Last updated 4 October 2026
Luume Labs keeps the information our clients give us so that we can agree work with them, sign agreements, send invoices and be paid. This notice says what we keep, why, for how long, who else sees it, and what you can ask of us.
Who we are
Luume Labs Ltd, registered in Northern Ireland, company number NI744123. Registered office: Forsyth House, Cromac Square, Belfast BT2 8LA. Registered with the Information Commissioner's Office, number ZC262237.
We decide how this information is used, so we are its controller. Write to us about it at billing@luumelabs.com.
What we keep, and why
Who you are and how to reach you. Your name, your role, the business you act for, its address, and your email address. We use them to prepare and send your agreement, invoices and documents, and to write to you about them.
Lawful basis: our contract with you, or the steps before it, when you are the client yourself; our legitimate interest in dealing with our client's people when you act for a business.
When you sign. The name you type, the role you give, the time, the internet address and the browser your signature came from, and the email address the signing link was sent to. We keep them so that you and we can show who signed what, and when.
Lawful basis: our legitimate interest in being able to prove an agreement, and in bringing or defending legal claims.
Invoices and payments. What is owed, what was paid, how and when. When you pay by bank transfer, the name and reference your bank sends with the payment, so that we can match it to your invoice.
Lawful basis: our contract, and the law, which requires us to keep accounting records.
Card payments. Your card details go straight to our payment provider. We never see or keep your card number.
Signing in to your documents. Your email address; a link that works once, for 24 hours; a session that ends after 30 minutes without use, and after 8 hours at most; and a scrambled form of your internet address for two hours, and of your email address for two days, to limit how often links can be asked for.
Lawful basis: our legitimate interest in keeping your documents secure.
Emails we send you. A record that each one went, and when.
Lawful basis: our legitimate interest in knowing what we have told you.
We do not use any of it for marketing, and we make no decisions about you by automated means.
How long we keep it
- Signed agreements and their signing records: 7 years after the agreement ends, or after its last invoice if that is later.
- Agreements that were never signed: 3 years after the offer was withdrawn or ran out.
- Invoices, payments and accounting records: 6 years after the end of the financial year they belong to, as the law requires.
- Our record of changes made to agreements and invoices: 7 years.
- Sign-in links: 24 hours. Sessions: 8 hours at most.
When a period ends, we delete the information from our own systems. Our payment provider keeps its own record of each payment, as the law requires of it, and invoices and payments stay in our accounting records for as long as we must keep our accounts.
Who else sees it
Only the providers who run parts of the service for us, each under a contract that lets them use it for us and for nothing else: our payment provider, our accounting software provider, and the providers of our cloud hosting and our email. We do not sell it or share it with anybody else, unless the law requires us to.
Some of these providers may handle information outside the UK. Where they do, it is protected by the UK's adequacy regulations or by the Information Commissioner's international data transfer agreement or addendum.
How we keep it safe
It is encrypted when it travels and when it is stored, and the personal and commercial details in our records are encrypted again, field by field, with keys we control. Only the people who need it to do the work for you can reach it.
Your rights
You can ask us for a copy of the information we hold about you; to correct it; to delete it, unless the law requires us to keep it; to limit how we use it; to object to a use that relies on our legitimate interests; and, for information you gave us under a contract, to have it in a form you can take elsewhere. Ask at billing@luumelabs.com. We answer within a month.
Complaints
If you are unhappy with how we have used your information, please tell us first, so that we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes
When this notice changes, the date at the top changes with it.