Privacy Policy

1. General Provisions and Terms

This Policy has been developed in compliance with the requirements of paragraph 2, part 1, Article 18.1 of Federal Law No. 152-FZ and defines the operator's policy regarding the processing of personal data. The Policy applies to all information that the operator may obtain about users during their use of the Website.

The Policy uses the following key terms:

• "Personal data" means any information relating to a directly or indirectly identified or identifiable individual (data subject).
• "Operator" – a person who, independently or jointly with others, organizes and (or) carries out the processing of personal data, and also determines the purposes and composition of the processed personal data, as indicated in Section 2 of this Policy.
• "Personal Data Subject" (hereinafter referred to as the "User") — an individual whose personal data is processed by the operator, including when filling out forms and calculators on the Website.
• "Processing of personal data" means any action or set of actions performed on personal data, whether automated or not, including collection, recording, systematization, accumulation, storage, updating, use, transfer, blocking, deletion, and destruction.
• "Anonymization of personal data" — actions that make it impossible to determine the belonging of personal data to a specific individual without the use of additional information.
• "Cookies" are small pieces of data sent by the Site and stored on the User's device, used to ensure the Site's operation, analytics, and other purposes specified in Section 12.
• "Cross-border transfer of personal data" means the transfer of personal data to the territory of a foreign state, to a foreign state authority, or to a foreign individual or legal entity.

Consent to the processing of personal data is provided by the User exclusively by performing active actions: checking the corresponding field (checkbox) and submitting the form on the Site. The mere fact of visiting or using the Site does not constitute and is not recognized as consent to the processing of personal data. Viewing the Site's pages is possible without providing personal data.

2. Personal Data Operator

The processing of personal data of the Website Users is carried out by the following operator:

• Name: Individual Entrepreneur Pavel Yuryevich Kolomin.
• INN: 971508170490.
• OGRNIP: 318774600058786.
• Legal address: [legal address to be confirmed].
• Phone: +7 925 525-55-66.
• Email address: hello@lumux.ru.
• Telegram: t.me/lumux_smart.
• Website: lumux.ru.

For any questions related to the processing of personal data, the User has the right to contact the operator using the contact details provided above. The operator's details are also provided in the Details section.

3. Composition of Processed Personal Data

The Operator processes personal data that the User voluntarily provides when filling out feedback forms and the preliminary cost calculation calculator on the Website.

Composition of personal data provided by the User:

• last name and first name;
• contact phone number;
• preferred communication channel — the User's choice between Telegram, WhatsApp, or Max; specified when submitting a request and used by the operator for the response.

Email addresses are not collected through the Site's forms, as the operator does not use the email channel for processing requests.

Technical data that may be automatically processed when using the Site:

• cookies (in accordance with Section 11 of this Policy);
• IP address — used transiently to protect against automated requests and limit the frequency of request submissions; the IP address is not stored by the operator;
• data from the Yandex.Metrica analytics service (anonymized information about visits to the Site, loaded only after obtaining the User's consent).

The operator does not collect special categories of personal data (concerning racial or ethnic origin, political views, health status, and others), nor biometric personal data.

4. Purposes of Personal Data Processing

The Operator processes the User's personal data solely for the following purposes:

• processing of User requests and provision of consultations on smart home system design, installation, and configuration services;
• preliminary calculation of the approximate cost of services based on the parameters specified by the User in the calculator;
• providing feedback to the User, including clarifying request details and coordinating service terms;
• analysis of Site traffic and improvement of its performance using anonymized analytics data.

The Operator does not use the User's personal data for purposes not provided for by this Policy and does not make decisions based on it that entail legal consequences for the User solely on the basis of automated processing.

5. Legal Basis for Processing Personal Data

Processing of the User's personal data is carried out by the operator on the following legal grounds:

• consent of the personal data subject to the processing of his personal data (clause 1, part 1, article 6 of Federal Law No. 152-FZ), provided by the User when filling out forms and calculators on the Site;
• the need for processing to fulfill the contract for the provision of services, of which the User is a party, as well as to perform actions prior to concluding such a contract at the User's initiative (pre-contractual actions).

Consent to the processing of personal data is provided by the User freely, of their own will and in their own interest, and is specific, informed, and conscious. The form and content of the consent are set out in the document Consent to the Processing of Personal Data.

6. Procedure and Terms of Processing, Conditions for Storing Personal Data

Processing of personal data is carried out both with the use of automation tools and without their use, in compliance with the principles and rules established by Federal Law No. 152-FZ.

To comply with the requirements of the legislation of the Russian Federation regarding the localization of databases, the initial recording of the User's personal data (surname, first name, contact phone number) is performed and stored in an information system located on the territory of the Russian Federation (Bitrix24 cloud service). The primary database of personal data resides in the Russian Federation.

On the technical infrastructure of the Site (the server hosting the Site is located outside the territory of the Russian Federation), direct user identifiers — surname, name, phone number, email address, IP address — are not stored. Only anonymized request data is retained on this infrastructure, specifically:

• completed form type;
• calculation parameters specified in the calculator;
• estimated calculation amount;
• document consent version and timestamp of consent provision.

Personal data is processed by the operator for the period necessary to achieve the processing purposes specified in Section 4, or until the User withdraws consent. Upon achieving the processing purposes or in case of consent withdrawal, personal data is subject to destruction or anonymization, unless otherwise provided by the legislation of the Russian Federation.

7. Transfer of Personal Data to Third Parties and Entrustment of Processing

The Operator does not disclose or transfer the User's personal data to third parties, except in cases expressly provided for by this Policy and the legislation of the Russian Federation.

To achieve the processing purposes, the operator engages the following persons who process personal data on behalf of the operator or provide services located in the territory of the Russian Federation:

• Bitrix24 is a customer relationship management (CRM) system used for receiving and processing requests; the initial recording of the User's personal data is carried out in this system, located in the territory of the Russian Federation;
• Yandex.Metrica is a web analytics service that processes anonymized data about Site visits; the service's servers are located in the Russian Federation; the service loads only after obtaining the User's consent.

To contact the operator, the User can choose from the Telegram, WhatsApp, and Max messengers (the "preferred communication channel" field). Communication via these messengers is initiated by the User; the operator's response is provided manually. The website does not automatically transfer the User's personal data to the messengers. Telegram and Max are used as standard communication channels; the use of WhatsApp is possible at the operator's discretion, taking into account legal risks associated with the status of Meta Platforms in the territory of the Russian Federation.

The operator is notified of incoming requests via the Bitrix24 system (Russian Federation) and Telegram. By default, only the fact of request receipt and a link to it are transmitted to Telegram, without specifying the User's surname, name, or phone number. If the operator activates the mode for transmitting a masked phone number to Telegram, such transmission will be disclosed in an updated version of this Policy with notification submitted to the authorized body for the protection of the rights of personal data subjects in accordance with Article 12 of Federal Law No. 152-FZ.

8. Cross-Border Transfer of Personal Data

Cross-border transfer of the User's personal data is not performed by the operator.

Initial recording and storage of the User's direct identifiers are carried out in an information system located on the territory of the Russian Federation. The notification to the operator about a request via Telegram contains only the fact of the request's receipt and a link to it and does not include the User's personal data, therefore cross-border transfer of personal data is not performed.

9. Rights of the Personal Data Subject and the Procedure for Withdrawing Consent

The user, as a subject of personal data, has the rights stipulated by Article 14 of Federal Law No. 152-FZ, including:

• the right to receive information regarding the processing of their personal data, including confirmation of the processing, its purposes, and the methods used;
• the right to request the clarification of their personal data if it is incomplete, inaccurate, or outdated;
• the right to demand the blocking or deletion of their personal data if it has been unlawfully obtained or is not necessary for the stated purpose of processing;
• the right to withdraw previously given consent to the processing of personal data;
• the right to protect their rights and lawful interests, including compensation for damages and moral harm through judicial proceedings.

To exercise their rights, including the withdrawal of consent to the processing of personal data, the User has the right to send a corresponding request to the operator at the email address hello@lumux.ru or by phone at +7 925 525-55-66. Upon receiving and verifying the request, the operator will cease processing the personal data and ensure its destruction or anonymization within the timeframes established by the legislation of the Russian Federation, unless other legal grounds for continuing the processing exist.

10. Personal Data Protection Measures

The Operator implements the necessary legal, organizational, and technical measures to protect the User's personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, as well as from other unlawful actions concerning personal data.

The measures applied include, in particular:

• minimization of the scope of processed personal data and refusal to store direct identifiers on the Site's technical infrastructure;
• placement of the primary personal data database in the information system within the territory of the Russian Federation;
• restricting access to personal data to the circle of persons who need it to perform their official duties;
• use of secure data transmission channels when filling out forms on the Site;
• application of protection against automated requests and limitation of request submission frequency.

When processing personal data, the operator ensures its confidentiality in accordance with the requirements of Article 7 of Federal Law No. 152-FZ.

11. Response to Personal Data Incidents

An incident is defined as an unlawful or accidental transfer (provision, dissemination, access) of personal data that resulted in a violation of the rights of personal data subjects. The Operator maintains a record of incidents and takes measures to prevent them and eliminate their consequences.

In accordance with Article 21.1 of Federal Law No. 152-FZ, upon detection of an incident, the operator:

• within 24 hours of identifying the incident, notifies the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) about the incident, its presumed causes and presumed harm, as well as the measures taken and the appointed responsible person;
• within 72 hours from the moment of identifying the incident, sends a notification to Roskomnadzor about the results of the internal investigation, as well as information about the individuals whose actions caused the incident (if identified);
• interacts with the state system for detecting, preventing, and eliminating the consequences of computer attacks (GosSOPKA) in cases established by law.

The internal response procedure includes: recording the fact and time of incident detection, containment (revoking access, blocking compromised channels), assessing the scope of affected data and the range of data subjects, notifying the authorized body within the specified deadlines, conducting an internal investigation with documentation of results, and taking measures to prevent recurrence.

The Website Architecture minimizes the consequences of potential incidents: direct identifiers (name, phone number) are not stored in the Website's database but are transmitted directly to the operator's secure CRM system (see section 6).

12. Use of cookies

Cookies are small pieces of data that are stored in the User's browser on their device when visiting the Site and are used to ensure the Site's operation, analytics, and other purposes specified in this section.

The Website uses the following categories of cookies:

• necessary — ensure the basic operation of the Site, save settings, and record the User's choice regarding cookies; always active and do not require the User's consent;
• analytical — used by the Yandex.Metrica service to collect anonymized visit statistics; disabled by default and loaded only after obtaining the User's consent;
• marketing — used by the Site's widgets and interactive elements; disabled by default and loaded only after obtaining the User's consent.

Analytical and marketing cookies, as well as analytics services, are loaded exclusively after the User's explicit consent, provided via the cookie management banner (opt-in principle). Prior to granting consent, the specified cookies and services are not loaded.

The user has the right to change or withdraw their consent to the use of cookies at any time via the cookie management banner on the Site, as well as manage cookies through their browser settings, including blocking or deleting them. Disabling certain categories of cookies may affect the availability of some Site features.

Website traffic analytics are performed using the Yandex.Metrica service, whose servers are located in the territory of the Russian Federation. The Google Analytics and Meta Pixel services are not used on the Website.

13. Procedure for Amending the Policy, Effective Date, and Document Version

The Operator has the right to make changes to this Policy. When changes are made, the date of the last update is indicated in the current version. The new version of the Policy comes into force from the moment it is posted on the Website, unless otherwise provided by the new version.

The current version of the Policy is permanently available on the Website at the Privacy Policy page. The User is advised to periodically review the current version of the Policy.

Effective date of this version: June 12, 2026. Document version: 1.1. This version incorporates the requirements of Article 21.1 of Federal Law No. 152-FZ (incident notification) and amendments introduced by Federal Law No. 420-FZ dated November 30, 2024.