This policy is aligned with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable global standards. It explains what we collect, why, and your rights.
Data Fiduciary
Lumora Media ("we", "us") is the Data Fiduciary for personal data collected via lumoramedia.org. We are headquartered in Amaravati, India.
What we collect & lawful basis
- Contact info (name, email, company, message) - on your consent when you submit a form.
- Newsletter email - on your consent when you subscribe; withdrawn any time via unsubscribe.
- Project intake details - on your consent when you use the Start a project wizard.
- Usage data via cookies / analytics (page views, referrer, device type) - only after you accept the cookie banner.
Purpose
To reply to your inquiry, deliver our newsletter, improve the site, and run our business. We do not sell your data and do not share it with third parties for marketing.
Processors & cross-border transfer
Form submissions are stored in our managed backend (Supabase, EU region). Analytics is processed by Google Analytics 4. Email delivery, when used, is via Resend. Some processors are located outside India; transfer happens under appropriate safeguards as permitted by the DPDP Act.
Retention
Inquiry data is retained for up to 24 months for follow-up. Newsletter subscribers are kept until you unsubscribe. Anonymous analytics is retained for 14 months. Data is deleted earlier on valid request.
Your rights (Data Principal)
- Right to access, correction, completion and erasure of your personal data.
- Right to nominate another individual to exercise rights on your behalf.
- Right to grievance redressal (see below) before approaching the Data Protection Board.
- Right to withdraw consent at any time, without affecting prior lawful processing.
Email privacy@lumoramedia.org to exercise any of these rights. We respond within 30 days.
Grievance Officer
Per Section 8(9) of the DPDP Act, our designated Grievance Officer is:
Name: Grievance Officer, Lumora Media
Email: grievance@lumoramedia.org
Response SLA: Within 7 business days of acknowledgement.
Children's data
We do not knowingly process personal data of individuals under 18. If you believe we have done so in error, please email us and we will delete it.
Updates
We may update this policy as our processing evolves or as the law changes. Material changes will be announced on this page with a revised "Last updated" date.