Privacy Policy

1. Controller

The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) is:

Dimitri Rupp
Company name: Lumi-Systems.io
Arnikaweg 47a/3, 1220 Vienna, Austria
Email: office@lumi-systems.io
Phone: +43 664 16 17 219

We have not appointed a data protection officer because the legal requirements for doing so
(Article 37 GDPR in conjunction with Section 6 DSG) do not apply to us. Please direct data protection inquiries
to the address given above.

2. Principles

We process personal data only insofar as this is necessary for the operation of this website, the
answering of your inquiries, and the processing of orders. We do not sell any
data, do not perform profiling, and do not use third-party advertising or analytics services.

This website loads no resources from external servers — no fonts, no
maps, no tracking pixels, no third-party scripts. Therefore, when a page is accessed, no contact is established
with Google, Meta or other third parties.

Links to our profiles on Instagram and Facebook. We operate profiles on
Instagram and Facebook (both belong to Meta). On this website, they are, as
simple links, embedded — the brand icons are hosted on our own server,
there are no none tracking pixels, buttons or embedded content from these providers.
As long as you do not click a link, no contact with Meta is established. Only by
clicking do you open the provider's page; from this point on, its terms and
privacy policy apply, and your IP address is transmitted to it. We have no
influence over data processing there. Whether you visit our profiles is up to you.

3. Server log files

When our website is accessed, the server automatically records:

• browser type and version as well as the operating system used
• the previously visited page (referrer), provided your browser transmits it
• the IP address of the accessing computer
• date and time of the request as well as the requested address

Purpose: establishing the connection, security and stability of operation, analysis of
malfunctions and defense against attacks.
Legal basis: our legitimate interest in a secure and functional
operation (Art. 6(1)(f) GDPR).
Retention period: 14 days, after which the logs are deleted. They are stored longer
only if a specific attack must be documented, until the matter is resolved.

According to the case law of the European Court of Justice, the IP address is personal data
(Judgment of 19 October 2016, C-582/14). A legally prescribed retention period for
server logs does not exist; the 14 days are our own determination, justified above.

4. Cookies and consent

When merely visiting, the server does not set any cookies. We have verified this: When
calling up the pages, the server does not send a single Set-Cookie-header. A single
exception is created by your browser itself — the counter of the watchlist. It contains no identifier
and is discarded when the browser is closed; the line is in the following table.

Cookies are only used where they are indispensable for a function you have requested:

For anything beyond that — in particular for analytics or marketing cookies — we obtain your
consent in advance. The legal basis for storing information on your device is
Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021); for the subsequent
processing, Article 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future. You can also
delete or block cookies in your browser settings; the website then functions
without restriction; only the shopping cart and wishlist cannot then be used.

5. Reach measurement (Matomo)

We measure the use of our website with Matomo — a software that we operate
on our own server (matomo.lumi-systems.io). There is no transfer to
third parties .

The analytics are set up to work without cookies:

• Cookies are disabled (disableCookies) — no identifiers are stored in your browser.
• The IP address is truncated before it is stored.
• Recognition is not based on you, but on a daily, non-traceable identifier.
• The referrer to a previous page is stored without the appended parameters.
• No linking across multiple websites takes place.

Purpose: to understand which content is read in order to improve our offering.
Legal basis: our legitimate interest in a data-minimising analysis of the
own offering (Art. 6(1)(f) GDPR). Since no information on your device
is stored or read from it, § 165(3) TKG 2021 does not apply.
Objection: You can object to the analytics at any time (Art. 21 GDPR) — a
message to office@lumi-systems.io suffices. We cannot
technically attribute individual visits, which is why there is no „opt-out“ button.

Please note: In Austria, there is no
decision by the data protection authority on self-hosted, cookie-less web analytics. We therefore do not rely on such a decision, but
describe the actual configuration openly here so that you can assess the processing.

6. Contact

Request form on lumi-systems.io. Using the form at /anfrage/ you can request an initial consultation or a project. The following data you provide will be processed: name, company, email address, phone number (optional), selected package and your message. Transmission takes place via our own WordPress installation and is delivered by email to office@lumi-systems.io; no third-party services (no captcha, no external form platform) are integrated. Purpose: processing and responding to your request and preparing an initial consultation. Legal basis: performance of pre-contractual measures (Art. 6(1)(b) GDPR). Storage duration: until your request is completed; subsequently deleted after no more than 24 months, unless a statutory retention obligation exists.

You can reach us via the contact portal contact.lumi-systems.io
or by email. The contact portal is the recommended way for support and project enquiries.

Processed data: the contact details you provide (name, email address,
organisation, phone number), your request including the selected category, priority and
Environment and technical details about the request:

• a reference number that we generate from the date and a random identifier
• a truncated hash value your IP address (privacy-friendly, not reversible)
• your browser identifier (User-Agent)

Your request is recorded as a work order in our self-hosted GitLab instance so that it
can be processed in a traceable manner.

Purpose: Processing and answering your request, traceability of the process,
Prevention of abuse.
Legal basis: Performance of pre-contractual measures and fulfilment of contracts
(Art. 6(1)(b) GDPR), for the technical details our legitimate interest in
abuse prevention (Art. 6(1)(f) GDPR).
Retention period: until your request is completed; afterwards we delete it after
at most 24 months, unless a statutory retention obligation exists or retention is necessary for
the assertion or defence of claims.

There is no statutory retention period for contact requests — this period is our own
determination based on the principle of storage limitation (Art. 5(1)(e) GDPR).

7. AI support assistant

On the page AI Assistant an AI-powered assistant is available
that answers questions about our services.

Processed data: Your inputs in the chat — text as well as images or files that you
upload — and the conversation history that your browser sends along with each request.

Storage with us: The conversation history is not on our server
stored. We only create an anonymous count to prevent overload
(number of requests per hour), and log technical errors without your inputs. The
history remains in your browser and ends when you leave the page or clear the history.

Purpose: Answering your question.
Legal basis: Your consent by actively using the assistant
(Art. 6(1)(a) GDPR) as well as our legitimate interest in efficient support
(Art. 6(1)(f) GDPR). You can stop using it at any time and instead contact us via the
contact portal — there your request remains exclusively with us.
Representation in the EU: DeepSeek has appointed a representative in the Union pursuant to Art. 27 GDPR
appointed (Prighter Group) and can be reached at rep_deepseek@prighter.com
reachable.

8. Online shop, payment and shipping

In the online shop you can order devices and books. For the processing
we process the order data you enter: name, address, email address, ordered
items and invoice amount.

Legal basis: Performance of the purchase contract (Art. 6(1)(b) GDPR) as well as
Compliance with legal obligations (Art. 6(1)(c) GDPR).

Payment

We offer payment by credit card, via Stripe and over PayPal comes in.
Payment processing is carried out exclusively by the respective payment service provider; we receive
no complete card data, only the information whether the payment was successful.

Depending on the payment method chosen, your payment service provider may require its own details from you. Please
read the privacy notices there.

Shipping

For delivery, we pass on your name and address to the commissioned shipping company.
Your email address is transmitted only to the extent necessary for the delivery notification.

Retention

We retain invoices and the associated receipts in accordance with § 132(1) of the Federal Fiscal Code
for seven years ; the period runs from the end of the calendar year in which the service
was provided.

9. Hosting

Our website is operated by a hosting provider in the European Union. The provider
processes on our behalf the data arising during access (in particular server log files) and is
bound by a data processing agreement pursuant to Art. 28 GDPR.

The AI assistant and the online shop run on the same infrastructure. Our GitLab instance, in which
support requests are recorded as work orders, we also operate ourselves.

10. Recipients

Recipients of your data are exclusively:

• our hosting provider (processor pursuant to Art. 28 GDPR)
• the payment service provider selected by you, insofar as required for the payment
• the contracted shipping company, to the extent necessary for delivery
• DeepSeek, insofar as you use the AI assistant
• our tax advisor and the tax authorities, insofar as statutory obligations exist

We do not sell personal data and do not disclose it for advertising purposes.

Not in this list: If you click a link to our profiles on Instagram
or Facebook, your browser transmits your IP address to the respective
provider (see Section 2). This is not triggered by us, but by your click; the provider is
in this respect the controller in its own right. As long as you do not click, no transmission occurs
.

11. Transfers to third countries

A transfer to a third country only takes place if you use the AI assistant: Your input
is then sent to DeepSeek in the People's Republic of China transmitted.

For China, there is no adequacy decision of the European Commission. The
The transfer is based on the standard contractual clauses pursuant to Art. 46(2)(c) GDPR
(Implementing Decision (EU) 2021/914) in conjunction with an assessment of the circumstances and additional
safeguards. A copy of these guarantees is available on request.

Otherwise, we process your data exclusively in the European Union. For the USA, there is
an adequacy decision (Data Privacy Framework), but we do not transfer any data there.

Regarding the links to Instagram and Facebook mentioned in Section 2: We ourselves transmit
no data in the process. Only when you click a link does your browser establish a connection
to the respective provider. What the provider then does with the data — including a possible
forwarding to a third country — is governed by its terms and conditions and lies outside our
control.

12. Retention period

Where no statutory period exists, we determine the duration in accordance with the principle of storage limitation
(Art. 5(1)(e) GDPR) ourselves and review it regularly.

13. Your rights

You have the following rights vis-à-vis us at any time:

• Access to the data processed concerning you (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your data, insofar as no retention obligation precludes this (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common, machine-readable format (Art. 20 GDPR)
• Objection to processing based on our legitimate interest (Art. 21 GDPR)
• Withdrawal of consent granted with effect for the future (Art. 7(3) GDPR)

To exercise them, it is sufficient to send a message to office@lumi-systems.io.
We respond within one month.

14. Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you can
lodge a complaint with the supervisory authority:

Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
www.dsb.gv.at

15. No automated decision-making

Automated decision-making, including profiling, under Article 22 GDPR does not
take place. The AI assistant does not make any decisions with legal effect vis-à-vis you; its
answers are non-binding information.

16. Obligation to provide

You are not obliged to provide any details. However, to complete an order, we require the
details required for contract performance and invoicing — without them we cannot
conclude the contract. Use of the AI assistant is voluntary; if you do not wish to transmit any data to
DeepSeek, please write to us via the contact portal.

17. Data security

We take technical and organizational measures to protect your data against loss, alteration and
unauthorized access. Transmission is encrypted throughout via HTTPS (TLS).
Access is restricted; servers and applications are updated regularly.

18. Changes

We will update this statement if processing or the legal situation changes. For your
subsequent visit, the version published here then applies. The date of the version is stated above.