Privacy notice

Who is responsible for your information

The controller of your information is JOSUE ARTURO LOPEZ LUQUEÑO, a sole proprietor (persona física con actividad empresarial) doing business as Lume Digital, with an address at Av. Úrsulo Galván SN, Col. Boyeros, Texcoco, State of Mexico, Mexico.

For any privacy matter, email legal@lumedigital.agency. Rights requests are handled at that same address. For anything else: hola@lumedigital.agency.

What we collect

What you give us when you use the site:

• When you send the form: what you need, a description of your situation, your current website, your name, work email, company and country.
• If you choose to answer: estimated budget, timeline and how you heard about us.
• Your self-assessment result, only if you check the box to attach it.

If you accept analytics cookies, Google Analytics also collects browsing data: the pages you visit, where you came from, your device and browser type, an approximate location (country or city) and a random identifier stored in a cookie. It also records clicks on our contact buttons, with no personal information. We don’t combine this data with your form submission or use it to identify you. If you decline, none of this is collected.

To prevent abuse, we keep a non-reversible fingerprint of your IP address for one hour. We don’t use it to identify you.

We don’t ask for sensitive information, and we ask you not to include any in your message.

How we use it

• To reply to your request and assess whether we can help.
• To prepare a written proposal, where appropriate, and follow up by email until the conversation ends.
• To protect the form from abuse.
• Only with your consent: to measure, in aggregate, which pages are visited and which buttons lead to contact, so we can improve the site (analytics).

Analytics isn’t needed to handle your request. You can decline it in the cookie notice or withdraw your consent at any time with the “Cookie preferences” link at the bottom of every page, and it won’t affect your request.

We don’t use your information for advertising, newsletters or offers. If we ever wanted to, we’d ask for your permission first.

Internal assessment of your request

When we receive your request, the site calculates an indicative fit score based on what you need, whether you already have a website, your timeline, estimated budget and the detail in your message. It helps us prioritize our work. It isn’t a final decision and has no legal effect: a person on our team reviews and replies to every request.

Legal bases (European Economic Area and United Kingdom)

If you’re in the European Economic Area or the United Kingdom, we rely on:

• steps you ask us to take before a possible contract, to reply and prepare a proposal;
• our legitimate interest, to protect the form and prioritize requests with the internal assessment;
• your consent, to attach the self-assessment and for analytics. You can withdraw it at any time, without affecting earlier processing.

In Mexico, where we are based, we process your information with your consent, under the Federal Law on Protection of Personal Data Held by Private Parties: you give it when you send your request and, for analytics, when you accept analytics cookies.

Who else processes it

Providers that process it on our behalf and under our instructions:

• Website, database and content delivery network hosting: Hostinger, in a data center in Massachusetts, United States.
• Email, including delivery of each request to our inbox: Hostinger.
• Analytics, only if you accept it: Google LLC (United States), through Google Tag Manager and Google Analytics. We don’t turn on its advertising features: no Google signals, no remarketing and no Google Ads linking.

If you hire us, Stripe processes the payment, as explained under “Client payments”.

We don’t sell or share your information with third parties. We would only disclose it to an authority if a law or court order required it.

International transfers

Lume Digital is based in Mexico. If you’re outside the United States, your information is processed outside your country. Each provider applies these safeguards:

• Hostinger hosts the website in the United States and provides email from its own infrastructure, which may be in other countries. It acts as a processor under its data processing addendum, which is part of its terms of service and incorporates the European Commission’s standard contractual clauses and, for UK data, the UK International Data Transfer Addendum.
• Google processes analytics data in the United States and other countries where it has facilities. It is certified under the EU-U.S. Data Privacy Framework and uses standard contractual clauses.
• Stripe, if you hire us, with the safeguards described under “Client payments”.

You can ask us for more information about these safeguards at legal@lumedigital.agency.

How long we keep it

We keep each business request for 12 months after our last contact if it doesn’t become a project, unless a legal obligation requires a different period. After that, the site deletes it automatically. If we end up working together, your information is governed by the contract and kept as long as legal, tax and contractual obligations require. The IP fingerprint deletes itself after one hour. Analytics cookies last up to two years in your browser, and Google Analytics keeps the associated data for no more than 14 months.

Your rights

Everyone

You can ask us to access, correct or delete your information, object to or restrict its use, or withdraw your consent. Email legal@lumedigital.agency with your name, how to reach you, what you’re asking for and anything that helps us find your request. We may ask you to verify your identity. It’s free. To withdraw your analytics consent you don’t need to email us: just use the “Cookie preferences” link at the bottom of every page.

If you’re in the United States

We collect identifiers (name, email) and professional information (company, website, needs) directly from you and, if you accept analytics, browsing information on this site, for the purposes described above. We don’t sell your personal information or share it for cross-context behavioral advertising. Do Not Track and Global Privacy Control: the site doesn’t track you across third-party sites or allow others to do so through it, and analytics only runs with your prior consent and without advertising features. If your state’s privacy law gives you additional rights, you can exercise them by emailing us.

If you’re in the European Economic Area or the United Kingdom

You also have the right to data portability. We’ll respond within one month, extendable by two more months for complex requests. Lume Digital has no establishment in Europe: we handle your requests directly at legal@lumedigital.agency, in English or Spanish. You can lodge a complaint with your local supervisory authority, such as the Information Commissioner’s Office in the UK.

If you’re in Mexico

We’ll respond within 20 days and, if your request is granted, carry it out within the following 15 days; both periods can be extended once. You may contact the Secretaría Anticorrupción y Buen Gobierno, Mexico’s data protection authority.

Client payments

If you hire us, payment is made through a Stripe payment link. Lume Digital never receives or stores your full card details. We receive the payment confirmation (name, email, amount and date) for invoicing and accounting, and keep it as long as tax obligations require. This website doesn’t process payments.

Stripe has a dual role. It processes the payment on our behalf, as a processor. For its own purposes, such as fraud prevention and meeting its financial-sector legal obligations (for example, anti-money laundering), it acts as an independent controller under its own privacy notice. Sharing this information is necessary to perform the contract you enter into with us.

Stripe may process payment data in the United States and other countries where it operates. According to its documentation, Stripe, LLC is certified under the Data Privacy Framework and its UK and Swiss extensions, and offers standard contractual clauses.

Children

This site is meant for businesses and professionals. It isn’t intended for anyone under 18, and we don’t knowingly collect their information.

How we protect your information

The site uses an encrypted connection (HTTPS), only administrators can see requests and the form includes anti-abuse measures. If a security incident significantly affected your rights, we would notify you as the law requires.

Cookies and similar technologies

Analytics cookies are only set if you accept them. Everything this site stores in your browser, how long it lasts and how to change your choice is explained in our cookie policy.

Changes to this notice

If we change this notice, we’ll post the new version on this page with its date. If the change is significant and you have an open request with us, we’ll let you know by email.

Effective date and last updated: October 18, 2026.