Privacy Policy

This policy explains how LMXLED Ltd handles personal information when you use the LUMAX Lighting website at lumaxled.com, including the enquiries you send us through the contact form and the Project Spec Builder. It also covers the records we keep about those enquiries, the providers who process them for us, and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Who we are

LMXLED Ltd is the data controller for the personal information described in this policy. LMXLED Ltd is registered in England and Wales under company number 08499159, with its registered office at Unit 8 Park Place, Newdigate Road, Harefield, UB9 6EJ, and trades as LUMAX Lighting.

You can contact us about anything in this policy at info@lmxled.co.uk or on +44 1895 348 835, or write to us at our registered office: Unit 8 Park Place, Newdigate Road, Harefield, UB9 6EJ.

LMXLED Ltd is not required to notify the Information Commissioner's Office or to pay the ICO data protection fee. We checked our position using the ICO's data protection fee self-assessment, which confirmed that our processing falls within a fee exemption. We will review that position if our processing changes.

We have not appointed a Data Protection Officer, because our processing does not require one. Privacy questions come to info@lmxled.co.uk, where they are handled by our data protection contact.

2. What this policy covers

The LUMAX Lighting website at lumaxled.com, including:

• the contact form on the Contact page
• the Project Spec Builder, which submits a project specification into the same enquiry system
• any email or telephone correspondence that follows from those enquiries

The website can be read without an account. We do not offer public registration or customer logins, so we hold no account or password data for website visitors. This policy does not cover our Terms & Conditions of supply or the Product Warranty, which are separate documents, or other companies' websites that we link to.

3. Information we collect

When you submit the contact form we collect the details you enter:

• your name, work email address and company
• your telephone number, if you give us one
• the product or enquiry type, the subject and the message you write
• a reference number that we generate and use to track the enquiry

When you submit a specification through the Project Spec Builder we collect your name, work email address and company, together with the specification itself: the deployment environment, run length, tube length, input voltage and hazard classification, the product we recommend for that combination, and your project notes. The specification and notes are stored with the enquiry as well as being sent to us by email.

Both forms include a hidden anti-spam field that people cannot see or focus. Automated submissions sometimes fill it in; those submissions are discarded and nothing is stored. We do not use that field to identify anyone.

We do not record your IP address in our enquiry records, and we use no analytics or tracking technologies on this website, so we do not build a profile of your browsing. We do not ask for, and do not want, special category information such as health data, so please do not include it in your message.

Our hosting platform does process standard technical request data, such as your IP address, in order to deliver the website securely and block abuse. It is not used to track you across other websites and is not linked to your enquiry record.

4. Why we collect it and our lawful basis

Under the UK GDPR we need a lawful basis for each purpose. The purposes and bases are:

• Responding to your enquiry, preparing quotations and technical proposals, and taking the steps you ask for before entering into a contract: Article 6(1)(b) (performance of a contract, or steps prior to entering one) and Article 6(1)(f) (our legitimate interests in responding to business enquiries).
• Communicating with you about your project by email or telephone: Article 6(1)(b) and Article 6(1)(f), as above.
• Keeping a record of enquiries and correspondence so we can support you, manage our work and answer later questions: Article 6(1)(f), our legitimate interests in running our business and keeping proper records.
• Keeping the website secure and free of automated abuse, through server-side rate limiting and the hidden anti-spam field: Article 6(1)(f), our legitimate interests in protecting the website and our mailbox from misuse.
• Meeting legal, tax and accounting obligations where an enquiry leads to a contract or order: Article 6(1)(c), compliance with a legal obligation.
• Marketing our own products and services to business contacts: Article 6(1)(f) (our legitimate interests) where the recipient is an incorporated organisation, and, where the Privacy and Electronic Communications Regulations treat the recipient as an individual subscriber, the soft opt-in or Article 6(1)(a) (your consent). You can object or opt out at any time.

We do not use your information for automated decision-making or profiling, and we do not use it to serve advertising to you.

5. Where your information is held and who processes it

The website and its enquiry database run on the Base44 platform. Base44 hosts the website, stores the enquiry records and delivers the notification emails to us. Base44 acts as our data processor, and we hold a data processing agreement with them, available at base44.com/dpa.

Base44 stores app data in the United States by default, so your enquiry information is transferred outside the UK. Base44's data processing terms, and those of the vendors it uses, are governed by approved transfer safeguards such as the Standard Contractual Clauses with the UK Addendum, the UK Extension to the EU-US Data Privacy Framework, and adequacy regulations, as applicable to each provider. A current list of Base44's subprocessors is published in the Base44 Trust Center at trust.base44.com.

Notification emails about your enquiry are delivered to our own mailboxes at lmxled.co.uk and held there under the retention rules in section 7. Our business email is provided by a third-party email host acting as our processor.

Enquiry records are visible only to authorised LUMAX Lighting personnel: platform access to the enquiry data is restricted to administrator accounts that our staff sign in to. We do not sell personal information, we do not share it for other organisations' marketing, and we disclose it to no one else except where the law requires it, for example to HMRC or a court.

6. Enquiry notifications, replies and marketing

When you submit an enquiry, your details are stored in our enquiry database first, and a notification email is then sent to our engineering inbox. The primary recipient is info@lmxled.co.uk, with darren@lmxled.co.uk as a backup, so the message reaches our own team and no one else. If a mailbox cannot accept the message, the platform retries it automatically. The enquiry is already saved, so nothing is lost.

We reply using the contact details you gave us, by email or telephone, to discuss your requirements, send specifications or quotations, and answer questions.

We market only to business contacts, and only about our own products and services. We do not sell your details, and we never share them so that another company can market to you.

The Privacy and Electronic Communications Regulations (PECR) distinguish between corporate subscribers and individual subscribers. Most of the organisations we deal with are corporate subscribers: limited companies, limited liability partnerships, public limited companies and similar incorporated bodies. PECR does not require prior consent for marketing email sent to a corporate subscriber at its business address, so we may send relevant product, technical and project information to a contact at one of those organisations.

Sole traders and unincorporated partnerships are treated as individual subscribers under PECR, even where we hold their business details. We email those contacts only where we have a valid soft opt-in or their specific consent.

The soft opt-in applies where we obtained the contact's details while discussing a potential or actual order, the message is about our own similar products, a simple way to refuse was offered when the details were collected, and every message includes a way to opt out. We rely on it only where each of those conditions is met, and where they are not met we ask for consent before sending any marketing.

Under the UK GDPR every marketing message needs a lawful basis, whichever type of recipient it goes to. Ours is our legitimate interests in promoting our own products, services and technical expertise to the businesses we deal with (Article 6(1)(f)), balanced against your rights and expectations: our marketing is business to business, it concerns our own products, and it is relevant to the recipient's role. Where we rely on consent instead, the basis is Article 6(1)(a).

You have the right to object to direct marketing at any time, and we honour that right without exception. Use the unsubscribe link in any message, reply to us, or email info@lmxled.co.uk, and we will stop marketing to you. We then keep only a note of your email address and your objection, so that the instruction continues to be respected.

We do not make marketing calls to numbers registered with the Telephone Preference Service or the Corporate Telephone Preference Service.

7. How long we keep your information

Different records are kept for different reasons, so the periods below differ.

• Records we are legally required to keep: where an enquiry leads to a contract, an order or an invoice, the transaction records that support it, including the correspondence that forms part of the contract, are kept for six years from the end of the relevant financial year, because tax and company law require us to retain accounting and related records for that period. This applies to the records behind a transaction, not to every enquiry we receive.
• Ordinary enquiry correspondence that does not lead to a transaction is not subject to that legal requirement. We keep it only while we need it for the purpose you gave it to us, normally while the enquiry or project is live and for a reasonable period afterwards in case you come back to us or we need to answer a later question about it.
• Enquiries with no prospect of proceeding are held only while there is a reasonable prospect of the work going ahead.
• A request not to receive marketing, or an objection to processing, is held as your email address and the fact that you asked us to stop. That record is kept so that the instruction can be honoured, and for nothing else.

Each month a report is produced for our own team listing the enquiries recorded as unsuccessful, meaning those marked Lost / Not Proceeding or No Response, where there has been no recorded activity for 24 months. The report identifies those enquiries for review by our team. It does not delete anything itself, and automatic deletion is not enabled, so an enquiry is only removed from our database when a member of staff deletes it. Where an enquiry is kept, we record the reason, and a retained enquiry continues to appear on later reports so that the position can be revisited.

The monthly report contains the enquiry details and is delivered to our mailboxes, where it is held under the same principles.

If you ask us to delete an enquiry, we will do so unless we are required to keep it, and we will confirm what we have done.

8. Keeping your information secure

Enquiry data is transmitted over encrypted connections (HTTPS) and stored in the website's database on the Base44 platform. Access is restricted to authorised LUMAX personnel through individual administrator sign-ins, and the notification pipeline delivers only to our own mailboxes. Public submissions are protected by server-side rate limiting and the hidden anti-spam field, so the mailbox and database cannot be flooded by automated submissions. Our platform provider maintains its own security programme, described in the Base44 Trust Center.

If you think your information has been handled insecurely, please tell us at info@lmxled.co.uk so that we can investigate.

9. Your rights

Under the UK GDPR you have the right to:

• be informed about how we use your information, which this policy does
• ask for a copy of the information we hold about you (access)
• have inaccurate information corrected (rectification)
• ask us to delete information we no longer need (erasure)
• ask us to restrict what we do with it (restriction)
• receive information you gave us in a portable format (portability)
• object to processing based on our legitimate interests, and to object to direct marketing at any time
• withdraw any consent you have given, where consent is the basis for a particular use

To exercise any of these rights, email info@lmxled.co.uk or write to us at the address in section 1. We will respond within one month. If a request is complex, or we have received several from you, we may extend that by up to two months and will tell you if so. There is normally no charge. If a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, and we will explain why.

10. Complaints

We would rather resolve a concern directly, so please contact us first at info@lmxled.co.uk. You also have the right to complain to the Information Commissioner's Office, which supervises data protection law in the UK: ico.org.uk, telephone 0303 123 1113, or write to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

11. Cookies

This website uses no advertising or tracking cookies and no analytics. The only browser storage is a small set of non-personal configuration values that let the site run, and a technical sign-in session for the staff who maintain the site. Our Cookie Policy explains both in full: lumaxled.com/cookie-policy.

12. Changes to this policy

We review this policy when our website, our providers or our practices change. The date at the top of this page shows the current version, and the latest version applies to the information we hold. If a change materially affects how we use your information, we will highlight it on this page.

13. Contact

Email info@lmxled.co.uk, telephone +44 1895 348 835, or write to LUMAX Lighting, Unit 8 Park Place, Newdigate Road, Harefield, UB9 6EJ.