Privacy Policy

The Processing of Personal Data undertaken by Lumx will always be based on a certain legal basis provided for in articles 7 and 11 of the LGPD, even if it may not have been listed in the table above.

7. About personal data of children and adolescents

Lumx does not knowingly request, collect, store, process, or share personal data of children and adolescents. If we identify the occurrence of any type of processing of said data, unintentionally, we will remove the personal data of that child or adolescent from our records immediately.

8. Sharing personal data with third parties

In order to fulfill the purposes described in this Notice, Lumx may share your personal data with partner companies, in order to offer benefits and new opportunities and/or send communications and advertising, improving the quality of service provided, which will be done in a justified manner, always maintaining the highest security standards, seeking to preserve your privacy as much as possible. Below are described some situations in which there is the possibility of sharing personal data and their respective purposes:

1. If, upon prior notice, the Data Subject agrees to share them;

2. Service providers and technology providers. Lumx operates in partnership with other organizations to enable its activities, such as providers of data hosting services, asset security, authentication and validation of registrations, detection of fraud and irregularities in transactions and payments, among others. In order to minimize risks for Data Subjects, suppliers are regularly evaluated and commit to contractual obligations for information security and personal data protection;

3. Public Authorities. For compliance with applicable legislation or upon request from public or government authorities;

4. In the event of a sale, in whole or in part, of the business or its assets, or as part of any business reorganization or restructuring, merger, spin-off or incorporation, so that we may share Users' information with third parties who are part of their respective businesses, taking the necessary steps to ensure that privacy rights continue to be protected, pursuant to this Notice;

5. Third-Party Links. The platform may include links to third-party websites, plug-ins, or applications. Clicking on these links or enabling such connections may allow third parties to collect or share personal data of the Data Subjects. Lumx is not responsible for the Privacy Notice of these third-party websites;

6. Customers or Partners: To send newsletters and share benefits or new opportunities, provided the Data Subject has not opted out. Personal data may be shared with partners or providers of web analytics services, to enable the Data Subject to access the website without problems and so that Lumx can understand how to improve its services and the experience when accessing the website; and

7. Third-party crypto wallets. To use Lumx's services, the Data Subject may use a third-party crypto wallet that allows transactions to be carried out on public blockchains. Your interactions with any wallet provider will be governed by the applicable Terms and that third party's Notice.

9. Retention and disposal of personal data

The personal data processed by Lumx will be retained for the duration of the contract, in accordance with Article 7, item V, of the LGPD. Upon the termination of this period, personal data, including third parties, will be stored in compliance with the statute of limitations under Brazilian law, unless the processing is based on the Data Subject’s consent, a legitimate interest that justifies continued storage, or if retention is otherwise authorized by applicable legislation.

Once the statute of limitations has expired, the personal data processed by Lumx will be deleted, except in cases where processing is necessary under the circumstances set forth in Article 16 of the LGPD, as outlined below:

1. Compliance with a legal or regulatory obligation by the Controller;

2. Study by a research body, ensuring, whenever possible, the anonymization of personal data;

3. Transfer to a third party, provided that the requirements for the processing of personal data set forth in LGPD are respected; or

4. Exclusive use of the controller, with access by third parties prohibited, and provided that personal data is anonymized.

5. In certain cases, Lumx has legal obligations that determine the storage of personal data for specific periods, such as IP address data, time and date of each access to our Platform, which must be retained for at least 6 months, in compliance with article 15 of Law No. 12,965, of April 23, 2014 ("Brazilian Civil Rights Framework for the Internet").

10. International Transfer of Personal Data

Lumx may transfer personal data to other countries in the event of providing services or functionalities that use technological infrastructure established outside Brazil, such as hosting servers and cloud services or when we need to involve third parties located abroad, under the terms of article 33 of the Brazilian General Data Protection Law.

Currently, the databases, websites and servers used by Lumx are hosted on Google Cloud infrastructure, specifically in the us-east1 region (South Carolina, United States). This choice aims to ensure high availability, performance, and security for our systems.

If there is a change in the hosting infrastructure — such as changing cloud provider, server, or storage country — data subjects will be duly notified by website or email and any affected contracts will be adjusted as necessary.

Lumx ensures that, in cases of international transfer, personal data will only be transferred to countries or companies that provide a level of personal data protection equivalent to that required by current Brazilian legislation, especially LGPD.

11. Data security

Lumx's responsibility is to take care of personal data and use it for the purposes described in this Notice. To ensure the privacy and protection of the personal data of the Data Subjects, Lumx adopts appropriate administrative measures and technological resources to ensure the security of all personal data processed. Among the security measures implemented are system access controls, backup policy, installation of barriers against improper access to databases (including firewalls), multi-factor authentication, among other information security controls.

In order to provide greater transparency, we inform you that the data stored during operations is all anonymized.

Lumx strives to protect personal data, but unfortunately, for reasons of force majeure, it cannot guarantee complete security. Unauthorized third-party entries and uses of End User information, hardware or software failures that are not under the company's control, and other external factors may compromise the security of personal data.

The Clients and End User are responsible for the security of their account and crypto wallet. Therefore, the performance and attention of the End User is essential for maintaining a safe environment for all. If you identify or become aware of any factor that compromises the security of your data in your relationship with Lumx, please contact us immediately.

12. Rights of data subjects

Data subjects have the right to request information from Lumx regarding the processing of their personal data through the requests below:

1. Right to confirm the existence of processing: Data Subjects may contact us in order to confirm whether any of their personal data is processed by Lumx;
   

2. Right of access: it is the right of Data Subjects to request access to existing personal data processed by Lumx;
   
   

3. Right to rectification of Personal Data: Data Subjects may request Lumx, at any time, to change their personal data, if it is incorrect, inaccurate or outdated. Examples are: name update, change of telephone number and address. It is important that personal data is accurate and current, and it is up to the Data Subject to keep Lumx informed in cases where their personal data needs to be corrected;
   
   

4. Anonymization, blocking, or deletion of unnecessary, excessive, or processed data in violation of the LGPD: Data Subjects may request the blocking and deletion of their personal data. Such request may only be denied by Lumx in cases where the request cannot be met or in cases where its storage is mandatory or allowed, in accordance with the hypotheses listed in article 7 of the LGPD and other applicable provisions. As anonymization prevents the identification of the individual, anonymized data is no longer considered personal data and, therefore, is outside the scope of application of the LGPD;
   
   

5. Portability: the right to request a copy of your personal data in electronic format and/or to transmit such personal data for use in the third-party service
   
   

6. Right to delete Personal Data processed with the consent of Data Subjects: personal data will be deleted once the purpose for its collection and processing has been fulfilled, except in certain cases:
   
   

   1. compliance with a legal or regulatory obligation by Lumx;

   2. transfer to a third party, provided that the requirements for processing Personal Data set forth in the LGPD are respected; or

   3. exclusive use of Lumx, its access by third parties is prohibited, and provided that the personal data is anonymized.
      
      

7. Information regarding the public and private entities with whom the controller has shared personal data: the Data Subject is entitled to request access to any personal data transmitted to these entities;
   
   

8. Information regarding the option to withhold consent and its consequences: Lumx is available to provide clear and transparent assistance concerning any doubts about the processing of Data Subjects’ personal data, including possible effects resulting from the refusal to provide consent;
   
   

9. Revocation of consent: Data Subjects have the right to revoke their consent for Personal Data processing at any time by submitting a written request to Lumx through a free procedure, provided that the processing is based on consent.

To ensure security, whenever a Data Subject submits a request to exercise their rights, Lumx may require additional information and/or documents to verify their identity and prevent fraud. This measure is intended to protect the security and privacy of all parties involved.

In certain cases, Lumx may have legitimate grounds to deny a request to exercise data subject rights. Such situations include, for example, instances where disclosing specific information could infringe on intellectual property rights or trade secrets of the company or third parties, as well as requests to delete data that must be retained due to legal or regulatory obligations. Additionally, retaining data may be necessary to enable the defense of the company or third parties in any type of dispute.

Furthermore, Lumx cannot modify or delete information stored on blockchains, as it neither holds custody nor control over these public networks. Data recorded on the blockchain may include transactions such as purchases, sales, and transfers linked to a blockchain address, crypto wallet, or other information managed via Lumx.

Some requests may not be fulfilled immediately or in full; however, Lumx is committed to addressing all requests in accordance with applicable laws and regulations.

If the Data Subject has any questions regarding these matters or how to exercise their rights, they may contact Lumx through the channels provided at the end of this Privacy Notice.

13. How to talk about personal data with Lumx?

If you believe that your Personal Data has been processed in a way that is incompatible with this Privacy Notice or your choices as a Data Subject, or if you have any questions, comments, or suggestions about this Notice or Lumx's data processing practices, please contact us through the channels below:

1. Email: dpo@lumx.io

2. Data Protection Officer (DPO): Débora Leal Soares de Castro

We are available to provide the necessary clarifications and ensure that your rights as a Data Subject are respected.

14. Modification of the Privacy Notice

Lumx may modify, at any time, this "Privacy Notice" to reflect any necessary changes, aiming at improving and corresponding to the services provided or to respond to legal, administrative or court order issues.

The updated versions of this Privacy Notice will be published on the website. Should Lumx make any changes to the way it processes personal information, Data Subjects will be notified either by email or through a notice on the website. In such cases, Data Subjects are responsible for reviewing these legal notices, and the changes will take effect from the date the updated Privacy Notice is published.

Your continued use of Lumx’s services after the effective date of any previously notified changes constitutes your acceptance of the updated Privacy Notice. We also recommend that you review this Privacy Notice periodically to stay informed about any modifications.