1. Who we are
1.1 Lumos is operated by Lumos (company registration and licence in progress), based in Dubai, United Arab Emirates ("Lumos", "we", "us").
1.2 We are responsible for your personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and other laws that apply to us.
1.3 This policy covers the Lumos app, our website lumospay.app, and our support channels.
2. Data we collect
2.1 Identity and verification. Your name, date of birth, nationality, ID document details and images, and a live selfie. Our verification partner Didit collects these when you verify your account and shares the result with us.
2.2 Contact details. Your phone number, email address and residential address.
2.3 Transactions. What you buy, sell and redeem, with prices, quantities, dates and invoices. Your holdings and AutoSave and goal settings.
2.4 Payments and payouts. Payment references and limited card details from our payment providers. We never see or store your full card number. Bank account details and IBAN for payouts.
2.5 Delivery. Your delivery address. At handover we record the ID number you show, a signed delivery note, photos of the metal and photos of both sides of your ID.
2.6 Device and usage. Device type, operating system, app version, IP address, log-in times and how you use the app, to keep it secure and working.
2.7 Support. Messages, emails and notes from your conversations with us.
2.8 Marketing preferences. Whether you want to hear from us about offers and news.
2.9 Website waitlist. If you join the waitlist or send a business enquiry, your email address and, if you give it, your company name.
2.10 Source of funds. Where the law requires, information about where your money comes from.
3. Why we use it
3.1 To provide the service under our agreement with you: open and run your account, carry out purchases, sales and deliveries, make payouts and send invoices.
3.2 To meet our legal duties: verify your identity, screen against sanctions lists, monitor for fraud and money laundering, keep records, and report suspicious activity to the UAE Financial Intelligence Unit through goAML when required.
3.3 For our legitimate interests, balanced against your rights: keep the app secure, prevent fraud, fix problems, improve our products, and defend legal claims.
3.4 With your consent: send you marketing. You can withdraw consent at any time in the app or by using the unsubscribe link.
3.5 We do not sell your personal data.
4. Who we share it with
We share only what each party needs to do its job, under contracts that require them to protect it.
- Our identity verification partner Didit.
- Payment providers (Lean for bank payments, TotalPay for cards) and the banks that process your payments and payouts.
- The vault operator that holds the metal in Dubai, where needed for deliveries and audits.
- Our delivery staff, who see your name, address and delivery details.
- Our cloud hosting providers: Huawei Cloud, and Cloudflare for this website and the waitlist.
- Our auditors, lawyers and professional advisers.
- Regulators, courts, police and other authorities, when the law requires it.
- If you use Lumos through another company's app, that company, for the services you use there.
- A buyer or successor of our business, if Lumos is sold or merged, under the same protections.
5. Transfers outside the UAE
5.1 Some providers may process data outside the UAE. When this happens we make sure your data stays protected to the standard UAE law requires.
5.2 We transfer data only to countries the UAE recognises as giving adequate protection, or with contract terms and safeguards the law allows.
6. How long we keep it
6.1 We keep identity, verification and transaction records for at least 5 years after our relationship ends, as anti-money-laundering law requires.
6.2 Delivery proof is kept for the same period as the transaction it belongs to.
6.3 Waitlist emails, and any answers you give in our welcome survey, are kept until the app launches and for 12 months after, unless you open an account or ask us to delete them sooner.
6.4 Other data is kept only as long as we need it for the purpose we collected it, then deleted or made anonymous.
7. How we protect it
7.1 Data is encrypted in transit. Sensitive fields, such as ID numbers and delivery proof, are also encrypted at rest using AES-256.
7.2 Staff access is limited to what each role needs. Every view of sensitive records is logged. Admin accounts need two-factor sign-in.
7.3 If a breach puts your data at risk, we will tell you and the authorities as the law requires.
8. Your rights
8.1 You can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data, where we are not required by law to keep it;
- stop or limit some uses of your data, or object to them;
- send your data to you or another provider in a common format;
- stop marketing, or withdraw any consent you gave.
8.2 Write to [email protected]. We may ask you to confirm your identity first. We aim to reply within 30 days.
8.3 Because of anti-money-laundering law, we cannot delete verification and transaction records before the retention period in clause 6 ends.
8.4 If you are not happy with our answer, you can complain to the UAE Data Office.
9. Children
Lumos is not for anyone under 18. We do not knowingly collect data from children. If we learn we have, we will delete it unless the law requires us to keep it.
10. Cookies and similar storage
10.1 Our website uses only the storage it needs to work, such as remembering choices you make on the page. We do not use advertising cookies. We do not use analytics cookies.
10.2 You can clear or block this storage in your browser settings. Some parts of the site may not work as well without it. See our Cookie Notice.
11. Changes to this policy
We may update this policy. If a change matters to you, we will tell you in the app or by email before it takes effect. The date at the top shows the latest version.
12. Contact us
For any privacy question or request, write to [email protected].