Privacy notice

1. Who we are

Lumaspace is operated by Lantern Digital Ltd, a company registered in Scotland.

Company number: [COMPANY NUMBER]

Email: hello@lumaspace.co.uk

For the purposes of UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Lantern Digital Ltd is the data controller for the personal information described in this notice unless we tell you otherwise.

References in this notice to “Lumaspace”, “we”, “us” or “our” mean Lantern Digital Ltd.

2. The information we may collect

The information we collect depends on how you use Lumaspace.

Information you give us

This may include:

• your name;
• email address and contact details;
• account and login information;
• information you provide when joining our waitlist or contacting us;
• funeral and gathering information;
• information about family members, friends and other people involved in a funeral;
• invitation and attendance information;
• RSVP responses;
• photographs, memories, messages and other content uploaded to a Lumaspace;
• information contained in an obituary, funeral notice or other content;
• information you choose to provide through planning tools, checklists or other Lumaspace features; and
• communications you have with us.

Some information entered into Lumaspace may relate to other living people. If you provide information about another person, you should only provide information that is appropriate and reasonably necessary for the purpose for which you are using Lumaspace.

Information about someone who has died

A Lumaspace will naturally contain information about the person who has died, such as their name, photograph, date of death, funeral arrangements and memories about their life.

UK GDPR generally applies to identifiable living individuals rather than deceased people. However, information about a person who has died may also reveal information about living family members, friends or other individuals. Where it does, we treat that information in accordance with applicable data protection law.

Information collected automatically

When you use our website or services, we may automatically receive limited technical information such as:

• IP address;
• device and browser type;
• operating system;
• pages or features accessed;
• dates and times of access;
• security and diagnostic information; and
• cookie or similar technology information where applicable.

Where required by law, we will ask for your consent before using non-essential cookies or similar technologies.

3. Planning tools and information stored on your device

Some Lumaspace tools, including our funeral budget planner and checklist, may be available without creating an account.

Where we tell you that information is stored locally on your device, it remains on that device and is not transmitted to or stored by Lumaspace unless you choose to use a feature that requires it to be sent to us, such as saving it to an account.

If you create an account and choose to save a plan, the relevant information will be stored securely with your account so that you can access it again.

We do not sell information entered into our planning tools.

4. Lumaspaces and information shared by families

Lumaspace allows organisers to create a digital space relating to a funeral and to share information with family members, friends and other invited people.

Depending on the choices made by the organiser, a Lumaspace may contain:

• funeral service details;
• wake or gathering details;
• funeral notices or obituary information;
• livestream information;
• photographs;
• memories and tributes;
• attendance and RSVP information;
• charity or donation information; and
• other information relating to the funeral or person who has died.

Some information may be visible publicly and other information may only be available to authorised or approved users.

We provide privacy and access controls to help organisers decide who can see information. Organisers should consider carefully whether information is appropriate to share before making it public or sharing it with other users.

Where access to a private Lumaspace requires verification or approval, we may process identity and contact information for the purpose of authenticating the user, managing access and protecting the privacy and security of the Space.

5. Information provided about other people

An organiser may provide us with information about another person, for example by adding someone to an invitation list.

This may include their name, email address and relationship to the funeral or organiser.

In those circumstances, we receive the information from the organiser rather than directly from the individual.

We use that information only as reasonably necessary to provide the relevant Lumaspace functionality, such as sending an invitation, providing funeral information, managing access or recording an RSVP.

Where required, we will provide appropriate privacy information to individuals when we first communicate with them.

6. How we use personal information

We may use personal information to:

• provide and operate Lumaspace;
• create and manage user accounts;
• save funeral plans and checklists;
• create and administer Lumaspaces;
• send invitations and funeral communications requested by organisers;
• manage access to private content;
• process RSVPs and attendance information;
• allow users to submit memories, photographs and other content;
• moderate or administer submitted content;
• respond to enquiries and provide support;
• maintain the security and integrity of our services;
• diagnose technical problems and improve reliability;
• understand how our services are being used;
• improve and develop Lumaspace;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims; and
• send marketing or product communications where we have permission or are otherwise permitted by law to do so.

We do not sell personal information.

7. Our lawful bases for using personal information

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we rely on one or more of the following:

Contract

Where processing is necessary to provide a service you have requested or to take steps at your request before entering into a contract.

For example, this may apply when we create and administer your Lumaspace account.

Legitimate interests

We may process information where this is necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and interests.

These interests may include:

• operating and improving Lumaspace;
• providing functionality requested by organisers;
• maintaining the security of our service;
• preventing misuse or fraud;
• understanding and improving the performance of our services; and
• communicating effectively with users.

Where we rely on legitimate interests, we consider the nature of the information, the reasonable expectations of the individuals concerned and the potential impact of the processing.

Consent

We rely on consent where required, including for certain marketing communications, non-essential cookies and any other processing for which consent is the appropriate lawful basis.

Where we rely on consent, you can withdraw it at any time.

Legal obligation

We may process personal information where necessary to comply with a legal or regulatory obligation.

8. Sensitive information

Because Lumaspace is used in connection with bereavement and funerals, information entered by users could sometimes reveal sensitive information about a living person.

For example, content could reveal information concerning someone's health, religious or philosophical beliefs, ethnicity or other information treated as “special category data” under UK GDPR.

We do not ask users to provide sensitive information unless it is necessary for a particular feature or purpose.

Where Lumaspace intentionally processes special category personal information, we will ensure that both an appropriate lawful basis and an applicable condition under data protection law are in place. Where appropriate, this may include obtaining explicit consent.

We ask users not to include unnecessary sensitive information about other living people when creating notices, memories or other content.

9. Waitlist and product updates

If you join the Lumaspace waitlist, we may collect your name, email address and any information you choose to provide about your circumstances or interest in Lumaspace.

We use this information to:

• administer the waitlist;
• tell you about the availability and launch of Lumaspace;
• understand demand for the service; and
• help us improve the product.

Where communications amount to direct marketing, we will comply with applicable electronic marketing and data protection requirements.

You can unsubscribe from marketing communications at any time using the unsubscribe option provided or by contacting us at hello@lumaspace.co.uk.

10. Who we share information with

We do not sell your personal information.

We may share information with carefully selected organisations that help us provide and operate Lumaspace. These may include providers of:

• website and application hosting;
• cloud infrastructure and database services;
• email and communications services;
• authentication and account services;
• analytics services;
• customer support and operational tools;
• security and fraud-prevention services;
• payment services, if applicable; and
• professional services such as legal, accounting or insurance advisers.

These organisations may process personal information on our behalf and are required to handle it appropriately and securely.

We may also disclose information:

• where you ask us to;
• where it is necessary to provide a feature or integration you choose to use;
• where required by law, regulation, court order or a competent authority;
• to establish, exercise or defend legal rights; or
• in connection with a merger, acquisition, financing, restructuring or sale of all or part of our business, subject to appropriate safeguards.

Where Lumaspace links to an external service, such as a charity, funeral director, livestream provider or other third-party service, that organisation may process information under its own privacy notice.

11. International transfers

Some of the organisations we use to operate Lumaspace may process information outside the United Kingdom.

Where personal information is transferred internationally, we take steps required by applicable data protection law to ensure that it receives an appropriate level of protection.

Depending on the destination and provider, this may include relying on UK adequacy regulations or appropriate contractual safeguards approved under UK data protection law.

You can contact us if you would like further information about safeguards relating to international transfers of your personal information.

12. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide our services and meet legal, accounting, security and regulatory requirements.

Different types of information may therefore be retained for different periods.

In determining retention periods, we consider:

• why the information was collected;
• how long a user wishes to maintain a Lumaspace;
• whether an account remains active;
• the nature and sensitivity of the information;
• security and fraud-prevention requirements;
• legal or regulatory requirements; and
• whether information is required to resolve a dispute or establish or defend legal claims.

Where information is no longer required, we will delete or anonymise it in accordance with our retention procedures.

We intend to provide users with appropriate controls for managing and deleting their account and content.

13. Security

We take appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include, where appropriate:

• encryption;
• secure authentication;
• access controls;
• separation of public and private content;
• secure hosting infrastructure;
• monitoring and logging;
• backup and recovery procedures; and
• limiting access to personal information to people who reasonably require it.

No online service can guarantee absolute security. If we become aware of a personal data breach, we will assess and respond to it in accordance with our legal obligations.

14. Public and private information

Lumaspace may allow an organiser to choose whether certain information is public or restricted.

Information marked or configured as public may be accessible to anyone who can access the relevant page and may potentially be copied, shared or indexed outside Lumaspace.

Private information is intended to be available only to users who have been given or approved for the relevant access.

We encourage organisers to use private settings where information is intended only for family members, friends or invited guests.

15. Memories, photographs and user-generated content

Users may be able to submit photographs, memories, messages or other content to a Lumaspace.

The organiser may have the ability to review or approve content before it becomes visible to others.

If you submit content concerning another living person, you should respect their privacy and should not submit information that is unnecessarily sensitive, confidential, unlawful or inappropriate.

If you believe content on Lumaspace contains personal information about you that should be corrected or removed, please contact us at hello@lumaspace.co.uk.

16. Cookies and similar technologies

Lumaspace may use cookies, local storage and similar technologies to operate our website and services.

Some technologies are strictly necessary for the website or service to function and do not require consent.

Where consent is required for analytics, advertising or other non-essential technologies, we will not use those technologies until you have made the relevant choice.

You can change your cookie preferences through the controls provided on our website.

Further information about the technologies we use will be provided in our Cookie Notice.

17. Your data protection rights

Depending on the circumstances and the lawful basis on which we process your information, you may have the right to:

• access personal information we hold about you;
• correct inaccurate or incomplete personal information;
• erase your personal information in certain circumstances;
• restrict how we use your information in certain circumstances;
• object to certain uses of your personal information;
• receive or transfer certain information in a portable format;
• withdraw consent where processing is based on your consent; and
• raise concerns about how your personal information is being used.

These rights are not absolute and may depend on the circumstances.

You can exercise your rights by contacting:

hello@lumaspace.co.uk

We may need to ask for information to confirm your identity before fulfilling a request.

We will not normally charge you for exercising your data protection rights.

Your right to object

Where we process your personal information on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.

You also have the right to object at any time to the use of your personal information for direct marketing.

18. Complaints

If you have a concern about how we use your personal information, please contact us first at hello@lumaspace.co.uk and we will try to resolve it.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

Website: ico.org.uk

Telephone: 0303 123 1113

You can contact the ICO at any time, although they may recommend that you raise your concern with us first.

19. Children

Lumaspace is primarily designed for adults organising or participating in funeral arrangements.

A funeral may, however, involve children and young people, and information about them may be included by family members.

We ask organisers to take particular care when sharing information or photographs relating to children and to use appropriate privacy settings.

If Lumaspace introduces functionality intended for children or determines that its online service is likely to be accessed directly by children, we will review the relevant functionality and privacy arrangements against the additional requirements applying to children's personal information.

If you are a parent or guardian and have concerns about information relating to a child on Lumaspace, please contact hello@lumaspace.co.uk.

20. Automated decision-making

We do not currently make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects.

If this changes, we will update this notice and provide the information required by law.

21. Changes to this Privacy Notice

We may update this Privacy Notice as Lumaspace develops, our services change or legal requirements evolve.

When we make material changes, we will take reasonable steps to bring them to the attention of affected users before the changes take effect where required.

The date at the top of this notice shows when it was last updated.

22. Contact us

If you have any questions about this Privacy Notice, how we use personal information or your data protection rights, please contact:

Lumaspace / Lantern Digital Ltd

Email: hello@lumaspace.co.uk