Legal
Privacy notice
What personal data is collected, why it is held, how long it is kept and the rights you have over it.
Last updated 12 September 2026
Who is responsible
LUXELENS LTD, company number 17389020, registered in England and Wales, is the data controller for personal data collected through this website. LuxeLens Digital is a trading style of that company.
What is collected
Only what is needed to answer you and deliver the service:
- Contact details you submit: name, email, phone, business name and website address
- Project information you choose to include in a brief, audit request or enquiry
- Consent record: what you agreed to, when, and the page it was given on
- Referral source and campaign parameters where present in the link you arrived from
- Client account records where you hold a portal login: organisation, contacts, billing address and service history
Why it is used
To respond to enquiries, prepare quotes, deliver contracted work, issue invoices and receipts, provide support under a care plan, meet legal and accounting obligations, and maintain the security of the service.
Marketing messages are sent only where you have asked for them, and every message includes a one-click way to stop receiving them.
Legal bases
Performance of a contract for delivery and billing; legitimate interests for responding to enquiries and protecting the service; consent for optional marketing and non-essential analytics; and legal obligation for financial records.
How long it is kept
Enquiries that do not become projects are kept for up to 24 months. Financial and contractual records are retained for the period required by UK company and tax law. Portal accounts are retained for the life of the client relationship and archived afterwards rather than deleted where a legal or financial record depends on them.
Who it is shared with
Service providers used to operate the business, such as hosting, email delivery, payment processing and accounting. They act on documented instructions and only for the purposes above. Data is never sold.
Your rights
You can ask for a copy of your data, correction of inaccuracies, deletion where no legal duty requires retention, restriction of processing, portability, and you can object to processing based on legitimate interests. You can also withdraw consent at any time.
Requests are answered within one month. You may also complain to the Information Commissioner's Office.
Security
Access to client records is restricted to named accounts with the minimum permissions needed. Private records and files are protected by server-side authorisation rules, not by hiding parts of the interface.