01
Data controller
The website luminaverseagency.com is operated by Luminaverse, a sole proprietorship (entreprise individuelle) run by Juliette Nanchino, registered under SIREN 887 558 468, with its registered office at REGISTERED_ADDRESS, France.
Luminaverse acts as data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the “GDPR”) for all personal data collected in the course of its activity and through this website.
Given its size and the nature of its processing activities, Luminaverse is not required to appoint a data protection officer and has not done so. Any request relating to personal data may be sent to [email protected].
02
Scope
This policy describes how Luminaverse processes personal data when you:
- browse luminaverseagency.com;
- complete a contact form or book an appointment;
- correspond with Luminaverse by email;
- interact with its official social media accounts;
- are contacted as part of a commercial approach.
It applies to clients, prospects, partners, applicants and professional visitors. It supplements the terms and conditions of sale and the legal notice.
03
Data collected and sources
Data you provide
- identity — first name, last name;
- professional contact details — email address, telephone number;
- company and job title;
- the content of your messages and enquiries;
- booking information — time slot, time zone, answers to the form questions, including estimated budget.
Data collected automatically
- cookie and tracker identifiers, subject to your choices;
- technical logs — IP address, timestamp, device and browser type;
- records of consent and withdrawal.
Data from third-party sources
As part of its professional outreach, Luminaverse may collect publicly available business contact details, in particular from corporate websites and professional social networks. Data subjects are informed of this at first contact, in accordance with Article 14 of the GDPR.
Data not collected
Luminaverse does not knowingly collect data falling within the special categories referred to in Article 9 of the GDPR, nor data concerning minors. Whether a field is mandatory or optional is indicated in each form; if mandatory fields are left blank, the request cannot be processed.
04
Purposes and legal bases
Data is processed for specified, explicit and legitimate purposes, and limited to what is necessary.
| Purpose | Data | Legal basis |
|---|
| Handling enquiries and first contact |
Identity, job title, contact details, message content |
Pre-contractual steps — Art. 6(1)(b) |
| Appointment booking |
Identity, email, time zone, form answers |
Pre-contractual steps — Art. 6(1)(b) |
| Performance of the contract and invoicing |
Identity, contact details, billing data |
Performance of a contract — Art. 6(1)(b) |
| Accounting and tax obligations |
Invoices, supporting documents |
Legal obligation — Art. 6(1)(c) |
| Professional outreach |
Identity, business contact details, job title |
Legitimate interests — Art. 6(1)(f) |
| Audience measurement and site improvement |
Cookie identifiers, page views, events, truncated IP address, device type |
Consent — Art. 6(1)(a) |
| Display of embedded third-party content |
Tracker identifiers set by the provider |
Consent — Art. 6(1)(a) |
| Security, maintenance, fraud prevention |
Server logs, IP address, timestamp |
Legitimate interests — Art. 6(1)(f) |
Luminaverse does not sell or rent your personal data. Where possible, data is aggregated or anonymised.
05
Commercial prospecting
Luminaverse addresses professionals. In line with the guidance of the French data protection authority (CNIL), electronic prospecting sent to a business email address, relating to products or services connected with the recipient's professional role, is based on Luminaverse's legitimate interest in developing its activity.
At first contact, the recipient is informed of the source of their contact details, the identity of the controller and their right to object.
You may object at any time and without giving reasons to receiving commercial communications, either through the unsubscribe link included in every message or by writing to [email protected]. Objections are actioned without delay.
Where the recipient is a natural person acting outside their professional activity, electronic prospecting is carried out only with their prior consent.
06
Use of artificial intelligence
Luminaverse's activity relies on generative artificial intelligence systems for the production of visual content.
These systems do not process personal data relating to visitors of this website. Materials submitted by a client in the context of a project are used solely for the purpose of performing the engagement.
Luminaverse does not contribute any personal data to third-party model training datasets, and favours tools whose terms of use exclude the reuse of submitted content for training purposes.
Where a project involves the processing of images depicting identifiable individuals, a specific written agreement is concluded with the client, who warrants that it holds the necessary authorisations.
07
Cookies and trackers
On your first visit, a consent banner — Real Cookie Banner, published by devowl.io — allows you to accept, refuse or customise the placement of trackers.
Only cookies strictly necessary for the operation of the website are placed without your consent. All others, including audience measurement cookies and trackers set by embedded third-party content, are activated only after explicit consent.
Audience measurement
Luminaverse uses Google Analytics 4, provided by Google Ireland Limited, to understand website traffic and improve its content. This processing is based solely on your consent, collected through the banner, and is activated only thereafter.
IP addresses are truncated before storage. Advertising and remarketing features are disabled. Data is neither combined with other services nor used for advertising targeting.
Luminaverse uses no advertising tracking or retargeting tools.
Your choices
You may change your preferences at any time via the “Manage cookies” link in the site footer. Withdrawing consent is as straightforward as giving it.
Records of consent and withdrawal are retained for six (6) months, in line with CNIL recommendations.
08
Recipients and processors
Access to data is strictly limited to authorised persons within Luminaverse and to its technical providers, to the extent necessary for their assignment.
| Provider | Role | Location |
|---|
| OVH SAS | Website hosting | France |
| Calendly LLC | Appointment booking | United States |
| devowl.io GmbH | Consent management | Germany |
| Google Ireland Limited | Audience measurement — Google Analytics 4 | Ireland · United States |
Each processor acts solely on Luminaverse's documented instructions, for defined purposes, and provides sufficient guarantees within the meaning of Article 28 of the GDPR.
Data may also be disclosed to Luminaverse's advisers — accountant, legal counsel — and to administrative or judicial authorities where required by law.
09
Transfers outside the European Union
Some providers, in particular Calendly and Google, are established in the United States or transfer data there. Such transfers are governed by one of the mechanisms provided for in Chapter V of the GDPR:
- the adequacy decision of 10 July 2023 concerning the EU–US Data Privacy Framework, where the provider is certified under it;
- failing that, the standard contractual clauses adopted by the European Commission, together with supplementary measures.
A copy of the safeguards in place may be obtained on request at [email protected].
10
Retention periods
| Category | Period |
|---|
| Prospects and enquiries without follow-up | 3 years from last contact |
| Clients — management data | Duration of the contractual relationship |
| Accounting records and invoices | 10 years (Art. L. 123-22 French Commercial Code) |
| Records of consent | 6 months |
| Security logs | 12 months |
| Audience measurement cookies | 13 months maximum |
| Aggregated audience data | 14 months |
Upon expiry of these periods, data is deleted or irreversibly anonymised.
11
Security
Luminaverse implements technical and organisational measures appropriate to the risks:
- encryption of communications via HTTPS;
- hosting within the European Union;
- access control and restriction, strong authentication;
- regular backups;
- logging and monitoring of security events;
- firewall protection and application updates.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, the CNIL is notified within seventy-two (72) hours and, where the risk is high, the data subjects are informed without undue delay.
12
Automated decision-making and profiling
No decision producing legal effects concerning you, or similarly significantly affecting you, is taken on the basis of solely automated processing.
Simple segmentation of contacts may be carried out for commercial organisation purposes. It does not constitute profiling within the meaning of Article 22 of the GDPR and has no significant consequences.
13
Your rights
In accordance with Articles 15 to 22 of the GDPR and French Act No. 78-17 of 6 January 1978 as amended, you have the following rights:
- right of access to your data;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to object, in particular to commercial prospecting;
- right to data portability;
- right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand;
- right to issue directives regarding the fate of your data after your death.
These rights may be exercised at [email protected]. Where there is reasonable doubt as to your identity, proof of identity may be requested.
Luminaverse responds within one (1) month of receiving the request, extendable by two (2) further months where the request is complex or where a high number of requests is received.
You also have the right to lodge a complaint with the French data protection authority — Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — or at cnil.fr.
14
Social media and third-party content
Luminaverse maintains a presence on LinkedIn, Instagram, TikTok, Discord and WeChat. Processing carried out by these platforms is governed by their own privacy policies, over which Luminaverse has no control.
Where Luminaverse jointly determines with a platform the purposes of processing page statistics, joint controllership may exist within the meaning of Article 26 of the GDPR. The arrangements are defined by the platform concerned.
Certain third-party content embedded in the website, in particular the booking module, may set trackers. These are activated only after your consent.
15
External links
The website may contain links to third-party sites. Luminaverse has no control over their content or their personal data practices and accepts no liability in this respect. You are invited to consult their respective policies.
16
Hosting
The website is hosted by OVH SAS, a simplified joint-stock company with share capital of €50,000,000, registered with the Lille Métropole Trade and Companies Register under number 424 761 419 00045, APE code 2620Z, intra-Community VAT number FR 22 424 761 419, whose registered office is at 2 rue Kellermann, 59100 Roubaix, France — ovhcloud.com.
OVH SAS is a subsidiary of OVH Groupe SA, registered with the Lille Trade and Companies Register under number 537 407 926.
17
Changes to this policy
This policy may be amended at any time to reflect changes in processing activities, tools used or applicable legislation. The version that applies is the one published on this page on the date of your consultation.
In the event of a material change, data subjects are informed by any appropriate means.
18
Contact
For any question relating to this policy or to your personal data:
Luminaverse — Data Protection
[email protected]
REGISTERED_ADDRESS, France
