LuminAura Privacy Policy

This is a copy-ready working draft structured around the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and the changes introduced by the Data (Use and Access) Act 2025. The ICO requires privacy notices to identify the controller, purposes, lawful bases, recipients, international transfers, retention periods and individual rights.
The draft covers the information currently collected through the LuminAura contact form—name, email address and enquiry details—as well as information that may be collected during prospective-client and client relationships.
Before publishing, complete the following:

• [LEGAL ENTITY NAME]

• [COMPANY NUMBER]

• [REGISTERED OR BUSINESS ADDRESS]

• Confirm whether LuminAura uses email-marketing software, a CRM, booking software, Google Analytics, Meta Pixel or other advertising technology

• Confirm whether info@luminaura.co.uk should be the privacy contact address

Privacy Policy
Last updated: 21 July 2026
1. About this Privacy Policy
This Privacy Policy explains how LuminAura collects, uses, stores and protects personal information when you:

• visit our website;

• contact us or submit an enquiry;

• book a consultation;

• subscribe to communications;

• engage with us through social media;

• become a prospective client, client, supplier or collaborator;

• participate in a project, event, webinar or campaign;

• otherwise communicate or work with us.

“Personal information” means information that identifies you, or could reasonably be used to identify you.
For the purposes of applicable UK data protection law, LuminAura is the controller of the personal information described in this Privacy Policy unless we tell you otherwise.
2. Who we are
LuminAura is a London-based brand consultancy providing brand strategy, creative direction, content production, digital growth and related consultancy services.
LuminAura is the trading name of:
Legal entity: [LEGAL ENTITY NAME]
Company number: [COMPANY NUMBER, IF APPLICABLE]
Registered in: England and Wales
Registered or business address: [FULL ADDRESS]
Email: info@luminaura.co.uk
Website: LuminAura.co.uk
References in this Privacy Policy to “LuminAura”, “we”, “us” or “our” refer to the legal entity identified above.
3. Personal information we collect
The information we collect depends on how you interact with us.
3.1 Information you provide directly
You may provide us with:

• your name;

• email address;

• telephone number;

• company or organisation name;

• job title or professional role;

• website or social-media profile;

• postal or business address;

• details contained in an enquiry or message;

• information about your brand, business, project or objectives;

• preferred services, budget and anticipated start date;

• consultation or meeting information;

• marketing and communication preferences;

• documents, images, recordings, biographies, brand materials or other project content;

• feedback, testimonials or survey responses;

• payment, invoicing or transaction information;

• correspondence between you and LuminAura.

Please do not provide sensitive or confidential personal information unless it is necessary for your enquiry or project and has been agreed with us in advance.
3.2 Information collected automatically
When you use our website, we or our service providers may collect:

• IP address;

• browser type and version;

• device type;

• operating system;

• approximate geographical location;

• pages viewed;

• links selected;

• dates, times and duration of visits;

• referring website or source;

• technical error and security information;

• cookie identifiers and similar online identifiers.

Some of this information is collected through cookies and similar technologies. Further information is provided in our Cookie Policy.
3.3 Information obtained from other sources
We may receive professional or business-related information from:

• referrals and introductions;

• clients, collaborators or professional advisers;

• publicly accessible websites;

• professional networking platforms;

• Companies House or other public registers;

• event, campaign or project partners;

• social-media platforms;

• suppliers and service providers.

Where required, we will provide appropriate privacy information when we obtain personal information from another source.
4. How we use personal information
We use personal information only where we have a lawful reason to do so.
Responding to enquiries and arranging consultations
We use your contact and enquiry information to:

• respond to your message;

• understand your requirements;

• assess whether our services are suitable;

• arrange consultations or meetings;

• prepare proposals or quotations;

• communicate about possible work.

Lawful basis: taking steps at your request before entering into a contract and our legitimate interests in responding to enquiries and developing business relationships.
Providing our services
We use personal information to:

• establish and manage client relationships;

• deliver agreed consultancy, creative, content and marketing services;

• plan and manage projects;

• organise production sessions, events or webinars;

• communicate with clients, participants and collaborators;

• obtain approvals;

• manage deliverables and project administration.

Lawful basis: performance of a contract, taking steps before entering into a contract and our legitimate interests in managing projects efficiently.
Managing payments and business records
We use relevant information to:

• issue quotations and invoices;

• receive and record payments;

• manage accounting and financial records;

• fulfil tax, regulatory and legal obligations;

• establish, exercise or defend legal claims.

Lawful basis: performance of a contract, compliance with legal obligations and our legitimate interests in administering and protecting our business.
Operating and improving our website
We may use technical and usage information to:

• deliver and maintain the website;

• understand how visitors use it;

• diagnose technical issues;

• improve performance and usability;

• protect the website against fraud, misuse and security threats;

• measure the effectiveness of content and campaigns.

Lawful basis: consent where required for non-essential cookies or tracking technologies, and our legitimate interests in operating a secure and effective website for strictly necessary processing.
Marketing and business development
Subject to applicable law and your communication preferences, we may use contact and professional information to:

• send information about LuminAura’s services;

• share relevant news, insights, events or invitations;

• maintain relationships with existing and prospective clients;

• conduct proportionate business-to-business development;

• measure engagement with communications.

Lawful basis: consent where required and, in appropriate business-to-business circumstances, our legitimate interests in promoting and developing our services.
You may unsubscribe or object to direct marketing at any time.
Publishing project work and testimonials
Where appropriate, we may use approved material to:

• publish case studies;

• display project imagery or video;

• identify clients, collaborators or contributors;

• publish testimonials;

• promote completed work through our website, portfolio and social-media channels.

Lawful basis: contract, consent where required, and our legitimate interests in demonstrating our experience and promoting our services.
The use of identifiable people, confidential material or unreleased project information may also be governed by project agreements, release forms or specific approvals.
Complying with legal obligations
We may process personal information where necessary to:

• comply with a legal, regulatory or court requirement;

• respond to lawful requests from public authorities;

• protect our legal rights;

• prevent or investigate suspected fraud, misuse or unlawful conduct;

• maintain appropriate records.

Lawful basis: compliance with legal obligations and our legitimate interests in protecting LuminAura, our clients and other parties.
5. Our legitimate interests
Where we rely on legitimate interests, those interests may include:

• responding to and managing enquiries;

• developing professional and commercial relationships;

• operating and improving our business;

• delivering and administering projects;

• promoting relevant services to business contacts;

• maintaining website and information security;

• preventing fraud or misuse;

• establishing, exercising or defending legal rights;

• demonstrating our experience through approved portfolio work.

We consider whether the processing is necessary and proportionate and whether your interests, rights or freedoms override our interests.
6. Direct marketing
We may send relevant marketing communications where:

• you have given consent;

• you are an existing client and the communication is permitted by law;

• the communication is directed to a corporate business address and we have a valid lawful basis;

• another lawful exception applies.

We will not require you to receive marketing as a condition of making a general enquiry.
Every electronic marketing communication will provide an appropriate way to unsubscribe.
Your right to object to marketing
You have the right to object at any time to the use of your personal information for direct-marketing purposes.
You can object or withdraw your consent by:

• selecting the unsubscribe option in a marketing email;

• contacting us at info@luminaura.co.uk;

• changing any available communication preferences.

When you opt out, we may retain limited information on a suppression list to ensure that we respect your request and do not send further marketing.
7. Cookies and similar technologies
Our website may use cookies, pixels, local storage and similar technologies for:

• essential website operation;

• security;

• remembering preferences;

• analytics and performance measurement;

• embedded content;

• marketing or advertising, where enabled.

We will request consent before using non-essential cookies or similar technologies where consent is required.
You can review or change your cookie choices through the website’s cookie settings. Further details are provided in our Cookie Policy.
8. How we share personal information
We may share personal information only where necessary and appropriate.
Recipients may include:

• website-hosting and website-management providers;

• email, cloud-storage and document-management providers;

• customer-relationship management and project-management providers;

• consultation-booking, webinar and video-conferencing providers;

• analytics, marketing and cookie-management providers;

• payment, accounting and bookkeeping providers;

• photographers, filmmakers, editors, designers and production specialists;

• project collaborators and delivery partners;

• professional advisers, including accountants, insurers and lawyers;

• regulators, courts, law-enforcement bodies or public authorities;

• prospective purchasers, investors or successors in connection with a business restructuring or sale.

Service providers acting on our behalf are expected to use personal information only for the relevant service and to protect it appropriately.
Where we deliver a project jointly with another organisation, we will clarify the parties’ respective responsibilities where necessary.
We do not disclose personal information to unrelated third parties for their own independent marketing unless you have agreed to this or another lawful basis clearly applies.
9. International transfers
Some of our service providers or their infrastructure may be located outside the United Kingdom.
Where personal information is transferred outside the United Kingdom, we will use an appropriate lawful transfer mechanism. This may include:

• transferring information to a country covered by UK adequacy regulations;

• using the United Kingdom International Data Transfer Agreement;

• using the UK Addendum to approved standard contractual clauses;

• relying on another permitted safeguard or legal exception.

You may contact us for further information about the safeguards used for relevant transfers.
10. How we protect personal information
We use proportionate technical and organisational measures designed to protect personal information against:

• unauthorised access;

• accidental loss;

• misuse;

• alteration;

• disclosure;

• destruction.

These measures may include access controls, password protection, secure systems, restricted permissions, staff and contractor confidentiality requirements, backups and appropriate contractual protections.
No internet transmission or storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, but we take reasonable measures appropriate to the nature of the information and the risks involved.
11. How long we retain personal information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, regulatory and reporting requirements.
Our usual retention approach is:
General and prospective-client enquiries
Normally retained for up to 24 months after the last substantive communication, unless the enquiry develops into a client relationship or there is another reason to retain it.
Client and project records
Normally retained for the duration of the relationship and for up to six years after the end of the relevant engagement, where necessary for contractual, legal, insurance or dispute-management purposes.
Financial and accounting records
Normally retained for six years from the end of the relevant financial year, or longer where required by law.
Marketing information
Retained until you withdraw consent, object to marketing or the information is no longer relevant. Limited suppression information may be retained to ensure that an opt-out continues to be respected.
Website and analytics information
Retained in accordance with the periods stated in our Cookie Policy and the settings applied to the relevant service providers.
Portfolio and project materials
Approved public project material may be retained as part of LuminAura’s historical portfolio unless an agreement, legal obligation or valid request requires its removal.
We may retain information for longer where necessary in connection with an actual or anticipated legal claim, regulatory enquiry, fraud investigation or legal requirement.
When information is no longer required, we will delete, anonymise or securely dispose of it.
12. Your data-protection rights
Depending on the circumstances and the lawful basis used, you may have the right to:

• be informed about how your personal information is used;

• request access to your personal information;

• request correction of inaccurate or incomplete information;

• request deletion of your information;

• request restriction of processing;

• object to processing based on legitimate interests;

• object to direct marketing at any time;

• request transfer of information in a portable format;

• withdraw consent where processing is based on consent;

• complain about how your information has been handled.

These rights are not absolute and may be subject to legal conditions or exemptions.
To exercise a right, contact:
Email: info@luminaura.co.uk
Address: [PRIVACY OR REGISTERED ADDRESS]
We may need to verify your identity before responding. We will not normally charge a fee, although the law permits a reasonable fee or refusal in limited circumstances involving manifestly unfounded or excessive requests.
13. Automated decision-making
LuminAura does not currently make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects.
We may use digital tools or artificial intelligence to assist with research, organisation, analysis or creative processes. Where we do so, material decisions remain subject to appropriate human judgement and oversight.
14. Special-category information
We do not ordinarily seek information concerning:

• health;

• race or ethnic origin;

• political opinions;

• religious or philosophical beliefs;

• trade-union membership;

• genetic or biometric information;

• sex life or sexual orientation.

If such information is necessary for a particular project, we will identify an appropriate lawful basis and additional legal condition before processing it.
15. Children’s information
Our website and consultancy services are primarily intended for adults and organisations.
We do not knowingly collect personal information directly from children through the website. Where a project involves children or young people, appropriate consent, safeguarding and contractual arrangements will be established with the relevant parent, guardian, organisation or authorised representative.
16. Third-party websites and services
Our website may contain links to external websites, social-media platforms, embedded content or third-party services.
Those third parties operate under their own privacy practices. LuminAura is not responsible for how an independent third party collects or uses personal information. You should review the relevant third party’s privacy information before submitting personal information to it.
17. Complaints
Please contact us first if you have concerns about how we have handled your personal information:
Email: info@luminaura.co.uk
Address: [FULL ADDRESS]
You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data-protection regulator.
The ICO can be contacted through its website or by telephone on 0303 123 1113.
18. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes to:

• our services;

• our data-handling practices;

• the technologies used on our website;

• our service providers;

• applicable law or regulatory guidance.

The latest version will be published on this page with a revised “Last updated” date.
Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals.
19. Contact us
Questions, requests and complaints concerning this Privacy Policy or your personal information should be sent to:
LuminAura
[LEGAL ENTITY NAME]
[FULL ADDRESS]
Email: info@luminaura.co.uk
Contact-form wording to add
Place this immediately beneath the form and above the Send Enquiry button:
 
We will use the information you provide to review and respond to your enquiry. For further information about how we handle personal information, please read our Privacy Policy.
Where you add an optional marketing checkbox, use separate wording:
 
☐ I would like to receive occasional news, insights and service updates from LuminAura. I understand that I can unsubscribe at any time.
Do not pre-tick the marketing box. Consent for electronic marketing and non-essential tracking must be active where required, and individuals have an absolute right to object to direct marketing.