Lumio CRM
Intelligent Real Estate

Privacy Policy

Last updated: July 2026

1. Information for the User

Who is the data controller for your personal data?

Lumio CRM S.L. is the CONTROLLER of the processing of the USER's personal data and informs you that this data will be processed in accordance with the provisions of Regulation (EU) 2016/679, dated April 27 (GDPR), and Organic Law 3/2018, dated December 5 (LOPDGDD).

  • Contact details for exercising your rights: Lumio CRM S.L., Avda. Emilio Castelar 10, 30740 San Pedro del Pinatar (Murcia), Spain. E-mail: hello@lumiocrm.com

Why do we process your personal data?

To maintain a commercial relationship with the user and to provide the services contracted through Lumio CRM. The planned operations for processing are:

  • Creating and managing your account, providing the functionalities of the platform contracted, and managing the subscription, billing and invoicing associated with it.
  • Processing orders, requests, responding to queries or any type of request made by the USER through any of the contact forms available on the CONTROLLER's website.
  • Sending of commercial communications by email or any other electronic or physical means that enables commercial communications. These communications will be carried out by the CONTROLLER and will be related to its products and services, or those of its collaborators or suppliers with whom it has reached a promotion agreement. In this case, third parties will never have access to the personal data.
  • Sending the online newsletter about news, offers and promotions in our activity.
  • Conducting market research and statistical analysis.

On what grounds can we process your personal data?

Because the processing is legitimised by Article 6 of the GDPR as follows:

  • Performance of a contract: creating and maintaining your account, providing the contracted services and managing the subscription.
  • Legal obligation: issuing and retaining invoices and accounting records in accordance with applicable tax legislation.
  • With the USER's consent: sending of commercial communications and the newsletter.
  • In the legitimate interest of the CONTROLLER: conducting market research and statistical analysis, ensuring the security of the platform, and processing orders and requests made by the USER.

Whose data do we process as a processor rather than as controller?

Lumio CRM is used by real estate agencies to manage their listings, contacts, pipeline and marketing activity. Where an agency records the personal data of its own clients and contacts in the platform, that agency is the data controller for that data and Lumio CRM S.L. acts solely as a data processor on its behalf, processing it only in order to provide the contracted service and in accordance with the agency's instructions. If you are a client or contact of one of our agency customers and wish to exercise your rights over that data, please contact the agency directly.

To whom do we disclose your personal data?

No disclosure of personal data to third parties is foreseen, except where necessary for the development and execution of the purposes of the processing, to the service providers listed in section 3, with whom the CONTROLLER has signed the confidentiality and data processor contracts required by current privacy regulations. We do not sell personal data, and we do not use it for advertising purposes.

What are your rights?

If you are located in the European Union or the United Kingdom, you have the following rights under the GDPR and Spain's LOPDGDD:

  • Right of access: request a copy of your personal data.
  • Right to rectification: request correction of inaccurate data.
  • Right to erasure: request deletion of your personal data.
  • Right to restriction: request that we limit how we process your data.
  • Right to portability: receive your data in a machine-readable format.
  • Right to object: object to processing based on legitimate interests.
  • Right to withdraw consent at any time, where processing is based on consent.
  • Right to lodge a complaint with the supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es), if you consider that the processing does not comply with current regulations.

To exercise any of these rights, write to hello@lumiocrm.com. We will respond within 30 days.

2. What Data We Collect

2.1 Agency users (agents, administrators)

  • Full name and email address, used for login and identification.
  • Phone number, optional, used for agent contact cards.
  • Profile photo, optional.
  • Role and permissions within the agency.
  • Login timestamps and session data.
  • Activity logs of actions taken within the platform.
  • Billing and tax details where a subscription is contracted.

2.2 Property data

  • Property details entered by agency users, such as address, price, description and photos.
  • Property images uploaded to our storage service.
  • Viewing records and open house registrations.

2.3 Contact and lead data

  • Name, email address and phone number of property enquirers.
  • Nationality, budget and property preferences.
  • Communication history and notes entered by agents.
  • Consent status and marketing preferences.
  • Lead source and scoring data.

This category is the data for which the agency is controller and we are processor, as described above.

2.4 Technical data

  • IP address and browser type, for security logging.
  • Device type and operating system.
  • Pages visited within the platform and feature usage.
  • Error logs and performance data.

3. Third-Party Services

Lumio CRM relies on the following providers to operate. Each processes data in accordance with its own privacy policy:

  • Supabase: database, authentication and file storage. Processes all platform data.
  • Vercel: application hosting and content delivery. Processes technical logs and IP addresses.
  • Stripe: subscription payments. Processes billing details and card data, which is entered directly into Stripe's own fields and never reaches our servers.
  • Anthropic: AI text generation. Processes property details and contact summaries submitted to the AI features.
  • Resend: transactional email delivery. Processes recipient email addresses and message content.
  • Meta (Facebook and Instagram), LinkedIn and TikTok: optional social media publishing. Process post content and access tokens, for agency accounts that choose to connect them.

4. Social Media Integrations

If an agency connects its social media accounts to Lumio CRM, the following applies:

  • We store OAuth access tokens in our database, which is encrypted at rest.
  • Tokens are used solely to publish content on behalf of the agency, when a user explicitly chooses to post.
  • We do not read your messages, followers or analytics beyond what publishing requires.
  • Agencies can disconnect their social accounts at any time from Settings.
  • Disconnecting revokes the token and we delete it within 24 hours.

5. Data Retention

  • Active accounts: data is retained for the duration of the agency's subscription.
  • Cancelled accounts: data is retained for 90 days after cancellation, then permanently deleted.
  • Contact and lead data: retained while the agency's account is active. The agency is responsible for its own compliance in respect of that data.
  • Backups: encrypted backups are retained for 30 days.
  • Security logs: retained for 12 months.
  • Invoices and accounting records: retained for the period required by Spanish tax legislation.

6. Cookies

Lumio CRM uses only technical and functional devices, which are strictly necessary to keep you signed in and to preserve the state of the interface, together with the cookies our payment provider sets on the checkout page. We use no analytical, advertising or tracking cookies. Full detail is in our Cookie Policy.

7. Data Security

In accordance with current data protection regulations, the CONTROLLER complies with the GDPR and the LOPDGDD for the processing of personal data under its responsibility, and with the principles described in Article 5 of the GDPR, whereby data is processed lawfully, fairly and transparently in relation to the data subject, and is appropriate, relevant and limited to what is necessary in relation to the purposes for which it is processed. The measures in place include:

  • All data transmitted over HTTPS and TLS encryption.
  • Access to the platform controlled by authenticated sessions and role-based permissions.
  • API keys and secrets held as environment variables, never in source code.
  • OAuth tokens stored encrypted.
  • Regular automated backups.
  • Access logs for authentication events.

In the event of a data breach affecting your personal data, we will notify affected parties within 72 hours, as required by the GDPR.

8. Children's Privacy

Lumio CRM is a business-to-business platform intended for use by real estate professionals. We do not knowingly collect personal data from anyone under the age of 18.

9. Mandatory or Optional Nature of the Information Provided

USERS, by ticking the corresponding boxes and entering data in the fields marked with an asterisk (*) in the contact form or presented in download forms, expressly and freely accept that their data are necessary for the provider to meet their request, with the inclusion of data in the remaining fields being voluntary. The USER guarantees that the personal data provided to the CONTROLLER are truthful and is responsible for communicating any modification thereof.

The CONTROLLER informs that the data requested through the website are necessary for the provision of an optimal service to the USER. If all data is not provided, it is not guaranteed that the information and services provided will be completely tailored to their needs.

The CONTROLLER guarantees that it has implemented appropriate technical and organisational policies to apply the security measures established by the GDPR and the LOPDGDD in order to protect the rights and freedoms of USERS, and has communicated the appropriate information to them so that they can exercise them.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the date shown at the top of this page, and notify active agency administrators by email if the changes are material. Continued use of Lumio CRM after changes are published constitutes acceptance of the updated policy.

11. Contact

For any privacy related question, or to exercise the rights described above, contact Lumio CRM S.L., Avda. Emilio Castelar 10, 30740 San Pedro del Pinatar (Murcia), Spain, e-mail hello@lumiocrm.com.