Privacy Policy

The company responsible for this website and the Lumzi services is Konkan Technologies Private Limited, Mhasla, Raigad, Maharashtra, India. We play two different roles, depending on the data:

• Data we decide about.For data about visitors to this website, people who contact us, and the people who hold and pay for customer accounts, we decide why and how the data is used. We are the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the “controller” under the EU and UK GDPR and the “controller” under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, PDPL).
• Data our customers put into Lumzi.When a school, training provider or company uses Lumzi, it decides what personal data goes into its workspace (for example students, parents, staff, learners, employees or IT users) and why. That customer is the data fiduciary or controller. We are its “data processor” (or “processor”) and use that data only to provide the services, on the customer’s instructions and under our Terms of Service and any data processing agreement we sign with the customer.

If you are a student, parent, staff member or learner and your organisation uses Lumzi, please contact that organisation first about your data. We will help it respond and will pass on any request we receive.

• Enquiries and demos: name, email, phone or WhatsApp number, organisation, role and what you write to us.
• Customer accounts: name, work email, organisation, sign-in details, role and settings of workspace users.
• Billing: billing contact, plan, invoices and payment status. Card, UPI and bank details are entered with our payment provider (Razorpay) and are not stored by us.
• Technical and usage data: IP address, browser and device type, pages and features used, and security and error logs.
• Workspace data (as processor): whatever the customer loads. In Lumzi SMS this can include student and parent records, admissions, attendance, marks, fees and messages; in Lumzi LMS, learner progress, submissions and certificates; in Lumzi ITops, employee, asset and ticket records.

We do not ask for sensitive data such as passwords in plain text, health or biometric data through this website. If a customer chooses to store such data in its workspace, it is responsible for having a lawful basis to do so.

• To reply to enquiries and arrange demos (your consent, or steps you ask us to take before a contract).
• To provide, secure, support and improve the services (performance of our contract with the customer; legitimate interests in running a safe and reliable service).
• To bill customers and keep accounts (contract; legal obligation).
• To send service and security messages (contract; legitimate interests).
• To send product news, only if you have agreed. You can opt out at any time (consent).
• To comply with law, respond to lawful requests and protect our rights (legal obligation; legitimate interests).

India:we process personal data with your consent given after this notice, or for a “legitimate use” allowed by section 7 of the DPDP Act (for example where you voluntarily give us your details for a specific purpose, or to comply with law). You may withdraw consent at any time by emailing konkantechnology@gmail.com; this does not affect processing already done, and we may then be unable to provide a service that depends on it. EU and UK: the legal bases are those shown in brackets above (Article 6 GDPR / UK GDPR). UAE: we rely on consent or another lawful ground set out in the PDPL.

We do not sell personal data, and we do not use workspace data for advertising.

This website and our sales process are meant for adults acting for their organisations. We do not knowingly collect personal data from children through this website.

Lumzi SMS and Lumzi LMS may be used by schools and training providers to manage data about children (under the DPDP Act, anyone under 18). In that case:

• the school or institution is the data fiduciary and is responsible for giving notice and obtaining verifiable consent from a parent or lawful guardian where the DPDP Act and its Rules require it (or for relying on an exemption that applies to it);
• Lumzi is the data processor and processes the data only to provide the service to that institution;
• we do not use children’s data for tracking, behavioural monitoring or targeted advertising, and we do not sell it or use it to build marketing profiles;
• Lumzi SMS includes consent records and an audit log to help schools meet these duties.

Parents and students should send requests about a student’s data to the school. If you contact us, we will forward the request to the school and support it.

Some features use artificial intelligence (AI), for example drafting replies, building course outlines or answering questions from a workspace’s own documents. AI features are optional and the customer decides whether to turn them on. When used, the relevant text is sent to an AI model provider (such as Anthropic or OpenAI, and Voyage AI for search embeddings in Lumzi ITops). Where the customer supplies its own provider key, the customer’s agreement with that provider also applies. We do not use workspace data to train AI models. AI output is a suggestion for a person to review; see the Terms of Service.

We use carefully chosen providers who process data for us under written terms. Which ones apply depends on the product and how the customer configures it:

• Vercel: website and application hosting, serverless functions and file storage.
• Cloudflare: domain name (DNS) and network services, and file storage for Lumzi LMS.
• Neon or another managed PostgreSQL provider: database hosting.
• Razorpay: payment processing for India and international payments.
• Clerk: sign-in and organisation accounts for Lumzi LMS.
• Background-job, rate-limiting and email-delivery providers (for example Inngest, Upstash and an email service or SMTP server): to run scheduled tasks, protect sign-in pages and send service emails.
• AI model providers (Anthropic, OpenAI, Voyage AI): only when AI features are switched on (see section 5).

A customer may also connect its own services, such as an SMS or WhatsApp messaging provider, a payment gateway for collecting school fees, or Microsoft Entra ID for sign-in. Those services act for the customer under the customer’s own agreement with them. We may also disclose data if the law requires it, or to protect the rights, property or safety of people or of Lumzi. If we sell or reorganise our business, data may pass to the new owner under this policy. An up-to-date list of sub-processors is available on request.

We are based in India and our providers may process data in India, the United States, the European Union and other countries. Under the DPDP Act, we will not transfer personal data to any country the Government of India restricts. For personal data from the EU or UK we rely on safeguards such as the European Commission’s standard contractual clauses and the UK International Data Transfer Addendum, or on our providers’ own approved transfer mechanisms. For the UAE we follow the transfer conditions in the PDPL. Ask us for details or a copy of the relevant safeguards.

• Enquiries that do not lead to a contract: up to 24 months after our last contact, unless you ask us to delete them sooner.
• Customer account data: for the life of the subscription and then as set out below.
• Workspace data: while the subscription is active. After it ends, the customer has 30 days to export its data; we then delete it from our live systems, and backup copies are overwritten in their normal cycle.
• Invoices and accounting records: for at least eight years, as Indian company law requires.
• Security and access logs: for at least one year where the law requires, and otherwise only as long as needed for security.

After these periods we delete or anonymise data, unless the law requires us to keep it longer.

We follow reasonable security practices and procedures, as required by the Information Technology Act, 2000 and the rules made under it, including encryption of data in transit, separation of each customer’s data, role-based access controls, encrypted storage of customer-supplied keys and credentials, and audit logs. Our providers encrypt stored data. No system is completely secure. If a personal data breach occurs, we will act quickly to contain it and will inform affected customers, individuals and authorities (such as the Data Protection Board of India) as the law requires. Where we act as processor, we will tell the customer without undue delay so it can meet its own duties.

Depending on where you live, you can ask us to:

• give you a summary of the personal data we hold about you, how we use it and who we have shared it with;
• correct, complete or update it;
• erase it, where we no longer need it or the law allows;
• withdraw your consent at any time;
• under the DPDP Act, nominate another person to exercise your rights if you die or become unable to do so;
• under GDPR / UK GDPR, also restrict or object to processing (including direct marketing at any time) and receive your data in a portable format;
• have a grievance about our handling of your data resolved.

Email konkantechnology@gmail.com to use any of these rights. We may need to verify your identity. We will reply as soon as we can and within the time the applicable law allows (for example, one month under GDPR).

If you are not satisfied, you can complain to a regulator: in India, the Data Protection Board of India (after first using our grievance process); in the UK, the Information Commissioner’s Office (ICO); in the EU, your local data protection authority; in the UAE, the UAE Data Office.

This website (lumzi.io) does not use analytics, advertising or tracking cookies. The Lumzi applications use strictly necessary cookies and browser storage to keep you signed in, protect against misuse and remember settings; these cannot be switched off without breaking sign-in. Our hosting and network providers keep standard server logs. If we add analytics or marketing cookies, we will update this policy first and ask for your consent where the law requires.

For any question, request or complaint about privacy or personal data, contact our Grievance Officer (who also handles data protection enquiries):

• Grievance Officer, Konkan Technologies Private Limited
• Address: Mhasla, Raigad, Maharashtra, India
• Email: konkantechnology@gmail.com

We will acknowledge your grievance within 48 hours and aim to resolve it within one month, and in any case within the period set by law. A data processing agreement (DPA) for customers, including one based on the EU standard contractual clauses for GDPR customers, is available on request at the same address.

We may update this policy when our services or the law change. We will post the new version on this page with a new “Last updated” date and, for significant changes, tell customers by email or in the product.