- Effective date
- Last updated
Luuta connects people, properties, cleaning tasks, logistics, and quality inspections. This policy explains how personal data is handled when you visit our website, contact us, or use Luuta through your organisation.
On this page
1. Who we are and what this policy covers
Panoramix Lab, Poland, develops and operates Luuta. In this policy, “we”, “us”, and “our” refer to Panoramix Lab. “Luuta” includes our public website, web application, mobile app, and related support services.
For privacy requests and legal notices, contact privacy@luuta.app. This policy covers our own processing and explains our role when we handle information on behalf of a business customer. Independent third-party services have their own privacy notices.
2. Our role and your organisation’s role
We act as a data controller when we decide why and how to process website enquiries, business contacts, service administration, security records, and diagnostics for our own purposes.
Your employer or other organisation using Luuta generally acts as the controller of workforce and operational data it puts into the service. We process that data on its documented instructions as a processor under the customer agreement and applicable data processing agreement. The organisation decides assignments, access permissions, and how work records are used.
For questions about your organisation’s work records or staff-data practices, contact its administrator or privacy contact first. If you send such a request to us, we will direct it to the relevant organisation and assist as required. This policy does not replace your organisation’s own notice.
3. Information you and your organisation provide
The information processed depends on the features your organisation uses and what you choose to submit.
Providing a demo enquiry is voluntary, but the form needs your name, work email, and company so we can handle it. Required account and work information is necessary for the corresponding service features. Optional messages and images are your choice; avoid submitting sensitive personal information that is not needed for the task.
- Account and profile details, such as name, email address, profile photo, account identifiers, and authentication and verification information.
- Organisation memberships, operating units, roles, permissions, staff assignments, shifts, and the properties or tasks associated with your work.
- Work records, including task progress, time records, supply requests, deliveries, incidents, inspection results, comments, and uploaded photos or files. Operational records may identify the person who performed an action.
- Demo enquiries: name, work email, company, optional team-size range and message, form language, source page, submission time, and request reference.
- Business correspondence, support requests, and the information you send when asking us to investigate a problem.
4. Technical information
When you access Luuta, our systems and service providers may process IP addresses, browser or device information, operating-system and app versions, request timestamps, session identifiers, and security or error logs. These help deliver requests, manage access, prevent abuse, and investigate faults.
Where push notifications are enabled, we process device registration tokens and notification preferences to route messages. Diagnostic reports may contain error details, stack traces, release information, and user or organisation identifiers. Optional analytics records service interactions and performance events when enabled with consent.
Website consent receipts contain a random consent reference, receipt reference, decision, timestamp, language, and notice version. We do not connect these references to demo-enquiry rows.
5. Purposes and legal bases
For processing where we are the controller, we rely on the legal basis appropriate to the purpose. Consent to optional analytics is separate from accepting service terms.
- Contracts and pre-contractual steps, where applicable: handling a request made by an individual who is a prospective contracting party and delivering services under that individual’s contract.
- Legitimate interests: communicating with representatives of business customers, administering the business relationship, supporting users, maintaining reliable services, diagnosing failures, and protecting systems against misuse. We consider these interests against the rights and interests of affected individuals.
- Legal obligations: responding to valid legal requests, meeting applicable record-keeping requirements, and handling data-protection obligations.
- Consent: optional website and app analytics. You can withdraw consent through website Cookie settings or the app’s privacy settings without losing access to the core service.
- Customer instructions: workforce and operational data is processed on behalf of the customer. The customer is responsible for identifying its legal basis and informing its personnel.
7. International transfers
Service providers may process information in countries outside the European Economic Area. The use of a European business operator does not by itself mean that all processing stays in Europe.
When a transfer requires protection under applicable data-protection law, we use a recognised transfer mechanism, such as an adequacy decision or standard contractual clauses, with supplementary measures where required. You can contact privacy@luuta.app for information about the safeguards applicable to your data or to request a copy, subject to necessary redactions.
8. Cookies, analytics, and crash reporting
The website uses the necessary luuta_consent cookie to remember your choice for six months. Optional Google Analytics is loaded only after a saved opt-in and only when analytics has been enabled for the site. You can reject optional analytics or withdraw your choice through Cookie settings in the footer.
Optional app analytics is controlled separately through the app’s privacy settings and applicable feature configuration. Website consent does not set your app preference, and app consent does not set your website preference.
Crash and error reporting is separate from optional usage analytics. When enabled, it supports reliability and fault investigation and may include technical context and account or organisation identifiers. Turning off optional analytics does not itself turn off crash reporting. We take steps to redact credentials and email addresses from application diagnostic text.
9. Camera, photos, and notifications
Luuta may ask for camera access when you scan a property code or take a photo for a supported workflow. It may ask for photo access when you select an image, for example for your profile. Content you choose to upload is processed as part of that workflow; granting a permission alone does not instruct us to upload your entire photo library.
Where available, push notifications communicate work updates and service information. You can manage device permissions through your operating-system settings and available preferences in Luuta. Declining a permission may prevent the related feature from working, while other features remain available.
10. Offline data and synchronisation
The mobile app stores locally cached records, preferences, and pending changes to support work with limited connectivity. Pending actions may be sent to the service when connectivity returns. Information saved locally is still personal data where it identifies a person.
Protect devices used for work, follow your organisation’s shared-device rules, and use the sign-out and account-management controls available in the app. Uninstalling the app or removing local data does not itself delete records already held by the service or your organisation.
11. How long information is retained
Website demo enquiries are retained for twelve months from submission unless an ongoing business relationship or a legal requirement justifies longer retention. Enquiries are removed through periodic administrative review. Website consent receipts are retained for twelve months, and the consent cookie expires after six months.
Account, support, security, and diagnostic information is kept for as long as needed for its purpose, considering the account or relationship status, the need to investigate issues, applicable legal duties, and the establishment or defence of claims. Analytics retention also depends on the relevant provider configuration.
Customer-controlled operational data follows the customer’s instructions and contractual retention arrangements. On ending the service, return or deletion is handled under the applicable customer and data processing agreements. Backup copies follow the applicable backup lifecycle and legal retention requirements. Deleting an individual account does not necessarily delete records that the customer must lawfully retain.
12. How we protect information
We use technical and organisational measures appropriate to the nature of the information and the risks, including access controls, restricted operational access, and measures to protect authentication information. Security measures are reviewed as services and risks change.
No internet transmission or storage system can be guaranteed completely secure. If you suspect unauthorised access to your account or a data incident, contact us promptly and inform your organisation’s administrator.
13. Your rights and how to exercise them
Subject to the conditions in applicable law, you may request access and a copy, correction, erasure, restriction, or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent at any time without affecting the lawfulness of earlier processing.
Send requests concerning our controller processing to privacy@luuta.app. We may need information to verify your identity and locate relevant records. We normally respond within one month; lawful extensions will be explained. For customer-controlled records, your organisation decides the response, and we assist it under our agreement.
You may complain to the President of Poland’s Personal Data Protection Office (UODO) or another competent supervisory authority. You do not need to contact us before lodging a complaint. Luuta’s operational workflows do not by themselves constitute automated decisions about you with legal or similarly significant effects; your organisation remains responsible for its employment and operational decisions.
14. Children, changes, and contact
Luuta is a business service and is not directed at children. Customers must ensure that their use of the service and the information they submit comply with applicable rules protecting minors.
We may update this policy to reflect changes to Luuta or legal requirements. The dates above identify this version. Where required, we will provide an additional notice of material changes. For privacy questions and legal notices, write to Panoramix Lab at privacy@luuta.app. For sales and demo enquiries, use sales@luuta.app.