At Lumin Sports, We care about how your personal information is handled.
This Privacy Policy explains how Lumin Sports Technology Pty Ltd (“Lumin Sports”, “We”, “Us” or “Our”) collects, uses, shares and protects personal information when you use or interact with Our products, services, websites and applications (together, the “Services”).
Lumin Sports works with teams, clubs, schools and other organisations involved in sport, and with the coaches, practitioners, administrators and athletes who use Our Services. The personal information We handle will depend on how you interact with Lumin Sports and how your organisation uses the Services.
Sometimes We decide how and why personal information is used, for example when you visit Our website, contact Us, purchase Services or interact with Our marketing. In other cases, such as when your team, club, school or employer uses Lumin Sports, that organisation decides how personal information is used and We handle it on their behalf. We explain these roles in more detail below.
This Privacy Policy explains what personal information We collect, how We use and share it, how We keep it secure, how long We keep it, how We handle international transfers, and the privacy rights and choices available to you.
If We need certain personal information to provide the Services, meet a legal requirement or enter into a contract with you, We will let you know. If you choose not to provide that information, We may not be able to provide the relevant Service or respond to your request.
This Privacy Policy applies to personal information We handle when you use or interact with the Services. This includes information about users, athletes, coaches, practitioners, administrators, customer contacts, website visitors, prospective customers, event attendees, support contacts and job applicants.
If you use the Services through an organisation, such as a team, club, school, sporting organisation or employer, that organisation may also have its own privacy policy or notice explaining how it handles your personal information.
We may decide how and why personal information is used, for example when We manage Our website, sales, marketing, billing, security, support and direct customer relationships. In these situations, We act as a controller.
When a customer uses Our Services to manage information about its athletes, staff or other users, the customer generally decides how and why that information is used. In these situations, We act as a processor and handle the information on the customer’s behalf.
Customers are responsible for ensuring they have the legal authority to provide personal information to Us and to use the Services with their athletes, staff and other users, including giving any required notices and obtaining any required consents.
The personal information We collect depends on how you use the Services, the features enabled by your organisation, and the integrations you or your organisation choose to connect. The categories below are examples of the personal information We may collect, and not every category will apply to every user.
Category | Examples |
|---|---|
Identity, account and profile information | Name, email address, username, password or authentication information, organisation, team, school, club, role, permissions, profile details, preferences and account settings. |
Contact and communications information | Phone number, business contact details, contact form submissions, emails, support tickets, chat messages, call notes, survey responses, event details and other communications with Us. |
Athlete, team and participation information | Sport, team, role, position, age or date of birth, sex/gender, schedules, attendance, availability, program participation, training group, coach/practitioner relationships and organisation-level metadata. |
Body measurements and physical characteristics | Height, weight, body mass, skinfolds, body composition, anthropometric measurements, physiological or exercise markers, and other body measurement information entered into or generated through the Services. |
Sport, training and performance information | Training sessions, workouts, wellness and readiness information, training load, fitness performance, exercise markers, test results, attendance, availability, program data, workload metrics, speed, distance, heart rate or similar performance-related data where provided. |
Health, wellness, injury and rehabilitation information | Injury status, rehabilitation notes, soreness, fatigue, sleep, stress, wellness questionnaires, readiness, medical or welfare notes, availability flags and other health or wellbeing information where provided through the Services. |
Precise and approximate location information | GPS, route, venue, location or movement data from mobile applications, connected devices or integrations where enabled, and approximate location information derived from IP address or device data. |
Connected device, app and integration information | Information authorised from third-party apps, wearables, connected devices, health/fitness platforms, performance systems and other integrations, including synchronisation status and integration metadata. |
Payment and billing information | Billing contact details, subscription or purchase details, invoices, tax and accounting records, and limited payment information. Full card details are handled by payment processors such as Stripe where applicable. |
Device, usage, log and diagnostic information | IP address, browser type, operating system, device identifiers, mobile device information, pages or features used, dates and times of use, referring URLs, crash logs, diagnostics, language settings, location settings and other technical information. |
Cookies, analytics and advertising information | Information collected through cookies, pixels, software development kits (SDKs), local storage and similar technologies, including analytics identifiers, advertising identifiers, referral sources, campaign information and consent preferences where enabled. |
AI inputs, outputs and metadata | Prompts, questions, documents, notes, reports, summaries, requested outputs, feedback and related metadata submitted to, generated by, or used in AI-enabled features. |
Marketing, sales and business relationship information | Enquiry details, customer relationship management (CRM) records, organisation details, role, business contact information, marketing preferences, event registrations, campaign engagement and sales communications. |
Recruitment information | If you apply for a role with Us, employment history, CV, qualifications, references, interview notes, eligibility information and related recruitment information. |
We do not intentionally collect more personal information than We reasonably need for the relevant purpose. Please do not provide sensitive information unless it is required for the Services, requested by your organisation, or otherwise relevant to your use of the Services.
Because Lumin Sports is built for sport, performance and athlete management, some of the information handled through the Services can be sensitive. This may include health, injury, rehabilitation, wellness, body measurement, physiological, sex or gender, and precise location information.
Different privacy laws may treat this information as sensitive information, health information or special category data. We only use it for the purposes described in this Privacy Policy, as authorised by you or your organisation, or as otherwise permitted by law.
Where a customer provides sensitive information to Us, that customer is responsible for obtaining any notices, permissions or consents required by law, including parent or guardian consent where applicable.
Directly from you: when you create an account, use the Services, complete forms, upload data, connect integrations, make purchases, communicate with Us, attend events, request support, or otherwise interact with Us.
From your organisation or authorised users: where your organisation, coach, practitioner, team administrator, school, club, federation, league, academy, employer or other authorised user creates or manages accounts, enters athlete or team data, invites you to the Services, or uses the Services on your behalf.
Automatically: when you use the Services, including through server logs, cookies, analytics tools, SDKs, security tools, crash-reporting tools and device information.
From third-party apps, devices and services: where you or your organisation authorise a connection or integration with the Services.
From service providers and partners: such as payment processors, analytics providers, CRM or marketing platforms, customer support tools, feedback tools, communication providers, security tools and other partners that support the Services.
From public or professional sources: where relevant to business, recruitment, marketing, partnership or customer relationship purposes.
We use personal information to provide, operate and improve the Services and support Our operations. Depending on how you interact with Us and the Services, We may use personal information to:
provide and manage the Services, including accounts, permissions, integrations, reports, support and billing;
use sport, performance, health and wellness information to provide the features, insights and recommendations available through the Services;
improve and develop the Services, understand how they are used, and provide AI-enabled features;
communicate with you about the Services and, where permitted, send marketing and product communications;
conduct analytics, research and benchmarking as described in this Privacy Policy;
protect the Services, Our users and Lumin Sports, including through security monitoring, fraud prevention and incident response; and
comply with legal and contractual obligations, respond to lawful requests and disputes, and protect a person's health or safety where necessary and permitted by law.
The legal basis or lawful ground We rely on depends on the law that applies to you and the context of the processing.
For users in the European Economic Area or United Kingdom, where We act as a controller, We may rely on the following legal bases:
Contract: where processing is necessary to provide the Services, administer your account, or take steps at your request before entering into a contract.
Consent: where you have consented to the processing, including where required for optional cookies, certain marketing communications, connected integrations or other optional features.
Legitimate interests: where processing is necessary for Our legitimate interests in operating, securing, supporting, improving and developing the Services, managing Our customer and business relationships, conducting analytics, communicating about Our Services and protecting Our legal rights and interests, provided those interests are not overridden by your rights and interests.
Legal obligations: where processing is necessary to comply with applicable legal, regulatory, tax, accounting or other obligations.
Where We process special category personal data as a controller, including health information, We will also rely on an applicable condition permitted under data protection law. Where We process this information on behalf of a customer, the customer is responsible for determining the applicable legal basis and special category condition.
For users in Switzerland, We process personal information in accordance with the Swiss Federal Act on Data Protection, including its requirements for lawful, transparent and proportionate processing.
For Australia, New Zealand and other jurisdictions, We collect, use and disclose personal information for the purposes described in this Privacy Policy and as permitted by applicable law.
We offer features that use artificial intelligence and machine learning (“AI-enabled features”). These features may process information you provide, including prompts, documents, notes, reports, athlete or team information, feedback and related data, to provide the requested output or functionality.
We may use third-party AI providers, including OpenAI and Amazon Web Services, to support these features. We take steps to ensure personal information is only used for authorised purposes and is protected by appropriate contractual, technical and organisational safeguards.
Unless We tell you otherwise or obtain any required permission, We do not allow third-party AI providers to use your personal information or customer data to train their general-purpose AI models.
AI-generated outputs can be incomplete or inaccurate and should be reviewed by someone with appropriate expertise before being relied on for decisions about health, welfare, training, performance, recruitment, selection or other significant matters.
We do not use AI-enabled features to make decisions that have legal or similarly significant effects on you without appropriate human involvement, unless We tell you and provide any rights required by law.
We may share personal information:
with your organisation and authorised users, such as coaches, practitioners and team administrators, where they are permitted to access information through the Services;
with other users where you choose to use features that make information visible or allow it to be shared;
with third-party apps, devices or services that you or your organisation choose to connect to the Services;
with service providers and technology partners that help Us provide, secure, support and improve the Services, as described below;
with professional advisers, insurers, auditors and other advisers where reasonably necessary;
with regulators, courts, law enforcement or other parties where required or permitted by law;
in connection with a merger, acquisition, financing, sale, reorganisation or similar business transaction; or
with your consent or at your direction.
Where We process personal information on behalf of a customer, We share that information in accordance with Our agreement with the customer, its instructions and applicable law.
We use service providers and technology partners to help Us provide the Services and support Our operations. These may include providers of cloud hosting and storage, AI services, customer support and communications, payments, billing and accounting, analytics, security and monitoring, sales and marketing, connected apps and integrations, and other technology or business services.
Where a provider processes personal information on Our behalf, We require it to use the information only for authorised purposes and to protect it appropriately. Where required by law or contract, We also put appropriate data processing and international transfer safeguards in place.
Some providers may handle personal information for their own purposes rather than solely on Our behalf. In those cases, their own privacy policies may also apply.
Where We act as a processor for a customer, service providers that process customer personal information on Our behalf may act as subprocessors. Our current subprocessor list and information about changes are available through Our Trust Centre at trust.luminsports.com.
The Services may link to or integrate with third-party websites, mobile applications, devices, content or services. We are not responsible for the privacy, security or content practices of third parties that We do not control. You should review the privacy policies and settings of any third-party service before connecting it to the Services or providing information to it.
If you or your organisation connect a third-party app, wearable, performance system or device to the Services, We may collect, use and disclose information through that integration according to your permissions, your organisation’s settings, and the third party’s terms and privacy settings. You may be able to disconnect integrations through the Services or the third-party provider’s settings.
We use cookies, pixels, SDKs, local storage, log files and similar technologies to operate the Services, keep them secure, remember preferences, understand how the Services are used, improve performance, and support marketing, analytics and advertising where enabled.
We use analytics and advertising tools including Google Analytics, HubSpot Analytics and Meta/Facebook Pixel. These tools may collect or receive information from Our websites, marketing pages or Services and other websites or apps to help Us measure campaigns, understand usage, improve the Services, and deliver or measure targeted advertising.
You can usually set your browser or device to refuse or delete cookies. Some Services may not function properly if cookies are disabled. Where required by law, We will seek consent for non-essential cookies, pixels or similar technologies, or provide choices through a cookie banner, consent tool, browser setting, account setting or other available control. You can also review Our Cookie Policy for further details and choices.
We do not knowingly use under-18 athlete records, health information or sensitive athlete information for targeted advertising. Where targeted advertising tools are used, they are intended for website, sales, marketing and campaign measurement purposes rather than athlete performance decision-making.
Some browsers or extensions support Global Privacy Control (GPC) or similar opt-out preference signals. Where required by applicable law, We will treat a recognised signal as a request to opt out of sale, sharing or targeted advertising for that browser or device.
Where We act as a controller, We may use personal information, where permitted by law, to create and use aggregated, de-identified or anonymised information for research, benchmarking, statistics, product development and performance insights.
Where We act as a processor, We will only use personal information for these purposes where permitted by Our agreement with the customer and its instructions.
We are based in Australia and store core Services data in Australia. Some operational, analytics, support, communications, billing, security, AI or service-provider data may be accessed, processed or stored in other countries where We, Our customers, Our service providers or Our partners operate. These countries may include Australia, the United States, the European Economic Area, the United Kingdom, New Zealand and other provider locations.
Australia is not currently recognised by the European Commission as providing an adequate level of data protection under the General Data Protection Regulation (“GDPR”). Other destination countries may also not be recognised as adequate under applicable data protection law.
Where We disclose or transfer personal information internationally, We take steps designed to protect it in accordance with applicable law. These steps may include contractual safeguards, data processing agreements, standard contractual clauses or other approved transfer mechanisms, transfer risk assessments, due diligence on service providers, access controls, encryption, logging and other technical and organisational security controls.
You may contact Us using the details below for further information about the safeguards that apply to your personal information and, where applicable, how to obtain a copy of them.
We keep personal information only for as long as We reasonably need it for the purposes described in this Privacy Policy. How long We keep information depends on the type of information, why We hold it, Our relationship with you or the relevant customer, and any legal, contractual, security or operational requirements that apply.
Customer, account, athlete, performance, health and other Services data is generally kept for the duration of the relevant customer relationship and then deleted or de-identified in accordance with Our agreement with the customer and Our standard retention processes.
Billing and accounting records may be kept for longer where required for tax, accounting, audit or legal purposes. Support records, security and audit logs, and backups may also be kept for longer where reasonably necessary for support, security, incident response, audit or disaster recovery.
Information held in backups may not be immediately deleted but will remain protected and subject to Our backup and retention processes. Aggregated, de-identified or anonymised information may be retained where individuals are no longer reasonably identifiable.
When personal information is no longer required, We will delete, de-identify or anonymise it as appropriate under applicable law.
We use a combination of technical, organisational, physical and managerial safeguards designed to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These safeguards may include access controls, authentication, encryption, monitoring, logging, staff training, security reviews, vendor controls and incident response procedures.
No method of electronic transmission or storage is completely secure. You are responsible for keeping your login credentials confidential and for using the Services in a secure environment. If We detect a data breach that is likely to result in serious harm or requires notification under applicable law, We will notify affected individuals, customers, regulators or other parties as required.
The Services are not intended for, and may not be used by, anyone under 13. Customers must not provide personal information about anyone under 13 through the Services.
The Services may be used by users aged 13 to 17 where permitted by the relevant customer and any authority or consent required by law has been obtained.
Customers are responsible for ensuring they have the legal authority to provide personal information about users under 18 to Us and to use the Services with them, including giving any required notices and obtaining parent or guardian consent where required by law.
If We become aware that personal information about anyone under 13 has been provided to Us, We will take appropriate steps to delete or de-identify it, unless We are required or permitted by law to retain it.
If We become aware that personal information has been provided to Us without the authority or consent required by law, We will take appropriate steps, including deleting or de-identifying the information where required.
Depending on your location and the context in which We process your information, you may have rights to:
request access to personal information We hold about you;
request correction of inaccurate or incomplete information;
request deletion of your account or personal information;
request restriction of processing or object to certain processing;
withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
request data portability where applicable;
opt out of marketing communications;
opt out of certain targeted advertising, sale or sharing under applicable US state laws;
limit the use or disclosure of sensitive personal information where applicable;
appeal a refusal to act on certain privacy requests where required by law;
complain to a privacy regulator or supervisory authority.
To exercise your rights, contact Us at privacy@luminsports.com, use the EUverify privacy request portal where applicable, or use any privacy controls made available in the Services. We may need to verify your identity before responding. If your account is managed by a customer, We may direct your request to that customer or assist it in responding.
You can unsubscribe from marketing emails by using the unsubscribe link in the email or by contacting Us. We may still send you service, security, transactional or account-related communications.
Australia - You may request access to or correction of your personal information and may complain to Us about Our handling of your personal information. If you are not satisfied with Our response, you may be able to complain to the Office of the Australian Information Commissioner.
New Zealand - If New Zealand privacy law applies, you may have rights to access and correct personal information and to complain to the Office of the Privacy Commissioner.
European Economic Area, United Kingdom and Switzerland - If GDPR, UK GDPR or Swiss data protection law applies, you may have applicable rights to access, correct or delete your personal information, restrict or object to certain processing, request portability where available, withdraw consent, and complain to the relevant supervisory authority. For EEA and UK users, where required, Our EEA and UK representatives are listed below.
United States - Depending on the applicable state privacy law and the context, We may act as a business, controller, service provider or processor. Depending on your state of residence, you may have rights to access, correct or delete your personal information, obtain a copy of it, opt out of targeted advertising, sale or sharing, opt out of certain profiling, limit certain uses or disclosures of sensitive personal information, and appeal certain decisions. We will not discriminate against you for exercising your privacy rights. We do not sell personal information for money. Some advertising, analytics or tracking technologies may be considered a sale or sharing under certain US state privacy laws.
Canada and other regions - You may have additional rights depending on where you live. We will respond to requests in accordance with applicable laws.
We may update this Privacy Policy from time to time. The updated version will be indicated by the “Last updated” date above. If We make material changes, We may notify you by posting a notice, sending a notification, emailing you, or taking other steps required by law. The updated Privacy Policy applies from the effective date stated in the updated version, except where additional consent is required by law.
For privacy questions, requests or complaints, contact Us at:
Lumin Sports Technology Pty Ltd
Privacy Officer
Level 4, 27 Leigh Street
Adelaide, South Australia 5000
Australia
Email: privacy@luminsports.com
We will investigate privacy complaints and respond within a reasonable period. If you are not satisfied with Our response, you may lodge a complaint with the relevant privacy regulator or supervisory authority.
For GDPR-related requests, you may also use Our EUverify privacy request portal: https://gdpr.euverify.com/verify/3cc8681b-d755-4f3e-a15d-19f371c718d2.
If you are located in the EEA or the UK and have questions or concerns about Our processing of your personal information, you may contact Our representatives:
Euverify Ltd (Ireland)
Unit 3D North Point House
North Point Business Park
New Mallow Road
Cork T23 AT2P
Ireland
Email: gdpr@euverify.com
Euverify Ltd (UK)
3rd Floor, 86-90 Paul Street
London EC2A 4NE
United Kingdom
Email: gdpr@euverify.com