Privacy Policy

Lumos IP – Public Lighting Management values privacy and the protection of personal data. This Policy explains, in plain language, what data we process on the website and on the Lumos IP – Public Lighting Management platform (web version and field app), for what purpose, for how long, and how you can exercise your rights, in accordance with Law No. 13,709/2018 (General Data Protection Law – LGPD).

1. Who is responsible for the data

• Website and sales contact (forms, demos, trial): Lumos IP – Public Lighting Management is the data controller.
• Platform and field app: the contracting company (for example, the public lighting service provider) decides which data about its employees and operations is recorded and is the controller. Lumos IP – Public Lighting Management acts as the processor, processing the data only to provide the contracted service and in accordance with the company's instructions.

2. Data we process

Where	Data
Website and forms	Name, email, phone number, company, job title, message sent, and browsing data (IP address, device, pages visited).
Platform account	Name, username, email, CPF or CNPJ, employee ID (when the company uses it), access profile, and company. The password is stored irreversibly (only its cryptographic hash).
Access security	Log of sign-in attempts (date, result, IP address, and browser), authenticator app key (stored encrypted), and recovery codes (stored only as a cryptographic hash). The username entered at sign-in is recorded only as a hash, never as plain text.
Field operations	Work orders, photos and execution records, signatures, identification and photo of crew members at crew check-in, and the device's location when the field app uses it to record service calls and routes, as configured by the company.
Notifications	Browser or device identifier used to send important operational alerts.
Citizen service	Data provided when requesting public lighting services (for example, name, contact details, and address of the location), depending on the channel used by the municipality or concessionaire.

3. What we use it for and the legal basis

• Providing the service and support: performance of a contract (art. 7, V).
• Protecting accounts and preventing fraud (authenticator, attempt limits, access logs): legitimate interest and fraud prevention and security of the data subject (art. 7, IX, and art. 11, II, g, where applicable).
• Sales contact and demos: consent or preliminary procedures related to a contract (art. 7, I and V).
• Complying with legal and regulatory obligations: art. 7, II.
• Improving the product, using aggregated data whenever possible: legitimate interest (art. 7, IX).

4. Crew photos and location

At crew check-in, the app records a live photo of each member to confirm who was present. This photo is used to audit the operation; we do not use automatic facial recognition to identify people. Photos are kept for 30 days and then automatically deleted. Location is used only for service, routing, and proof-of-service functions, within the limits set by the contracting company.

5. Sharing

We do not sell personal data. We may share it with:

• the contracting company, which is the controller of the platform data;
• essential providers acting under our instructions: hosting and infrastructure, file storage, content delivery, notification delivery, and analytics tools;
• public authorities, when required by law or court order.

Some of these providers may process data outside Brazil. In those cases, we adopt the safeguards provided for in the LGPD (art. 33) for international transfers.

6. How we protect data

• Sign-in to the web platform requires a password and an authenticator app code.
• Limit on access attempts and temporary lockout after repeated attempts.
• Protected connection (TLS), passwords stored only as a cryptographic hash, and encrypted authenticator keys.
• Profile-based access: each person sees only what their role and company allow; password and authenticator resets are performed only by an administrator.
• Access logs for auditing and incident investigation.

In the event of a security incident that may cause relevant risk or harm, we will notify the National Data Protection Authority (ANPD) and the affected data subjects, under art. 48 of the LGPD.

7. How long we keep data

Data	Retention period
Log of sign-in attempts	180 days
Crew check-in photos	30 days
Sales contact (website)	As long as the relationship lasts or until you request deletion
Operation and account data	For the duration of the contract and for the period required by law or necessary to defend legal claims

After these periods, the data is deleted or anonymized.

8. Your rights

Under art. 18 of the LGPD, you may request:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law;
• portability, where applicable;
• information about the parties with whom we share your data;
• withdrawal of consent, when consent is the legal basis;
• objection to processing carried out without consent, if there is a violation of the law.

If your data is on a contracting company's platform, the request may also be made to that company, which is the controller; we help fulfill the request. We respond within 15 days. You may also file a complaint with the ANPD (gov.br/anpd).

9. Cookies and browser storage

On the website we use cookies to improve the experience and measure traffic. On the platform we use only what is needed to keep your session and remember preferences (such as theme and menu), plus temporary storage in the tab during sign-in, which never stores your password. You can block cookies in your browser, but parts of the service may stop working.

10. Children and adolescents

Our services are aimed at companies and public bodies and are not intended for people under 18 years of age.

11. Changes to this policy

We may update this Policy. The date at the top shows the latest revision, and relevant changes will be announced on the platform or by email.

12. Data protection officer and contact

To exercise your rights or ask questions about privacy:

• Data protection officer (DPO) email: [email protected]
• Support: [email protected] · WhatsApp +55 31 98697-5086
• City: Belo Horizonte/MG