1. Who We Are
LumaGrid is a trading name of OGR Group Ltd, a company registered in England and Wales (company number 17258397). Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. You can contact us at legal@lumagrid.uk.
LumaGrid is registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration reference is C1968207.
2. What Data We Collect
Event Organisers & Clients
- Name, email address, phone number, billing address
- IP address at point of booking
- Payment details (processed by Stripe — we do not store card data)
- Event details: name, date, venue name and postcode
Event Guests (Uploaders)
- IP address at point of upload (logged automatically)
- Photographs uploaded to event galleries
- EXIF metadata embedded in photographs (may include location, device, timestamp)
Website Visitors
- We use Cloudflare for DNS, CDN, and security. Cloudflare retains server access logs independently for up to 30 days.
- We do not use third-party analytics or advertising trackers.
3. Why We Collect It & Legal Basis
Contract (Art 6(1)(b)): To provide the event photo service you have paid for — creating your gallery, enabling guest uploads, processing your download.
Legal obligation (Art 6(1)(c)): To comply with UK law — retaining evidence in connection with content reports, cooperating with law enforcement, meeting OSA obligations.
Legitimate interests (Art 6(1)(f)): To protect the platform from fraud and illegal content, to defend against chargebacks, and to maintain platform security.
4. How Long We Keep It
- Event photos: 7 days active storage + 7 days cold storage (ZIP) = deleted permanently on day 14 after your event end date.
- Organiser personal data: 1 month after event end date, then deleted.
- Booking records: Retained as required by law and for chargeback defence (up to 14 days post-event unless a dispute is active).
- Content reports: Retained indefinitely until resolved, then 5 years minimum.
- Account data: 12 months from last activity, then deleted.
- Fraud prevention records: Where a payment is disputed or results in a chargeback, we may retain the email address associated with that booking on a restricted list for up to 24 months to prevent repeat fraud. This is processed under our legitimate interests (Art 6(1)(f) UK GDPR) to protect the platform and its users. You may request removal via a Data Subject Access Request to legal@lumagrid.uk — we will consider removal where no active or pending dispute applies.
5. Who We Share Data With
- Cloudflare: Infrastructure provider (Workers, R2 storage, D1 database, CDN). Data Processing Agreement in place.
- Stripe: Payment processing. They are an independent data controller for payment data.
- Resend: Transactional email delivery.
- Law enforcement: We will comply with lawful requests under the Investigatory Powers Act 2016 and PACE 1984.
We do not sell your data. We do not share your data with advertisers.
6. Your Rights
Under UK GDPR you have the right to: access your data (Subject Access Request), correct inaccurate data, request deletion (where no legal obligation to retain applies), object to processing, and data portability. To exercise any of these rights, contact legal@lumagrid.uk. We will respond within 30 days.
If you are unhappy with how we handle your data, you can raise a complaint directly with us first via our contact form (select "Data Protection Complaint") or by emailing legal@lumagrid.uk — we will acknowledge your complaint within 30 days. If you remain unsatisfied, or would prefer to go straight to the regulator, you also have the right to complain to the ICO: ico.org.uk/make-a-complaint · 0303 123 1113.
6a. Children's Data
Our guest upload and gallery pages are likely to be accessed by children attending the events they relate to, so we have considered the ICO's Age Appropriate Design Code. We collect no account, profile, or behavioural data from any guest — including children — and we do not use tracking, advertising, or profiling of any kind. The only data involved is the event photos themselves and an optional, anonymous-by-default comment; there is no name field on the upload or comment forms. Photos are retained only for the limited periods set out above and are then permanently deleted.
7. International Transfers
Cloudflare operates a global network. Your data may be processed in data centres outside the UK. Cloudflare's Data Processing Addendum includes appropriate safeguards for international transfers under UK GDPR.
8. Changes to This Policy
We will update this page when our practices change. Significant changes will be communicated by email to active account holders.
1. The Service
LumaGrid provides a private event photo upload and sharing platform. You create a gallery, guests upload photos via QR code, and you download a ZIP after the event. Galleries are PIN-protected and time-limited.
By booking an event you confirm you are at least 18 years old, that you have the authority to bind any organisation you represent, and that you have read and accepted these Terms.
2. Your Responsibilities
- You are responsible for all content uploaded through your event code.
- You must take reasonable steps to prevent prohibited content being uploaded through your event code.
- You must not share your event code publicly in a way that enables unknown third parties to upload content.
- You acknowledge that content uploaded through your event code may be referred to law enforcement without prior notice to you.
3. Cancellations & Refunds
LumaGrid provides a digital service that is delivered immediately upon booking confirmation. By completing your booking you expressly consent to immediate delivery of the service and acknowledge that your 14-day cancellation right under the Consumer Contracts Regulations 2013 is lost from the moment the service is activated.
Refunds are considered on a case-by-case basis. Where no photos have been collected and the event has not been used, a full refund may be issued and the event cancelled. Where an event has been used (photos uploaded or gallery accessed), refunds are not available — we may offer a goodwill credit or extension instead. Stripe processing fees are non-refundable in all cases. If you have a genuine dispute, contact hello@lumagrid.uk within 30 days of booking. See our full Refund Policy for details.
4. Data Retention
Event photos are permanently deleted 14 days after your event end date. This is not reversible. Download your gallery before the deadline. LumaGrid is not liable for data lost due to failure to download before deletion.
5. Platform Availability
LumaGrid is built on Cloudflare infrastructure and targets high availability. We do not guarantee 100% uptime. Scheduled maintenance will be communicated in advance where possible. No refund is due for downtime of less than 24 continuous hours.
6. Limitation of Liability
To the maximum extent permitted by law, LumaGrid's total liability to you for any claim arising from use of the service is limited to the amount you paid for the booking in question. We are not liable for indirect, consequential, or incidental losses.
7. Governing Law
These Terms are governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.
8. Changes to Terms
We may update these Terms. Continued use of the service after notification of changes constitutes acceptance. We will give at least 30 days' notice of material changes by email.
Prohibited Content
The following content is strictly prohibited on LumaGrid and will result in immediate account termination and referral to law enforcement where required:
- Child Sexual Abuse Material (CSAM) — any sexual image of a person under 18
- Content that facilitates the sexual abuse or exploitation of children
- Content promoting, glorifying, or facilitating terrorism or political violence
- Content depicting or facilitating serious violence or harm to individuals
- Non-consensual intimate imagery
- Content that is illegal under the laws of England and Wales
Reporting Content
All gallery and upload pages include a Report button. Use it if you encounter content that violates this policy. Critical reports are reviewed immediately. You can also contact safety@lumagrid.uk.
If you believe a crime has taken place — do not wait. Contact police on 101 (non-emergency) or 999 (emergency).