lumi — Privacy Notice

Version 1.1 · Effective 3 September 2026

This notice explains, in plain English, what personal data lumi processes, why, and the rights you have.

Who we are

lumi ("we") is a service operated by Lumi HR Ltd, a company registered in England and Wales, company number 17063359, registered office 6 Chestnut Close, Ampthill, MK45 2PU, United Kingdom. For the personal data described here, Lumi HR Ltd is the data controller. You can reach us at dpo@lumihr.co.uk.

What we collect

• Account data — your name, work email, organisation, and role. Used to sign you in, set your permissions, and contact you about the service.

• Organisation profile — benign firmographic facts about your employer (sector, size, region, ownership). Used to place you in the right peer groups. This is organisation-level information, not personal data.

• Benchmark submissions — your organisation's reward data. This is organisational, not personal; it is never published in a way that can identify a single organisation (see the suppression rule in How lumi works → How the numbers are calculated).

• Usage data — basic logs needed to run and secure the service.

What we do not do

We do not sell personal data. We do not use your data to train third-party models. We do not publish any peer figure that rests on fewer than the suppression floor of organisations.

Lawful basis

Account and usage data: our legitimate interest in providing and securing the service, and performance of our contract with your organisation. Marketing contact, where applicable, rests on consent you can withdraw at any time.

AI-assisted analysis (AI Insights)

When AI Insights is active for your account, we process aggregated, derived figures from your benchmark data — domain-level position counts, named metrics with their percentile and sample-size figures, prevalence figures, and your peer-group size — to generate plain-language descriptive summaries. Individual salaries and base-pay levels are not used.

Generation is performed by our AI sub-processor, Anthropic PBC, which processes the figures on our instructions and, under its commercial API terms, does not retain them or use them to train its models (see the Sub-processor List). Our lawful basis is legitimate interest (Art. 6(1)(f)), supported by a Legitimate Interests Assessment; AI Insights are on by default and you can turn them off at any time in Settings. The output is descriptive only and makes no automated decision with legal or similarly significant effect (Art. 22 does not apply). Cached summaries are regenerated when your underlying data changes. See the AI Insights Terms for full detail.

Retention

We keep personal data only as long as we need it:

• Account data (your name, email, role and consent records) is kept while your account is active. If your organisation leaves lumi, or you or your organisation ask us to delete your data, it is removed from live systems within 30 days of the request (see the Data Sharing Agreement, §5.2). Residual copies in our encrypted backups then expire under our backup rotation within a further 35 days, after which no copy remains.

• Benchmark submissions are versioned per collection window and retained as anonymised historical snapshots so trends stay meaningful; these carry no personal identifiers.

• Sign-in and security records are short-lived by design: sessions expire after 14 days, and password-reset links after 2 hours.

Your rights

You may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. To exercise any right, contact your organisation's lumi Admin, or email us at dpo@lumihr.co.uk.

Cookies

See the separate Cookie Policy for how we use cookies and similar technologies.

Changes

We may update this notice from time to time; material changes will be posted here with a revised effective date.