Legal

Privacy Policy

Effective date: October 23, 2026

This policy explains how Luma Digital Partners LLC, doing business as Luma Partners ("Luma Partners", "we", "us"), handles personal data when you visit luma.partners, contact us, take part in a recruitment process, or are employed through our Employer of Record (EOR) services when we provide them. It is our personal data processing policy (política de tratamiento de datos personales) under Colombian law.

Who is responsible for your data

The data controller (Responsable del Tratamiento) is Luma Digital Partners LLC, a limited liability company organized under the laws of the State of Wyoming, United States.

  • Registered address: 5830 E 2nd St, Ste 7000 #25423, Casper, Wyoming 82609, USA
  • Operations: our team works from Bogotá, Colombia
  • Email: info@luma.partners
  • Phone and WhatsApp: +57 300 125 0521

Why Colombian and US rules apply

We are a US company, but our team processes personal data in Colombia, and many of the people whose data we handle are there. Colombian law applies to processing carried out in Colombian territory, so we follow Law 1581 of 2012 and Decree 1377 of 2013, now compiled in Decree 1074 of 2015. We also follow the US laws that apply to us (see "Information for US visitors and residents").

Personal data we collect

  • Website contact form: first and last name, corporate email address, phone number (optional), the service you are interested in, and your message.
  • Email and WhatsApp: your contact details and whatever you choose to tell us.
  • Business relationships: names, job titles, contact, contract, and billing details of client and supplier representatives.
  • Recruitment: CV, work history, education, skills, salary expectations, availability, location, interview notes, assessment results, and references you authorize.
  • EOR employees (when we provide EOR services in Colombia or the US): identification documents, contact details, contract and compensation data, bank details, social security and benefits affiliation, tax information, and leave records.
  • Website technical data: IP address, browser and device type, pages visited, referring URL, and approximate location, collected through cookies and similar technologies.

We do not ask for sensitive data through the website. Please do not include it in the form.

How we use your data

  • Prospects and clients: to answer inquiries, prepare proposals, deliver and invoice services, and manage the relationship. We send commercial updates only if you authorize them, and you can opt out at any time.
  • Candidates: to evaluate your profile, present it to client companies for specific roles with your knowledge, communicate about the process, and keep it on file for future openings if you authorize it.
  • EOR employees (when we provide EOR services): to manage the employment relationship, payroll, statutory benefits, and social security affiliations, keep legally required records, and report to the client company within the agreed scope.
  • Website visitors: to operate and secure the site, prevent form spam, and, if you consent, understand how the site is used.
  • All categories: to comply with the law and to establish or defend legal claims.

Authorization

We process personal data with your prior, express, and informed authorization, except where the law does not require it (for example, public data or a request from an authority). You may give it in writing, electronically, or through clear conduct. Our contact form includes a required checkbox, linked to this policy, through which you give this authorization. Silence never counts as authorization. We keep proof of each authorization, including the form submission record.

Sensitive data and minors

Some data, such as employment-related health information (medical leave, occupational exams), union membership, or biometric data, is sensitive. We process it only when the law permits, mainly for employment obligations when we provide EOR services, and we will tell you which data is sensitive and why. You are not required to authorize its processing, and no activity depends on it unless the law requires it.

Our website and services are directed to businesses and adults, and we do not knowingly collect data from minors. The only exception is data about an EOR employee's minor dependents for benefits enrollment, which we process only when the law requires it, in the minor's best interest, and with authorization from their legal representative.

Our role in recruitment and EOR

In most cases we are the controller. When a client company decides on part of the processing (for example, choosing a candidate or receiving payroll records), we act as a processor (Encargado del Tratamiento) under a written agreement and the client's instructions. When we provide EOR services, we may also be a controller of employee data as the legal employer. Each service agreement defines the roles, and you may contact us or the client company to exercise your rights.

Who we share data with

We do not sell personal data. We share it only as needed with:

  • Service providers acting as our processors, such as Squarespace (website hosting) and our email, storage, payroll, and accounting tools. They may use the data only to serve us.
  • Client companies, as needed for a recruitment process you join or the EOR services they contract.
  • Government and social security entities, when the law requires it.
  • Professional advisors (legal, tax, accounting) bound by confidentiality.
  • A buyer or successor in a merger or similar transaction, subject to this policy.

International transfers between the US and Colombia

Because we are a US company with a team in Colombia, your data may be stored or accessed in the United States, Colombia, and other countries where our providers operate. In particular:

  • Our website is hosted by Squarespace, a US provider that processes form submissions and website data on our behalf, as a processor under its data processing terms.
  • Our Bogotá team accesses data stored with US providers, and we share recruitment and EOR information with US client companies.

When we send data to processors abroad, contracts require them to protect it and use it only for our purposes, as Colombian regulations require. We transfer data to other controllers in countries that may not offer adequate protection only with your authorization or under another legal exception, such as performing a contract with you. By submitting your data after being informed of this policy, you authorize these transfers for the purposes described here.

Cookies and similar technologies

Our website uses:

  • Strictly necessary Squarespace cookies that run the site, keep it secure, and remember your cookie choices.
  • Google reCAPTCHA on the contact form, which uses device and interaction data to detect spam.
  • Functional and analytics cookies from Squarespace's built-in site analytics, which help us understand in aggregate how visitors use the site.

A Squarespace cookie banner lets you accept all cookies, reject non-essential ones, or manage your preferences. Non-essential cookies, including analytics, are used only if you consent through the banner. You can change your choice at any time through the "Preferences" option or your browser settings. Google's privacy policy applies to reCAPTCHA.

The site links to our LinkedIn page (https://www.linkedin.com/company/luma-co/) and to WhatsApp, which have their own privacy policies.

How long we keep data

We keep data only as long as its purpose requires, and then delete or anonymize it, unless the law or a contract requires us to keep it longer. As a general rule:

  • Prospects and form submissions: up to 24 months after our last interaction.
  • Clients and suppliers: during the relationship and then for the periods required by commercial and tax laws.
  • Candidates: during the process and, if you authorize it, up to 24 months afterwards for future openings.
  • EOR employees: during employment and then for the periods required by labor, social security, and tax laws.

Our databases remain in effect while we carry out the activities described here.

Security

We use technical, human, and administrative measures suited to a small team, including access restrictions, strong authentication, and confidentiality commitments, to protect data against loss, misuse, and unauthorized access. No system is completely secure. If an incident affects your data, we will notify you and the authorities when the law requires it.

Your rights

Under Colombian law, as a data subject (Titular) you have the right to:

  • Know, update, and rectify your data, including partial, inaccurate, or misleading data.
  • Request proof of your authorization, unless it was not legally required.
  • Be informed, on request, about how we have used your data.
  • Revoke your authorization and/or request deletion of your data when processing does not respect legal principles, rights, and guarantees, unless you have a legal or contractual duty to remain in our database.
  • Access your personal data free of charge.
  • File complaints with the Superintendencia de Industria y Comercio (SIC), Colombia's data protection authority, after first submitting a query or claim to us.

How to exercise your rights

Our privacy area handles all requests. Write to info@luma.partners with the subject line "Personal data request", or send a letter to our registered address. Include your full name, a way to verify your identity, a contact address, a description of your request, and any supporting documents. Successors, legal representatives, and attorneys-in-fact may also submit requests with proof of their capacity.

  • Queries (consultas), to know what data we hold or how we use it: we answer within 10 business days of receipt. If we need more time, we will tell you why and answer within 5 additional business days.
  • Claims (reclamos), to correct, update, or delete data, revoke authorization, or report a possible breach of the law: we answer within 15 business days from the day after receipt. If we need more time, we will tell you why and answer within 8 additional business days. If a claim is incomplete, we will ask you to complete it within 5 days of receipt; if you do not respond within 2 months, it is considered withdrawn. While a complete claim is being processed, we will mark the data as "claim in process".

Information for US visitors and residents

We are organized in Wyoming, and many of our clients and visitors are in the United States. Depending on your state of residence, you may have rights under applicable state privacy laws. These may include the rights to know, access, correct, delete, or obtain a copy of your personal information, and to opt out of certain uses of it. Whether they apply depends on your state and whether its law covers us. We will respond as applicable law requires and will not discriminate against you for making a request.

We do not sell personal information or use sensitive information to infer characteristics about you. You can reject non-essential cookies at any time through our cookie banner. To make a request, follow the steps in "How to exercise your rights" and tell us your state of residence. We may need to verify your identity before responding.

Changes to this policy

If we make substantial changes, particularly to the controller's identity or the purposes of processing, we will notify you through the website or by email before they take effect and ask for new authorization when the law requires it. The effective date above shows the latest version.