1. Data controller
Luniq, trademark by Homiq BV
Kruisvest 5B, 8000 Brugge, Belgium
Enterprise number (KBO/BCE): 1020.314.690
VAT: BE1020.314.690
Email: legal@luniq.io
Privacy contact: Léon Missoul, reachable at legal@luniq.io.
We have not appointed a Data Protection Officer; GDPR Article 37 does not require one for our activities.
We process personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable laws.
2. Personal data we collect
2.1 Information you provide via forms
- Contact form: name, email, phone number, company, your inquiry and any other information you provide.
- Newsletter and Orbit waitlist: email address.
- Job applications: name, email, phone number, LinkedIn profile, your message and your CV (including any personal data it contains).
- AI website audit and pricing estimator (where offered): website URL, email address and the answers you provide.
2.2 Automatically collected data
We use cookies and analytics to collect technical and usage data (e.g., IP address, device and browser type, pages visited, timestamps). We also use Orbit, our own first-party analytics, which records only anonymous, aggregated usage statistics and does not identify you. See our Cookie Policy for details.
2.3 Data processed through Orbit (on behalf of clients)
When providing our Orbit managed growth service, we may process data from third-party integrations (such as Google Search Console) connected by the client. This data may include search performance metrics, keyword rankings, page impressions, and click data. This processing is performed on behalf of the client (who remains the Controller) and is governed by our Data Processing Agreement.
2.4 Orbit platform account and workspace data
When you create an account on the Orbit platform, we collect your first and last name, email address and a securely hashed password (we never store passwords in plain text). Within a workspace we process the workspace name and settings, the CMS connection details you provide for integrations (such as API keys and endpoints), and the content you create, generate or publish through the platform (such as blog posts, keywords and audience personas).
2.5 Payment data
Subscription payments are handled by our third-party payment provider. We do not store full card numbers or banking details on our servers. We may receive and store transaction identifiers, your plan type and your billing status.
3. Purposes and legal bases for processing
We only process personal data when we have a lawful basis under GDPR:
| Purpose | Data categories | Legal basis |
|---|---|---|
| Responding to inquiries and providing quotes (incl. via contact form, AI website audit, AI pricing calculator) | Form inputs listed above | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) |
| Sending marketing emails/newsletters | Email; optional profile preferences | Consent (Art. 6(1)(a)) |
| Website analytics and product improvement | Usage/technical data via cookies | Legitimate interests (Art. 6(1)(f)) |
| Operating, maintaining, and securing our website | Technical/diagnostic data | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations (e.g., invoicing, tax) | Client and transaction data | Legal obligation (Art. 6(1)(c)) |
| Providing and operating the Orbit platform (accounts, workspaces, content tools) | Account, workspace and content data | Performance of a contract (Art. 6(1)(b)) |
| Processing subscriptions, payments and invoicing | Billing and transaction data | Performance of a contract and legal obligation (Art. 6(1)(b), 6(1)(c)) |
| Securing the platform and preventing fraud or abuse | Account, device and usage data | Legitimate interests (Art. 6(1)(f)) |
Automated decision-making
We do not engage in automated decision-making that produces legal effects or similarly significant effects on you. Any AI-based outputs (e.g., the pricing calculator) are informational estimates only and are not binding. Final proposals and pricing are provided manually.
Processing via Orbit
Our Orbit service uses AI-assisted tools to generate and optimize website content (such as blog posts, landing pages, and newsletters) on behalf of our clients. This processing may involve analysis of search performance data from Google Search Console to determine content strategy. All AI-generated content undergoes human review before publication. The client remains the Controller for any personal data processed through their website; Luniq acts as Processor under the terms of our Data Processing Agreement.
5. Data retention
- Contact and inquiry data: kept while relevant to our relationship and deleted on request, typically up to 2 years after our last contact.
- Analytics data: Google Analytics up to 14 months; Orbit data is anonymous and aggregated.
- Client and contractual data: 7 years, to meet legal and accounting obligations.
- Marketing and newsletter data: until you unsubscribe or withdraw consent.
- Cold prospecting data: deleted after 12 months without mutual contact, or earlier if you object.
- Platform account data: kept while your account is active; deleted within 30 days of an account deletion request.
- Workspace content: kept while the workspace is active; deleted when the workspace owner requests deletion.
- Platform usage and security logs: up to 12 months.
We delete personal data earlier on a valid request, unless we are legally required to keep it. Because some data is held by the third-party platforms we use, deletion may depend on those providers' own processes and timelines.
6. Your rights
Under GDPR, you have the following rights regarding your personal data:
- Access your data
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing based on legitimate interests
- Withdraw consent at any time (for consent-based processing)
- Lodge a complaint with a supervisory authority (Belgium: Gegevensbeschermingsautoriteit)
To exercise your rights, email legal@luniq.io. Instructions are also provided on our legal pages.
8. Marketing communications
We send marketing emails only if you explicitly sign up. You can unsubscribe at any time via the link in our emails or by contacting legal@luniq.io. Withdrawing consent does not affect the lawfulness of processing prior to withdrawal.
Cold prospecting does not require prior opt-in. This communication is based solely on legitimate interests, under the conditions set out in the Cold prospecting section. You can unsubscribe or object at any time via the link in the message or by contacting legal@luniq.io.
9. Cold prospecting
We process limited business contact details (such as name, job title, professional email address and company name) to reach out to potential business clients for whom our services can reasonably be relevant. We obtain these details from publicly available and professional sources, such as company websites, business directories, public professional networks like LinkedIn, and events such as trade shows.
The legal basis for this processing is our legitimate interest (Article 6(1)(f) GDPR). We have carefully balanced our commercial interest against the data subject's right to privacy.
For all forms of cold prospecting:
- we use only publicly available or professionally provided business data;
- we limit ourselves to messages relevant to the recipient's professional role or organisation;
- we clearly identify ourselves and why we are contacting you;
- we always offer an easy way to object or unsubscribe from further communication.
When someone objects or unsubscribes, we immediately remove the contact details from our prospecting list. If no mutual contact or interest is established within 12 months, the data is automatically deleted.
You can object to this processing at any time (Article 21 GDPR), after which we stop immediately. This processing is used exclusively for B2B prospecting, and the categories of data and the sources described above are provided to meet our information duty under Article 14 GDPR.
10. Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or loss. While no system is fully secure, we review and improve our measures regularly.
11. Children
Our website and the Orbit platform are not directed at children, and you must be at least 16 years old to create an account. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at legal@luniq.io and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time. Updates will be posted here with a new "Last updated" date. Please review this page periodically.
13. Contact
Luniq (Homiq BV)Kruisvest 5B, 8000 Brugge, Belgium
VAT: BE1020.314.690
Email: legal@luniq.io
