This Privacy Policy explains how Up2media B.V. (“Up2media”, “we”, “us”, “our”) collects and processes personal data when you use the LumiTour mobile application and related websites (the “Service”).
If you have questions, contact us at privacy@lumitour.app.
1. Who is the data controller
Up2media B.V.
Registered in The Netherlands (KVK: 08319500)
Registered office:
LumiTour UP2Media Mensinkweg 72a 7442TG Nijverdal, The Netherlands
Email: privacy@lumitour.app
For privacy questions or requests: privacy@lumitour.app.
We are based in the EU and do not require an EU representative. We do not appoint a Data Protection Officer at this time; you can contact us via the email above.
2. What data we collect
We collect the following categories of personal data, depending on how you use the Service:
- Account & contact data: name, email address, password (hashed), organisation, role, preferences.
- User-generated content (UGC): points of interest (POIs), titles, descriptions, photos, audio, routes, ratings, comments, and any metadata you submit.
- Location data: precise or approximate device location with your permission to centre the map and show nearby POIs. We do not track your location in the background for advertising or profiling.
- Device & technical data: device model, OS version, app version, language, country, IP address, time zone, diagnostics (crash logs), and performance events.
- Usage data: interactions with screens and features, timestamps, and general analytics to improve the product (aggregated where possible).
- Support data: information you provide when contacting support (including attachments).
We do not intentionally collect special categories of data (e.g., health, religion). Please do not upload sensitive data about yourself or others.
3. Sources of data
- Directly from you when you create an account, submit POIs or other UGC, or contact support.
- From your device when you grant permissions (e.g., location, camera, microphone, photo library).
- From third-party providers strictly to deliver features, such as Google Maps Platform for maps, geocoding and Places data.
4. Purposes and legal bases (GDPR)
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide and operate the Service | account creation, authentication, show maps & nearby POIs, render your UGC | Contract (Art. 6(1)(b) GDPR) |
| Optional device features | location for map centring/nearby POIs; camera/mic/photo library for uploads | Consent (Art. 6(1)(a)) |
| Improve and secure the Service | diagnostics, crash logs, performance metrics, prevent abuse | Legitimate interests (Art. 6(1)(f)) — our interest in a reliable and secure service |
| Communicate with you | support replies, service notices | Contract or Legitimate interests |
| Legal compliance | tax, accounting, law-enforcement requests | Legal obligation (Art. 6(1)(c)) |
You may withdraw consent at any time (e.g., by disabling location in system settings). This does not affect processing carried out prior to withdrawal.
5. Third-party services and content
The Service displays content and features from third parties, including Google Maps Platform (maps, geocoding, Places). Your use of these features is also subject to the provider’s terms and policies. Those providers may process limited technical and location data to provide their services. We do not control and are not responsible for third-party terms.
We do not sell personal data and we do not use advertising identifiers for tracking across apps.
7. International data transfers
If personal data is transferred outside the European Economic Area (EEA), we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs) and additional measures where necessary. You may contact us for more information or a copy of relevant safeguards.
8. Retention
We keep personal data only as long as necessary for the purposes above:
- Account data: for the life of the account; if you delete your account, we delete or anonymise within 30 days, except where the law requires a longer retention.
- UGC (POIs, media): until you delete it or set it to private; residual backups may persist for up to 90 days.
- Support tickets: up to 24 months after closure.
- Diagnostics & logs: typically 12–24 months in aggregated or pseudonymised form.
We may retain minimal records to comply with legal obligations, resolve disputes, and enforce agreements.
9. Your rights (EU/EEA)
You have the right to request: access, rectification, erasure, restriction, objection (including to processing based on legitimate interests), and data portability. Where processing is based on consent, you can withdraw consent at any time.
To exercise your rights, email privacy@lumitour.app. We may need to verify your identity. You also have the right to lodge a complaint with your local supervisory authority. In The Netherlands, this is the Autoriteit Persoonsgegevens.
10. Children
The Service is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child provided personal data, contact us so we can delete it.
11. Security
We implement technical and organisational measures appropriate to the risk, including encryption in transit (TLS), access controls, least-privilege, monitoring, and regular backups. No method of transmission or storage is 100% secure.
13. User-generated content and sharing
If you choose to publish POIs or other content publicly, it may be visible to other users. Do not share personal data of others without a lawful basis and consent. You are responsible for the content you upload. We may remove content that violates these terms or the law.
You can delete your content at any time in the app. Deleted content may remain in backups for a limited time (see Retention).
14. Automated decision-making
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you.
15. Changes to this Policy
We may update this Policy from time to time. We will post the updated version in the app or on our website and update the “Last updated” date. If changes are material, we will provide additional notice where required by law.
16. Contact
Up2media B.V. Mensinkweg 72a 7442TG Nijverdal, The Netherlands
Email: privacy@lumitour.app
If you are not satisfied with our response, you can lodge a complaint with your local data protection authority (in the Netherlands: Autoriteit Persoonsgegevens).
Need an offline copy? You can download the PDF version here: LumiTour_Privacy_Policy.pdf
Contact Us
Have questions or suggestions? We’d love to hear from you.
Email: info@lumitour.app
Privacy inquiries: privacy@lumitour.app