PRIVACY POLICY
Last updated: June 25, 2025
Operator: Limited Liability Partnership “LUMERA INTERNATIONAL”,
BIN: 250640028478,
Registered Address: Republic of Kazakhstan, 050067, Almaty, Nauryzbay District, Tauzholy microdistrict, Zhansha Dosmukhamedov street, building 49.
1. GENERAL PROVISIONS
1.1. This Privacy Policy for the Collection and Processing of Personal Data (hereinafter — the “Policy”) has been developed by LLP “LUMERA INTERNATIONAL” (hereinafter — the “Operator”) in accordance with the Law of the Republic of Kazakhstan No. 94-V dated May 21, 2013 “On Personal Data and Their Protection” (hereinafter — the “Law of the RK”), and also taking into account the principles of the European Union’s General Data Protection Regulation (GDPR).
1.2. This Policy governs the procedure for the collection, processing, and protection of Users’ personal data by the Operator when using the website https://lumera.travel/eng (hereinafter — the “Website”), the application forms for purchasing prepaid concierge packages, and the partnership cooperation forms.
1.3. The Operator operates as a cross-border provider of global concierge services. The processing of Users’ data is necessitated by the need to provide an international service and to perform agreements to which the User is a party.
1.4. By using the Website and providing their data, the User confirms unconditional consent to the terms of this Policy and gives explicit consent to the cross-border transfer and processing of their data under the conditions described below.
2. KEY DEFINITIONS
2.1. Personal data — any information relating to a directly or indirectly identified or identifiable individual (Data Subject).
2.2. Data Subject (User) — an individual (client, partner, or Website visitor) whose personal data is processed by the Operator.
2.3. Processing of personal data — any action or set of actions performed with personal data, including collection, accumulation, storage, modification, supplementation, use, distribution, cross-border transfer, anonymization, blocking, and destruction.
2.4. Cross-border transfer of personal data — the transfer of personal data to the territory of foreign states, to authorities of foreign states, or to foreign individuals or foreign legal entities.
3. LIST OF PERSONAL DATA PROCESSED
The Operator processes the following categories of data:
3.1. Client data (individuals):
4. PURPOSES OF COLLECTING AND PROCESSING PERSONAL DATA
Personal data is processed on lawful grounds for the following purposes:
4.1. Contract performance (primary basis): Arranging, paying for, and providing international concierge services (travel organization, booking, technical support, information support).
4.2. Communication: Sending confirmations, receipts, acts, order status notifications, and processing incoming requests and partnership proposals.
4.3. Marketing (based on consent): Informing about the Operator’s new services, packages, promotions, and special offers.
4.4. Service optimization: Analytics of Website usage, enhancing security, fraud prevention, and technical audit.
5. LEGAL GROUNDS FOR PROCESSING
The legal grounds for the Operator’s processing of personal data are:
5.1. The explicit and informed consent of the User, expressed through implied actions on the Website (checking a checkbox, submitting a completed form).
5.2. The necessity of concluding and performing an agreement (public offer) to which the User (client or partner) is a party.
5.3. The Operator’s legitimate interests (ensuring cybersecurity, protecting IT infrastructure from spam and DDoS attacks).
5.4. Compliance with the requirements of applicable international legislation and the legislation of the Republic of Kazakhstan.
6. INTERNATIONAL HOSTING AND CROSS-BORDER DATA TRANSFER
6.1. Due to the specific nature of the Operator’s activities as a global service provider and the architecture of the software used, the Operator’s information systems and main databases are physically located in certified data centers within the territory of European Union (EU) member states.
6.2. Users located in the Republic of Kazakhstan or other states, by providing their personal data through the Website’s forms, express their direct and informed consent to the cross-border transfer thereof to the territory of the European Union for subsequent processing and storage.
6.3. The Operator guarantees that the EU countries to which the data is transferred ensure reliable and adequate protection of personal data in accordance with GDPR standards. Cross-border transfer is carried out exclusively for the purposes of providing the global concierge service and performing agreements.
7. DATA RETENTION PERIODS
7.1. Personal data is stored on the Operator’s European servers for the period necessary to achieve the purposes of processing, or until the User withdraws consent:
8. RIGHTS OF DATA SUBJECTS (INCLUDING RK AND GDPR STANDARDS)
Users, regardless of their citizenship and location, have the following rights:
8.1. Right of access and information: To know about the fact, purposes, terms, and place of processing of their personal data.
8.2. Right to rectification: To demand correction or updating of incomplete, inaccurate, or outdated data.
8.3. Right to withdraw consent: To withdraw consent to data processing at any time (partially or fully).
8.4. Right to erasure (right to be forgotten): To demand destruction of personal data if the purposes of its collection have been achieved or consent has been withdrawn.
8.5. Right to restriction of processing: To demand suspension of data processing when disputing its accuracy or the lawfulness of processing.
8.6. Right to lodge a complaint: To appeal the Operator’s actions to the authorized body for the protection of the rights of personal data subjects of the Republic of Kazakhstan (Ministry of Digital Development, Innovation and Aerospace Industry of the RK — MDDIA RK), or to the supervisory authority of the User’s country of residence (for EU residents).
9. PROCEDURE FOR HANDLING REQUESTS
9.1. All requests concerning the provision of information, modification, blocking, or deletion of personal data shall be sent by Users to the Operator’s dedicated e-mail address: support@lumera.travel.
9.2. The Operator reviews requests and takes the necessary measures (provides information, makes changes, or deletes data) within 3 (three) business days from the moment the request is received. The request must contain data that allows the User to be unambiguously identified (full name, e-mail, or phone number provided at registration).
10. COOKIE POLICY
10.1. To ensure the proper functioning of international web interfaces, the Website uses cookie files.
10.2. By continuing to use the Website, the User agrees to the collection of technical cookie files. The User has the right to disable cookie support at any time in their internet browser settings, while acknowledging that some international functions of the Website may become unavailable.
11. FINAL PROVISIONS
11.1. This Policy is an open and public document available on the Internet at: https://lumera.travel/eng/privacy-policy.
11.2. The Operator has the right to unilaterally amend this Policy (for example, when expanding its business geography or when the applicable law changes). The current effective date is always indicated at the beginning of the document.
11.3. In all matters not regulated by this Policy, the Parties shall be governed by the legislation of the Republic of Kazakhstan and applicable international standards.
Approved and put into effect:
Director of LLP “LUMERA INTERNATIONAL”,
Mardanshin M. M.,
June 25, 2025
Last updated: June 25, 2025
Operator: Limited Liability Partnership “LUMERA INTERNATIONAL”,
BIN: 250640028478,
Registered Address: Republic of Kazakhstan, 050067, Almaty, Nauryzbay District, Tauzholy microdistrict, Zhansha Dosmukhamedov street, building 49.
1. GENERAL PROVISIONS
1.1. This Privacy Policy for the Collection and Processing of Personal Data (hereinafter — the “Policy”) has been developed by LLP “LUMERA INTERNATIONAL” (hereinafter — the “Operator”) in accordance with the Law of the Republic of Kazakhstan No. 94-V dated May 21, 2013 “On Personal Data and Their Protection” (hereinafter — the “Law of the RK”), and also taking into account the principles of the European Union’s General Data Protection Regulation (GDPR).
1.2. This Policy governs the procedure for the collection, processing, and protection of Users’ personal data by the Operator when using the website https://lumera.travel/eng (hereinafter — the “Website”), the application forms for purchasing prepaid concierge packages, and the partnership cooperation forms.
1.3. The Operator operates as a cross-border provider of global concierge services. The processing of Users’ data is necessitated by the need to provide an international service and to perform agreements to which the User is a party.
1.4. By using the Website and providing their data, the User confirms unconditional consent to the terms of this Policy and gives explicit consent to the cross-border transfer and processing of their data under the conditions described below.
2. KEY DEFINITIONS
2.1. Personal data — any information relating to a directly or indirectly identified or identifiable individual (Data Subject).
2.2. Data Subject (User) — an individual (client, partner, or Website visitor) whose personal data is processed by the Operator.
2.3. Processing of personal data — any action or set of actions performed with personal data, including collection, accumulation, storage, modification, supplementation, use, distribution, cross-border transfer, anonymization, blocking, and destruction.
2.4. Cross-border transfer of personal data — the transfer of personal data to the territory of foreign states, to authorities of foreign states, or to foreign individuals or foreign legal entities.
3. LIST OF PERSONAL DATA PROCESSED
The Operator processes the following categories of data:
3.1. Client data (individuals):
- First name and last name (to the extent specified in forms or correspondence);
- E-mail address;
- Contact phone number (including Telegram messenger ID/account);
- Information on transactions made, prepayment amounts, and purchased concierge packages;
- History of requests, preferences, and communications related to the provision of concierge services.
- Full name of the contact person and their position;
- Corporate e-mail address, contact phone number, and Telegram account;
- The partner company’s website address, business geography, and description of the partnership business scenario.
- IP address, cookie data, browser type and version, operating system, access date/time, and referral source (referrer).
4. PURPOSES OF COLLECTING AND PROCESSING PERSONAL DATA
Personal data is processed on lawful grounds for the following purposes:
4.1. Contract performance (primary basis): Arranging, paying for, and providing international concierge services (travel organization, booking, technical support, information support).
4.2. Communication: Sending confirmations, receipts, acts, order status notifications, and processing incoming requests and partnership proposals.
4.3. Marketing (based on consent): Informing about the Operator’s new services, packages, promotions, and special offers.
4.4. Service optimization: Analytics of Website usage, enhancing security, fraud prevention, and technical audit.
5. LEGAL GROUNDS FOR PROCESSING
The legal grounds for the Operator’s processing of personal data are:
5.1. The explicit and informed consent of the User, expressed through implied actions on the Website (checking a checkbox, submitting a completed form).
5.2. The necessity of concluding and performing an agreement (public offer) to which the User (client or partner) is a party.
5.3. The Operator’s legitimate interests (ensuring cybersecurity, protecting IT infrastructure from spam and DDoS attacks).
5.4. Compliance with the requirements of applicable international legislation and the legislation of the Republic of Kazakhstan.
6. INTERNATIONAL HOSTING AND CROSS-BORDER DATA TRANSFER
6.1. Due to the specific nature of the Operator’s activities as a global service provider and the architecture of the software used, the Operator’s information systems and main databases are physically located in certified data centers within the territory of European Union (EU) member states.
6.2. Users located in the Republic of Kazakhstan or other states, by providing their personal data through the Website’s forms, express their direct and informed consent to the cross-border transfer thereof to the territory of the European Union for subsequent processing and storage.
6.3. The Operator guarantees that the EU countries to which the data is transferred ensure reliable and adequate protection of personal data in accordance with GDPR standards. Cross-border transfer is carried out exclusively for the purposes of providing the global concierge service and performing agreements.
7. DATA RETENTION PERIODS
7.1. Personal data is stored on the Operator’s European servers for the period necessary to achieve the purposes of processing, or until the User withdraws consent:
- Client data (including financial interaction history) — for the entire term of the agreement, as well as for 3 (three) years after its termination, to protect the Operator’s legal interests.
- Partner data — for the term of the agreement and 5 (five) years after its termination.
- Technical data and cookie files — up to 12 months.
8. RIGHTS OF DATA SUBJECTS (INCLUDING RK AND GDPR STANDARDS)
Users, regardless of their citizenship and location, have the following rights:
8.1. Right of access and information: To know about the fact, purposes, terms, and place of processing of their personal data.
8.2. Right to rectification: To demand correction or updating of incomplete, inaccurate, or outdated data.
8.3. Right to withdraw consent: To withdraw consent to data processing at any time (partially or fully).
8.4. Right to erasure (right to be forgotten): To demand destruction of personal data if the purposes of its collection have been achieved or consent has been withdrawn.
8.5. Right to restriction of processing: To demand suspension of data processing when disputing its accuracy or the lawfulness of processing.
8.6. Right to lodge a complaint: To appeal the Operator’s actions to the authorized body for the protection of the rights of personal data subjects of the Republic of Kazakhstan (Ministry of Digital Development, Innovation and Aerospace Industry of the RK — MDDIA RK), or to the supervisory authority of the User’s country of residence (for EU residents).
9. PROCEDURE FOR HANDLING REQUESTS
9.1. All requests concerning the provision of information, modification, blocking, or deletion of personal data shall be sent by Users to the Operator’s dedicated e-mail address: support@lumera.travel.
9.2. The Operator reviews requests and takes the necessary measures (provides information, makes changes, or deletes data) within 3 (three) business days from the moment the request is received. The request must contain data that allows the User to be unambiguously identified (full name, e-mail, or phone number provided at registration).
10. COOKIE POLICY
10.1. To ensure the proper functioning of international web interfaces, the Website uses cookie files.
10.2. By continuing to use the Website, the User agrees to the collection of technical cookie files. The User has the right to disable cookie support at any time in their internet browser settings, while acknowledging that some international functions of the Website may become unavailable.
11. FINAL PROVISIONS
11.1. This Policy is an open and public document available on the Internet at: https://lumera.travel/eng/privacy-policy.
11.2. The Operator has the right to unilaterally amend this Policy (for example, when expanding its business geography or when the applicable law changes). The current effective date is always indicated at the beginning of the document.
11.3. In all matters not regulated by this Policy, the Parties shall be governed by the legislation of the Republic of Kazakhstan and applicable international standards.
Approved and put into effect:
Director of LLP “LUMERA INTERNATIONAL”,
Mardanshin M. M.,
June 25, 2025