Privacy Policy, Terms of Service and Data Deletion
Last updated: 21 October 2026
This page explains how THUNDERLINES, Lda., trading as luum. digital ("luum", "we", "us"), collects and uses personal data. It covers our website luumdigital.com, our business relationships with partners and clients, and our Meta application "luum. router.", which receives leads from Meta lead ads run on our own Facebook and Instagram Pages.
Our consumer landing pages and lead forms each have their own campaign privacy notice. That notice shows at the moment you submit your details, and it names the company your request is sent to. This page completes those notices.
We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese data protection law (Law 58/2019).
The page has three parts:
Part 1 – Privacy Policy
1. Who is responsible for your data
The controller of your personal data is:
THUNDERLINES, Lda. (trading as luum. digital) NIPC 516424939 Registered office: Rua Jaime Moniz, n.º 12, Edifício Krypton III, Bloco 1, R/C A, 9060-343 Funchal, Portugal Office: Rua Braamcamp 9, Lisboa, Portugal Email: privacy@luumdigital.comWe have not appointed a Data Protection Officer, as the law does not require one for our activity. For any question about your data, write to privacy@luumdigital.com.
2. What we do
luum is a lead generation company. We run advertising on Facebook and Instagram that leads to our own landing pages and to Meta lead forms. When you ask to be contacted about a product or service (for example a home improvement quote, an energy solution, insurance or a credit offer), we collect your details and send them, in real time, to the company named in the consent you gave.
- Each request goes to one company only, the one named on the form.
- We do not sell, rent or resell your data to anyone else, and we do not use co-registration.
- We do not contact you for our own marketing. The company that receives your request contacts you about it.
Once your request is delivered, that company becomes an independent controller of the data it received. Its own privacy policy then applies to its use of your data.
3. The data we collect
| Who you are | Data we collect | Where it comes from |
|---|---|---|
| Person who submits a request on one of our forms | Name, email, phone number, postcode or address, the details of your request (for example type of project, type of property, or information needed for an insurance or credit quote), and a record of your consent (date and time, consent text shown, form and page used, IP address) | You, through our landing pages or Meta lead forms |
| Person who submits a Meta lead form on one of our Pages | The fields you filled in, plus technical identifiers from Meta (lead ID, form ID, ad and campaign IDs, Page ID, submission time) | Meta Platforms Ireland Ltd., through our app "luum. router." |
| Business contact (partner, client, prospect, supplier) | Name, company, job title, business email and phone, messages exchanged, billing details | You, your company, or public professional sources such as LinkedIn |
| Visitor of luumdigital.com | IP address, browser and device type, pages requested, date and time | Your browser, through our hosting and security provider |
We do not ask for special categories of data, such as health, religion or political opinions.
4. Why we use your data, on what legal basis, and for how long
| Purpose | Legal basis (GDPR) | How long we keep it |
|---|---|---|
| Send your request to the company named on the form | Your consent, Art. 6(1)(a) | 24 months after your request, then deleted |
| Keep proof of your consent and defend legal claims | Our legal obligation and legitimate interest, Art. 6(1)(c) and (f) | Up to 5 years after your request |
| Check lead quality and prevent fraud (duplicates, fake or wrong details) | Legitimate interest, Art. 6(1)(f) | Within the 24 months above |
| Measure the results of our ads (sending a coded, non-readable version of your contact details to Meta) | Your consent, Art. 6(1)(a) | As set by Meta, up to 24 months on our side |
| Manage our relationships with partners and clients, and contact business prospects | Contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f) | During the relationship, then up to 2 years. Invoices and accounting records: 10 years, as Portuguese law requires |
| Keep our website working and secure | Legitimate interest, Art. 6(1)(f) | A short period, in line with our hosting provider's security logs |
When a period ends, we delete the data or make it anonymous.
5. Who we share your data with
- The company named on the form. Only that company receives your request.
- Our service providers, who process data only on our instructions and under a data processing agreement:
- Meta Platforms Ireland Ltd. – advertising, lead forms and ad measurement
- Google Ireland Ltd. (Google Workspace) – email and documents
- Cloudflare, Inc. – website hosting and security
- Our internal API routing software, operated by luum, which delivers each lead to its company
- Public authorities and courts, only when the law requires it.
- Our legal and accounting advisers, under a duty of confidentiality.
We never sell your personal data.
6. Transfers outside the European Economic Area
We store data in the European Union where possible. Some of the companies we deliver requests to, and some of our providers, are in the United Kingdom, the United States or South Africa. In those cases we use the safeguards the GDPR requires:
- United Kingdom: the European Commission's adequacy decision.
- United States: the EU-U.S. Data Privacy Framework for certified companies, or the European Commission's Standard Contractual Clauses.
- South Africa and other countries: the European Commission's Standard Contractual Clauses.
You can ask us for a copy of these safeguards at privacy@luumdigital.com.
7. Your rights
You have the right to:
- access your data and get a copy of it
- correct data that is wrong or incomplete
- have your data deleted
- restrict how we use your data
- receive your data in a common format and move it to another company
- object to the use of your data based on our legitimate interest
- withdraw your consent at any time, without affecting what was done before
To use any of these rights, email privacy@luumdigital.com. We answer within one month. We may ask you to confirm your identity first.
If you ask us to delete your data or withdraw your consent, we also tell the company we sent your request to, and we tell you which company it was. You can also contact that company directly.
If you think we have not respected your rights, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or to the authority of the EU country where you live.
8. Security
We protect your data with encrypted connections (HTTPS/TLS), secure API delivery to partners, access limited to the staff who need it, and credentials kept in a password manager.
9. Automated decisions
We do not make decisions about you that have legal or similar effects using only automated means. Our software only sends your request to the company you chose.
10. Minors
Our forms and services are for people aged 18 or over. We do not knowingly collect data from minors. If you think we have, contact us and we will delete it.
11. Cookies
luumdigital.com does not use cookies, analytics tools or advertising trackers. Our consumer landing pages may use them; each landing page explains this in its own notice and asks for your consent where the law requires it.
12. Changes to this page
We may update this page when the law or our services change. The date at the top always shows the latest version.
13. Contact
THUNDERLINES, Lda. (luum. digital) – Rua Jaime Moniz, n.º 12, Edifício Krypton III, Bloco 1, R/C A, 9060-343 Funchal, Portugal – privacy@luumdigital.com
Part 2 – Terms of Service
1. Scope
These terms apply to the use of luumdigital.com, our forms and our Meta application "luum. router.". By using them, you accept these terms. If you do not accept them, please do not use them.
2. What luum is, and what it is not
luum connects people who ask for a quote or information with companies that offer that product or service.
- luum does not sell the products or services shown in our ads and forms.
- luum is not a credit intermediary, an insurance broker or a financial adviser, and gives no advice of that kind.
- Any quote, offer or contract is made directly between you and the company that contacts you. luum is not a party to it.
3. Your use of our forms
When you submit a form, you confirm that:
- you are 18 or over
- the details you give are true and are your own
- you want the company named on the form to contact you about your request
Please do not submit details of another person, or false or misleading information.
4. Business clients and partners
Our services to business clients and partners are covered by a separate written agreement. If that agreement and these terms differ, the agreement prevails.
5. Meta platforms
Our ads and lead forms run on Facebook and Instagram. Your use of those platforms is also covered by Meta's own terms and data policy.
6. Intellectual property
The content of luumdigital.com, including text, design and the luum name and logo, belongs to THUNDERLINES, Lda. or is used with permission. You may not copy or reuse it without our written consent.
7. Links to other websites
Our website and forms may link to other websites, including those of our partners. We are not responsible for their content or their privacy practices.
8. Liability
We work to keep our website available and accurate, but we cannot guarantee it is always error-free or uninterrupted. We are not responsible for the products, services, quotes or decisions of the companies that contact you. Nothing in these terms limits any right you have as a consumer under mandatory law, or our liability where the law does not allow it to be limited.
9. Changes
We may update these terms. The date at the top of this page shows the latest version.
10. Law and courts
These terms are governed by Portuguese law. Any dispute goes to the courts of Funchal, Portugal, unless mandatory consumer law gives you the right to go to the courts where you live.
Part 3 – User Data Deletion
You can ask us at any time to delete the personal data we hold about you. This includes data you sent through our landing pages, through Meta lead forms on our Facebook and Instagram Pages, and data received through our app "luum. router.".
How to ask
- Send an email to privacy@luumdigital.com with the subject "Data deletion request".
- Include the name, email address and phone number you used on the form, so we can find your data.
- If you remember them, add the approximate date of your request and the product or service it was about.
What happens next
- We confirm we received your request within 5 working days.
- We delete your data from our systems within 30 days, and we confirm it by email.
- We tell the company we sent your request to that you asked for deletion, and we tell you which company it was, so you can also contact it directly.
What we may keep
We keep only what the law requires, for example a short record that you asked for deletion and when we did it. We do not use that record for any other purpose.
If you have any question about deletion, write to privacy@luumdigital.com.