Privacy Policy

Last updated: April 2026

1. Who we are

Lume Financials ("Lume", "we", "us") is a financial intelligence firm registered in the Netherlands (KVK: 72098031, BTW: NL002226099B47). We act as a data processor when handling your financial information to deliver our services. This privacy policy explains how we collect, use, store, and protect your personal and financial data in compliance with the General Data Protection Regulation (GDPR/AVG).

2. What data we collect

Personal data

Name, email address, company name, and contact details provided through our website, forms, or direct communication.

Financial data

Revenue figures, cost structures, P&L data, cash positions, and other financial information you provide for the purpose of our services. This data is provided voluntarily by you and is necessary to deliver the agreed services.

Website data

We may collect basic analytics data (pages visited, session duration) through privacy-respecting analytics tools. We do not use invasive tracking or sell any data to third parties.

3. How we use your data

Your data is used exclusively to:

• Deliver the services you've engaged us for (analysis, modeling, reporting)
• Communicate with you about your engagement
• Improve our services and internal processes (using anonymised, aggregated data only)

We never use your data for marketing to third parties, sell your data, or share it with anyone outside of Lume without your explicit consent.

4. AI and data processing

Lume uses AI tools as part of our workflow. When AI is used:

• AI receives only structured, anonymised metric exports. Never your raw documents, bank statements, or personally identifiable information
• All AI-generated output is reviewed by a qualified human analyst before delivery
• We control exactly what data AI processes and maintain full oversight

5. Data storage and security

Your data is stored on secure, industry-standard cloud infrastructure within the EU. Access is limited to your assigned analyst and essential operations personnel. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse.

6. Data retention and deletion

We retain your data for the duration of our engagement plus 12 months for reference and continuity purposes. You may request deletion of all your data at any time, and we will comply within 7 business days. Upon deletion, all copies of your data are permanently removed from our systems.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Request restriction of processing
• Data portability: receive your data in a structured, machine-readable format
• Object to processing
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

8. Third-party services

We use the following categories of third-party services to deliver our work:

• Cloud storage and infrastructure (EU-based)
• Communication tools (email, video conferencing)
• AI processing tools (structured data only, as described above)
• Automation tools for workflow management

All third-party services are selected for their compliance with EU data protection standards.

9. Changes to this policy

We may update this policy from time to time. Active clients will be notified of significant changes. The latest version is always available on our website.

Contact

For privacy-related questions or to exercise your data rights, contact us at hello@lumefinancials.com.