This policy explains what personal data this website actually collects, what we do with it, and the choices you have. We have written it to describe what genuinely happens — nothing more, nothing less.
The short version: the only personal data this site collects is what you type into our forms so we can reply to you. We set no cookies, run no advertising, keep no mailing list, and never sell data.
01Who we are
Lumitec AI Ltd (company no. 16173119) is the data controller for this website. Registered office: Cedar Lodge, York Road, Shiptonthorpe, York, YO43 3PH, United Kingdom. We are registered with the Information Commissioner's Office (ICO), registration reference ZC032377.
Privacy questions or requests: [email protected] or +44 1904 916700.
02What we collect
Form submissions. The site has three forms. Each collects only what you enter:
- Book a call — name, work email, phone (optional) and an optional note about what you're trying to do.
- Contact — name, email, optional subject, and your message.
- Careers — name, email, phone, the role you're interested in, and whatever you tell us about yourself (including any links you choose to share).
Anti-abuse data. When you submit a form we also record your IP address and browser user-agent string. These are used solely to rate-limit abuse of the forms and are automatically deleted from our records after around 30 days.
Aggregate analytics. We use Cloudflare Web Analytics, which is cookieless and does not build individual profiles — we see aggregate page-view statistics, not you.
Email. If you email us directly, we hold that correspondence in our business email (Microsoft 365).
03How we use it, and why we're allowed to
- Replying to your enquiry — including one automatic confirmation email. Lawful basis: our legitimate interest in responding to people who contact us, and where relevant, steps taken at your request before entering a contract (UK GDPR Art. 6(1)(b) and 6(1)(f)).
- Recruitment — assessing your careers enquiry (Art. 6(1)(b) pre-contract steps and 6(1)(f)).
- Security and anti-abuse — bot protection (Cloudflare Turnstile) and per-IP rate limiting on the forms (Art. 6(1)(f)).
- Legal obligations — where we are required to keep or disclose records (Art. 6(1)(c)).
We do not use your data for marketing, we do not operate a mailing list, we do not profile you, and we do not sell or rent personal data to anyone.
04Who processes it for us
We use a small number of service providers ("processors") to run this site. Each processes data only on our instructions:
- Cloudflare, Inc. — hosts this website, stores form submissions in our database, provides the Turnstile anti-bot check and cookieless analytics.
- Resend, Inc. (United States) — delivers the notification and confirmation emails when you submit a form.
- Cal.com, Inc. — only if you choose to book a meeting slot after submitting the booking form; anything you enter on their page is covered by their own privacy policy.
- Microsoft — our business email and productivity platform.
- Professional advisers (accountants, lawyers, insurers) where genuinely necessary.
We may also disclose data where required by law, or as part of a sale or reorganisation of the business (in which case this policy would continue to apply to your data).
05International transfers
Some of our processors are US companies. Where personal data leaves the UK/EEA — principally email delivery via Resend in the United States — the transfer is protected by recognised safeguards: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Addendum / EU Standard Contractual Clauses in the provider's data processing agreement. Cloudflare processes data on a global network under its data processing addendum with equivalent safeguards.
06How long we keep it
- Form submissions (name, email, message): up to 24 months from submission, so we can handle follow-up conversations, then deleted automatically.
- IP address and user-agent captured with a submission: removed automatically after around 30 days (they are only needed for short-term abuse prevention).
- Careers enquiries: see Job applicants below.
- Email correspondence: retained as normal business records for as long as the relationship (or a legal obligation) requires.
07Job applicants
If you contact us about working at Lumitec AI, we use what you send us solely to assess your enquiry. It is read personally by the founders — there is no automated screening. If we don't end up working together, we keep your enquiry for up to 6 months after our decision (in case a suitable role opens), then delete it — unless you ask us to keep your details on file, or ask us to delete them sooner, which you can do at any time.
08Cookies — we don't set any
This website sets no cookies and writes no tracking data to your browser. That is why you don't see a cookie banner — there is nothing to consent to.
- Cloudflare Web Analytics is cookieless and measures aggregate traffic only.
- Cloudflare Turnstile (the anti-bot check on our forms) evaluates browser signals to distinguish humans from bots. It is strictly necessary for the security of the forms and, as configured on this site, does not set cookies.
09Keeping data secure
All traffic to this site is encrypted (TLS). Form submissions are stored in access-controlled infrastructure with the minimum data needed, protected by the security measures described above, and accessible only to the founders. We review what we hold and purge it on the schedules in section 6 automatically.
10Your rights
Under UK GDPR (and EU GDPR where it applies) you can ask us to: access the data we hold about you; correct it; delete it; restrict or object to our use of it; or provide it to you in a portable format. You can also object to processing based on legitimate interests.
To exercise any right, email [email protected] — we respond within one month. You also have the right to complain to the Information Commissioner's Office (UK) or your local supervisory authority in the EU.
11Links to other websites
This site links to external sites (for example LinkedIn, Companies House and cal.com). This policy covers lumitec.ai only — other sites have their own policies.
12Changes to this policy
If we change how this website handles personal data, we will update this page and the "last updated" date above. Significant changes will be flagged clearly. This policy was last reviewed and rewritten on 5 July 2026 to describe the site's actual data processing.