Lumorus CoSec Hub Privacy Policy
Effective date: 16 June 2026 Last Updated: 16 June 2026
Effective date: 16 June 2026
Last Updated: 16 June 2026
- About this Privacy Policy
This Privacy Policy explains how Lumorus Group Ltd. and its relevant group companies, trading under Lumorus and operating the CoSec Hub, collect, use, store, share and protect personal data.
This Privacy Policy applies to:
- users of the CoSec Hub
- clients and prospective clients of our CoSec Retainer services
- users of our Governance Knowledge Centres
- directors, officers, shareholders, beneficial owners, employees, contractors and other individuals whose information may be provided to us by clients
- individuals who contact us, subscribe to our communications, attend our events or engage with our content
This Privacy Policy should be read together with our CoSec Retainer Terms and Conditions, Platform Terms of Use, Data Processing Agreement, Consumer Protection and Fair Use Policy, and any relevant client agreement.
- Who we are
For the purposes of UK data protection law, the relevant controller is:
Lumorus Group Ltd
Company no.: 12750296
Address: City Pavilion, 27 Bush Lane, Cannon Green, United Kingdom, EC4R 0AA
Email: [email protected]
Where we decide why and how personal data is used, we act as a controller. Where we process personal data on behalf of a client through the CoSec Hub or as part of managed company secretary services, we may act as a processor. Where we act as processor, the relevant client remains responsible for determining the purpose and lawful basis for the processing, and our processing is governed by our Data Processing Agreement.
- Personal data we collect
We may collect and process the following types of personal data.
3.1 Identity and contact data
This may include:
- name
- job title
- organisation
- business address
- email address
- telephone number
- username or platform identifier
- client account details
3.2 Client onboarding and account data
This may include:
- information provided when a client applies for, subscribes to or uses the CoSec Retainer service
- company information
- billing contact details
- authorised user lists
- communication preferences
- onboarding forms
- support requests
- client relationship records
3.3 CoSec Hub platform data
This may include:
- login details
- user activity logs
- access permissions
- audit trails
- uploaded documents
- comments, tasks and workflow records
- meeting, compliance, entity and statutory record information
- IP address
- browser type
- device data
- usage and diagnostic data
3.4 Governance and company records
Depending on the services used, clients may upload or provide data relating to:
- directors
- officers
- shareholders
- beneficial owners
- persons with significant control
- committee members
- meeting attendees
- authorised signatories
- client employees, advisers or service providers
- KYC and due diligence subjects
This data may include appointment details, dates of birth, nationality, residential or service addresses, identification documents, proof of address, signatures, declarations of interest, attendance records, meeting records and governance documents.
3.5 Payment and transaction data
This may include:
- billing details
- invoice history
- subscription status
- payment confirmation data
- account references
We do not normally store full card payment details ourselves. Where card payments are used, they are usually processed by a third-party payment provider.
3.6 Marketing and communications data
This may include:
- marketing preferences
- event registrations
- newsletter subscriptions
- responses to campaigns
- survey responses
- website form submissions
- records of communications with us
3.7 Cookie and tracking data
This may include:
- website usage data
- cookie identifiers
- analytics data
- consent preferences
- pages viewed
- referral source
- session information
More detail is set out in the Cookie Notice section below.
3.8 Special category and sensitive data
We do not intentionally collect special category data unless it is necessary for a specific service, required by law, or provided by a client in connection with governance, KYC, regulatory or compliance work.
Special category data may include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, biometric data or sexual orientation.
Where special category data is processed, we will only do so where a lawful condition applies under UK data protection law.
- How we collect personal data
We may collect personal data:
- directly from you when you complete forms, contact us, subscribe, attend events, use the CoSec Hub or engage with our services
- from clients who provide information about their directors, officers, shareholders, employees, advisers or other stakeholders
- through the CoSec Hub and our related technology systems
- through website cookies and analytics tools
- from third-party providers, including payment providers, CRM tools, identity verification providers, professional advisers and publicly available sources
- from Companies House, regulators, registries, public databases and other public sources where relevant to the services
- Why we use personal data
We may use personal data for the following purposes.
5.1 To provide our services
This includes:
- delivering CoSec Retainer services
- providing access to the CoSec Hub
- providing Governance Knowledge Centre content
- managing entity records and statutory registers
- supporting board, committee and shareholder meeting processes
- managing governance calendars and compliance deadlines
- preparing filings, registers, resolutions, minutes and related documents
- providing account management and client support
5.2 To manage client relationships
This includes:
- onboarding clients
- responding to enquiries
- managing subscriptions
- processing payments and invoices
- providing service updates
- handling complaints
- maintaining client records
5.3 To operate, secure and improve the CoSec Hub
This includes:
- creating and managing user accounts
- authenticating users
- monitoring system performance
- maintaining security logs and audit trails
- detecting misuse or unauthorised access
- improving platform functionality
- troubleshooting technical issues
5.4 To comply with legal and regulatory obligations
This includes:
- complying with UK data protection law
- complying with company law, tax, accounting, AML, sanctions, regulatory and professional obligations where applicable
- responding to lawful requests from courts, regulators, law enforcement or public authorities
- maintaining appropriate business records
5.5 To send marketing and service communications
This includes:
- sending newsletters, updates, invitations and thought leadership
- promoting relevant Lumorus services
- sending service alerts and account messages
- inviting feedback
- managing opt-outs and communication preferences
Electronic marketing is subject to PECR where applicable. The ICO confirms that different electronic marketing rules apply depending on whether the recipient is an individual subscriber or a corporate subscriber, and whether the communication is solicited or unsolicited.
5.6 To protect our rights and interests
This includes:
- enforcing our terms
- preventing fraud
- protecting confidential information
- managing disputes
- obtaining professional advice
- preserving evidence where necessary
- Lawful bases for processing
We only process personal data where we have a lawful basis to do so. Depending on the context, we may rely on one or more of the following lawful bases:
Lawful basis | When we may rely on it |
Contract | To provide services, manage subscriptions, operate user accounts and perform client agreements |
Legal obligation | To comply with legal, regulatory, tax, accounting, company law and data protection obligations |
Legitimate interests | To manage our business, improve services, secure the platform, communicate with business contacts and protect our rights |
Consent | For certain marketing activities, non-essential cookies, optional communications or specific processing where consent is required |
Vital interests | Rarely, where processing is necessary to protect someone’s life |
Public task | Unlikely to apply to most Lumorus processing, but may be relevant only where expressly required by law |
Where we rely on legitimate interests, we consider whether our interests are overridden by the rights and freedoms of the individuals concerned.
- Data Collection Policy
We collect only the personal data that we reasonably need for the purposes described in this Privacy Policy.
Our data collection principles are:
- we collect personal data lawfully, fairly and transparently
- we only collect data that is relevant and necessary
- we avoid collecting excessive personal data
- we use clear forms and notices where possible
- we separate mandatory and optional data fields where appropriate
- we restrict access to personal data based on role and need
- we maintain audit trails where appropriate
- we review collection practices as the CoSec Hub develops
Clients using the CoSec Hub are responsible for ensuring that any personal data they upload or provide to us has been collected lawfully and that appropriate notices have been given to the relevant individuals.
- Cookies and similar technologies
Our websites and the CoSec Hub may use cookies and similar technologies.
Cookies are small text files placed on a device when a user visits a website or uses an online service. Similar technologies may include pixels, tags, local storage and device identifiers.
The Information Commissioner’s Office (ICO) states that organisations using cookies or similar technologies must clearly explain how they work and what they are used for, in a way that users can understand.
8.1 Types of cookies we may use
We may use:
- Strictly necessary cookies
These are needed to operate the website or platform, keep users logged in, maintain security, remember privacy settings and enable core functionality.
- Analytics cookies
These help us understand how users interact with our website or platform, including pages visited, time spent and performance issues.
- Functionality cookies
These remember user preferences, such as display settings or saved choices.
- Marketing cookies
These may be used to measure campaigns, personalise content or support relevant marketing.
8.2 Cookie consent
We will not use non-essential cookies unless we have obtained any consent required by law.
Users can manage cookie preferences through our cookie banner, browser settings or any cookie preference centre made available on our website or platform.
8.3 Third-party cookies
Some cookies may be set by third-party providers, such as analytics, CRM, payment, video, marketing or support tools. Where this happens, those third parties may also process personal data in accordance with their own privacy terms.
- Who we share personal data with
We may share personal data with:
- Lumorus group companies
- authorised personnel, contractors and consultants
- IT hosting, SaaS, cloud infrastructure and platform providers
- CRM, email, marketing and analytics providers
- payment processors
- identity verification, KYC or AML providers
- professional advisers, including lawyers, accountants, auditors and insurers
- regulators, courts, law enforcement agencies or public authorities where legally required
- Companies House, registries and other filing bodies where necessary for the services
- client-authorised users and representatives
- third parties involved in a business transfer, restructuring, merger or sale
We require service providers to protect personal data and to use it only for authorised purposes.
- International transfers
Some of our service providers, systems or support teams may be located outside the UK.
Where personal data is transferred outside the UK, we will take steps to ensure that appropriate safeguards are in place. These may include:
- adequacy regulations
- the UK International Data Transfer Agreement
- the UK Addendum to the EU Standard Contractual Clauses
- contractual, technical and organisational safeguards
- How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to provide services, comply with legal obligations, resolve disputes, maintain records and protect our rights.
The ICO’s records management guidance identifies the need for organisations to document storage periods for personal information in a retention schedule.
Our retention periods may depend on:
- the type of data
- the nature of the client relationship
- contractual requirements
- legal, tax, accounting or regulatory obligations
- limitation periods for legal claims
- whether data is held as controller or processor
- client instructions under the Data Processing Agreement
Indicative retention approach:
Data type | Indicative retention approach |
Website enquiry data | Kept for as long as needed to respond and manage follow-up |
Marketing data | Kept until opt-out, withdrawal of consent or account inactivity review |
Client account data | Kept during the relationship and for a reasonable period afterwards |
Contract and billing records | Kept in line with tax, accounting and legal requirements |
Platform audit logs | Kept for security, compliance and evidential purposes |
Client-uploaded data processed on behalf of clients | Kept in accordance with the client agreement and Data Processing Agreement |
Complaints and dispute records | Kept for as long as needed to manage the complaint, dispute or legal risk |
Where data is no longer needed, we will delete, anonymise or securely archive it.
- How we protect personal data
We use appropriate technical and organisational measures to protect personal data, which may include:
- access controls
- role-based permissions
- password and authentication controls
- encryption where appropriate
- secure cloud storage
- audit logs
- staff and contractor confidentiality obligations
- data protection and security training
- incident response processes
- backup and recovery controls
- supplier due diligence
- regular review of systems and permissions
No system is completely secure. Users are responsible for keeping their login details confidential and for notifying us promptly if they suspect unauthorised access.
- Your data protection rights
Depending on the circumstances, individuals may have the following rights under UK data protection law:
- the right to be informed
- the right of access
- the right to rectification
- the right to erasure
- the right to restrict processing
- the right to data portability
- the right to object
- rights relating to automated decision-making and profiling
The ICO summarises these individual rights as part of its UK GDPR guidance.
To exercise your rights, contact us at:
Email: [email protected]
We may need to verify your identity before responding. Some rights are subject to legal limitations, exemptions or competing obligations.
Where we process personal data as a processor on behalf of a client, we may refer the request to the relevant client because the client is usually responsible for responding as controller.
- Marketing communications
We may send marketing communications to business contacts, subscribers, clients and prospective clients where permitted by law.
We may rely on consent, legitimate interests, or the soft opt-in where applicable. We will provide a clear way to unsubscribe or opt out of marketing communications.
You can opt out at any time by:
- clicking the unsubscribe link in our emails
- contacting us at [email protected]
- updating your communication preferences, where available
Service communications, such as account alerts, security notices, billing notices and platform updates, are not marketing communications and may still be sent where necessary.
- Automated decision-making and profiling
We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
The CoSec Hub may use analytics, AI-assisted tools or automation to support workflows, compliance reminders, document management, governance insights or service delivery. Where such tools are used, they are intended to support human review and operational efficiency, not to make final legal, employment, credit, regulatory or similarly significant decisions about individuals without appropriate human involvement.
- Children
Our services are intended for business and professional users. We do not knowingly collect personal data from children.
- Third-party links
Our websites, CoSec Hub or Governance Knowledge Centres may contain links to third-party websites, platforms or resources. We are not responsible for the privacy practices, content or security of those third-party services.
- Complaints
You may contact us first if you have concerns about how we use your personal data.
Email: [email protected]
You also have the right to complain to the UK Information Commissioner’s Office.
ICO website: ico.org.uk
ICO helpline: 0303 123 1113
- Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements or business operations.
The latest version will be made available on our website or through the CoSec Hub. Where changes are material, we may notify users by email, platform notice or other appropriate means.
