Privacy and data protection
Privacy Policy
How Lume NDR & CSR collects, uses, protects, retains and deletes personal and operational data.
1. Who we are
Lume NDR & CSR is operated by Lume Ventures. The service helps businesses manage courier return and pending-delivery workflows, merchants, agents, integrations, notifications and operational reports.
Privacy questions and deletion requests can be sent to contact@lumecourier.com or WhatsApp +971 50 454 1256.
2. Data we collect
Depending on how the service is used, we process:
Account and profile information, including name, business name, email address, WhatsApp or phone number, role and workspace membership.
Demo-request information, including website and how the requester heard about Lume.
Shipment and operational information supplied by a customer, courier or integrated provider, such as tracking number, consignee name, phone number, address, merchant, courier, product information, COD value, shipment status, return reason, timestamps, agent assignment and remarks.
Integration configuration and encrypted credentials required to connect customer-authorized APIs.
Device and notification information, including an installation identifier, push-notification token, device model, platform and app version when notifications are enabled.
Security and diagnostic information, including login and security events, error messages, crash reports, device platform and app version. Passwords, API keys and full shipment payloads are not intentionally included in user-submitted problem reports.
The app may use device biometric authentication. Biometric templates remain under the control of the device operating system and are not received or stored by Lume.
3. How we use data
We use this information to:
Authenticate users and enforce workspace and role permissions.
Import, organize and update authorized shipment and return information.
Support agent assignments, customer contact, approvals, reporting and notifications.
Maintain integrations and synchronize provider data requested by the customer.
Detect abuse, investigate errors, maintain security and improve reliability.
Respond to demo requests, support enquiries and legal obligations.
We do not sell personal information or customer operational data.
4. Customer responsibility
Business customers control the shipment and consignee information they provide or authorize Lume to process. Each customer is responsible for having a lawful basis and any necessary notices or permissions for that data. Lume processes it to provide the contracted service, protect legitimate business and security interests, meet legal obligations, and act on valid consent where consent is required.
5. Data sharing and service providers
Data is shared only as necessary to operate the service, comply with law, protect rights and security, or follow the customer's authorized workflow. Service providers may include hosting and database providers, courier or customer-authorized API providers, Firebase services for notifications and crash diagnostics, and Expo services for secure application delivery and updates.
Service providers process information under their own contractual and security obligations. We do not permit them to use customer operational data for unrelated advertising.
6. Workspace separation and access
Customer workspaces are logically separated. Authorized Super Admins, Admins and Agents can access information according to their assigned role and workspace. Platform administration is used to manage customer workspaces, subscriptions, security and support and is not intended to expose one customer's data to another customer.
7. Security
We use encrypted network connections, server-side credential storage, role-based access controls, workspace isolation, monitoring and other reasonable safeguards. No online service can guarantee absolute security. Users must protect their credentials, devices and connected API keys and must report suspected unauthorized access promptly.
8. Retention and deletion
Information is retained while an account is active and as reasonably needed to provide the service, maintain security, resolve disputes and comply with law. Under the service terms, customer operational data is scheduled for deletion approximately one month after account suspension or termination, subject to backup rotation and legitimate legal, billing, fraud-prevention or security retention requirements.
An authorized account owner may request account and associated data deletion by emailing contact@lumecourier.com with the subject Account deletion request, or by contacting +971 50 454 1256. We may verify identity and authority before deletion. Users may also ask their workspace Super Admin to remove an internal Admin or Agent account.
9. User choices
Users can disable push notifications in the app or Android settings, remove locally saved biometric login accounts, log out, and request correction or deletion of eligible information. Disabling notifications does not prevent essential in-app operational information from being displayed after login.
10. International processing
Service providers may process data in countries other than the user's country. Where required, reasonable contractual and technical safeguards are used for such processing.
11. Children
The service is a business operations product and is not directed to children. Users must be at least 18 years old or otherwise legally able and authorized to use the service for their organization.
12. Changes to this policy
We may update this policy when the service, law or our data practices change. The current version and effective date will be published at https://ndr.lumeventure.com/privacy. Material changes will be communicated through a reasonable channel where required.
13. Contact
Lume Ventures
Rehman Plaza, Service Rd, Khana Pul Wst, Islamabad, Pakistan
Email: contact@lumecourier.com
WhatsApp: +971 50 454 1256