GDPR & Data Rights

LumenVest AI is committed to full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR). This page outlines your rights as a data subject and how we handle your personal data.

This policy applies to all individuals whose personal data is processed by LumenVest AI, regardless of whether they are located within the European Economic Area (EEA).

We process personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)) — to provide simulations, generate and deliver reports, and process payments. • Legitimate interest (Art. 6(1)(f)) — to manage installer applications, improve our services, and prevent fraud. • Consent (Art. 6(1)(a)) — for optional analytics cookies and marketing communications, where applicable.

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

You have the following rights under Articles 13–22 of the GDPR:

• Right of access (Art. 15) — obtain a copy of your personal data and information about how it is processed. • Right to rectification (Art. 16) — request correction of inaccurate personal data. • Right to erasure (Art. 17) — request deletion of your personal data when it is no longer necessary or you withdraw consent. • Right to restriction (Art. 18) — request that we limit processing in certain circumstances. • Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format. • Right to object (Art. 21) — object to processing based on legitimate interests, including profiling. • Right not to be subject to automated decisions (Art. 22) — our AI-generated simulations are informational tools and do not produce legal or similarly significant effects.

For all GDPR-related enquiries, data access requests, or complaints, please contact our Data Protection Officer:

Email: dpo@lumenvest.ai

We will acknowledge your request within 72 hours and provide a substantive response within 30 days, as required by GDPR.

Your data may be processed by third-party services located outside the EEA. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission. • Adequacy decisions for countries with equivalent data protection standards. • Binding Corporate Rules where applicable.

Stripe, our payment processor, is certified under the EU-US Data Privacy Framework.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach. • Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights. • Document all breaches and remediation actions taken.

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with your local supervisory authority. A list of EU/EEA data protection authorities is available at edpb.europa.eu.

We encourage you to contact us first at dpo@lumenvest.ai so we can address your concern directly.