This policy explains what personal data The Apollo Project (PVT) Ltd ("we", "us") collects through Lumo and agentlumo.lk, why we collect it, who we share it with and the rights you have. We follow Sri Lanka's Personal Data Protection Act, No. 9 of 2022 ("PDPA").
1. Who this policy is for
- Visitors to agentlumo.lk.
- Businesses that sign up for Lumo, and the people on their teams.
- Shoppers who chat on WhatsApp with a business that uses Lumo.
For shoppers, the business you are chatting with decides how your data is used. It is the "controller" of your data, and we handle the chat for it as its "processor". Please read that business's own privacy policy too. Our Data Protection Policy explains how we look after data we handle for businesses.
2. What we collect
When you visit our website
- Basic technical details that every web server records, such as your IP address, browser type and the pages you open. We use these only to keep the site running and secure.
- We use Google Analytics to count visits and see which pages and buttons people use, so we can improve the site. It sets cookies and records details such as the pages you view, the links you click, your rough location, device and browser. We don't use it to show you ads. You can block it with your browser's settings or Google's opt-out add-on.
- We use the Meta Pixel to measure our Facebook and Instagram ads. It sets a cookie and tells Meta which pages you open, when you open or fill in the "Get started" form, and when you tap a store's WhatsApp button. Our server also sends the same events to Meta (through Meta's Conversions API), with your IP address, browser type and a scrambled (hashed) copy of the name you type, so Meta can match the visit to a Meta account. We don't keep a copy. Meta uses this to show our ads to people more likely to be interested. You can control ads from Meta in your Facebook or Instagram ad settings.
- Some sample photos on the site load from Unsplash, which receives your IP address when your browser loads them.
When you contact us or sign up
- The "Get started" form opens WhatsApp with your details filled in. Apart from the Meta Pixel events described above, it doesn't send your details to our servers. If you send that message, we receive your name, shop name, website or Instagram link, how many messages you get, and your WhatsApp number and profile name.
- If you become a customer: names, email addresses and phone numbers of your team, billing details, and your WhatsApp Business account details.
- Business information you give us to train Lumo: products, prices, photos, policies and how you like to talk to customers.
When a shopper chats with a business that uses Lumo
- WhatsApp number and profile name.
- The messages, photos and other content sent in the chat.
- Order details given in the chat, such as name, delivery address, phone number and what was ordered.
Lumo does not ask for card numbers or bank passwords in the chat. Please don't send them.
3. Why we use it
- To run Lumo: reply to shoppers, take orders, hand chats to the business's team and show chats in the portal. Legal basis: performing our contract with the business.
- To set up, train, test and improve the bot for each business. Legal basis: contract, and our legitimate interest in a service that works well.
- To reply to your enquiries and support you. Legal basis: your request and our legitimate interest.
- To bill customers and keep accounting records. Legal basis: contract and legal obligation.
- To keep our systems secure and prevent misuse. Legal basis: legitimate interest and legal obligation.
We don't sell personal data. We don't use one business's customer chats to train a bot for another business. We don't send marketing messages to shoppers.
4. Who we share it with
We share personal data only with service providers who help us run Lumo, and only as much as they need:
- Meta, to send and receive WhatsApp messages through the WhatsApp Business Platform, and, through the Meta Pixel and Conversions API, to measure and improve our Facebook and Instagram ads.
- AI service providers, to understand messages and write replies. We use providers that do not use our data to train their own products.
- Hosting and storage providers, to run our servers, portal and databases.
- Google, through Google Analytics, to measure how people use agentlumo.lk.
- The business's own tools that it asks us to connect, such as Shopify, WooCommerce, email or Slack, for stock, orders and notifications.
We may also share data if the law requires it, to protect people's safety, or as part of a sale or merger of our business (in which case this policy would continue to apply).
5. Data sent outside Sri Lanka
Some of our providers, including Meta, Google and our AI and hosting providers, store or process data outside Sri Lanka. When that happens, we take the steps the PDPA requires, such as using providers with strong security and contracts that protect the data.
6. How long we keep it
- Website server logs: up to 90 days.
- Google Analytics data: up to 14 months.
- Enquiries from people who don't become customers: up to 12 months.
- Chats and orders handled for a business: while that business uses Lumo, then deleted within 90 days after it leaves (unless it asks us to delete them sooner).
- Billing and accounting records: as long as tax and company law requires.
7. Your rights
Under the PDPA you have the right to:
- know what personal data we hold about you and get a copy;
- ask us to correct data that's wrong or incomplete;
- ask us to delete your data, or stop or limit how we use it;
- withdraw consent, where we rely on it;
- ask for a review of decisions made only by automated means that seriously affect you;
- complain to the Data Protection Authority of Sri Lanka.
To use any of these rights, email info@agentlumo.lk. If you are a shopper, you can also ask the business you chatted with, and we'll help them answer. We'll reply within the time the law requires. We may need to check who you are first.
8. Keeping data safe
We protect personal data with access controls, encryption in transit and other reasonable security measures. Our Data Protection Policy has more detail. No system is perfectly secure, but if a breach affects your data, we'll act quickly and tell the people and authorities we need to.
9. Children
Lumo is a service for businesses. We don't knowingly collect data from children under 18 except where a child messages a business that uses Lumo. In that case, the business decides how that data is used.
10. Changes to this policy
We may update this policy. We'll change the date at the top and, if the change is important, tell our customers directly.
11. Contact
The Apollo Project (PVT) Ltd
Email: info@agentlumo.lk
Phone / WhatsApp: 076 994 8407