Data processing terms

The company details on this page are still being added.

These terms form part of the terms of use between your business (“you”) and the company that runs Lugroom (“Lugroom”, “we”). They apply to personal data about your buyers, clients, consignors, enquirers and other people that you put into Lugroom, or that reaches you through your storefront. They are written to meet Article 28 of the EU and UK GDPR and similar laws, including the California Consumer Privacy Act (where we act as your service provider). If these terms and the terms of use conflict about personal data, these terms win.

1. Roles

You decide why and how this personal data is used: you are the controller (or “business”). Lugroom processes it only to provide the service to you: we are the processor (or “service provider”).

2. What we process

• People: your buyers, clients, prospects, consignors, people on memo, enquirers, newsletter subscribers, and reviewers.
• Data: names, contact details, addresses, purchase and enquiry history, interests and wish lists, notes your team writes, consent choices, reviews, and for large cash sales the type and last four characters of an ID document.
• Purpose and duration: to store, display and organise your records, run your storefront, and send the emails you set up, for as long as you use Lugroom and then as section 9 describes.

You should not put special categories of data (such as health or beliefs) or full identity document numbers into Lugroom.

3. Your instructions

We process the data only on your documented instructions, which are these terms, the terms of use and the way you set up and use Lugroom. We don't sell it, use it for our own purposes, combine it with other data for profiling, or use it to train AI models. If we believe an instruction breaks data protection law we will tell you. If the law requires us to process the data in some other way, we will tell you first unless the law forbids it.

4. Your responsibilities

• Have a lawful basis for the data you collect and tell people how you use it (your own privacy notice).
• Only send marketing to people who agreed where consent is required. Lugroom records consent and adds an unsubscribe link to every marketing email.
• Choose retention periods that suit your legal obligations in Settings → Data retention, and answer requests from the people whose data you hold (Lugroom lets you view, correct, export and erase a client's details).
• Control who on your team has access, and remove people who leave.

5. Confidentiality and security

Everyone at Lugroom who can access the data is bound by confidentiality. We maintain technical and organisational measures that include:

• isolating each store's records from every other store's at the database level (row-level security);
• encryption in transit (TLS) and at rest;
• role-based access within your store, with private figures shown only to owners and admins, and two-factor sign-in for staff;
• access to production systems limited to the few people who operate the service;
• automated backups, a web application firewall, rate limits, and monitoring and alerting;
• keeping only the parts of sensitive data that are needed (for example only the last four characters of an ID number).

6. Subprocessors

You authorise us to use the following subprocessors:

• Amazon Web Services, Inc.: Hosting, database, file storage, content delivery, security filtering and sending email (Amazon SES). Location: United States (US East, Ohio); content delivery from AWS locations worldwide.
• Anthropic, PBC (Claude, through Claude Platform on AWS): The AI storefront designer: drafts storefront text and layout from what a dealer asks it to design. It is not sent client or buyer records.. Location: United States.

We impose data protection terms on each subprocessor that are at least as protective as these, and remain responsible for them. We will give you at least 30 days' notice by email before adding or replacing a subprocessor. If you object on reasonable data protection grounds and we can't address the objection, you may close your store and we will refund any fees paid for the period after it closes.

7. International transfers

The data is stored in the United States. Where the law requires a transfer mechanism (for example for data about people in the UK, the EEA or Switzerland), the European Commission's standard contractual clauses (module 2, controller to processor), with the UK addendum and Swiss amendments as applicable, are incorporated into these terms by reference.

8. Helping you

• Requests from individuals: Lugroom's tools let you answer most requests yourself. If someone contacts us directly about data you control, we will pass the request to you and not answer it ourselves, and we will help where you need us to.
• Breaches: we will tell you without undue delay, and in any case within 72 hours, after we become aware of a personal data breach affecting your data, with what we know about it, the likely consequences and what we are doing about it, and keep you updated.
• Assessments: we will give you reasonable help with data protection impact assessments and consultations with regulators about the service.

9. When the service ends

You can export your data at any time. When you close your store, your data is taken offline at once and deleted 30 days later, and removed from backups within a further 90 days, unless the law requires us to keep it. Your retention settings delete client details on the schedule you choose while you use Lugroom.

10. Information and audits

We will make available the information reasonably needed to show we meet these terms, including answers to security questionnaires. If that isn't enough, or a regulator requires it, you may audit our compliance once a year, with at least 30 days' notice, during business hours, at your cost, under confidentiality, and in a way that doesn't expose other customers' data.

11. Liability

Each party's liability under these terms is subject to the limits in the terms of use, except where the law doesn't allow it to be limited.

12. Contact

Questions about these terms or about how we process your data: our support page.