Privacy Policy

This Privacy Policy ("Policy") describes how the operating company identified in the footer ("Company", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you access or use the website lumiocap.com and related services operated under the brand Lumio Capital("Lumio Capital").

This Policy applies to visitors, founders, entrepreneurs, and any individual who submits a pitch, contacts us, or otherwise interacts with our website. It does not apply to third-party websites linked from our platform, which are governed by their own privacy policies.

This Policy is framed in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and other applicable Indian laws as amended from time to time.

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
• "Data Principal" means the individual to whom the personal data relates — typically you.
• "Data Fiduciary" means the Company, which determines the purpose and means of processing personal data collected through this website.
• "Data Processor" means any entity that processes personal data on our behalf, such as hosting or form processing providers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

The Company, whose identity and principal place of business are stated in the footer, is the Data Fiduciary for personal data collected through Lumio Capital.

For privacy-related queries, rights requests, or grievances, contact us at legal@lumiocap.com. For general inquiries, contact info@lumiocap.com. We will acknowledge grievances promptly and aim to resolve them within the timelines prescribed under applicable law.

We collect only personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this Policy.

• Identity and contact information: full name, email address, LinkedIn or professional profile URL (if voluntarily provided).
• Pitch submission data: founder names, company name, email, pitch summary, problem statement, team background, pitch deck URL, and any other information you voluntarily provide
• Technical and usage data: IP address, browser type and version, device identifiers, operating system, referring URLs, pages viewed, session duration, and similar data collected through server logs, cookies, or analytics tools (where enabled).
• Communications: content of emails or messages sent to us, including attachments and metadata.
• Consent records: records of acknowledgements you provide when submitting forms, including acceptance of our legal policies.

We do not intentionally collect sensitive personal data (such as biometric data, health records, or financial account credentials) through the pitch form. Please do not submit information you are not comfortable sharing or that you are not authorised to disclose.

• Directly from you when you complete the pitch submission form, email us, or otherwise communicate with us.
• Automatically through cookies, log files, and similar technologies when you browse our website.
• From publicly available professional profiles you reference or link to in your submission.

We process personal data for the following purposes:

• Reviewing and evaluating pitch submissions and potential investment opportunities.
• Communicating with founders, co-founders, and authorised representatives regarding submissions.
• Conducting preliminary due diligence and internal investment assessment.
• Operating, securing, maintaining, and improving our website and related systems.
• Complying with applicable legal, regulatory, tax, and law-enforcement obligations in India.
• Establishing, exercising, or defending legal claims and preventing fraud or misuse.
• Maintaining business records in accordance with our retention practices.

Depending on the context, processing is carried out based on: (a) your consent, where required under the DPDP Act; (b) performance of steps at your request prior to entering into a potential commercial or investment arrangement; and/or (c) legitimate uses permitted under applicable law, including compliance with legal obligations and prevention of unlawful activity.

Where we rely on consent, you may withdraw consent at any time by contacting legal@lumiocap.com. Withdrawal does not affect the lawfulness of processing prior to withdrawal, and we may continue processing where another lawful basis applies.

In accordance with the DPDP Act, we provide this notice informing you that:

• Personal data listed in this Policy is collected for the purposes stated herein.
• You have the rights described in the section on Data Principal rights below.
• You may contact us to exercise those rights or raise grievances regarding our processing.
• If your grievance is not resolved satisfactorily, you may escalate the matter to the Data Protection Board of India once constituted and empowered under the DPDP Act.

We do not sell or rent your personal data. We may share personal data in the following circumstances:

• Within the Company: with directors, officers, employees, advisors, and investment committee members involved in evaluating opportunities, subject to confidentiality obligations.
• Data processors: with service providers who assist us with website hosting (including cloud/CDN providers such as Netlify), form data routing (including Google Workspace / Google Apps Script where configured), email delivery, analytics, and IT security — only to the extent necessary and subject to contractual safeguards.
• Professional advisers: with lawyers, accountants, auditors, or consultants bound by confidentiality, where required for due diligence or compliance.
• Legal and regulatory authorities: where required by applicable law, court order, subpoena, or lawful request by government or regulatory bodies, including the Securities and Exchange Board of India (SEBI), where applicable.
• Business transfers: in connection with a merger, reorganisation, acquisition, or sale of assets, subject to appropriate confidentiality and notice where required by law.

Pitch submissions submitted through our website may be transmitted to and stored in third-party systems, including Google Sheets via Google Apps Script, when you use our online form. These providers process data on our behalf and may store data on servers located in India or abroad, subject to their own terms and security practices.

Where analytics is enabled and you have consented to analytics cookies, usage data is processed on our behalf by Google Analytics, a service of Google.

We require processors to implement appropriate security measures and process data only for specified purposes. However, we are not responsible for the independent privacy practices of third-party platforms you voluntarily link to (such as external pitch deck hosts).

Personal data is primarily processed in India. Where personal data is transferred outside India — for example, through cloud hosting, email, or productivity tools — we will ensure such transfers comply with the DPDP Act and applicable rules regarding cross-border transfer, including transfers to jurisdictions permitted by the Central Government or transfers made with appropriate safeguards and contractual protections.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Active evaluation of a pitch or ongoing investment discussions.
• Maintenance of records for legal, regulatory, audit, or dispute-resolution purposes.
• Enforcement of our agreements and protection of our legal rights.

Pitch submissions that do not proceed to investment may be retained for an internal evaluation period (typically up to twenty-four (24) months) unless a shorter or longer period is required by law or legitimate business need, after which data may be deleted or anonymised.

Anonymised or aggregated data that cannot reasonably identify you may be retained indefinitely for analytics and business insight.

We implement reasonable technical and organisational security measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure, consistent with the SPDI Rules and industry practices. These measures may include access controls, encryption in transit where supported, secure hosting environments, and restricted internal access on a need-to-know basis.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any credentials or links you share with us.

In the event of a personal data breach that is likely to affect your rights, we will take reasonable steps to investigate, mitigate harm, and notify affected Data Principals and relevant authorities as required under the DPDP Act and applicable rules.

Our website keeps cookies to a minimum. We use two categories:

• Strictly necessary: a single first-party cookie (lc_consent) that records your cookie choice.
• Analytics cookies: set by Google Analytics to help us understand, in aggregate, how visitors use our site. These are placed only with your consent and only when analytics is enabled on the website.

We ask for your choice through a cookie banner on your first visit and do not place analytics cookies unless you accept them. You can change or withdraw your choice at any time using the "Cookie preferences" link in the website footer. You can also control cookies through your browser settings.

Full details, including the name, purpose, and duration of each cookie, are set out in our Cookie Policy.

Subject to applicable law, including the DPDP Act, you may have the following rights:

• Right to obtain information about personal data we process about you and how we process it.
• Right to access and obtain a copy of your personal data, where applicable.
• Right to correction of inaccurate or incomplete personal data.
• Right to erasure of personal data, subject to legal retention obligations and legitimate business needs.
• Right to withdraw consent where processing is consent-based.
• Right to grievance redressal in respect of our processing of your personal data.
• Right to nominate another individual to exercise your rights in the event of your death or incapacity, as permitted under the DPDP Act.

To exercise any of these rights, email legal@lumiocap.com with sufficient detail to verify your identity and specify your request. We will respond within thirty (30) days, or such other period as prescribed under applicable law. We may request additional information to confirm your identity before fulfilling certain requests.

If you have concerns about how we handle your personal data, please contact us first at legal@lumiocap.com. We will investigate and endeavour to resolve your grievance within thirty (30) days of receipt.

If you are not satisfied with our response, you may have the right to lodge a complaint with the Data Protection Board of India or other competent authority once available and applicable under the DPDP Act.

Our website and services are not directed at individuals under eighteen (18) years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact legal@lumiocap.com and we will take steps to delete such information promptly.

We do not use solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning Data Principals in connection with pitch evaluations. Investment decisions involve human review and judgement.

We may update this Policy from time to time to reflect changes in law, technology, or our practices. The "Last updated" date at the top indicates when this Policy was last revised. Material changes will be posted on this page. Your continued use of the website after changes become effective constitutes acknowledgement of the updated Policy, subject to applicable law.

This Policy is governed by the laws of India. Subject to applicable law, any dispute arising out of or relating to this Policy shall be subject to the exclusive jurisdiction of the competent courts in the jurisdiction specified in the footer.