1. Who we are
This site and these services are operated by Lume Systems ("Lume", "we", "us"), ABN 62 851 283 660, based in Australia. You can contact us about privacy any time at hello@lumesystems.com.au.
2. What this policy covers
This policy covers personal information we handle when you:
- Visit our website or contact us with an enquiry
- Book a chat with us
- Engage Lume for an audit, an automation or AI build, a dashboard, or ongoing care of a system
It does not cover job candidates applying for roles through Lume's hiring system. Because that involves more detailed handling (including automated assessment), candidates have their own dedicated Candidate Privacy Policy. Where the two overlap, the candidate policy is the more specific and applies to candidate applications.
Anonymity. You can browse our website without identifying yourself. To answer an enquiry or do work for you, though, we need to know who we're dealing with.
3. What personal information we collect
If you enquire or book a chat
- Your name, email address and phone number
- Your business name and what you tell us about your business
If you become a client
- Contact and account details needed to run the engagement and invoice you
- Business information gathered during an audit or build; see Client business data below
If you just visit the website
- Basic technical information (such as IP address and browser type) processed by our website host and the embedded services on the page; see Our website
We don't buy personal information, collect it from data brokers, or gather more than the work needs.
4. Client business data
Auditing and automating a business means looking at how it actually runs. Depending on the engagement, that can involve business records that contain personal information about other people, for example staff names on rosters, supplier contact details, or customer names in a booking system.
Where that happens:
- We access only what the engagement genuinely needs, with the client's knowledge and permission
- We use it solely to do that client's work, never for any other client, and never for marketing
- We handle it under the same security practices as everything else we hold (see How we keep it safe)
- Systems we build are set up to run on the client's own accounts, so the client (not Lume) remains in control of their data once the work is handed over
If you're a staff member, supplier or customer of one of our clients and have questions about information in that client's systems, the client is the right first port of call, but you're always welcome to contact us too.
5. Why we collect, use and disclose it
We use personal information only to run Lume and deliver its services. Specifically, to:
- Respond to enquiries and hold the chats you book
- Scope, quote and deliver audits, builds and dashboards
- Operate and maintain systems clients have engaged us to run
- Invoice and keep the records the law requires
- Keep our services secure and troubleshoot problems
We do not sell personal information, use it for advertising, or add you to marketing lists.
6. Our use of AI
AI is central to what Lume builds, so we're upfront about how it's used:
- In the systems we build. The automations we deliver often use an AI provider to read and process content, for example reading a job application (covered in the Candidate Privacy Policy) or turning business records into a report. What a system sends to the AI provider is limited to what that job needs.
- In how we work. We use AI tools to help build, test and document systems.
- People decide. AI in our systems reads, sorts, scores and summarises. It assists decisions. It is not set up to make significant decisions about a person on its own.
Our AI provider processes content in the United States (see Overseas processing), and we choose providers that commit not to train their models on this data.
7. Who we share it with
We use a small number of trusted third-party providers to run Lume:
- A cloud database provider that stores data we host (hosted in Sydney)
- A workflow provider that runs our automations
- An AI provider that performs reading, scoring and summarising in our systems
- Email and SMS providers that send notifications
- A website host and a scheduling provider for booked chats
These providers process personal information only to deliver their part of the service. We don't sell personal information to anyone, and we don't share it for advertising. Beyond this, we would only disclose personal information if the law required us to.
8. Information processed overseas
Data we host is stored in Australia (Sydney). Some of the providers we use process data outside Australia. In particular, our AI provider processes content in the United States, and our website host and scheduling provider are US-based. So the country where your information is most likely to be processed outside Australia is the United States.
Where data is handled overseas, we take reasonable steps to ensure it's protected to a standard consistent with the Australian Privacy Principles, including choosing reputable providers with strong published security and privacy commitments.
9. How we keep it safe
We take reasonable technical and organisational steps to protect personal information, including:
- Encryption of stored data
- Two-factor authentication on the systems that hold data
- Access limited to only what's needed to do the work
- Secrets and credentials kept out of shared or published code
- Secure deletion of data we no longer need
No system is perfectly secure, but we work to reduce risk and to respond quickly if something goes wrong.
10. If something goes wrong (data breaches)
If a data breach occurs that is likely to result in serious harm to anyone whose information we hold, we will notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable, in line with the Notifiable Data Breaches scheme, and we'll tell you what happened, what information was involved, and what we're doing about it. Where the breach involves a client's business data, we'll also notify that client immediately.
11. How long we keep it
- Enquiries: kept only as long as the conversation is live, then deleted.
- Client engagement data: kept for the length of the engagement, then deleted or handed back, except the basic records the law requires us to keep (such as invoices and tax records, which are kept for the statutory period).
- Candidate applications: deleted within 6 months of the role being filled, as set out in the Candidate Privacy Policy.
12. Accessing, correcting or deleting your information
You can ask us:
- What personal information we hold about you
- To correct it if it's wrong or out of date
- To delete it
Email hello@lumesystems.com.au. There's no charge for making a request, and we'll respond within 30 days. If we ever couldn't do what you ask (for example, where the law requires us to keep something), we'll tell you why in writing and what your options are.
13. Our website
Our website doesn't use advertising trackers, and we don't build profiles of visitors. Like most websites, basic technical information (such as your IP address and browser type) may be processed by our website host and by embedded services on the page (the fonts we load and the booking widget you can use to schedule a chat) in order to deliver the page to you. If you book a chat, the booking service collects the details you enter under its own privacy policy.
14. Making a complaint
If you think we've mishandled your personal information, please contact us first at hello@lumesystems.com.au so we can try to put it right. We'll acknowledge your complaint, look into it, and reply with what we found and what we'll do.
If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
15. Changes to this policy
We may update this policy from time to time as the services or the law change. The latest version will always be on this page, with the date it was last updated shown at the top. If we make a significant change to how we handle personal information, we'll say so prominently on this page.