Privacy Policy — "Chinese? I Can." (go-lume.com)

For data collected directly by this Site (purchase records, learning progress, support e-mails), the controller is:

• Jing Lu, OSVČ, trading as Lume Studio
• IČO: 29611911
• Address: Italská 2304, 272 01 Kladno - Kročehlavy
• Contact: hello@go-lume.com

Where Managed Payments applies to your transaction, the seller of record is Sold through Link, LLC. Your payment and transaction data are processed by Stripe and its affiliated entities as independent controllers, for their own payment, tax, fraud-prevention and compliance purposes; we do not direct or control that processing. The transaction is carried out through Link, Stripe's payment service. Your receipt email contains a link that lets you associate the transaction with a Link account; creating or using a Link account is optional and is not required in order to buy from us. We do not receive or store your full payment card details.

We do not operate a user account or password system. After Stripe confirms your payment, you are returned to our Site and your browser receives an access cookie that opens the Course you bought (see §6). We do not send you an access e-mail. If you lose access — for example, on a new device or after clearing your cookies — write to hello@go-lume.com and we will restore it. We collect:

• E-mail address: provided at checkout via Stripe. For access purposes, we store it only in hashed (pseudonymised) form, linked to your purchase, so that we can verify and restore your access when you ask us to.
• Purchase and access data: which Courses and units you bought; an access record containing an internal identifier, the units unlocked, the date of issue, its source, whether the access has been revoked, and any internal note (for example, about a manual restoration); and the identifier of your Stripe checkout session, which we use to issue your access after payment. (Card/payment details are collected and stored by Stripe, not by us.)
• Refund records: for each refund, its date, the order it relates to, and whether it was a refund where we were not at fault (a withdrawal under your statutory right of withdrawal, or a refund within our voluntary 14-day refund window) or a refund caused by a problem on our side. If we decide under Section 4 of our Terms of Service to decline your future orders, we also record that decision, its date, and the e-mail address it applies to.
• Learning data (if applicable): progress, exercise responses, and usage within Courses, used to show your learning progress and improve content.
• Technical data: anonymized, host-level traffic statistics only — see §6. We do not collect analytics data tied to you individually.
• Communications: messages you send us for support, and, if you opt in, marketing e-mails (e.g., waitlist sign-up).

• Contract performance (Art. 6(1)(b) GDPR): giving you access to the Courses you bought (including the access record and access cookie described in §2 and §6), restoring your access when you ask us to, and providing customer support.
• Legal obligation (Art. 6(1)(c)): bookkeeping/tax records as required of Lume Studio as OSVČ.
• Consent (Art. 6(1)(a)): marketing e-mails (e.g., waitlist sign-up) — you can withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)): keeping the Site secure, improving Course content based on aggregated, anonymized usage.
• Legitimate interest (Art. 6(1)(f)): keeping refund records and, where applicable, a record of our decision to decline your future orders, so that we can apply the rule in Section 4 of our Terms of Service and prevent misuse of our refund windows. This does not affect any refund you are entitled to. You can object to this processing at any time — see §7.

We retain your purchase and learning data for as long as needed to provide you Course access and support. After that, we keep only what we are required to keep for tax and accounting purposes, for the periods set out below. You may request earlier deletion of other data — see §7.

Tax and accounting records. Records of purchases and refunds that form part of our tax records are kept for as long as Czech tax law requires. As a sole trader keeping tax records, we keep them at least until the time limit for assessing the relevant tax has expired. That time limit is generally three years from the deadline for filing the relevant tax return and may be extended by law, up to a maximum of ten years (Act No. 280/2009 Coll., Tax Code, Section 148). Where Czech VAT law requires us to keep tax documents, we keep them for ten years from the end of the tax period in which the transaction took place (Act No. 235/2004 Coll., on Value Added Tax, Section 35). During that time, these records are used only for tax and accounting purposes.

Refund records and declined-order records. The records we keep to apply the rule in Section 4 of our Terms of Service are deleted three years after the most recent refund where we were not at fault. When they are deleted, any decision to decline your future orders lapses. We do not keep these records for longer merely because some of the same transactions also appear in our tax and accounting records.

We do not sell your personal data. We only share data with the parties above (and legal authorities where required by law).

We only use strictly necessary cookies — cookies without which the Site cannot provide the service you asked for. We do not use any non-essential cookies, and we do not use cookies for analytics or advertising. The Site sets the following cookies:

• lume_ent: records your access to the Course you bought, so that you can open it without an account or password. It contains an internal access identifier, the units you have unlocked and an expiry date. It is digitally signed so that it cannot be altered, and scripts on the page cannot read it. It is set when you return from Stripe's checkout after payment and is kept for up to one year.
• lume_ent_ui: a copy of your access status (the units you have unlocked and the expiry date) without any identifier, used only so that the page can show you which units are open. It is kept for up to one year.

If you delete these cookies, if they expire, or if you use another browser or device, write to hello@go-lume.com and we will restore your access. Stripe's checkout pages are operated by Stripe, which sets its own cookies there under its own policies. Cloudflare Web Analytics, used for our own aggregate traffic statistics, is cookie-free by design and does not set any cookies in your browser. Because we use only strictly necessary cookies, no cookie-consent banner is required under applicable law; this section serves as our required disclosure.

As an EU/Czech data subject, you have the right to: access your data; request correction; request erasure; restrict or object to processing; data portability; and withdraw consent at any time without affecting prior lawful processing. You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz).

If we have decided under Section 4 of our Terms of Service to decline your future orders, you can ask us to reconsider that decision, and you can object to our keeping of the related refund and declined-order records. Such decisions are taken by a person, not by automated means alone.

To exercise these rights, contact: hello@go-lume.com

Some of our processors (e.g., hosting/e-mail providers) may process data outside the EU/EEA. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Courses are not directed at children under 16 without parental consent. If you believe a child has provided us data without appropriate consent, contact us to have it removed.

We may update this Privacy Policy; material changes will be reflected by an updated "Last updated" date.