LumeSwan Privacy Policy

LumeSwan determines the purposes and means of the platform processing described below and acts as controller for that processing. A connected provider may be an independent controller for personal data it needs to perform a booked service, comply with legal obligations or communicate directly with a customer.

For questions, privacy requests or complaints, contact LumeSwan through the existing Contact page. We ask for additional information only when needed to verify your identity or request.

Depending on how you use LumeSwan, we may process:

• account and profile data, including name, username, email address, phone number, address, date of birth, profile image and user role;
• login and verification data, including session data, account security, verification status and data Google, Microsoft or Apple provides with your permission;
• business and provider data, including profiles, locations, contact, registration and tax details, services, prices, availability, photos, employees, claims and verification data;
• booking data, including the selected service, date or time, guests, add-ons, preferences, notes, cancellation status and booking communications;
• payment and invoice data, including amounts, payment status, invoice data, payment references, refunds and payout data. Full payment-card details are generally handled by the payment provider;
• content and communications, including reviews, favourites, support tickets, messages, complaints and notification preferences;
• technical and usage data, including IP address, device and browser information, cookie IDs, viewed pages, searches, logs, errors and security signals.

Do not provide special-category data, such as health information, unless it is necessary for a particular booking and you understand that the relevant provider will receive it. Where required, we rely on explicit consent or another valid legal exception.

• directly from you when you create an account, book, pay, manage a profile, contact us or post content;
• from a business, employee or other user entering data for a booking or business process;
• from the login, payment, mapping, verification or communication service you use;
• automatically through cookies, logs and similar technology;
• from public business sources, websites, directories and map or location sources for imported, unclaimed business profiles.

Business profiles, listings, photos, opening hours, prices, reviews and other information intended to make a provider discoverable and bookable may be publicly visible. Do not place private information in public fields.

LumeSwan may import basic business information from public sources to make its marketplace, map and search useful. An authorised business can claim such a profile. A business or individual may use the Contact page to request correction, restriction or deletion of inaccurate or unnecessary personal data. We assess such requests against legal duties and legitimate interests.

We share personal data only where needed, for example with:

• the provider and authorised employees fulfilling a booking;
• payment providers, banks and services supporting invoices, refunds and payouts;
• hosting, database, security, email, SMS, support and technical providers;
• Google, Microsoft or Apple when you select their login method;
• mapping, location, analytics, cookie-management and anti-abuse services where enabled;
• advisers, insurers, auditors, successor businesses or authorities where legally permitted or required.

Processors acting for LumeSwan may use data only under our instructions and appropriate terms. Some recipients, including providers and payment services, may be independent controllers for their own legal duties.

Some technical providers may process data outside the European Economic Area. Where required, we rely on a European Commission adequacy decision, approved Standard Contractual Clauses or another valid safeguard. You may request information about safeguards applicable to a specific transfer through the Contact page.

We use necessary cookies for login, language preferences, security, carts and temporary booking holds. Analytics and similar services, including Google Analytics and JourneyDash, may process website usage data to measure performance and usability.

Where consent is required, we request it through the cookie banner. You can later change your choice through “Cookie preferences” in the footer. Blocking necessary cookies may prevent login, booking or other core features from working.

We keep personal data no longer than necessary for its purpose. Relevant criteria include:

• account and profile data for the account's lifetime and afterwards only as needed for closure, security, disputes or legal duties;
• booking, payment, invoice and payout data as needed for fulfilment, service, claims and accounting; Dutch basic tax records are generally retained for seven years;
• support, communication and verification data as needed to resolve the request, prevent misuse and handle disputes;
• technical logs, cookies and analytics for their configured period and for as short a period as reasonably possible;
• public business information while the profile remains current and relevant or until a valid correction or deletion request is resolved.

We delete or anonymise data when the applicable period ends, unless further retention is legally required or permitted.

We use appropriate technical and organisational safeguards, including access controls, secure connections, secure session cookies, logging and encryption where appropriate. No online system is entirely risk-free. Protect your login details and report suspected misuse promptly through the Contact page.

Depending on the circumstances, you may have rights to information, access, correction, deletion, restriction, portability and objection. You may withdraw consent for future processing at any time. We may verify your identity and must consider the rights of others, statutory retention duties and GDPR exceptions.

Submit a request through the Contact page. We normally respond within one month. The GDPR allows an extension for complex requests, in which case we notify you in time. You may also complain to your local supervisory authority or the Dutch Data Protection Authority.

LumeSwan may support search ranking, recommendations, availability and fraud prevention with automated rules. These features are intended to make the platform useful and safe and do not independently make decisions producing legal or similarly significant effects. If this changes, we will explain the logic, consequences and applicable rights beforehand.

LumeSwan is not intended to manage accounts for young children without permission from a parent or legal guardian. If you believe a child provided personal data without valid permission, contact us so we can investigate and delete it where appropriate.

We may update this Privacy Policy when our services, providers or laws change. The latest version is always available on this page. We will provide appropriate notice of material changes.