Terms of Service

1. Who provides the service and what these terms cover

These Terms of Service govern the Lumiqo service, the lumiqo.net website, and the free Data Health Audit. Lumiqo is a marketing data service operated from Zurich, Switzerland. Company registration is in progress. The registered name, business ID and address appear in the "Provider details" section of this page on the day they exist. Until then we trade as Lumiqo.

By creating an account, starting a trial, sending a file for an audit, or using the service, you accept these terms for yourself and for the company you represent. If you do not accept them, do not use the service. If we have signed a separate agreement with you, that agreement wins wherever the two conflict.

Three documents make up the whole agreement: these terms, the Data Processing Agreement in Annex 1 below, and the order or plan you purchased. Where they conflict, the order comes first, then the DPA for anything about personal data, then these terms.

2. What the service does

Lumiqo has two parts. The data infrastructure extracts data from the sources you connect, normalises it, verifies it, repairs history, reports on its quality, and delivers it to the destinations you choose. The analytics layer, if your plan includes it, produces metrics, attribution, forecasts and related analysis on top of that data.

Our Pricing page carries plan contents, prices, and the limits on sources, accounts, destinations and Monthly Active Rows, as they stand when you buy.

We improve the service continuously and may change how features work. If we remove a feature you rely on, or change one in a way that materially reduces the service, we tell you at least 30 days in advance.

3. Using the website

You may read lumiqo.net and use its forms for their intended purpose. Do not copy or republish its content, scrape it outside the ordinary use of a browser, or interfere with how it runs. The site and its content belong to us.

When you email us or send a form, you are communicating with us electronically, and you agree that notices we send you by email meet any requirement that they be in writing.

4. The free Data Health Audit

Anyone can send one export from an advertising or commerce platform and receive an audit of it, free of charge, normally within 48 hours. The audit is a report on what we find in your file. It creates no contract for the service, carries no warranty, and commits us to nothing beyond the report itself.

We use the file for the audit and nothing else, then delete it and everything derived from it within 30 days of delivering the report, or sooner if you ask. The analysis works on aggregate advertising metrics, so please leave out columns that identify people. Details are in our Privacy Policy.

5. Accounts

The service is for business use. Give us accurate account details and keep them current. Keep your credentials to yourself, and tell us at support@lumiqo.net as soon as you suspect anyone else has used your account. You are responsible for what happens under your account, including what the people you authorise do with it.

6. Free trial

New customers can use the service for 30 days without commitment. Either of us can end the trial at any time. When it ends, continued use needs a paid subscription; if you decide not to continue, export your data before the trial account closes.

7. Fees, billing and plan changes

We invoice in euros, monthly in advance, unless we agree otherwise. Prices exclude VAT and other applicable taxes, which we add where required.

We charge the overage rate shown for your plan on any use above the Monthly Active Rows it includes. A Monthly Active Row is a row delivered to your destinations during a calendar month. A row delivered to several destinations counts once, not once per destination, and we do not charge for full refreshes or reruns.

You can change plans whenever you like; the change takes effect from the next billing period unless we agree otherwise. We can change prices with at least 30 days' notice, effective from your next billing period after that notice.

If an invoice falls overdue we ask you for payment. If it stays unpaid 14 days after a written reminder, we may suspend the service until you pay it.

8. Cancelling and ending the agreement

You can cancel at any time, effective at the end of the current billing period. There is no long-term commitment and no exit fee.

We can suspend or end access if you breach these terms materially, including non-payment or misuse, and do not fix the breach within a reasonable period after we tell you about it. We can suspend immediately where we have to in order to protect the service, other customers, or comply with the law.

When the agreement ends, you can export your data. We then delete your platform data as described in the Privacy Policy and in Annex 1.

9. Your data, and what we may do with it

Your data stays yours. As between you and us, you keep all rights to what you connect and to what we deliver to your destinations.

You give us the limited right to access, process and store that data in order to provide, secure and support the service, and for nothing else. Where that data contains personal data, we handle it as a processor under Annex 1, which applies from the moment we first process such data.

Making sure you may connect each source and account is your job, including your clients' accounts when you work as an agency. You confirm that you have those rights, and you cover us for claims from third parties arising from data you connected without them.

10. Agency and white-label use

If you use Lumiqo for clients, one account can cover every client you manage, with each client's data kept separate, and reports can carry your brand. You remain our customer and are responsible for your clients' use of what we deliver, for having the right to connect their accounts, and for your own agreements with them. We have no contract with your clients.

11. What you must not do

Do not break the law or third-party rights with the service, including the terms of the platforms you connect. Do not try to reach other customers' data, our infrastructure, or parts of the service you have not paid for. Do not resell or sublicense the service except as your plan allows, for example agency use or an agreed white-label arrangement. Do not reverse engineer the service or use it to build a competing product. Do not connect data you are not entitled to process, and do not connect special categories of personal data under Article 9 of the GDPR without agreeing it with us in writing first.

You also confirm that you are not subject to sanctions that would prohibit us from serving you, and that you will not use the service where export control or sanctions law forbids it.

12. Platforms we connect to

The service depends on platforms and APIs we do not control, such as Meta, Google, TikTok, and your warehouse or BI provider. They set their own terms, and we take no responsibility for their availability, their changes, or the accuracy of the data at source. When a platform changes or restricts an API, we adapt the service as fast as we reasonably can, and our data quality reporting is built to make the resulting gaps visible rather than hide them.

13. Availability and support

We aim to keep the service available and the pipelines running on their described schedules. Automated monitoring watches pipeline runs and infrastructure, and failures raise alerts. We plan maintenance to cause as little disruption as we can manage, and tell you in advance when it will be noticeable.

We support you through support@lumiqo.net and during onboarding. We answer within one business day. We do not offer a 24/7 on-call service or a separate service level agreement unless we have agreed one with you in writing.

14. Early access features

We sometimes offer a feature marked as beta, preview or early access. We provide those as they are. They may change or disappear, and no availability commitment covers them. Use them at your discretion.

15. Analytics outputs are decision support

Forecasts, attribution models, scenario analyses and recommendations are statistical estimates based on the data available. They support your decisions and guarantee no business outcome. What you do with them, including how you allocate budget, remains your decision and your responsibility.

16. Intellectual property and feedback

The service, including its software, models, design and documentation, belongs to us and our licensors. These terms give you the right to use the service during your subscription and transfer nothing else. Our name and logo stay ours; you may state that you are a Lumiqo customer.

If you send us feedback or a feature request, we can use it to improve the service without owing you anything for it.

17. Confidentiality

Each of us will protect the other's confidential information with at least reasonable care, use it only to perform under these terms, and disclose it only to people and providers bound by confidentiality obligations, or where the law requires disclosure.

18. Warranties and disclaimers

We warrant that we will provide the service with reasonable skill and care. Beyond what these terms say expressly, we provide the service as it is and disclaim every other warranty to the maximum extent the law allows, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

19. Liability

To the maximum extent the law allows, neither of us is liable to the other for indirect, incidental, special or consequential damage, or for lost profits, revenue or goodwill.

Each party's total liability arising out of or relating to these terms stops at the fees paid or payable for the service in the 12 months before the event that caused the claim. This limit does not apply to liability that cannot be limited by law, to either party's wilful misconduct, or to your obligation to pay for the service.

20. Force majeure

Neither of us is in breach because of an event outside our reasonable control, such as a major outage at an infrastructure provider, a change a platform imposes without notice, industrial action, or a natural disaster. The party affected tells the other and does what it reasonably can to limit the damage. If the event lasts more than 30 days, either party can end the agreement for the affected part of the service.

21. Notices

Legal notices to us go to support@lumiqo.net. Notices to you go to the email address on your account. A notice counts as received on the next business day after we send it.

22. Transferring the agreement

You may not transfer this agreement without our written consent. We may transfer it to a company that acquires our business or the part of it that provides the service, and we will tell you if that happens.

23. Changes to these terms

We may update these terms. Material changes are notified at least 30 days in advance, by email or in the product, and apply from your next billing period after the notice. If you do not accept the new terms, cancel before they take effect.

24. Governing law and disputes

Swiss law governs these terms, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. If we cannot settle a dispute between us, the courts of the City of Zurich decide it. Nothing here removes mandatory protections a consumer may have under the law of the country they live in.

25. The rest

If a court finds one provision unenforceable, the rest stays in force. If we do not enforce a right immediately, we do not lose it. Nothing here makes us partners, agents or joint venturers. These terms, Annex 1, and your order are the whole agreement between us about the service, and replace earlier discussions about it.

26. Annex 1: Data Processing Agreement

The sections that follow are our Data Processing Agreement. They apply to every customer from the moment personal data is first processed, so the DPA is in place before processing begins rather than issued on request, which is what Article 28 of the GDPR requires. No signature is needed for it to take effect. If your procurement process needs a countersigned copy, or the agreement executed on your own paper, write to support@lumiqo.net.

27. Scope and roles

This DPA covers the personal data Lumiqo processes on behalf of a customer while providing the Lumiqo service. It forms part of the Terms of Service.

For the platform data the customer connects, the customer is the controller and Lumiqo is the processor. For data about the customer's own account holders and billing contacts, Lumiqo is a controller and its Privacy Policy applies instead.

The DPA starts when the customer connects a source and lasts as long as we process personal data on the customer's behalf.

28. Subject matter, duration, nature and purpose

Subject matter: extraction, normalisation, verification, repair, storage, analysis and delivery of the customer's connected platform data.

Duration: the term of the subscription, plus the deletion period described in the Privacy Policy.

Nature and purpose: providing the service the customer subscribed to, including data quality reporting and, where subscribed, analytics.

Instructions: we process personal data only on the customer's documented instructions. The Terms of Service, this DPA, and how the customer configures the service together make up those instructions.

29. Categories of data and data subjects

The service is built to process aggregated advertising, commerce and analytics data. It does not need personal data to work, and we ask customers not to connect columns of direct identifiers the service has no use for.

Where personal data is present in connected sources anyway, it is usually online identifiers, pseudonymous customer or order identifiers, transaction records, and technical data such as device or region. The data subjects are usually the customer's own customers, prospects and website visitors.

Lumiqo does not knowingly process special categories of personal data under Article 9 of the GDPR, and the customer must not connect sources containing them without a written agreement first.

30. What Lumiqo does as processor

Processes personal data only on the customer's documented instructions, including instructions about transfers to a third country, unless EU or member state law requires otherwise, in which case we tell the customer before processing unless that law forbids it.

Binds everyone we authorise to process the personal data to an appropriate duty of confidentiality.

Takes the security measures Article 32 of the GDPR requires, described below.

Engages subprocessors only under the conditions in the Subprocessors section, and places the same data protection obligations on them.

Helps the customer respond to requests from data subjects exercising their rights, using appropriate technical and organisational measures.

Helps the customer with security, breach notification, data protection impact assessments, and prior consultation with a supervisory authority, taking into account the nature of the processing and what we know.

Deletes or returns all personal data at the end of the service, at the customer's choice, and deletes existing copies unless EU or member state law requires us to keep them.

Gives the customer the information needed to demonstrate compliance with Article 28, and allows and contributes to audits as described below.

31. Security measures

We encrypt personal data in transit and at rest. Access is role based: only the people and systems that need the data can reach it, administrative and infrastructure access requires multi-factor authentication, and we remove access when it is no longer needed.

We restrict access to production environments and encryption keys. We log system and pipeline activity, including authentication and access events, and can review it afterwards. Every pipeline run is recorded with its timestamp and outcome, so you can trace a delivered figure back to the run that produced it.

Microsoft Azure hosts the service, which inherits the physical, network and platform controls of that infrastructure, including its certifications. Regional hosting means data can stay in the region the customer needs.

32. Subprocessors

The customer gives general authorisation for Lumiqo to engage subprocessors. The current list is in our Privacy Policy, in the section "Who else sees the data".

If we intend to add or replace a subprocessor that handles customer platform data, we update that page and notify customers at least 30 days in advance. A customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the customer may end the affected part of the service without penalty for the rest of the term.

Lumiqo stays fully liable to the customer for its subprocessors' performance.

33. Data subject requests

If a data subject contacts Lumiqo about data we process for a customer, we do not answer the substance ourselves. We pass the request to the customer without undue delay and help them respond.

Where the service can locate, export, correct or delete records, we make that available to the customer, and we help on request in other cases.

34. Personal data breaches

Lumiqo notifies the customer without undue delay after becoming aware of a personal data breach affecting personal data processed on that customer's behalf.

The notification describes what happened, the categories and approximate number of data subjects and records involved as far as we know them, the likely consequences, what we have done or propose to do, and who to contact for more. Where the full picture is not yet clear, we send what we have and follow up as we learn more.

35. Deletion and return

Customers can export their data at any time during the subscription. When the agreement ends, the customer can ask for the personal data back, export it directly, or ask us to delete it.

Unless the customer asks for return, we delete platform data from the active dataset and the archive within a reasonable period after the account closes. Encrypted backups lose their copies on the backup rotation schedule. Where EU or member state law requires us to keep data, we keep it for that purpose only, and this DPA continues to protect it.

36. Audits and information

On written request, and no more than once in any twelve months unless a supervisory authority requires otherwise or a breach has occurred, Lumiqo provides the information reasonably needed to demonstrate compliance with Article 28, including our security documentation and our infrastructure providers' certifications.

Where that is not enough, we contribute to an audit by the customer or by an independent auditor the customer appoints under confidentiality. Audits happen during business hours, with reasonable notice, and without disrupting the service or exposing other customers' data.

37. International transfers

Microsoft Azure hosts the service and supports regional hosting, so customer data can stay in the region the customer requires.

Where personal data goes outside the EU or EEA, the transfer relies on an adequacy decision or on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses, plus any supplementary measures a transfer impact assessment shows we need. This DPA incorporates the Standard Contractual Clauses by reference where they apply.

38. Precedence and liability under this DPA

If this DPA and the Terms of Service conflict, this DPA wins on anything about the processing of personal data. If this DPA and the Standard Contractual Clauses conflict, the Clauses win.

Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service, as far as the law allows.

Questions about this document? Contact us at support@lumiqo.net.