Privacy Policy

§ 1. General information

This privacy policy sets out the rules for processing the personal data of users of the LuukMe mobile application (the “Application”).

The Application is a digital service that lets users publish video content, create user profiles, browse other users’ content and communicate between matched users.

The Application is available through mobile app stores, in particular Google Play, and in the future also other official app stores.

Using the Application requires creating a user account.

The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Personal Data Protection Act and other applicable laws.

§ 2. Data Controller

The controller of personal data is:

Kacper Domian

The Controller decides on the purposes and means of processing users’ personal data.

The Controller has not appointed a Data Protection Officer.

For all matters regarding the processing of personal data you can contact the Controller directly.

§ 3. Definitions

For the purposes of this Policy, the following definitions apply:

• Application – the LuukMe mobile application available in mobile app stores.
• User – an adult natural person using the Application.
• Personal data – any information relating to an identified or identifiable natural person.
• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council.
• Profiling – any form of automated processing of personal data consisting of using the data to evaluate certain personal aspects of the user.

§ 4. Scope, purposes and legal bases for processing

The Controller processes users’ personal data for the following purposes:

Providing the data required to create an account is voluntary but necessary to use the Application.

Providing an email address in the early-access form is voluntary. Signing up means consent to receiving more than one email message for the purpose above. You can withdraw your consent at any time by contacting the Controller (contact@luukme.com) or by using the unsubscribe link in the message you receive. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. The email address is deleted after consent is withdrawn or after the early-access list is discontinued — whichever happens earlier.

Emails sent as part of the early-access list may contain a measurement element (a so-called pixel) that records the date and time a message is opened and clicks on links it contains. We use this data solely to analyse the effectiveness of our communication (Article 6(1)(f) GDPR — the Controller's legitimate interest). The IP address and information about the email client are processed only transiently, to distinguish automatic fetches performed by email providers' proxy servers from genuine opens, and are not stored permanently. Blocking image loading in your email client prevents open measurement. Measurement data is deleted together with the early-access list data.

§ 5. Mandatory and optional data

1. Data marked in the registration form with an asterisk (“*”) is mandatory and necessary to create and maintain a user account in the Application. Failure to provide it makes using the Application impossible.
2. Other data is optional and may be provided by the user to complete their profile or use additional features of the Application.
3. Optional data can be changed or deleted by the user at any time in the account settings, where the Application’s functionality allows it.
4. The Controller processes both mandatory and optional data in line with the purposes set out in this Privacy Policy and on the basis of the GDPR.

§ 6. Profiling and automated decision-making

1. The Application may carry out profiling consisting of analysing user activity, in particular:
   • viewed video materials,
   • reactions to content,
   • activity in the feed.
2. Profiling is used to match the content shown in the Application to the user’s interests.
3. Profiling does not produce legal effects concerning the user.
4. In certain cases, decisions regarding platform security may be made using automated systems (e.g. detecting spam or content that violates the terms of service). In such a case the user has the right to:
   • contest the decision,
   • express their point of view,
   • request human intervention.

§ 7. Age requirement – 18+

The Application is intended solely for persons who are at least 18 years old. Providing a date of birth is required when creating an account. If a user is found not to meet the age requirement, the account may be deleted. The Application does not allow indicating an age <18.

§ 8. Recipients of personal data

1. Users’ personal data may be shared with the following categories of recipients:
   • hosting and IT infrastructure providers,
   • email delivery service providers,
   • sign-in service providers (e.g. Google, Microsoft),
   • electronic payment operators,
   • analytics and diagnostics tool providers,
   • content moderation tool providers,
   • music service providers used in video materials,
   • entities providing legal and advisory services.
2. Entities processing the data act on the basis of data processing agreements.
3. Data may also be shared with public authorities where such an obligation arises from the law.

§ 9. Transfers of data outside the European Economic Area

As the Controller uses technology services provided by global providers (e.g. Google, Microsoft), personal data may be transferred outside the European Economic Area. In such cases, data is transferred using appropriate safeguards provided for in the GDPR, in particular:

• the European Commission’s standard contractual clauses,
• European Commission adequacy decisions on the level of data protection.

§ 10. Data retention period

Personal data is stored for the following periods:

• account data – for the period of using the Application,
• communication data – until the account is deleted,
• transaction data – for the period required by tax law,
• technical logs – up to 12 months,
• backups – a maximum of 30 days,
• early-access form data – until consent is withdrawn or the early-access list is discontinued (whichever happens earlier),
• data related to claims – until the claims become time-barred.

Deleting an account removes the data from the active database, except for data required by law.

§ 11. User rights

The user has the following rights:

• the right of access to data,
• the right to rectification of data,
• the right to erasure of data,
• the right to restriction of processing,
• the right to data portability,
• the right to object to data processing,
• the right to withdraw consent,
• the right to human intervention in the case of automated decisions,
• the right to lodge a complaint with a supervisory authority.

The supervisory authority in Poland is: the President of the Personal Data Protection Office (PUODO).

§ 12. Data security

The Controller applies appropriate technical and organisational measures to ensure the security of the processed personal data, in particular:

• encryption of data transmission,
• access control to IT systems,
• protection of the server infrastructure,
• monitoring of security events.

§ 13. Changes to the privacy policy

The Controller may update this Privacy Policy in connection with the development of the Application or changes in the law.

Users will be informed of significant changes within the Application.

§ 14. Contact

For matters regarding the protection of personal data you can contact the Controller:

email: contact@luukme.com