Privacy Policy

1. Controller and contact

The controller of your personal information is Luma Thrive Group LLC, a limited liability company organised under the laws of the State of New Mexico, with a registered address at 1209 Mountain Road PL NE STE R, Albuquerque, NM 87110, USA.

Privacy requests and questions: the contact address published in the footer of this website. We respond to every request we receive, and we identify the person handling it.

2. Personal information we collect

• Coaching application data you submit voluntarily: name, email address, and — where you choose to provide them — country or time zone, Instagram handle, selected coaching goal, preferred start date, and the free-text description of your situation.
• Client data, if you become a coaching client: the information needed to deliver coaching (training and nutrition preferences, schedule, equipment, check-in notes, and the progress information you choose to share).
• Communications: emails and messages you exchange with us, and the records of those exchanges.
• Billing data, if you purchase coaching: name, billing contact details, and transaction records. Card details are entered directly with our payment processor and are never received or stored by Luma.
• Technical data generated automatically: IP address, user agent, requested URL, referrer, and timestamps, recorded in standard web-server logs.
• Consent record: your cookie choice, stored in your browser's local storage together with the date it was made.

We do not request special-category health data through this website, and the application form asks you not to submit it. If you choose to share health information during a coaching relationship, we process it only to deliver the coaching you asked for, on the basis of your explicit consent, and you may withdraw that consent at any time.

3. Sources

We collect personal information directly from you. We do not buy contact lists, we do not scrape social platforms, and we do not enrich your record with data purchased from brokers.

4. Purposes and legal bases

• Reviewing and answering your coaching application — steps taken at your request prior to entering a contract (GDPR Art. 6(1)(b)); your consent where consent is the applicable basis (Art. 6(1)(a)).
• Providing coaching services and administering the client relationship — performance of a contract (Art. 6(1)(b)).
• Invoicing, accounting, and tax records — compliance with a legal obligation (Art. 6(1)(c)).
• Securing the website, preventing abuse and spam, and keeping server logs — our legitimate interests in operating a safe service (Art. 6(1)(f)).
• Optional measurement — your consent, given through the cookie banner and withdrawable at any time (Art. 6(1)(a)).
• Defending or establishing legal claims — our legitimate interests, or compliance with a legal obligation.

5. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects. Coaching applications are read and decided by a person.

6. Recipients and processors

• Hosting and email delivery providers, to store the website and transmit application notifications.
• A payment processor, for clients who purchase coaching, acting as an independent controller for payment and fraud-prevention purposes.
• Professional advisers (accounting, legal) bound by confidentiality, where strictly necessary.
• Public authorities, where disclosure is required by law, court order, or lawful request.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We disclose it only to service providers who process it on our documented instructions under written agreements:

7. International transfers

Luma is established in the United States. If you contact us from the European Economic Area, the United Kingdom, or Switzerland, your personal information is transferred to the United States. Where required, those transfers rely on the European Commission's Standard Contractual Clauses or another valid transfer mechanism, together with supplementary technical measures such as encryption in transit. You may request information about the safeguards applied.

8. Retention

• Applications that do not become a coaching relationship: deleted no later than 12 months after the last contact, unless you ask us to delete them sooner.
• Client records: kept for the duration of the coaching relationship and for up to 6 years afterwards, to meet accounting, tax, and limitation-period obligations.
• Server logs: retained for a maximum of 90 days for security and diagnostics.
• Consent records: kept while the consent is valid and for as long as needed to evidence it.

9. Your rights

Subject to the law that applies to you, you have the right to access your personal information; to rectify inaccurate data; to erase it; to restrict or object to processing; to data portability; to withdraw consent at any time without affecting prior processing; and not to be discriminated against for exercising any of these rights.

Residents of California, Colorado, Connecticut, Virginia, and other US states with comprehensive privacy laws also have the right to know, delete, correct, and obtain a portable copy of their personal information, and to appeal a refused request. Luma does not sell personal information or share it for targeted advertising, so no opt-out of sale or sharing is required.

To exercise a right, write to the contact address in the footer. We verify identity proportionately and reply within 30 days (extendable by a further 60 days where permitted, with notice). Exercising these rights is free unless a request is manifestly unfounded or excessive.

10. Complaints

If you are in the EEA or the UK you may lodge a complaint with your local supervisory authority; in the UK this is the Information Commissioner's Office. We would welcome the chance to address your concern first.

11. Security

The website is served exclusively over HTTPS. Application data is transmitted over authenticated, encrypted email channels; access to client records is restricted to personnel who need it; and the application endpoint applies bot filtering and rate limiting. No method of transmission or storage is perfectly secure, but we review these measures and will notify you and the competent authority of a personal-data breach where the law requires it.

12. Children

The website and coaching services are intended for adults aged 18 or over. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.

13. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The updated version is published on this page with a new date, and material changes are communicated to active clients by email.