Privacy Notice

1. Who is responsible

The controller of the personal data described in this notice is LUMI TECHOLOGY CORPORATION - FZCO, which operates FileMentra (“FileMentra”, “we”, “us”):

For privacy questions and requests, write to office@esmb.rs.

This notice applies to everyone whose data we handle: account holders, workspace members, people who send files without an account, guests who open something shared with them, signers, people who report content, visitors to our website and people who write to us.

2. Controller and processor: two roles

We are the controller of the data we need to run FileMentra itself: accounts, sign-in and security records, billing, support, abuse reports and our website.

We are a processor for the content that customers put into their workspaces: files, folders, messages, comments, the names and email addresses of the people they share with, signatures and data-room activity. The workspace owner decides why that content is processed and who may see it, and our Data Processing Addendum governs how we handle it. If your data is in someone else’s workspace, that organisation is the one to contact first; we will help them answer you.

3. The data we use, why, and on what basis

Where we rely on legitimate interests, we have balanced them against your rights, and you can object as described in section 9. We do not use your data to target advertising, we do not build marketing profiles, and the only data an advertising platform receives from us is the ad measurement on our public website described in section 12. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Data about guests and people you share with

When a customer shares something with you, the customer’s workspace holds your email address and, depending on the feature, your name and a record of what you did:

• Transfers: when the link was opened and which files were downloaded.
• Rooms and file requests: your email address, the code checks, and what you opened, uploaded or wrote.
• Vault data rooms: your email address and name, acceptance of any non-disclosure terms, which pages you viewed and for how long, questions you asked, and a watermark identifier. Network addresses are stored only as one-way digests of the network range.
• Signature requests: your name, email address, the code check, your consent to sign electronically, the time you signed and your signature image, which together form the evidence of the signature.

The customer is the controller of this data. For most features we store IP addresses and browser details only as one-way digests.

5. Where the data comes from

From you; from the workspace owner or administrator who invites you or shares with you; from Google if you sign in with it; from Stripe about the status of payments; from single sign-on providers your organisation connects; and from your device when you use the service.

6. Who receives it

• People in your workspace and the people it shares with, according to the roles and links the workspace sets.
• Our service providers, who process data only on our instructions and under written data protection terms. They are listed, with what they do and where, on our Subprocessors page.
• Professional advisers such as lawyers, auditors and accountants, under a duty of confidentiality.
• Authorities, only when the law requires it and following the process in our law enforcement guidelines.
• A buyer or successor, if our business is sold or merged, subject to this notice.

We do not sell personal data, and we do not share it for cross-context advertising.

7. Where it is stored and international transfers

Customer files, databases and backups are stored in Frankfurt, Germany (European Union). Some of our providers are established outside the European Economic Area, mainly in the United States, and our company is established in the United Arab Emirates. Where personal data is transferred to a country without an adequacy decision of the European Commission, we use the Standard Contractual Clauses approved by the Commission (and the UK International Data Transfer Addendum for UK data), together with additional safeguards such as encryption. You can ask us for a copy of the relevant safeguards.

8. How long we keep it

A legal hold placed by a workspace or required by law suspends deletion of the data it covers until it is released.

9. Your rights

Depending on where you live, you have the right to:

• know what personal data we hold about you and receive a copy (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• restrict how we use it;
• receive it in a portable format (portability);
• object at any time to processing based on our legitimate interests, including the abuse-prevention processing described above (Article 21 GDPR);
• withdraw consent where we rely on it, without affecting earlier processing;
• complain to a data protection authority, in particular where you live or work.

Many of these you can do yourself in My account: edit your profile, download your data and delete your account. For anything else, write to office@esmb.rs. We answer within one month, and may ask you to confirm your identity first. If your data is in a customer workspace, we pass your request to that customer and help them answer it.

10. Regional information

European Economic Area, United Kingdom and Switzerland

This notice is written to meet Articles 13 and 14 of the GDPR and the UK GDPR. The legal bases are shown in section 3.

California and other US states

In the last twelve months we collected the categories of personal information described in section 3 (identifiers, commercial information, internet activity and, for signers, signatures) for the business purposes described there. We do not sell or share personal information, as those terms are defined in the California Consumer Privacy Act, and we do not use sensitive personal information to infer characteristics about you. You have the right to know, correct and delete your personal information and not to be treated differently for exercising these rights. An authorised agent may make a request for you.

United Arab Emirates

We process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, to the extent it applies, and you have the rights it gives you.

11. Security

We protect data with encryption in transit and at rest, isolation between workspaces enforced in the database, two-factor sign-in, least-privilege staff access with its own audit trail, malware quarantine, rate limiting and continuous monitoring. Read more on our security page. No system is completely secure; if a breach affects your data, we will tell you and the authorities as the law requires.

12. Cookies

We use the cookies and browser storage needed to keep you signed in and the service secure, and one more: when you arrive on one of our tagged links (for example an ad), a first-party cookie notes which link it was, and when you set up a workspace that note is kept with it so we can tell which ads bring signups. See the Cookie Notice.

Our public website pages, and not the service itself, also load Google’s tag for Google Analytics and Google Ads, so we can see how the website is used and measure which of our Google ads bring visits and signups. In the EEA, the UK and Switzerland it uses cookies only if you allow it, and you can change that choice at any time on the Cookie Notice page; without your consent Google receives only anonymous signals. We do not use it for remarketing or to personalise ads. Google receives the public page you visited (never pages inside the service, except that the first screen after you sign up is reported once to Google Ads, as its bare address, so we can count which ads bring signups), your browser and device details and IP address. For Google Analytics, Google processes this on our behalf; for Google Ads it acts as an independent controller under its own privacy policy.

The same public pages load Meta’s pixel, so we can measure which of our Facebook and Instagram ads bring visits, signups and paid plans. It follows the same choice: in the EEA, the UK and Switzerland it does not load until you allow it. Meta receives the public page you visited, your browser and device details and IP address, and, when they happen, the fact that an account was created, a paid plan started or a sales enquiry was sent, without your name or anything from your files. When you create an account, our server also reports it to Meta directly (Meta’s Conversions API) under the same choice, with your email address and account id only as one-way hashes, so Meta can match the signup to the ad that brought it. We do not use it to build audiences for remarketing. Meta Platforms Ireland Limited acts as an independent controller under its own privacy policy.

To see how our public website is used, we count visits to its public pages (such as the home, product, pricing, legal and help pages) with PostHog, in its EU region. This stores nothing in your browser. What is counted is the page, the site or tagged link you came from, your browser and device type and your country. The country is looked up from your IP address on our own server, in a database from DB-IP (licensed CC BY 4.0); PostHog uses the IP address only to tell unique visitors apart for the day, folded into a one-way hash, and does not keep it. Pages inside the service, shared links, signing pages and guest areas are never reported, and the visit data is not linked to your account. We use it only to improve the website and our marketing, on the basis of our legitimate interest.

13. Children

FileMentra is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.

14. Changes to this notice

We will update this notice when our processing changes. If a change is significant, we will tell account holders by email or in the app before it takes effect. The date at the top shows when it last changed.

15. Contact

Privacy: office@esmb.rs. Reporting content: Report abuse. Authorities: law enforcement guidelines. Post: at the address in section 1.