LUMON GROUP PRIVACY NOTICE

Updated May 15th 2025

All Lumon Group companies are committed to protecting your privacy. The information we collect is always used to serve you in the best possible way. You can rest assured that we store and treat your data respectfully, securely and carefully.

Lumon Group processes your personal data in accordance with current data protection legislation. This privacy policy provides you with comprehensive information about Lumon’s personal data processing activities. The purpose of the privacy notice is to provide you with information on how we process personal data in customer relationship management and sales and marketing activities. The information may be supplemented by specific privacy notices and additional local documents. Please note that your data protection rights may vary from country to country depending on the data protection laws of the applicable country. Our privacy notice sets out your rights under the EU General Data Protection Regulation (“GDPR”). However, mandatory laws or regulations take precedence if they conflict with and are stricter than our privacy notice.

1. Controllers and contact details

Lumon Invest Oy (established in Finland and being the parent company of Lumon Group) is the joint data controller
Lumon Invest Oy
Business ID: FI22544498
Kaitilankatu 11, 45130 Kouvola, Finland
tel.:+358 (0) 20 7403 200
email: [email protected]

together with other Lumon Group companies:
Lumon Oy, Lumon Suomi Oy, Suomen Visor Oy, Lumon International Oy, Lumon Cristales Espana S.A., Svenska Lumon AB, Lumon Norge AS, Lumon North America Inc., Lumon Deutschland GmbH, Lumon Schweiz AG, Lumon France SAS, Lumon Danmark Aps, Lumon Fabrica S.L., Lumon Polska SP. Z O.O., and Balkonser Oy.

For more information on joint controllership, please see section 15 of this privacy notice.

Contact details in privacy matters:

Lumon Invest Oy / Privacy Matters
Kaitilankatu 11, 45130 Kouvola, Finland
[email protected]
Contact details of the Data Protection Officer: [email protected]

2. What kind of personal data do we collect?

Lumon’s customer register may contain, for example, the following information we collect and process:

• Basic information: for example, first name, last name, street address, postal code, city, country, phone number, mobile phone number
• Purchase history: for example, place and date of purchase, total purchase, payment method, delivery address, personal identity code
• Customer relationship management data: for example, desired contact method, apartment type, start date of customer relationship, ownership of Lumon products, contracts, billing information and similar information necessary for relationship management
• Personal preferences: for example, Lumon products you are interested in and consents or prohibitions for direct email and SMS marketing
• Data collected from the use of the Lumon website and other online tools, such as browsing data, location data and IP address.
We also store information about companies, such as company name, address, VAT number, shipping and billing addresses, name of company contact persons, email, telephone number and title/position. We collect this information in order to communicate and serve our potential and existing customers better and to improve the overall customer experience.

3. Where do we collect personal data from?

Personal data is collected by telephone, websites or other digital channels, meetings or other similar means. Data is also collected in connection with the conclusion of a customer contract and otherwise during the customer relationship. Personal data may also be obtained from Lumon’s representatives on the basis of their business contacts or through information collected and updated from public and private registers.

We collect and process data when you, for example:

• fill out a form to book a planning visit, request more information, get a quote, download a guide, e-book or similar document, or subscribe to a newsletter on any of our websites
• place an order for our products or services available in our online stores
• you send a message to Lumon’s personnel representative to receive service
• You accept the agreement in an electronic signature program
• voluntarily participate in a customer survey on Lumon’s website or by email
• give feedback or chat via our chat tools or email
• you voluntarily participate in a survey or raffle conducted by Lumon
• you voluntarily allow the use of browser cookies
• log in to our customer portal to review your order or receive other useful information
• call Lumon and provide your contact information and other personal information
• visit Lumon’s stand at fairs or exhibitions, shopping centres or parking lots and give your contact information to a Lumon employee or fill out a digital or paper form
• provide your contact information to a Lumon employee who visits home and enters the information into our systems
• you provide information to attend an event where the event organizer can pass on your information to the exhibitors of the event

4. What do we base our use of your personal data on and for what purposes do we collect your personal data?

When carrying out sales, marketing or customer relationship management activities, we process personal data of our potential and existing consumer and business customers (including, for example, newsletter subscribers, individuals who have requested a quote or sent a contact request, event attendees and website visitors).
Lumon’s websites and online stores use cookies to collect information about user behaviour on our websites, online stores and portals. This includes, for example, information about the devices users use, the pages they visit and what they download. We use this information to improve the usability of our online services for our customers and potential customers.

Insofar as our contractual partner is a consumer customer, the processing of personal data is mainly based on an agreement with the data subject. Insofar as we process corporate customer’s personal data in connection with a contract with a company, Lumon’s legal basis for processing is legitimate interest based on a contractual relationship. The processing is also based on Lumon’s legitimate interest, for example, insofar as we carry out marketing for company representatives, marketing based on a customer relationship or marketing based on mail or telephone to consumer customers, or when we collect receivables or develop our business.

The processing may also be based on the consent given by the data subject when we use non-essential cookies to take measures, such as targeting advertising, or sending consumers electronic direct marketing.

The processing of personal data contained in accounting documents is based on our legal obligation.

Insofar as the processing is based on legitimate interest, we consider that the processing benefits both you and us. The processing of personal data enables you to receive relevant information about our contract or services. Taking into account the nature and purpose of the data, we consider that the processing does not conflict with your fundamental rights or freedoms. You can object to marketing at any time. You can object to other processing based on legitimate interest on grounds relating to your personal situation as described below.

The purposes of processing your personal data are:

to process your order, manage your account, create invoice and warranty documents

• to communicate with you during the relationship between you and Lumon (incl. e.g., feedback and customer satisfaction surveys)
• to manage, develop, analyze, and retrieve statistics of the relationship between you and Lumon to process requests and act upon them accordingly
• to invite you to sales and marketing events
• to implement opinion and market surveys, and to organize prize competitions and draws
• to conduct direct marketing, online targetings, and advertising
• to email you regarding your open offer
• to email you with special offers on other products and services we think you might like
• to plan and develop business operations and services
• to manage receivables and collect debt
• to identify users and manage access rights
• to detect, prevent and investigate of misuse, fraud or other crimes
• to analyze and segment data and to retrieve statistics for the above mentioned purposes

The grounds and purposes of processing your personal data are:

• on the basis of a contract
o processing a consumer customer’s order, managing your account, creating an invoice and warranty certificate

• on the basis of legitimate interest
o streamline communication between you and Lumon (including, for example, feedback and customer satisfaction surveys)
o manage, develop, compile statistics and analyse your customer relationship so that we can process and respond to your requests
o invite you to sales and marketing events
o marketing
o conducting opinion polls and market research, as well as organising competitions and sweepstakes;
o plan and develop business and services
o manage receivables and collect debts
o identify users and manage access rights
o identify, prevent and investigate misuse, fraud or other criminal offences
o analyze and segment data and retrieve statistics for the above purposes;
o communicate with you by email regarding your open offer

• on the basis of consent
o online targeting and advertising using cookies and other similar technologies
o communicate with the consumer via email about special offers and other products and services that we think you will like;

• on the basis of a legal obligation
o processing of personal data contained in accounting documents
o processing of personal data related to the implementation of statutory liability for defects

5. Do we use user profiles?

We may create user profiles in order to provide you with the best possible customer service and offers that are most relevant to you. The messages you receive from Lumon are tailored based on the information. Your profile can be based on your browsing and shopping history for example. However, we do not make automated decisions that have legal effects or otherwise significantly affect you.

We may identify the browser you are using by means of a cookie ID or other similar identifier and recognize your browser when you return to our site. We may combine information related to the cookie ID with customer data that identifies you personally, for example, when you order a product from our online store or open a newsletter sent by us. We also use customer information that personally identifies you, such as your name, email address and phone number, for example, when we use modelling to create custom audiences and lookalike audiences. In such cooperation, we transfer our customer data encrypted to our partner, such as Meta or Google, which compares the encrypted data with its own data and forms a target group to which we can target advertising on the partner’s website or utilise the data in such a way that we limit the presentation of advertising to a target group that has already made purchases in Lumon’s online store.

6. Who is your personal data shared with and can it be transferred outside the EEA?
We may disclose or otherwise share your information with third parties in the following cases:

• Authorities: We may disclose personal data as required by the competent authorities and based on the legislation in force at the time.
• M&A: If we sell or otherwise reorganize our business, personal data may be disclosed to buyers and their advisors.
• Debt collection and legal claims: We may disclose your data to selected partners for the purpose of collecting our claims and for the exercise and defence of legal claims.
• Advertising partners: We may share encrypted customer register data with a partner who matches the data with its own identifiers and creates target groups to be used in targeted advertising.
• Consent: Based on your consent, we may disclose your personal data within the limits specified in your consent.

We use certain services, such as marketing automation tools and website analysis tools, where data may be transferred to other countries (e.g. United Kingdom, Canada, Switzerland and the United States). Data from these services is mainly stored on service providers’ servers in the EEA and the United States. However, some data processing activities of service providers are carried out outside the EEA, for example in Canada. Data transfers to Canada, the United Kingdom and Switzerland are carried out on the basis of an adequacy decision issued by the European Commission.

The level of data protection may be lower outside the EEA than in the EEA. If the recipient country, such as the United States, has not received an adequacy decision from the EU Commission, Lumon Group applies other appropriate safeguards to ensure the protection of personal data, for example by applying Standard Contractual Clauses for the transfer of personal data to third countries (https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en) in accordance with the European Commission’s decision.

We use the services of external service providers, such as system and communication software services, logistics and printing houses. In accordance with data processing agreements, each service provider processes personal data only to the extent necessary for this purpose.

In certain countries or geographical areas, Lumon works with or through trusted resellers. Information may be shared with trusted resellers to ensure that you are served in the best possible way. In addition, our service providers may have access to your personal data as their services are required for certain requests and technical processing of orders.

When Lumon processes your order, it may send your information to credit reference agencies to prevent fraudulent purchase attempts.

7. What are the principles of protection of your personal data?

Your personal data is always protected by appropriate technical and administrative measures. Lumon strives to ensure that information in Lumon’s possession is not misused, removed without reason, falsified or manipulated, and is not disclosed to third parties or published without your permission. Our systems are secure and access to them is only possible for Lumon employees using personal login information.

Access to the system requires a username and password. The system is also protected by firewalls and other technical solutions.

• The information in the register is only available to authorized and specifically designated employees
• The use of the register is protected by personal login information and access rights
• The registry is located on a computer stored in a data centre with limited access
• The information in the register is located in safe and protected premises
• The register is backed up regularly

8. How long do we keep the data?
Your personal data will be stored in our customer register for as long as it is necessary to achieve the purposes defined in this privacy notice, for example:

• contacts that do not lead to an offer or a customer relationship are stored for two years;
• contacts which we have provided with an offer are stored for five years;
• survey and lottery responses are stored for six months;
• online behavioural data and preferences are stored for two years;
• accounting records are stored for 6-10 years from the end of the accounting period;
• purchase data is stored for the life cycle of glass products, which is about 20 to 30 years, or  for  the life cycle of carpets or other accessories, which is about 5 to 10 years. After that, we completely delete the data from our servers.

9. What are your rights regarding data processing?

Requests related to data processing should be sent to the address mentioned in section 1.
As a data subject, you have the following rights:

Right to access, correct and delete data
• You have the right to receive information about the processing of your personal data, including the right to view the personal data relating to you in your register. You also have the right to request the correction and deletion of your data.
Right to prohibit direct marketing
• You have the right to object to the processing of your data for marketing purposes, including profiling and direct marketing.
Right to data portability
• You have the right to receive your personal data that you have provided to us with your consent or contract in a machine-readable format and the right to transfer it to another controller if technically feasible.
Right to withdraw consent
• If the processing of your personal data is based on your consent, you may withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
Right to lodge a complaint with a supervisory authority
• You have the right to lodge a complaint with a data protection authority if you believe that the processing of your personal data is not lawful.
Right to object and restrict the processing of personal data
• You have the right to object to the processing of your personal data based on legitimate interest, on grounds relating to your personal situation. In such a situation, for example, processing is restricted for the time necessary to assess the grounds for objecting to the processing. Processing may also be restricted, for example, if you contest the accuracy of the personal data, in which case the processing will be restricted for a period during which we can verify the accuracy of the data. If there are compelling legitimate grounds for the processing that override your rights or freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims, we will contact you to continue processing the data.

Requests should be sent to [email protected]. We will process your request as soon as possible, but no later than within one month.

Lumon reserves the right to refuse the request or charge the costs of fulfilling the request, if the requests are made unreasonably often or if they are manifestly unfounded or unreasonably demanding. If you are dissatisfied with our response, you have the right to lodge a complaint with a data protection authority.

10. How are requests related to the processing of personal data handled?

The Data Protection Officer handles all requests in accordance with section 9 above. We will process the request as soon as possible, but no later than one month after receiving the request. If the request is particularly complex or if we have many requests to process, we may request an extension, if necessary, but we will inform you at the latest within one month of receiving the request. If we are unable to process your request, we will inform you of the reasons and you can lodge a complaint with a data protection authority or exercise any of your other rights.

11. What are cookies?
Cookies are small text files placed on your computer or mobile phone to collect standard Internet log information and page visitor behaviour information. Lumon’s websites, online stores and other online services use cookies and related tracking pixels. When you visit our website or online store, we may collect information from you, including (but not limited to): your IP address, device type, browser type, and mouse movements through cookies or similar technologies.

We use temporary session cookies, which close when you close your browser, and persistent cookies, which are stored on your computer’s hard drive. Cookies allow us to recognize your browser and use this information for analytical purposes, such as counting visitors to our website. This information allows us to observe and monitor the interests of our customers and thus improve our website. You can see the expiry time of cookies in our cookie settings.

You can give your consent to the setting of cookies in the cookie settings of the website. In addition, cookies may be blocked by browser settings. However, if you block some or all cookies, you may not be able to fully use all of our services.

12. What are cookies used for?
Lumon uses cookies in several ways to improve your user experience in our online services, for example, in the following ways:

• We’ll keep you logged in
• We show you the right information
• We serve you with relevant content and pre-filled forms
• We improve the customer experience by collecting statistics about website usage and understanding website usage patterns
• We will show you a chat window to chat with Lumon representatives
• We select the best and most interesting ads for you.

We have divided the cookies we use into five categories: 1) necessary, 2) functional, 3) performance-related, 4) targeting and 5) social media cookies. Strictly necessary cookies are always enabled, but other cookies require your consent.

You can consent to the use of non-essential cookies and find out more about the purposes for which the cookies are used, the partners who set the cookies and the expiry date of the cookies by visiting the Cookie Settings (link to the One Trust cookie pop-up window). You can withdraw your consent at any time.

13. How do third parties collect data on Lumon’s website or how do we share information with them?

In addition to its own cookies, Lumon’s online service uses cookies from third parties, such as measurement service providers, advertising technology providers and social media service providers. Some partners process cookie IDs and related website usage data as data controllers (either as an independent controller or jointly with Lumon as a joint controller) and thus determine the purposes and means of personal data processing. For more information, please refer to each partner’s privacy policies, which you can access through the site’s cookie settings.

Third parties may use cookies, for example, to prevent them from showing you the same advertising again. Some third parties may also use cookies or other web beacons (e.g., 1-pixel image files) to analyse and measure the impact of ads or to select ads you are likely to be of interest to you.

The partners we use and the description of the cookies they set are explained in more detail in the cookie settings, but we use, for example, Google Analytics, a web analytics service provided by Google Inc. We use it to analyze the use of our website and to develop our website to serve users even better. In addition, we use, for example, Google’s Enhanced Conversions. It renders customer data obtained in connection with an order form, such as name, email address and /or phone number, into encrypted identifiers and such data is used to measure conversions and improve the effectiveness of advertising. The use of Google Analytics requires consent for performance cookies, and the use of Enhanced Conversions requires consent for targeting cookies.

In addition, we use Meta’s data-driven capabilities to market our products and services. For example, we use Facebook’s Conversions API tool which allows us to share online and offline events, i.e. our customers’ activities, directly from our server to Facebook’s server. Server events can be associated with the Facebook pixel to help improve the performance and measurement of Facebook advertising campaigns. This requires consent for targeting cookies.

As described in Section 5, we work with companies such as Google and Meta to create audiences based on our encrypted customer data to target our advertising. If you wish, you can contact us and object to the use of your personal data to create the target groups, but primarily you can influence the creation of target groups and targeting of advertisings in connection with Google’s “Ads Customer Match” and “Customer List Custom Audiences” through the partner’s advertising preferences:

• Google: https://myadcenter.google.com/home
• Facebook: https://fi-fi.facebook.com/help/109378269482053/?helpref=uf_share

14. How is the information kept up to date?

We are obliged to keep the information up to date, but we cannot do so without your help. Please contact us if anything changes in your register, such as your contact information. You can contact us using the contact details above.

15. How do Lumon Group companies act as joint controllers?

The Lumon Group companies listed in section 1 above process the personal data described in this privacy notice as joint controllers, i.e. jointly determine the purposes and purposes of use of the personal data.

The joint controllers have agreed on their mutual arrangement by written agreement. According to the agreement, Lumon Invest is responsible for the information security of the common systems, but otherwise each company is responsible for its own information security practices. In addition, it has been agreed that the joint controllers will inform you of the processing of personal data through this privacy notice. The privacy notice may contain country-specific clarifications. To exercise your rights, you may contact any company that acts as joint controller of Lumon Group, but primarily we ask you to contact the company whose customer you are a customer of or with whom you otherwise interact. In section 1 you will find contact information.

In addition, individual Lumon Group companies act as joint controllers when they manage a page on social media, such as Facebook, Instagram or LinkedIn. With respect to Facebook or Instagram page insights, Meta and Lumon Group company are joint controllers. With respect to LinkedIn page insights, LinkedIn and Lumon Group company are joint controllers. You can find out more about the processing of personal data Facebook’s privacy notice or LinkedIn’s privacy notice.

16. Changes to the privacy notice

Lumon Group may update this privacy notice from time to time, for example due to changes in legislation or business practices. The updated versions will be published on Lumon Group’s website, and the updated notices will take effect on the date of their publication. We recommend that you check this notice regularly for up-to-date information on how your personal data is processed.