Privacy policy

1. Who handles your data

For any question or request about your personal data, write to [email protected]. A person answers, not an automated form.

Controller

FALKEM SWISS Sagl, operating under the trading name Lume Studio

Registered office

Piazza Indipendenza 3, CH-6830 Chiasso, Switzerland

UID/VAT

CHE-190.276.060 IVA

Privacy email

[email protected]

2. Which law applies

The primary framework is the Swiss Federal Act on Data Protection (FADP).

The European GDPR applies when the territorial conditions in Article 3 are met, for example when we offer services to people located in the European Union. Where it applies, the rights described in section 9 apply in addition.

3. What data we collect

When you write from the Contact form

Your first and last name, your business, the kind of project you are looking for, your message, and the contact detail you choose yourself: email or phone. When you confirm, the form sends the enquiry directly to Lume Studio. We treat it as received only when the site confirms acceptance.

When you write by email

The sender address, the subject, the content of the message and any attachments.

When you browse the site

The technical data every website receives in order to work: IP address, date and time, page requested, browser and device type. It is used to deliver the pages and to protect the site from abuse.

Your cookie choice

It stays in your browser’s local storage under the key "lume-consent-v1". It is not a tracking cookie and it never leaves your device: it only saves us from asking again on every visit.

Site statistics

If you leave the "Statistics" category on, Cloudflare Web Analytics collects aggregate measures of page views and traffic sources without using cookies.

When you become a client

Project and business details, written approvals, correspondence and billing data. The materials you hand over stay yours.

When you pay

When a website-package invoice is validly issued, it states the verified payment details and the payment method applicable to that invoice.

4. Why we process it

• Answering your request, understanding the project and preparing a quote.
• Running the project and our relationship with you: communication, approvals, delivery and support.
• Remembering the cookie choice you made, in your browser.
• Understanding in aggregate how the site is used, so we can improve it.
• Keeping the site running and protecting it from abuse.
• Issuing invoices and meeting Swiss accounting and tax obligations.

5. On what basis

Swiss law requires processing to be lawful, proportionate, transparent and secure, and the data to be accurate. We collect only what the purposes above require, and nothing beyond that.

Where the GDPR applies, the legal bases are these:

• pre-contractual steps and performance of the contract, for your request and for the project (Art. 6(1)(b));
• our legitimate interest in keeping the site running and secure (Art. 6(1)(f));
• your consent, for statistics and any non-essential tool, which you can withdraw at any time (Art. 6(1)(a));
• legal obligations, for invoices and accounting records (Art. 6(1)(c)).

6. How long we keep it

Enquiries that do not become a project

After confirmed delivery, the enquiry content remains in the D1 database for no more than 30 days. The related operational metadata remains for 90 days. Content for unresolved enquiries remains in D1 during delivery attempts and is deleted within 24 months after receipt. If the person does not become a client, the HubSpot contact and related enquiries are deleted or anonymized within 24 months after the last substantive contact, unless a legal duty or a documented need to defend a claim requires longer retention.

Clients

Working files remain for the project and are returned or deleted from copies controlled by Lume within 90 days after handover, unless the client instructs otherwise or law requires retention. The order, approvals, changes, handover and minimum relationship evidence are kept for 10 years after the relationship ends.

Invoices and accounting records

10 years, as the Swiss Code of Obligations requires.

Your cookie choice

It stays in your browser until you change it or clear the site data.

Technical data and statistics

Operational form metadata remains in D1 for 90 days. Cloudflare Web Analytics keeps unsampled data for 7 days and makes aggregate statistics for the previous 6 months available. We do not create a permanent local copy of those statistics.

7. Who we entrust your data to

We work with a small set of selected providers to run the site, communications and payments. The list below explains what data they receive and for what purpose. We do not sell your data and we do not use it for third-party advertising.

Beyond the providers listed below, your data reaches only our accounting adviser or a lawyer where needed, and the authorities where the law requires it.

Cloudflare

Delivery and hosting of the site, protection against attacks, and cookieless aggregate statistics. Cloudflare receives the form enquiry through a site function, stores it temporarily in the EU-jurisdiction D1 database, and delivers it through a queue and dedicated process.

Hostpoint

Email for [email protected], so the messages you send us and our replies.

HubSpot

HubSpot receives the contact and enquiry data to centralize its management and follow the project from the first message to delivery.

GitHub

Version control and website deployment automation. It may receive code, content and assets intended for the website; form enquiries, passwords and full payment details remain outside the code archive.

Wise

Receipt and reconciliation of website-project invoices, only when the invoice identifies a verified Wise account.

8. Transfers outside Switzerland

The Cloudflare D1 database used for the form has EU jurisdiction. The HubSpot EU account is primarily hosted in Germany.

For transfers to countries without a Swiss adequacy decision, the DPAs and other applicable standard contractual documents of Cloudflare, HubSpot and GitHub provide, depending on the processing, for the Swiss–US Data Privacy Framework for certified organizations in the United States and/or standard contractual clauses adapted to the FADP. Wise processes payment data under its privacy notice and applicable regulatory duties; providers may involve other countries listed in their current subprocessor lists.

9. Your rights

You can ask whether we process data about you and obtain a copy of it, have it corrected or deleted where the legal conditions are met, and withdraw at any time a consent you gave, for example the one covering statistics.

Where the conditions of Article 28 FADP are met, you can ask for your data to be handed over or transmitted in an electronic format. Where the GDPR applies, restriction, objection, portability and a complaint to the competent authority apply in addition.

Write to [email protected]: we answer within 30 days. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).

10. Security

We protect data with measures proportionate to the systems we control: encrypted connections, secrets kept separate from public code, collection limited to necessary fields and revocable access. For external services, we use the controls available in the relevant account and limit the data sent to the stated purpose.

No system is completely secure and we cannot guarantee provider continuity. Where a personal data breach is likely to result in a high risk to the personality or fundamental rights of affected persons, we notify the FDPIC as soon as possible. We also inform the affected person when this is necessary for their protection or required by the FDPIC.

11. Changes and contact

The date at the top of the page identifies the published version of this policy. If we add a tool, a provider or a new purpose, we update this policy before switching it on and, where consent is required, we ask you for it.

For any question: [email protected].