Posting Date: May 1, 2025
Effective Date: May 1, 2025
LUMINA TECH INC (“We”, “Us” or “LUMINA”) respects your privacy and the security of your personal information.

LUMINA TECH INC Limited, which provides administrative and other services to various LUMINA entities, and LUMINA entities are committed to protecting and respecting your privacy and ensuring that your personal data is processed fairly and lawfully in line with all relevant data protection legislation. This Privacy Notice sets out the principles governing the use of your personal data that may be collected, received, used, stored and disclosed in connection with your use of our websites and online properties (the “Websites”).
LUMINA’s processing of your personal data may be subject to data protection laws in the European Economic Area (the “EEA”), the United Kingdom (the “UK”), the United States of America (the “U.S.”) and Hong Kong Special Administrative Region (“HK”), including the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), the UK General Data Protection Regulation (the “UK GDPR”), the UK Data Protection Act 2018 (the “DPA18”), the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA” and together with the CCPA, “CCPA/CPRA”) and the Personal Data (Privacy) Ordinance of Hong Kong (“PDPO”). Under the GDPR, the UK GDPR and the DPA18, we are the “controller” of your personal data, under the CCPA/CPRA, we are characterized as a “business” in our use of personal data and under the PDPO, we are the “data user” of your personal data.

LUMINA may collect, receive, use, store, transfer and otherwise process the following personal data about you in connection with the Websites:
◾Usage Data, such as information about how you use our Websites, products and services.
◾Geolocation Data, such as geographic location information about a particular individual or device.

We use different methods to collect personal data from and about you, including through:
◾Automated technologies or interactions.As you interact with the Websites, we will automatically collect data about your equipment, browsing actions and patterns.
◾You may be requested to provide some or all of the personal data described in this Privacy Notice in connection with your use of the Websites. If you fail to provide certain information when requested, and this personal data is necessary for us to comply with our legal and regulatory obligations, to perform the contract we have entered into with you or to manage our relationship with you, we will not be able to continue your involvement with the Websites. In all other cases the provision of your personal data is voluntary.

LUMINA only processes personal data where we have a legal basis for doing so. Most commonly, we will rely on the following legal basis, or legal bases, to process your personal data:
◾Where it is necessary for our legitimate interests (or those of a third party) and where consistent with applicable laws
◾Providing you with access to content and features in the Websites.
◾Administering and protecting our business, including troubleshooting, data analysis, testing, system, maintenance and support, reporting and hosting data.

LUMINA generally may share all of the personal data that it collects with its affiliates and the employees of those affiliates for the purposes described above. In addition, we may disclose all of the personal data that we collect in one or more of the following circumstances:
As authorised, such as by agreements related to LUMINA providing services to you and as authorised by you or your representatives.
As required to provide our services, such as with our third-party service providers, agents or contractors in connection with services that these individuals or entities perform for LUMINA.
As required to protect ourselves, such as where we believe it is necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our policies or as evidence in litigation in which we are involved or as otherwise permitted or required by law or regulation.
As legally required, such as to cooperate with regulators during periodic regulatory examinations or in accordance with law enforcement requests, court orders or other judicial or administrative proceedings.
As legally permitted, such as with any third party that acquires, or is interested in acquiring, all or part of our assets or shares, or that succeeds us in carrying on all or a part of our business, whether by merger, acquisition, reorganisation or otherwise. Among other activities, LUMINA and its affiliates may also share personal data with its lawyers, accountants, custodians and advisors and with persons otherwise acting in a representative or fiduciary capacity on behalf of LUMINA.
We do not disclose any personal data about you to non-affiliates to market to you.
LUMINA may store and transfer your personal data in and to the U.S., the EEA, the UK, HK and other jurisdictions, including to facilitate our third-party processors’ access to and/or processing of personal data, and these jurisdictions may have data protection laws that are not as protective as those in your jurisdiction. When we transfer your personal data outside the EEA and the UK, and to the extent required by the GDPR, the UK GDPR and the DPA18, we rely on appropriate or suitable safeguards to transfer your personal data, including:
◾Using standard contractual clauses approved by relevant authorities as ensuring adequate safeguards for personal data.
◾Obtaining your consent to transfer personal data after first informing you about the possible risks of such a transfer.
◾When the transfer is necessary for the performance of a contract between you and us or if the transfer is necessary for the performance of a contract between us and a third party that is entered into in your interest.
◾Where the transfer is necessary to establish, exercise or defend legal claims.
◾For more information, including to obtain a copy of the documents used to protect your personal data, please contact us using the information provided in the “Contact Us” section below.

LUMINA seeks only to retain personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, safety or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. In all cases, to determine the appropriate retention period for personal data we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Under applicable EU and UK laws, individuals in the EU and the UK, or to whom the GDPR, the UK GDPR or the DPA18 apply, may have a right to some or all of the following (subject to a limited number of exceptions): (i) request access to and rectification or erasure of their personal data; (ii) obtain restriction of processing or to object to processing of their personal data; and (iii) ask for a copy of their personal data to be provided to them, or a third party, in a digital format. Individuals also have the right to lodge a complaint about the processing of their personal data with their local data protection authority in the EEA or UK.
These rights are not absolute and each is subject to certain exceptions or qualifications. For example, if you wish to withdraw your consent or object to processing, we may need to determine whether our use of your personal data needs to continue for other lawful purposes, such as fulfilment of a legal or contractual requirement.

If you are an individual resident in California, the CCPA/CPRA may apply with respect to your personal data. To the extent applicable, California residents may have the right to request information about the categories or specific pieces of personal data we collect about you, as well as information about our use and disclosure of that personal data, as well as the rights to request that we delete and/or correct your personal data, and to not be discriminated against for exercising your privacy rights. Although California residents may have the right to opt out of the sale and sharing of personal data, as those terms are defined by CCPA/CPRA, LUMINA does not sell or share personal data as the terms “sell” and “share” are used under the CCPA/CPRA, including personal data of individuals under 16 years of age, and we have not sold or shared your personal data in the last 12 months.
Additionally, California residents may have the right to limit the use of their SPI for to only those purposes not authorised by the CCPA/CPRA. However, LUMINA only uses and discloses SPI as permitted under the CCPA/CPRA without requiring LUMINA to provide you with a notice regarding the “right to limit,” as defined therein. Nevertheless, if you have further questions about our uses or disclosures of SPI, you should contact us using the information below.

Under the PDPO, individuals to whom the PDPO applies may have rights to request access to and correct or update their personal data. These rights are not absolute and is subject to certain exceptions or qualifications.

If you wish to exercise any of these rights, please contact us using the information below. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of the other rights described above). Similarly, if an agent makes a request on your behalf, they will be required to verify the request by submitting your written authorisation, and we may still ask that you verify your identity with us before we can proceed with the request. We will not honour any requests from agents until authorisation is verified. We have these security measures in place to ensure that personal data is not disclosed to any person who has no right to receive it.
We will respond to your request within one month of receipt of your request, or otherwise within the timeline required by applicable law. In some cases, we may not be able to fulfil your request to exercise the right before this date and may need to request more time. Where we cannot provide a full response to you for any reason, we will let you know about this in our initial reply to your request. You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights described above). In some cases, however, we may charge a reasonable fee if your request is clearly unfounded or excessive (for example, if you request multiple copies of the personal data). Alternatively, we may refuse to comply with the request in such circumstances.

California’s “Shine the Light” law permits California residents to annually request and obtain certain information free of charge about what personal data is disclosed to third parties for direct marketing purposes in the preceding calendar year. We do not distribute your personal data to outside parties without your consent for their direct marketing, or any other purpose, except as provided in this Privacy Notice. To make a request, please contact us using the information below.

Links on the Websites may take you to third party sites over which we have no control. While such links are provided for your convenience, you should be aware that the personal data handling practices of the linked websites might not be the same as ours and LUMINA does not accept any responsibility or liability for these policies. You should review any privacy policies on those linked websites. This Privacy Notice does not cover the information practices of any linked websites.

The Websites are intended for use by those over 18 years of age, and minors under the age of 13 may not use the Websites. We do not knowingly solicit or collect personal data on the Websites from children under the age of 13. If we learn that, despite these measures, a child under the age of 13 has submitted personal data to us through the Websites, we will take reasonable measures to delete such personal data from our records and to not use the data for any purpose (except where necessary to protect the safety of the child or others as required by law).

We keep this Privacy Notice under review and reserve the right, at our discretion, to change, modify, add to or remove portions from it, and we will update the date above accordingly. On some occasions, we may also actively advise you of specific personal data handling activities or significant changes to this Privacy Notice where we are required to do so by applicable law. However, we recommend that you return to the Websites to check for any other changes to this Privacy Notice.