Privacy Policy

1.1 Account and Company Data
Business name, GSTIN, address, bank account details, and other company profile information you provide.

1.2 User Data
Names, email addresses, phone numbers, and role information for individuals you grant access to (Leadership, HR, Accountant, CA users).

1.3 Employee Data
Where you use our HR and Payroll features, we process personal data of your employees on your behalf, which may include: names, contact details, salary and bank account information, PAN, leave and attendance records, and other HR-related data you choose to enter.

1.4 Financial and Business Data
Transaction records, invoices, expenses, income, GST-related figures, loan records, and other business financial data you enter into the Platform.

1.5 Usage Data
Technical information such as login activity, IP address, browser type, and general usage patterns, collected to maintain platform security and improve our services.

For Company and User Data, Lumuxo acts as the Data Fiduciary under the DPDP Act.

For Employee Data you enter into the Platform, your company is the Data Fiduciary, and Lumuxo acts as a processor on your instructions — you are responsible for ensuring you have appropriate consent or lawful basis from your employees to process their personal data through our Platform, and for responding to your employees' data rights requests regarding their own information.

We use the data described above to:

• Provide, operate, and maintain the Platform and its features (payroll processing, invoicing, GST computation support, reporting, etc.);
• Communicate with you regarding your account, support requests, or service updates;
• Improve and secure the Platform;
• Comply with applicable legal obligations.

We do not sell your data or your employees' data to third parties, and we do not use your business data to train external, third-party AI models without your consent.

4.1. Your data is stored on secure cloud infrastructure. We employ technical safeguards including encryption, access controls, and row-level data isolation designed to ensure that each company's data remains segregated from other companies using the Platform.

4.2. Access to your data within Lumuxo Books is governed by the role-based permission system you configure (Leadership, HR, Accountant, CA). We restrict our own internal team's access to customer data to what is necessary for support and platform operation.

4.3. While we take reasonable and industry-standard measures to protect your data, no system can be guaranteed to be completely secure, and we cannot guarantee absolute security against all possible threats.

We may share data with trusted third-party service providers who help us operate the Platform, including cloud hosting/database providers, email delivery services, and (where you enable such features) messaging service providers. These providers are contractually obligated to handle your data in accordance with applicable data protection standards and only for the purposes of providing services to us.

We do not permit these providers to use your data for their own independent purposes.

Some of our infrastructure providers may store or process data on servers located outside India. Where this occurs, we take steps to ensure such transfers are conducted in a manner consistent with applicable Indian data protection law.

We retain your data for as long as your account remains active, and for a reasonable period thereafter to allow you to export your data, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your data in accordance with Section 9 below, subject to any legal retention requirements.

We may use cookies or similar technologies to maintain your login session and understand basic usage patterns. We do not use third-party advertising trackers.

Subject to the DPDP Act and other applicable law, you (and, where applicable, your employees whose data you have entered) have the right to:

• Access the personal data we hold;
• Request correction of inaccurate data;
• Request erasure of personal data, subject to our legal retention obligations;
• Withdraw consent where processing is based on consent;
• Lodge a grievance regarding how your data has been handled.

Requests regarding employee data should generally be directed to your company (as the Data Fiduciary for that data) in the first instance; your company may then coordinate with us as needed.

In accordance with the DPDP Act, you may direct any privacy-related questions, complaints, or grievances to our Grievance Officer:

Name: Joshua Thomas
Email: Support@lumuxo.com
Address: 97-1, ST3, Nehruji Nagar, Gandhigram, 624302

We will make reasonable efforts to respond to and resolve grievances within the timeframe required by applicable law.

Lumuxo Books is intended for use by business entities and their adult representatives. We do not knowingly collect personal data from individuals under the age of 18 for account registration purposes.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will make reasonable efforts to notify you of material changes.

If you have questions about this Privacy Policy, please contact us at: Support@lumuxo.com