Privacy Policy

1. Introduction

LUMO PRIVEE SRL, with registered office at Via San Senatore 8, 20122 Milan, Italy (VAT no. 12864230961) (“Lumo”, “we”, “us”), acts as Data Controller with respect to the personal data processed in connection with its educational and consultancy services. This Privacy Notice explains how we collect, use, store, and protect personal data, and the rights of individuals under Regulation (EU) 2016/679 (“GDPR”). For any questions regarding this Privacy Notice or the processing of personal data, you may contact us at: admin@lumo-edu.com

2. Definitions

• Users: students to whom we provide tutoring, educational or admissions consultancy services.
• Parents / Guardians: parents or individuals exercising parental responsibility over Users.
• Personal Data: any information relating to an identified or identifiable natural person.
• Services: the educational, tutoring and consultancy services provided by Lumo.

3. Categories of Personal Data

We may collect and process personal data relating to Users, Parents/Guardians, tutors, employees, and prospective clients, including:

• Identification and contact details (name, email, phone number, address, nationality, tax code)
• Educational and academic information (school attended, grades, assessments, transcripts, exam results)
• Administrative and billing data (invoices, payments, bank details)
• Communications (emails, messages, notes related to the Services)

Special category data

Where strictly necessary to provide appropriate educational support, we may process limited special category data, such as information relating to learning disabilities or specific educational needs. Such data is processed with appropriate safeguards and only for educational purposes.

4. Methods of Data Collection

Personal data may be collected:

• directly from Users or Parents/Guardians;
• through contracts, intake forms, correspondence, and communications;
• via third parties such as schools or professionals involved in the educational process;
• via publicly available sources, where relevant.

5. Legal Basis for Processing

Personal data is processed on one or more of the following legal bases:

• Performance of a contract or pre-contractual measures;
• Consent, where required (particularly for special category data);
• Legitimate interests related to delivering and improving our services, provided such interests do not override data subject rights;
• Compliance with legal obligations.

6. Processing Methods and Security

Personal data is processed using electronic and manual means, in compliance with GDPR principles of lawfulness, fairness, transparency, and data minimisation. We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. Access to data is limited to authorised personnel only.

7. Data Storage and Retention

Personal data is stored on secure servers and cloud-based tools used for business operations, including internal management and communication platforms. Data is retained for up to ten (10) years from the end of the contractual relationship or last relevant interaction, unless a longer retention period is required by law. After this period, data is deleted or anonymised.

8. Purposes of Processing

Personal data is processed for the following purposes:

• providing tutoring, educational and admissions consultancy services;
• communicating with Users and Parents/Guardians regarding services and progress;
• organising lessons and academic activities;
• managing administrative, accounting, and billing obligations;
• complying with legal and regulatory requirements;
• sending information about services, events, or initiatives (where permitted).

9. Cookies and Online Tracking

Our website does not use profiling or marketing cookies. Any technical cookies strictly necessary for website functionality may be used.

10. Data Sharing and Processors

We do not sell personal data. Personal data may be shared with third-party service providers acting as data processors solely for the purposes described above, including:

• IT and cloud service providers (e.g. internal management tools);
• communication platforms (e.g. messaging and email services);
• professional advisors (e.g. accounting and payroll).
Where data is transferred outside the European Economic Area, appropriate safeguards are adopted in accordance with GDPR.

11. Data Subject Rights

Data subjects have the right to:

• access their personal data;
• request rectification or updating;
• request erasure;
• request restriction or object to processing;
• request data portability;
• lodge a complaint with the competent data protection authority.
Requests may be submitted to admin@lumo-edu.com. We will respond in accordance with applicable law.

12. Updates

This Privacy Notice may be updated from time to time. The most recent version will always be available on our website.