Businesses trust Lumo with their customers' chats and orders. This policy explains how The Apollo Project (PVT) Ltd ("we", "us") protects that data and meets Sri Lanka's Personal Data Protection Act, No. 9 of 2022 ("PDPA"). It sits alongside our Privacy Policy and Terms of Service.
1. Our role
- For shopper chats and orders, the business using Lumo is the controller. It decides why the data is collected. We are its processor: we handle the data only to run Lumo for that business and only as it instructs.
- For our own customers, team members and website visitors, we are the controller.
2. The principles we follow
- Lawful and fair. We only process personal data for a clear, lawful reason.
- Only for the stated purpose. Shopper data is used to serve that business's customers, nothing else.
- Only what's needed. Lumo asks shoppers only for what an order needs, such as name, address and phone number. It never asks for card numbers or passwords.
- Accurate. Businesses can correct order details in the portal, and we fix errors we're told about.
- Not kept longer than needed. See the retention periods below.
- Secure. See the safeguards below.
- Accountable. We keep records of how we process data and review this policy at least once a year.
3. What we commit to businesses
- Each business's data is kept separate. One business can't see another's chats, and we never use one business's chats to train another's bot.
- We don't sell shopper data or use it for our own marketing.
- Only our team members who need access to set up, train or support a bot can see that business's chats, and they are bound to keep them confidential.
- We help businesses answer requests from their shoppers to see, correct or delete their data.
- Businesses can export their chats and orders at any time.
- A business can ask us to sign a data processing agreement. Email us and we'll send one.
4. Security safeguards
- Data is encrypted in transit between WhatsApp, our servers, the portal and connected tools.
- Portal access requires a login, and each business's team can see only its own account.
- Staff access to systems is limited by role and removed when no longer needed.
- Passwords, keys and access tokens for connected services are stored securely and never shared in chats.
- We keep software up to date and back up data so it can be restored.
- Lumo only answers from the business's own information and hands a chat to a person when it isn't sure, which reduces the risk of sharing wrong or private information.
5. Service providers
We use a small number of trusted providers to run Lumo: Meta (WhatsApp Business Platform), AI service providers, and hosting and storage providers. We pick providers with strong security, give them only the data they need, and have contracts that require them to protect it. We use AI providers that do not train their own products on our data.
Some of these providers process data outside Sri Lanka. We transfer data only in the ways the PDPA allows.
6. How long we keep data
- Shopper chats and orders: while the business uses Lumo. After a business leaves, we delete them within 90 days, or sooner if the business asks. The business can ask for an export before then.
- Business account and team details: while the account is active, and up to 12 months after, unless the law needs us to keep them longer.
- Billing records: as long as tax and company law requires.
- Backups are overwritten on a regular cycle, so deleted data leaves our backups soon after.
7. Data breaches
If we find out that personal data has been lost, accessed or shared without permission, we will:
- act at once to contain it and limit any harm;
- tell the affected business without undue delay, and within 72 hours where we can, with what we know;
- help the business notify the Data Protection Authority and affected people where the law requires;
- find out what went wrong and fix it so it doesn't happen again.
8. Rights requests
Anyone can ask to see, correct or delete their personal data, or object to how it's used. Shoppers can ask the business they chatted with, or contact us and we'll pass the request to that business and help it respond. We answer requests within the time the PDPA requires.
9. Data protection contact
For any question about data protection, to request a data processing agreement or to report a concern, contact our data protection team:
The Apollo Project (PVT) Ltd
Email: info@agentlumo.lk
Phone / WhatsApp: 076 994 8407
If you're not happy with our answer, you can complain to the Data Protection Authority of Sri Lanka.