LUCOLED ("we", "us", "our") is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Belgian Data Protection Act of 30 July 2018. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website lucoled.com and use our web and desktop applications.
1. Data Controller
The data controller responsible for your personal data is:
2. What Personal Data We Collect
We collect the following personal data when you register for an account on any of our web or desktop applications:
| Data Field | Collected At |
|---|---|
| First name | Registration |
| Last name | Registration |
| Email address | Registration |
| Phone number | Registration |
When you visit our website, we may also automatically collect technical data such as your IP address, browser type, operating system, pages visited, and the date and time of your visit through cookies and similar technologies (see Section 6).
3. How and Why We Use Your Data
We use your personal data for the following purposes:
| Purpose | Description |
|---|---|
| User authentication | To verify your identity when you log in to our applications |
| Account management | To create, maintain, and manage your user account |
| System administration | To ensure the security, performance, and proper functioning of our applications |
| Technical support | To assist you with any issues related to our applications |
| Marketing communications | To send you offers, news, and updates about new features and products — only with your explicit consent |
4. Legal Bases for Processing
Under the GDPR, we must have a valid legal basis for processing your personal data. We rely on the following:
| Purpose | Legal Basis | GDPR Article |
|---|---|---|
| Authentication & account management | Contractual necessity — processing is necessary for the performance of the contract between you and LUCOLED | Art. 6(1)(b) |
| System administration & security | Legitimate interest — ensuring the security and proper functioning of our systems | Art. 6(1)(f) |
| Marketing communications | Consent — we will only send you marketing communications if you have given us your explicit, informed consent | Art. 6(1)(a) |
| Legal obligations | Compliance with legal obligations to which we are subject | Art. 6(1)(c) |
5. Marketing Communications
We may use your email address and phone number to send you offers, news, and updates about new features and new products. However, we will only do so if you have provided your explicit consent.
How we obtain consent
During registration or in your account settings, you will see a separate, clearly labelled marketing consent checkbox. This checkbox is never pre-ticked and is not bundled with the terms of service or registration consent. You actively choose to opt in.
How to withdraw consent
You can withdraw your marketing consent at any time through:
- The opt-out toggle in your profile or account settings within any of our applications
- The Unsubscribe link included in every marketing email we send
6. Cookies
Our website uses cookies and similar technologies. Cookies are small text files placed on your device that help us provide a better user experience.
Types of cookies we use
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly necessary | Essential for the website to function (e.g., session management, security) | No |
| Analytics | Help us understand how visitors use our website (e.g., pages visited, time spent) | Yes |
| Marketing / Advertising | Used to deliver relevant advertisements and track campaign performance | Yes |
When you first visit our website, a cookie consent banner will allow you to accept or reject non-essential cookies. You can change your cookie preferences at any time through the cookie settings link in the website footer.
7. Who We Share Your Data With
We may share your personal data with the following categories of recipients:
| Recipient | Purpose | Relationship |
|---|---|---|
| Abhinav Digicompsoft Services Pvt. Ltd. (India) | Development, maintenance, and support of our web and desktop applications | Data Processor — governed by a Data Processing Agreement |
| GoDaddy.com | Web server hosting for our applications | Sub-processor — under our direct account |
| Microsoft Corporation | Distribution of our desktop application via the Microsoft Store | Sub-processor — under our direct account |
8. International Data Transfers
Your personal data is stored on servers located within the European Economic Area (EEA). However, our software development partner, Abhinav Digicompsoft Services Pvt. Ltd., is based in India and accesses your data remotely for development, maintenance, and support purposes.
This remote access constitutes a transfer of personal data under the GDPR. To ensure your data receives an equivalent level of protection, we have implemented the following safeguards:
- Standard Contractual Clauses (SCCs) adopted by the European Commission under Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor)
- A Transfer Impact Assessment confirming that the transfer does not undermine the level of protection guaranteed by the GDPR
- Supplementary technical measures including encrypted VPN access, multi-factor authentication, access logging, and a strict no-local-storage policy
9. Data Retention
We retain your personal data only for as long as necessary for the purposes described in this policy. The specific retention periods are:
Free accounts
If you have not used your account for 6 consecutive months, we will send you a notification to your registered email address informing you that your account and all associated personal data will be deleted. If you do not respond or log in within 30 days of this notification, your data will be permanently deleted.
Paid / licensed accounts
Your data is retained for the full duration of your valid licence. After your licence expires, you have a 30-day grace period to renew. If you do not renew within this period, your data will be permanently deleted. We will send you a reminder at least 7 days before the end of the grace period.
General rules
All deletions are permanent and irreversible. Where any legal or regulatory obligation requires us to retain certain data beyond these periods (such as tax or accounting records), we will retain only the minimum necessary data and restrict its processing to the legally required purpose.
10. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Right of access | You can request a copy of the personal data we hold about you |
| Right to rectification | You can request correction of inaccurate or incomplete data |
| Right to erasure | You can request deletion of your personal data (see Section 11) |
| Right to restriction | You can request that we limit the processing of your data in certain circumstances |
| Right to data portability | You can request your data in a structured, commonly used, machine-readable format |
| Right to object | You can object to processing based on legitimate interest |
| Right to withdraw consent | Where processing is based on consent, you can withdraw it at any time |
| Right to lodge a complaint | You can lodge a complaint with the Belgian Data Protection Authority (see Section 16) |
11. Delete My Data
You have the right to request the deletion of all your personal data under Article 17 of the GDPR. We provide an easy way to exercise this right:
| Step 1. | Log in to your account in any of our web applications |
| Step 2. | Navigate to Account Settings |
| Step 3. | Click the “Delete My Data” button |
| Step 4. | Confirm your request by re-entering your password |
Once submitted, your request is forwarded to our data protection team for review. If no legal exemption applies, your data will be permanently deleted within 30 days of your request. You will receive a confirmation once the deletion is complete.
In certain cases, we may be legally required to retain some of your data (for example, for tax or accounting purposes, or to defend legal claims). If this applies, we will inform you of what data is retained and why.
For the desktop application, you can submit a deletion request through the Settings menu, which will be routed to our server for processing. Alternatively, you can request deletion by emailing us at jurjen@lucoled.com.
12. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption of personal data at rest (AES-256)
- Role-based access control limiting who can access your data
- Multi-factor authentication for all administrative access
- Regular access reviews and monitoring
- Mandatory data protection training for all personnel who handle personal data
- Secure software development practices with separation of development and production environments
While we take every reasonable precaution to protect your data, no method of transmission over the internet or electronic storage is 100% secure. If you become aware of any security incident involving your account, please contact us immediately.
13. Children’s Privacy
Our applications and website are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete the data.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the “Last Updated” date at the top of this document
- Notify registered users by email if the changes materially affect how we process their personal data
- Where required by law, obtain your consent before applying changes that affect your rights
We encourage you to review this policy periodically to stay informed about how we protect your personal data.
15. Contact Us
If you have any questions about this Privacy Policy, about how we process your personal data, or if you wish to exercise any of your rights, please contact us:
16. Supervisory Authority
If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the competent supervisory authority:
——— End of Privacy Policy ———