Privacy Policy

Definitions

In this policy, "personal data" means any information relating to an identified or identifiable individual; "processing" means anything done with that information, from collecting it to erasing it; the "controller" decides why and how data is processed; a "processor" handles data on the controller's instructions; and "you" is the visitor or account holder to whom the data relates.

Personal data we collect

When you register or use the services we collect at minimum: your first name and last name, telephone number, email address, and the content of any enquiry or message you send. As onboarding proceeds we also collect your date of birth, residential address, identity document details and copies, transaction and account records, and correspondence with your manager or support. Data you give is combined with data generated by use: device and browser information, IP address, timestamps of visits, pages viewed and preferences set in the platform.

Usage data

Usage data is the technical trail of your interaction with the site: how you reached it, which pages you opened, how long you stayed, error events and the identifiers your browser presents. It serves security, diagnostics and aggregate statistics, for example which guide new users read most, and it is reviewed in identifiable form only when investigating a specific incident or account question.

Files known as cookies

Cookies are small files a website stores on your device. We use strictly necessary cookies to keep sessions signed in and security features working, which cannot be switched off in the platform. Preference cookies remember choices such as chart settings. Analytics cookies, where enabled, measure aggregate use of the site and help us improve it; they collect statistics, not your identity. Marketing cookies are set only with your consent, if at all, and support the optional messages described in the Terms of Use. Your browser settings let you block or delete cookies at any time; strictly necessary cookies blocked together may make parts of the site unusable.

Who is the controller and who processes

Luminvestry, at 25 Old Broad Street, London EC2N 1HN, United Kingdom, is the controller for the personal data described in this policy. Processors act only on our documented instructions, under contracts requiring confidentiality and appropriate security, and remain subject to this policy's standards. Where a service is delivered with a licensed executing entity, that entity acts as controller for the data it processes directly, under the privacy terms it provides you during onboarding.

How your information is used

Your data is used to: answer your enquiries and put you in touch with a personal manager; create, verify and administer your account; execute and document the services you request, including deposits and withdrawals; meet legal obligations such as identity verification, record keeping and reporting; keep the platform and your account secure, including fraud and intrusion detection; improve the site, its materials and its usability in aggregate form; and, only with your consent, send you optional marketing messages you can withdraw at any time.

Legal bases for processing

Processing rests on the bases recognised by applicable UK data protection law. Contract: processing needed to set up and run your account and deliver the services you asked for. Legal obligation: identity verification, record keeping, and reporting duties under the anti-money laundering framework. Legitimate interests: site security, fraud prevention, service improvement and aggregate statistics, each balanced against your rights and expectations. Consent: the optional marketing mailings, and any non-essential cookies, given freely and withdrawable at any time. Vital interests and legal claims: the rare cases where processing is necessary to protect someone's life or to establish, exercise or defend legal rights.

How long data is kept

Retention follows purpose. Enquiry messages are kept for up to twenty-four months after the conversation ends. Account and transaction records are kept for the duration of the relationship and for seven years afterwards, the period required for financial records under applicable UK rules. Identity verification records follow the retention period required by the anti-money laundering framework. Marketing consents are kept until withdrawal plus a short documentation window. Usage data is held in identifiable form for up to twenty-six months, after which only aggregates survive. When a retention period ends, data is securely deleted or anonymised.

Disclosure and data sharing

Data is shared only with defined recipients and only as needed: the licensed entity that executes your transactions; affiliated companies within our group operating part of the service; identity verification and payment providers; IT service providers hosting infrastructure under processing agreements; professional advisers such as auditors and lawyers; and regulators or competent state authorities where a lawful request or reporting duty applies. We never sell personal data, and we do not share it for third-party advertising.

Data security

Technical and organisational measures protect data in transit and at rest, including TLS encryption for connections, encryption of stored records within access-controlled systems, least-privilege access with individual audit logging, and segregation of production data from test environments. People undergo training, and access by staff to your records is logged and reviewed. No system is perfectly secure, which is why we also run monitoring, incident response and, where required, breach notification procedures.

Your rights as a data subject

You have the right to: access your personal data and receive a copy; have inaccurate data rectified; have data erased where no overriding obligation requires keeping it; restrict processing while a dispute about accuracy or basis is resolved; object to processing based on legitimate interests or to direct marketing at any time; and receive your data in a portable, machine-readable format where processing rests on contract or consent. Requests are free of charge in normal circumstances, answered within one month, and can be extended by two further months for genuinely complex cases, of which you would be told. Verification of identity applies to any request, and where the law limits a right, for example identity records under the AML framework, we explain the limit and what we can do instead.

Service providers involved

Current categories of processor include: identity verification and document checking services; email and communication delivery; cloud hosting and content delivery; product analytics running under aggregation and no-remarketing commitments; and payment providers handling transactions under their own regulated frameworks. Each processor's role is bound by contract to the instructions we give and the standards of this policy.

Analytics

Aggregate analytics tell us which pages help users and where the site confuses them. Measurements are configured to avoid building individual profiles for advertising: no cross-site tracking for marketing, no sale of insights to third parties, and IP addresses truncated where practical. Where the analytics toolkit supports consent modes, non-essential measurement honours the consent you gave or withheld.

Advertising and retargeting

Retargeting, showing you an advertisement after you leave the site, runs only where you have consented to marketing cookies, through providers contractually barred from using the data for unrelated purposes. Consent is requested through a clear banner, is as easy to withdraw as to give, and refusing it never limits access to the site or the services.

Links to other websites

Our site links to third-party pages, such as exchanges or payment providers, whose privacy practices differ from ours. This policy covers the data we process; from the moment you follow a link, the destination's own policy governs. We encourage reading it, particularly before creating accounts or entering payment details.

Children's privacy

The services are directed at adults and are not intended for anyone under eighteen. We do not knowingly collect data from children. If you believe a child has provided personal data, write to us and we will delete it promptly after verification, and take reasonable steps to prevent recurrence.

Changes to this policy

This policy is reviewed at least annually and whenever our processing changes. Updates are published here and take effect on publication; material changes, such as a new category of recipient, are additionally announced in the platform or by email to active account holders. The version that applied when you first registered is available on request.

Contacting us

For any privacy matter, to exercise a right or to ask what data we hold: [email protected], or by post to 25 Old Broad Street, London EC2N 1HN, United Kingdom, marked for the attention of the Data Protection contact. If you are unhappy with our answer, you also have the right to complain to the UK supervisory authority for data protection, which we will confirm details of in our reply.