1. Who we are
Lumus Assessoria Publicitaria Ltda, trading as LUMUS Company, registered under CNPJ No. 43.873.616/0001-80, headquartered at Rua Padre Anchieta, 2050, conjunto 603, Bigorrilho, Curitiba/PR, CEP 80730-000, is the controller of the personal data processed on this website, except when another role is specifically informed.
Data Protection Officer (DPO): dpo@lumus.company. Privacy requests: compliance@lumus.company. Legal contact: juridicolumus@biomebr.com.
2. Data we may collect
- Voluntarily provided data, such as name, email, phone, company, role, and the content of messages or forms.
- Technical and security data, such as IP address, date and time of access, device identifiers, browser, operating system, event logs, and signs of malicious activity.
- Navigation and interaction data, such as pages visited, traffic source, clicks, scrolling, time spent, campaigns, and visual interaction with the screen.
- Cookie, advertising, and consent preferences, including the date, time, and version of the accepted notice.
- Commercial relationship data entered into CRM or operational tools after contact with LUMUS.
3. Purposes and legal bases
- To respond to contacts, prepare proposals, and execute pre-contractual measures requested by the data subject.
- To execute contracts and provide consulting, marketing, branding, and communication services.
- To comply with legal or regulatory obligations and exercise rights in legal proceedings.
- To prevent fraud, incidents, and attacks, including through IP analysis and technical logs, based on legitimate interest and infrastructure protection.
- To produce statistics and improve the website and services, subject to consent when the technology is not strictly necessary.
- To customize advertising, measure campaigns, and build audiences, subject to specific consent.
- To share data with partners for offers or commercial purposes, including for remuneration, only after free, informed, unequivocal, specific, and prominent consent. The use of the website or general acceptance of this Policy does not substitute this consent.
4. Cookies and tracking technologies
We use strictly necessary cookies and, after the user's choice, analytics, marketing, and advertising cookies. Google Analytics, Meta Pixel, and Wix's click or screen analysis technologies may associate events with online identifiers.
Non-essential cookies must remain disabled until consent is manifested. The user can refuse or revoke their choice through the preference manager, when available, through browser settings, or via email at compliance@lumus.company, without prejudice to essential functions.
5. Processors, suppliers, and recipients
- Amazon Web Services — AWS: infrastructure, hosting, and cloud storage, with encryption and security controls applicable to the contracted services.
- Google Analytics: audience, device, navigation, traffic source, and website interaction metrics.
- Google Sheets: operational support and organization of information authorized by LUMUS.
- Meta Pixel: campaign measurement, audience creation, and advertising, when authorized.
- Replit: development infrastructure, technical provisioning, and operational analysis of the site.
- Wix: real-time analysis tools, clicks, and visual interaction or session recording, when enabled and consented.
- LUMUS proprietary CRM: contact management, relationship history, opportunities, and requests.
6. Devir and BME
Devir Tecnologia do Futuro Ltda, CNPJ 44.692.294/0001-29, acts in the processing and technical operation of the website on behalf of LUMUS, and may receive, organize, transmit, and make information available in accordance with documented instructions and applicable security measures.
Bme - Administracao, Incorporacao e Assessoria de Propriedades LTDA, CNPJ 59.240.559/0001-31, the parent company of LUMUS, may receive information for governance, administration, security, auditing, and corporate support. It will be the controller when deciding its own processing purposes and a processor when acting exclusively under LUMUS's instructions.
We do not authorize processors to use data for their own incompatible purposes. Commercial sharing with partners requires specific consent and the identification or indication of the categories of recipients before the user's choice.
7. International transfer
Global suppliers, especially AWS, Google, Meta, Replit, and Wix, may process data outside Brazil. LUMUS will adopt mechanisms permitted by the LGPD and the ANPD's regulations, as well as contractual and security measures appropriate to the risk.
8. Security and retention
We adopt technical and administrative measures proportionate to the risks, including applicable encryption in transit and storage, access control, activity logs, and security monitoring. No environment is entirely immune to incidents.
Data is kept for the period necessary for the informed purposes, compliance with legal obligations, defense of rights, and contractual terms. After that, they will be deleted or anonymized, except in the case of a legal requirement for retention.
9. Data subject rights
Under the LGPD, the data subject may request confirmation of processing, access, correction, anonymization, blocking, deletion, portability when regulated, information about sharing, review of automated decisions, revocation of consent, and information about the consequences of refusal. Requests can be sent to dpo@lumus.company or compliance@lumus.company. We may request proof of identity.
10. Children and adolescents
The website is intended for people over 18 years of age and does not seek to intentionally collect data from children. If we identify inappropriate processing, we will take measures to interrupt it and delete the data, observing legal obligations.
11. Updates and legislation
This Policy may be updated to reflect legal, technical, or operational changes. Relevant changes will be highlighted on the website. Law No. 13,709/2018 (LGPD), Law No. 12,965/2014 (Marco Civil da Internet), Law No. 8,078/1990 (Consumer Defense Code), where applicable, and other applicable Brazilian standards apply.