Privacy Policy

Lumina is committed to protecting the privacy and personal data of all individuals who interact with our platform. This Privacy Policy sets out how we collect, use, store, share, and protect personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy is reviewed annually and updated as necessary to reflect changes in legislation, platform functionality, or organisational practices.

This policy applies to all individuals who access or interact with the Lumina platform, including:

• Learners aged 14–24
• Parents and carers of learners under 18
• Partner institutions, including schools, colleges, and other organisations
• Lumina staff, contractors, and content contributors

Lumina processes personal data only where a lawful basis exists under UK GDPR. The applicable bases include:

• Consent — the individual has provided clear, informed consent for processing
• Contractual necessity — processing is required to deliver the service the individual has registered for
• Legal obligation — processing is necessary to comply with applicable law, including safeguarding requirements
• Legitimate interests — processing is necessary for Lumina's operational purposes, provided this does not override the individual's rights

The categories of personal data collected will depend on how the individual interacts with Lumina. These may include:

Account and identity data

• Full name, date of birth, and age
• Email address and encrypted account credentials
• Institution name, year group, and role (learner, teacher, administrator)

Learning and activity data

• Submitted coursework, tasks, and project content
• Questions and inputs submitted to the AI Tutor
• Progress data, badge completion, and pillar tracking

Technical and usage data

• IP address, browser type, device type, and operating system
• Pages visited, session duration, and platform interaction data
• Cookie and preference data

Parental and institutional data

• Parent or carer contact details (for learners under 18, where applicable)
• Institutional contact details and administrative user information

Personal data is processed for the following purposes:

• Providing access to the Lumina platform and delivering educational content
• Operating the AI Tutor to respond to learner queries (see Section 7)
• Tracking learner progress across the 7 learning pillars and issuing badges
• Administering institutional accounts, enrolment, and dashboards
• Monitoring platform performance, resolving technical issues, and improving user experience
• Meeting safeguarding obligations and reporting requirements
• Communicating account-related or service-critical information

Lumina delivers educational content to learners from the age of 14. Additional safeguards apply to the processing of data belonging to learners under 18:

• For learners under 16, parental or institutional consent is obtained prior to data processing
• For learners aged 16–17, consent may be provided by the learner themselves or their institution, in accordance with ICO guidance
• Lumina does not knowingly collect excessive or unnecessary personal data from children
• Parents and carers may request access to, correction of, or deletion of their child's personal data at any time

The Lumina platform includes an AI-powered tutor that responds to learner questions and provides guidance. The following applies to AI Tutor interactions:

• Learner inputs are transmitted to a third-party AI provider for the purpose of generating responses
• The AI provider processes inputs in real time and does not retain personal data beyond the immediate session
• Lumina does not use AI Tutor conversation data to train or fine-tune AI models
• No decisions affecting a learner's access, progress, or standing are made solely through automated processing

Learners or their parents may raise concerns about AI data processing by contacting legal@wearelumina.co.

Lumina does not sell, rent, or trade personal data under any circumstances.

Data may be disclosed to the following categories of recipient, solely for the purposes outlined in this policy:

• Partner institutions — to facilitate educational delivery, progress reporting, and safeguarding
• Service providers — trusted third parties that support platform infrastructure, including hosting and AI services, bound by contractual data protection obligations
• Regulatory and safeguarding authorities — where disclosure is required by law or necessary to protect a young person

Certain services that support the Lumina platform are operated by providers based outside the United Kingdom, including in the United States.

Where personal data is transferred internationally, Lumina ensures appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) as approved by the UK Information Commissioner's Office
• Assessment of the recipient country's data protection adequacy
• Data minimisation — only the information strictly necessary for the service is transferred

Lumina uses cookies and similar technologies for the following purposes:

• Essential cookies — required for platform functionality, such as maintaining login sessions
• Preference cookies — used to remember user settings and choices
• Analytics cookies — used to understand platform usage patterns and improve the service

Essential cookies cannot be disabled as they are necessary for the platform to function.

Lumina employs appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS) and at rest
• Access controls restricting data to authorised personnel only
• Regular security assessments and monitoring
• Secure hosting infrastructure with redundancy and backup protocols

No system can guarantee absolute security. Lumina takes all reasonable steps to mitigate risk and will notify affected individuals and the ICO in the event of a qualifying data breach.

Personal data is retained only for as long as necessary to fulfil the purposes described in this policy. Specific retention periods are as follows:

• Account data — retained while the account is active, and securely deleted within 12 months of account closure
• Coursework and submitted content — retained while the account is active, and deleted within 12 months of closure unless earlier deletion is requested
• AI Tutor conversation data — retained for up to 30 days to support continuity of learning, then automatically deleted
• Usage and analytics data — retained in anonymised form for up to 24 months
• Safeguarding records — retained in accordance with applicable statutory guidance and legal requirements

Individuals may request earlier deletion of their data at any time (see Section 13).

Under UK GDPR, individuals have the following rights in relation to their personal data:

• Right of access — to request a copy of the personal data held about them
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of personal data where there is no compelling reason for its continued processing
• Right to restrict processing — to request limitation of data processing in certain circumstances
• Right to data portability — to receive personal data in a structured, commonly used format for transfer to another provider
• Right to object — to object to processing based on legitimate interests or direct marketing
• Right to withdraw consent — to withdraw previously given consent at any time, without affecting the lawfulness of prior processing

Requests should be directed to legal@wearelumina.co. Lumina will respond to all valid requests within 30 calendar days.

Where the individual is under 18, a parent or carer may submit a request on their behalf.

Any concerns regarding the handling of personal data should be raised with Lumina in the first instance by contacting legal@wearelumina.co.

Individuals also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113

Lumina reserves the right to update this Privacy Policy as necessary. Where material changes are made, affected individuals will be notified through the platform or by email. The effective date at the top of this document reflects the most recent revision.

For any enquiries relating to this Privacy Policy or Lumina's data protection practices:

• General enquiries: info@wearelumina.co
• Legal, safeguarding & data protection: legal@wearelumina.co