1. About Lumiya
Lumiya is a Türkiye-based digital parenting platform that provides services to international users in multiple languages.
Lumiya aims to provide parents and families with informative content, personalized experiences, saved content, planners, digital tools, and additional services that may be introduced over time.
This Privacy and Personal Data Protection Policy (“Privacy Policy”) explains how personal data is collected, used, stored, protected, and, where necessary, shared in connection with the Lumiya website, user accounts, personalization features, saved content, planners, communication and support services, and digital experiences for children that may be introduced in the future.
Users can review this Privacy Policy to understand how their personal data may be processed when using Lumiya services.
Where explicit consent is required for a particular personal data processing activity, such consent will be obtained separately.
2. Data Controller
Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller in respect of personal data processing activities relating to services offered under the Lumiya brand is the Lumiya brand.
Contact Address:
Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No:46/50
Maltepe, İstanbul, Türkiye
Privacy and Personal Data Contact:
privacy@lumiya.com.tr
For the purposes of this Privacy Policy, the services provided under the Lumiya brand are hereinafter referred to as “Lumiya.”
3. Personal Data We May Process
Depending on the Lumiya services and features you use, different categories of personal data may be processed.
These may include:
first and last name,
email address,
account and session information,
account identifiers,
language preferences,
content preferences,
profile information provided by a parent,
saved or favorited content,
planner data,
other information created or entered by the user,
IP address,
device and browser information,
operating system information,
online identifiers,
cookie and similar technology data,
usage logs,
error and security logs,
and communications with Lumiya support.
Where Google Sign-In or another third-party authentication method is used, Lumiya may receive authentication information that the relevant provider is permitted to share within the scope of permissions granted by the user.
Lumiya follows the principle of data minimization and aims not to collect personal data that is unnecessary for the provision of its services.
4. How We Collect Personal Data
Personal data may be collected directly from users when they:
use the Lumiya website,
create a user account,
sign in with Google,
provide profile information,
save or favorite content,
use planners,
select preferences,
complete forms,
submit support requests,
or communicate electronically with Lumiya.
Certain technical information may also be generated or collected automatically through the website, servers, security systems, cookies, analytics technologies, and third-party service providers used by Lumiya.
The scope of the personal data collected may vary depending on the services used and the choices made by the user.
5. Purposes of Processing Personal Data
Personal data may be processed for purposes including:
creating and managing user accounts,
authenticating users,
protecting account and platform security,
providing Lumiya services,
remembering language and content preferences,
operating saved-content and planner features,
personalizing the user experience,
identifying and resolving technical issues,
preventing abuse, fraud, and unauthorized access,
responding to user support requests,
measuring service performance and reliability,
improving and developing the Lumiya platform,
and complying with applicable legal obligations.
Personal data is processed only to the extent relevant, necessary, and proportionate to these purposes.
6. Legal Bases for Processing Personal Data
Depending on the nature of the relevant processing activity, personal data may be processed on the legal grounds set out in Articles 5 and, where applicable, 6 of the KVKK.
Personal data necessary for creating a user account and providing services requested by the user may be processed where such processing is directly related to the establishment or performance of a contract.
Activities relating to platform security, fraud and abuse prevention, technical logging, and ensuring the reliability of Lumiya services may be carried out on the basis of legitimate interests, provided that such processing does not adversely affect the fundamental rights and freedoms of the data subject.
Personal data that must be retained or disclosed under applicable law may be processed for the purpose of complying with legal obligations.
Personal data may also be processed where such processing is necessary for the establishment, exercise, or protection of a legal right.
Where explicit consent is required for analytics, marketing, personalization, or similar processing activities, consent will be obtained separately.
Where applicable, users may withdraw their consent at any time.
7. Our Service Providers
Lumiya may use various technology service providers to operate its services securely, efficiently, and reliably.
Lumiya uses Amazon Web Services (AWS) for its primary application infrastructure. The primary AWS region may be configured as eu-central-1, Frankfurt, Germany.
Lumiya may also use:
Cloudflare for traffic management, content delivery, performance, and security,
Google Analytics for usage and performance measurement, subject to applicable user preferences and consent requirements,
Google Login / OAuth for authentication,
and Resend for account verification, security notifications, service communications, and other system-generated emails.
The service providers and technical infrastructure used by Lumiya may change over time.
Where such changes materially affect the processing of personal data, this Privacy Policy may be updated accordingly.
8. Sharing and Transfer of Personal Data
Personal data may be shared, to the extent necessary for the provision of Lumiya services, with:
cloud infrastructure providers,
hosting providers,
content delivery and security providers,
authentication providers,
email and communication providers,
analytics and performance measurement providers,
and other technical service providers supporting Lumiya.
Personal data may also be disclosed to competent public authorities, judicial authorities, administrative authorities, or other authorized institutions where necessary to comply with a legal obligation or a lawful request.
Any such transfer or disclosure is limited to the relevant purpose and to the personal data reasonably necessary for that purpose.
9. International Data Transfers
Lumiya is based in Türkiye but provides services to international users and uses technology providers that operate globally.
As a result, certain personal data may be processed or stored on servers or infrastructure located outside Türkiye.
Due to the global infrastructure of service providers such as Amazon Web Services, Cloudflare, Google, and Resend, personal data may be processed in Türkiye, the European Economic Area, the United States, or other countries in which such providers maintain infrastructure.
Depending on the configuration and operation of individual services, certain service providers may process or store personal data outside the European Union or Türkiye.
Where personal data is transferred outside Türkiye, Article 9 of the KVKK and applicable regulations concerning international transfers of personal data are taken into consideration.
The appropriate legal transfer mechanism and safeguards are determined according to the nature and circumstances of the relevant transfer.
10. Cookies and Similar Technologies
Lumiya may use essential cookies and similar technologies to:
operate the website,
maintain user sessions,
protect account security,
remember user preferences,
and enable essential platform functionality.
Non-essential analytics, measurement, or similar technologies may be activated in accordance with the user's preferences and, where required by applicable law, the user's consent.
Users may manage or change their preferences relating to non-essential cookies through the cookie preference mechanisms provided by Lumiya.
More detailed information about cookies, their purposes, providers, and retention periods is provided in the Lumiya Cookie Policy.
11. Google Sign-In
Lumiya may use Google Login / OAuth to allow users to create an account or sign in more easily.
When a user chooses to sign in with Google, Lumiya only accesses information made available within the scope of the permissions granted by the user and Google's authorization process.
Such information is generally used to authenticate the user and associate the user's Google identity with their Lumiya account.
Google's processing of personal data within its own services is governed by Google's own privacy policies and terms.
12. Children's Data
Lumiya's primary purpose is to provide digital content and tools for parents and families.
If Lumiya introduces accounts, games, activities, or personalized digital experiences directly intended for children, principles including:
data minimization,
parental control,
age-appropriate design,
security,
and the best interests of the child
will be taken into consideration.
Lumiya aims to process only the minimum amount of personal data necessary for the relevant children's feature to operate.
Results from games, activities, progress tracking, or usage relating to children are not intended to be used to diagnose or determine a child's:
intelligence,
psychological condition,
personality,
medical condition,
health status,
or developmental level.
If future features require the processing of sensitive or special-category personal data relating to children, the applicable legal basis and additional security measures will be assessed separately.
13. Personalization
Lumiya may personalize the platform experience according to information such as:
the user's selected language,
age group,
content categories,
saved content,
and preferences provided by the user.
Personalization is intended to provide users with more relevant content, recommendations, and platform features.
Lumiya does not intend to make decisions that produce legal or similarly significant effects on users solely through automated systems.
14. Retention of Personal Data
Personal data is retained only for as long as necessary for the purposes for which it is processed and in accordance with applicable legal retention, limitation, and evidentiary periods.
Where a user account is terminated or the relevant purpose of processing ceases to exist, the personal data concerned may be deleted, destroyed, or anonymized unless another legal basis or legal retention obligation requires continued storage.
Limited additional retention periods may apply as a result of backup systems, security systems, or technical processes operated by Lumiya or its service providers.
15. Data Security
Lumiya takes technical and organizational measures appropriate to the nature and level of risk in order to:
prevent unlawful processing of personal data,
prevent unauthorized access to personal data,
and ensure the secure storage of personal data.
Such measures may include:
access controls,
authorization controls,
secure connection technologies,
account and session security,
system logging,
infrastructure security,
software updates,
and security monitoring and controls.
However, no method of electronic transmission over the internet or electronic storage can provide an absolute guarantee of security.
Where a personal data breach occurs, the necessary assessments will be carried out and any notification obligations required by applicable law will be fulfilled.
16. User Preferences
Users may manage their language, content, notification, cookie, and similar preferences through the options made available within their Lumiya account or the platform.
Permissions relating to personal data processing activities that are not essential for the operation of a particular feature may be modified or withdrawn where applicable.
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before that consent was withdrawn.
17. Your Rights Under the KVKK
Under Article 11 of the KVKK, data subjects may have the right to:
learn whether their personal data is being processed,
request information if their personal data has been processed,
learn the purpose of the processing of their personal data,
learn whether their personal data is being used in accordance with the stated purposes,
learn the third parties to whom their personal data has been transferred in Türkiye or abroad,
request correction of incomplete or inaccurate personal data,
request deletion or destruction of personal data where the applicable legal conditions are satisfied,
request that correction, deletion, or destruction operations be notified to third parties to whom the personal data has been transferred,
object to a result arising against the individual as a result of the analysis of personal data exclusively through automated systems,
and request compensation for damages suffered as a result of unlawful processing of personal data.
18. Exercising Your Rights and Contacting Us
For questions regarding privacy, the processing of personal data, or your rights under the KVKK, you may contact Lumiya at:
When evaluating a personal data request, Lumiya may request information necessary to verify the identity of the person submitting the request.
Requests will be assessed in accordance with the procedures and time periods established under the KVKK and applicable secondary legislation.
19. International Users
Although Lumiya is based in Türkiye, it may provide services in multiple languages to users located in different countries.
Depending on the user's country of residence or location, additional or different personal data protection laws may apply.
Where applicable foreign legislation grants users additional rights or imposes additional obligations in relation to Lumiya's services, such requirements may be assessed separately.
The principal legal framework governing this Privacy Policy is the personal data protection legislation of the Republic of Türkiye, in particular Law No. 6698 on the Protection of Personal Data (KVKK).
20. Third-Party Links
Lumiya may contain links to third-party websites, applications, services, products, or content.
When a user leaves Lumiya and accesses a third-party service, the privacy and personal data processing practices of that third party will apply.
Lumiya is not responsible for the privacy practices, content, or data processing activities of independent third parties.
Users are encouraged to review the privacy policies of third-party services before providing personal information to them.
21. Changes to This Privacy Policy
Lumiya's services, technical infrastructure, service providers, features, and applicable legal requirements may change over time.
Accordingly, this Privacy Policy may be updated where necessary.
Where material changes are made, the updated Privacy Policy will be published on Lumiya and, where appropriate or legally required, users may be informed through suitable communication methods.
The date of the current version is displayed in the “Last Updated” section at the top of this Privacy Policy.
22. Contact
For questions about this Privacy Policy, personal data, or Lumiya's privacy practices, you may contact:
Lumiya
Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No:46/50
Maltepe, İstanbul, Türkiye
Email:
privacy@lumiya.com.tr