This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website https://lumov.io (the "Website") and when you contact us through it. We are committed to handling your personal data lawfully, fairly and transparently, in line with the General Data Protection Regulation (EU) 2016/679 ("GDPR") where applicable and the Malaysian Personal Data Protection Act 2010 ("PDPA").
1. Who we are (Data Controller)
The data controller responsible for your personal data is:
- Entity: UNISHOP LLC
- Registered address: 102 Gold Ave SW #399, Albuquerque, NM 87102, United States
- Contact email: contact@unishopllc.net
- Website: https://lumov.io
In this Privacy Policy, "we", "us" and "our" refer to the entity named above. "You" refers to any visitor of the Website.
For the purposes of the PDPA, the entity above acts as the "data user".
2. Scope of this Policy
This Policy applies only to personal data processed through the Website (the LUMOV brochure/lead-generation site). It does not cover:
- any separate commercial agreement, advertiser terms, or partner contract you may sign with us;
- third-party websites linked from our Website (see Section 11).
The Website is a business-to-business informational (brochure) website. It has no user accounts, no online store, no payment processing, and no online transactions.
3. What personal data we collect
We practise data minimisation: we only collect what we need.
3.1 Data you provide directly — Contact form
When you submit our contact form, we collect:
| Field | Type of data |
|---|---|
| Full name | Identification data |
| Company | Professional data |
| Role / job title | Professional data |
| Country | Location (country-level) |
| Message | Free-text content you choose to share |
Please do not include sensitive personal data (e.g. health, religion, political opinions) in the free-text message field — it is not needed and we ask you not to submit it.
3.2 Data collected automatically — Server logs
Like virtually all websites, our server records standard technical logs when a page is requested, which may include:
- IP address;
- browser type and user-agent string;
- date and time of the request and the pages/resources requested.
These logs are used for security, troubleshooting and the proper operation of the Website.
3.3 Anti-spam — Cloudflare Turnstile
To protect the contact form against spam and abuse, we use Cloudflare Turnstile, a privacy-oriented bot-detection service provided by Cloudflare, Inc. When you interact with the form, Turnstile may process technical signals (such as your IP address and limited browser/interaction data) and may set a technical cookie strictly necessary to perform its security check (see Section 9). Turnstile is designed not to be used for advertising or cross-site user tracking.
3.4 Analytics
We currently do not use any web analytics tool, and we do not use advertising or tracking cookies. If, in the future, we add analytics, we intend to use a privacy-friendly, cookieless solution (e.g. Plausible) that does not set tracking cookies and does not identify individual visitors. This Policy will be updated accordingly before any such tool is deployed.
4. Why we use your data and our legal basis
| Purpose | Personal data used | Legal basis (GDPR) |
|---|---|---|
| Respond to your enquiry and follow up on a potential business relationship | Contact form data | Your consent when you choose to submit the form, and/or our legitimate interest (Art. 6(1)(f)) in responding to B2B enquiries and developing our business |
| Operate, secure and troubleshoot the Website | Server logs | Legitimate interest (Art. 6(1)(f)) in the security and integrity of our service |
| Prevent spam and abuse of the contact form | Turnstile signals | Legitimate interest (Art. 6(1)(f)) in protecting our systems |
Under the PDPA, we process your contact-form data on the basis of your submission of the form, which constitutes your consent to be contacted in response to your enquiry, and for the directly related purpose of responding to it.
We will not use your contact details for marketing emails or newsletters without obtaining a separate, clear opt-in from you.
5. We do not sell your data
We do not sell, rent or trade your personal data to third parties. We do not share it for third-party marketing or advertising purposes.
6. Who we share data with (processors and third parties)
We share personal data only with the service providers necessary to operate the Website, and only to the extent needed:
| Recipient | Role | Purpose |
|---|---|---|
| Cloudflare, Inc. | Processor / service provider | Anti-spam protection (Turnstile) for the contact form |
| Our hosting provider — self-hosted on our VPS | Infrastructure | Hosting and serving the Website. The underlying VPS / data-centre provider is Hostinger International Ltd. |
| Email / messaging tools we use to read and reply to enquiries | Processor | Receiving and responding to your message — no third-party email provider is currently used; submissions are stored securely on our own VPS |
We may also disclose personal data where required to do so by law, court order or a valid request from a competent authority.
We require our service providers to process personal data only on our instructions and to apply appropriate security measures.
7. International data transfers
We are based in / operate from the United States. Some of our service providers (in particular Cloudflare) operate globally, which means your personal data may be processed on servers located outside your country, including outside the EU/EEA.
Where personal data of EU/EEA individuals is transferred outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and/or other lawful transfer mechanisms offered by the relevant provider. Cloudflare publishes its own data-protection and transfer documentation, which forms part of the safeguards we rely on.
Under the PDPA, we take reasonable steps to ensure that any cross-border transfer of personal data is consistent with the protection required under Malaysian law.
8. How long we keep your data
We keep personal data only for as long as necessary for the purposes set out above:
| Data | Retention period |
|---|---|
| Contact form submissions | For the duration of the exchange and any resulting business relationship, then up to 24 months after the last meaningful contact, unless a longer period is required by law or to manage a dispute |
| Server logs | Up to 12 months |
| Turnstile technical cookie | Short-lived; see Section 9 |
When the retention period ends, we delete or anonymise the data.
9. Cookies and similar technologies
We keep cookies to the strict minimum:
- We do not use advertising or marketing cookies.
- We do not use third-party tracking cookies.
- Cloudflare Turnstile may set a strictly necessary technical cookie (or use equivalent local storage) solely to perform its bot/spam check on the contact form. This cookie is essential to the security function it serves and is not used for advertising or cross-site tracking.
Because we only use strictly necessary technologies, consent for these is not required under the GDPR/ePrivacy framework. If we later introduce any non-essential cookies or non-essential analytics, we will update this Policy and, where required, request your consent through a compliant cookie banner before they are set.
10. Your rights
10.1 Under the GDPR (if you are in the EU/EEA)
You have the right to:
- access the personal data we hold about you (Art. 15);
- request rectification of inaccurate data (Art. 16);
- request erasure of your data ("right to be forgotten", Art. 17);
- request restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
You also have the right to lodge a complaint with your local supervisory authority (Data Protection Authority).
10.2 Under the PDPA (Malaysia)
You have the right to:
- request access to your personal data;
- request correction of inaccurate, incomplete, misleading or out-of-date data;
- withdraw consent to the processing of your personal data;
- limit the processing of your personal data for direct marketing (note: we do not currently carry out direct marketing through the Website).
10.3 How to exercise your rights
To exercise any of these rights, contact us at contact@unishopllc.net. We will respond within one month (GDPR) and within the period required by the PDPA. We may ask for information to verify your identity before acting on a request.
11. External links
Our Website may contain links to third-party websites (for example, partner pages). We are not responsible for the privacy practices or content of those websites. We encourage you to read their privacy policies.
12. Security
We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss or alteration, including HTTPS encryption in transit, access controls on our server, and use of a reputable anti-abuse service (Turnstile). No method of transmission or storage is perfectly secure, but we work to maintain protection appropriate to the sensitivity of the data we handle.
13. Children
The Website is a B2B service and is not directed at children. We do not knowingly collect personal data from children.
14. Changes to this Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be communicated through the Website.
15. Contact
For any question about this Privacy Policy or about how we handle your personal data:
- Entity: UNISHOP LLC
- Address: 102 Gold Ave SW #399, Albuquerque, NM 87102, United States
- Email: contact@unishopllc.net