Lumthera
Start a conversation

Legal All policies

Privacy policy

What personal data we collect, why, who sees it, how long we keep it, and your rights under the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of RS, no. 87/2018).

Last updated 25 September 2026 · LUMTHERA (Miloš Trifunović PR LUMTHERA), Serbia

1. Who is responsible for your data

The controller of your personal data is:

MILOŠ TRIFUNOVIĆ PR Konsultantske aktivnosti u vezi s poslovanjem i ostalim upravljanjem LUMTHERA Čačak
Put Vencom za Sušicu 2, 32102 Loznica, Čačak, Serbia
MB 67893018 · PIB 114838771
Email: hello@lumthera.com · Phone: +381 69 100 4502

We have not appointed a data protection officer. For any privacy question or request, write to hello@lumthera.com.

2. What we collect and why

WhenWhat dataWhyLegal basis
You contact us Name, email, company, message, and anything else you choose to send To reply and to prepare a confirmation or proposal Steps before a contract at your request; our legitimate interest in answering enquiries
You book or buy Name, email, company, billing address, tax ID (for businesses), service details, correspondence To deliver the service, issue invoices and keep records Performance of the contract; legal obligations under accounting and tax law
You pay Payment status, amount, currency, date, card brand and last four digits, payment reference To match payments to orders, handle refunds and prevent fraud Performance of the contract; legal obligations; legitimate interest in preventing fraud
We work together Call notes, documents and materials you share with us To deliver the session or project Performance of the contract
You complain Your contact details and the complaint To handle it and keep the records the law requires Legal obligation
You visit the website IP address, browser type, pages requested, time (in server logs) To run the website securely and stop abuse Legitimate interest in running a secure website

You do not have to give us any personal data, but without contact and billing details we cannot reply to you or sell you a service. We do not use website analytics or advertising trackers, we do not sell personal data, and we do not make decisions about you based solely on automated processing.

When a project involves processing personal data on your behalf (for example, your customers’ data inside a system we build), we act as your processor under a separate data processing agreement.

3. Card payments

Card payments are processed securely by our payment provider. You enter your card details on the provider’s secure payment page, not on our website, and we never receive or store your full card number or security code. The payment provider processes your payment data as a separate controller under its own privacy notice, and may use automated checks to prevent fraud.

4. Who we share data with

We share personal data only as far as each provider needs it to do its job for us:

  • Our payment provider: card payment processing and fraud prevention.
  • Zoho: email hosting for our @lumthera.com addresses (EU data centre).
  • Render: hosting of this website (United States).
  • Cloudflare: domain name, content delivery and protection against attacks (global network).
  • Video-call providers such as Google Meet or Zoom, for sessions held on those platforms.
  • Our accountant, for bookkeeping and tax filings in Serbia.
  • Public authorities, where the law requires us to disclose data.

5. Transfers outside Serbia

Some of these providers process data in the European Union, the United Kingdom or the United States. Where a country is not on the Government of Serbia’s list of countries with an adequate level of protection, we rely on standard contractual clauses adopted by the Commissioner for Information of Public Importance and Personal Data Protection, or on another safeguard allowed by the law. You can ask us for a copy of the safeguards that apply.

6. How long we keep data

  • Enquiries that do not lead to a contract: 12 months after our last exchange.
  • Contracts, invoices and payment records: for as long as Serbian accounting and tax law requires, generally up to 10 years.
  • Complaint records: at least 2 years, as consumer protection law requires.
  • Project materials: until the end of the engagement, then returned or deleted unless you ask otherwise.
  • Server logs: kept by our hosting providers for a short period, usually days or weeks.

7. Your rights

You have the right to:

  • be informed about how your data is processed, and to get a copy of it;
  • have inaccurate data corrected and incomplete data completed;
  • have your data deleted, and to restrict how it is processed, where the law allows;
  • receive your data in a structured, machine-readable format and have it transferred (data portability);
  • object to processing based on our legitimate interests;
  • withdraw your consent at any time, where processing is based on consent, without affecting earlier processing.

To use any of these rights, write to hello@lumthera.com. We reply within 30 days. You also have the right to complain to the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), Bulevar kralja Aleksandra 15, Belgrade, www.poverenik.rs.

8. Security

Our website is served only over encrypted connections (HTTPS). Access to our email, documents and systems is limited to people who need it and protected with strong authentication. Card data is handled only by our payment processor.

9. Other points

  • Our services are not aimed at anyone under 18, and we do not knowingly collect their data.
  • How we use cookies is explained in the cookie policy.
  • We may update this policy. The date at the top shows the current version; significant changes are announced on this page.