Legal

Privacy policy

Lumoura · Version 2.0 · Effective date: 26 October 2026
This is a translation of the Dutch version. If the two differ, the Dutch version prevails.

Lumoura helps you collect all the photos and videos from your celebration in one place. We handle your data and your guests' data with care. Below you can read which data we process, why, for how long, who we share it with and what rights you have.

1. Who are we?

Lumoura is a service of DannyvdSluijs.

We are the controller for your account, your order and the payment. We process the photos and videos that guests upload on your behalf as the organiser of the event: you decide who gets the guest page, what stays online and when you download everything.

2. What data do we process?

2.1 Organisers (for example the wedding couple)

• Name and email address
• Details of your event: name, date, type of event, welcome message, chosen theme and any access code
• Order details: chosen package, amount, any discount code and the payment status. Your payment details (such as card or account number) go directly to our payment partner Stripe; we do not see or store them
• Your password, stored only in encrypted (hashed) form and unreadable to us
• Technical data when you log in, such as IP address and time, for security

2.2 Guests

• The photos and videos you upload. We remove location data (GPS) and other metadata from photos and videos
• Optionally your name, if you enter it yourself
• Optionally your email address, only if you ask for a notification once the album is ready (see section 4)
• An anonymous session code in a cookie, so we can keep track per guest of how many photos can still be shared
• IP address and browser details, for security and to prevent abuse

3. What do we use this data for, and on what legal basis?

• Providing the service: creating your event, showing the guest page, storing uploads, the portal and the download. Basis: performance of the contract (Art. 6(1)(b) GDPR)
• Payment and accounting: processing your order and keeping the records required by law. Basis: contract and legal obligation (Art. 6(1)(b) and (c) GDPR)
• Service emails: the welcome email with login link, password reset and reminders before your photos are deleted. Basis: performance of the contract
• The notification to guests: one email as soon as the album is shared. Basis: the guest's consent (Art. 6(1)(a) GDPR)
• Security and abuse prevention: for example limiting the number of attempts at an access code. Basis: legitimate interest (Art. 6(1)(f) GDPR)

We do not send newsletters or advertising, we do not sell data and we never use photos or videos for our own promotion.

4. The notification once the album is ready

On the guest page, guests can leave their email address for a single notification. As soon as the organiser shares the album, we send that one email with a link to the album. Immediately afterwards we delete the email address. If the album is not shared, we delete the address no later than the end of the event's retention period. The email address is not passed on to the organiser and is not used for any other purpose. Would you like it deleted sooner? Just email us.

5. Ownership of photos and videos

Photos and videos remain the property of the guest who took them and of the organiser. We only store them and show them to the organiser and, if the organiser turns on the gallery, to the guests of the event. Come across an upload that does not belong there? The organiser can delete uploads; you can also email us.

6. How long do we keep data?

We keep photos and videos according to the event's package. After the upload period:

• Trial: 14 days
• Basic: 3 months
• Premium: 12 months
• All-in: 24 months

30 days and 7 days before deletion, the organiser receives an email reminder to download everything. After that we permanently delete the photos, videos and guest data. Copies in our backups disappear within 30 days after that.

• Account and event data: for as long as your account exists. You can have your account deleted at any time
• Order and payment data: 7 years, because Dutch law requires us to keep our records for that long
• Email address for the notification: until the notification has been sent, at the latest until the end of the retention period (see section 4)
• Technical logs: up to 30 days

7. Who do we share data with?

Only with parties we need to make Lumoura work, and only what they need for that:

• Stripe (Stripe Payments Europe Ltd., Ireland): processes the payments. Stripe may also process data outside the EU; the European Commission's standard contractual clauses apply to this
• Postmark (ActiveCampaign, United States): sends our service emails, such as the welcome email, reminders and the notification to guests. Standard contractual clauses apply here as well
• Hosting: the app, the database and all photos and videos are on our own servers in the Netherlands
• Competent authorities: only if the law requires us to

We do not load fonts, scripts or trackers from third parties. So when you visit Lumoura, no data goes to Google or other parties.

8. Security

• All connections are encrypted via HTTPS
• We store passwords only in hashed form
• An event can be protected with an access code, with a limit on the number of attempts
• Photos and videos can only be reached via temporary, signed links
• We remove location data from photos and videos
• Access to our systems is restricted and secured, and we make a backup (snapshot) several times a day, which we keep for two weeks

9. Your rights

You have the right to access, rectification, erasure, restriction and portability of your data, and you can object to processing based on legitimate interest. You can always withdraw consent you have given, such as for the notification. Send your request to mail@lumoura.eu; we will respond within 30 days.

Do you disagree with how we handle your data? Please let us know first, so we can find a solution together. You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your own country.

10. Cookies

We only use functional cookies that are needed to make Lumoura work: to keep you logged in, to secure forms, to remember your language choice and the access code you entered, and to keep track of the number of uploads per guest. No tracking or advertising cookies. These cookies do not require consent.

11. Changes

If we materially change this privacy policy, we will let organisers know by email at least 14 days in advance. The current version is always available at lumoura.eu/en/privacy.

12. Contact