information reasonably available to us. Where we act as controller, we will notify PRODHAB, affected persons, or other authorities when required by applicable law.

Retention, return, and deletion

We retain information only for as long as reasonably necessary for the disclosed purpose, to provide the service, maintain security, address a request, or comply with legal obligations and limitation periods. The criteria include relationship duration, client instructions, data sensitivity, risk, existing disputes, and fiscal, contractual, or regulatory requirements.

Where we act as processor, at the end of the service we will return or delete client data at the client's choice and in accordance with the applicable agreement, unless retention is required by law. Residual copies in protected backups may remain until ordinary rotation and will not be reused for active purposes. Deletion within external providers also depends on their capabilities and contractual commitments.

When information is no longer needed, it will be deleted, anonymized, or blocked against unauthorized use. A preservation obligation, security investigation, or dispute may temporarily suspend deletion.

User rights

You may request, free of charge, confirmation of processing, access to your data, information about its purpose and use, correction, updating, cancellation or deletion, and state your decision regarding transfers where applicable. We will respond within the applicable period; for requests governed by Costa Rican Law No. 8968, the period is five business days after receipt unless another rule permits otherwise.

A request may be limited when information must be retained by law, to protect third-party rights, to preserve evidence needed for a dispute, or where another legal exception applies. If you believe your rights have been infringed, you may also contact Costa Rica's Data Protection Agency (PRODHAB) or the competent authority in your jurisdiction.

Contact

For privacy-related inquiries, write to esteban.jimenez@lumasolutions.tech.