Data Retention Policy

Version: 1.0 · Effective Date: 1 January 2026

1. Purpose

This Data Retention Policy explains how long LumoBond AB (under formation) ("LumoBond", "we", "us"), a company organised under the laws of Sweden, keeps the personal data we collect through our waitlist and website at lumobond.com, and the principles we apply when deciding retention periods. It supplements our Privacy Policy and should be read alongside it.

2. Our Retention Principles

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Where data is no longer needed for these purposes, we delete it, anonymise it, or aggregate it so that it can no longer be linked to an identifiable individual.

3. Waitlist Data

When you join our waitlist, we collect information such as your name, email address, and any optional details you provide, for example interest areas or referral source. We retain this waitlist data for as long as you remain on our waitlist, and, following any product launch, for as long as necessary to invite you to join the platform and to fulfil obligations related to your registration. If we discontinue the waitlist or our project without launching a product, we will delete or anonymise waitlist data within twenty-four months of that decision, unless you have asked us to delete it sooner or the law requires a different period.

To demonstrate compliance with applicable data protection and marketing law, we keep records of consent given by waitlist members and website visitors. Each consent log entry includes:

The type of consent given (for example, marketing communications consent, or a specific cookie category such as Analytics or Marketing);
The timestamp at which consent was given, changed, or withdrawn;
The version of the consent text or policy that was presented to you at the time (for example, the specific wording of the marketing opt-in checkbox or the version of this Data Retention Policy or our Cookie Policy then in effect);
The source form or touchpoint through which consent was captured, such as our waitlist sign-up form, the cookie consent banner, or a specific campaign landing page.

We retain consent logs for as long as necessary to demonstrate compliance with legal requirements, which is typically for the duration of our relationship with you plus a period afterwards to address any potential regulatory enquiry or dispute, generally up to six years from the date consent was last confirmed or withdrawn, in line with general limitation periods under Swedish law, unless a longer period is required by applicable law.

5. Policy Version Records

We maintain an internal archive of each version of our legal and consent documents, including this Data Retention Policy, our Privacy Policy, Terms of Service, and Cookie Policy, together with their effective dates. This allows us to determine which version of a policy applied to a given individual at a given time, which is important both for transparency and for defending our compliance position if challenged. Archived policy versions are retained indefinitely in our internal records, though they are not necessarily published on the Site once superseded.

6. Communications and Support Records

If you contact us by email, for example at privacy@lumobond.com, we retain that correspondence for as long as necessary to respond to and resolve your enquiry, and thereafter for a reasonable period, typically up to thirty-six months, to handle any follow-up questions and to maintain internal quality and training records, unless a longer retention period is required for legal or regulatory reasons.

7. Security and Vulnerability Reports

Reports submitted to privacy@lumobond.com under our Security & Vulnerability Disclosure Policy, together with related investigation and remediation records, are retained for as long as necessary to address the reported issue and for a reasonable period afterwards, generally up to five years, to support ongoing security improvements and to demonstrate our handling of the matter should it be required for legal or regulatory purposes.

Data collected through cookies and similar technologies is retained according to the lifespans described in our Cookie Policy, generally ranging from the duration of your browser session up to twelve months for persistent cookies, after which your consent preferences will need to be reconfirmed. Aggregated or anonymised analytics data, which does not identify you, may be retained for longer periods for statistical and business planning purposes.

9. Deletion and Anonymisation

When a retention period expires, or when you exercise your right to erasure under applicable data protection law, we will delete or irreversibly anonymise the relevant personal data, except where we are required or permitted to retain it for a longer period, for example to comply with a legal obligation, to establish, exercise, or defend legal claims, or because you have asked us to retain limited information (such as your email address) on a suppression list to ensure we do not contact you again.

10. Your Rights

You may ask us at any time to delete your personal data, including your waitlist entry and associated consent records, subject to the exceptions described in section 9. You can exercise this right by contacting privacy@lumobond.com. Further detail on your rights under applicable data protection law is set out in our Privacy Policy.

11. Backups

Personal data that has been deleted from our active systems may persist for a limited period in encrypted backup copies until those backups are cycled out in the ordinary course of our backup schedule, which is typically no longer than ninety days.

12. Changes to This Policy

We may revise this Data Retention Policy from time to time to reflect changes in our data practices, legal requirements, or the evolution of our product. We will update the effective date above whenever changes are made.

13. Contact Us

For questions about this Data Retention Policy, or to exercise any of your data protection rights, please contact us at privacy@lumobond.com.