Privacy notice
Who is responsible
LunoLake ApS is the data controller for this site.
Vågøvej 16, 8700 Horsens, Denmark. CVR 46459296.
info@lunolake.com
Write to that address about anything on this page. We are not required to have a data protection officer and do not have one, so your message reaches us directly.
This site
This site counts visits with Google Analytics, and only if you said yes. Nothing is loaded and nothing is written until you do. Say no and the site works exactly the same; there is no part of it you have to accept anything to read. You can change your mind from the Cookies link at the bottom of any page, as easily as you answered the first time.
If you say yes, Google sets two cookies, _ga and one beginning _ga_, both for two years. They give you a number so that two visits can be told apart, and they are the only cookies this site sets. We see which pages are read, roughly where in the world from, and how people arrived. We do not see who you are, we have turned off the settings that would follow you to other sites or build an advertising profile, and we do not use any of it to identify anybody.
Google is our processor for this and processes it on our instructions. Your answer is remembered in your own browser and is never sent to us or to them. docs.lunolake.com and portal.lunolake.com set no cookies of this kind at all and are not measured, so they never ask.
The web server keeps no log of the addresses requests come from or the pages they asked for. We log what the application itself reports, which is errors and the acts listed under the portal below. Signing in to the portal happens at Microsoft, and the record of that is Microsoft’s own sign-in log for your work account rather than something we hold.
The contact form
When you write to us through the form we receive what you typed: what it is about, your name, your company, your email address, the trading partners you named, and your message. We use it to answer you, which is a step you asked us to take before any agreement, and nothing else. Everything except your name, email and message is optional.
The message is kept in three places: a log on the server that runs this site, so nothing is lost if mail fails, the mailbox that receives it, and the portal we work in, where it becomes the enquiry we answer and whatever we noted about answering it. We delete it when the enquiry is finished, and at the latest 12 months after your last message to us. If we end up working together, the correspondence becomes part of our records for that agreement and follows the rules for those instead, including the five years that Danish bookkeeping law requires of accounting material.
The chat
The chat box appears only while someone at LunoLake is available. Before the first message we ask for your name, company and email so we know who we are talking to and can still answer you if the conversation is cut off; a phone number is optional. That is the same purpose as the form.
What you write goes to a channel in our Microsoft Teams, where the person answering reads it, and the reply comes back to the box. The conversation is kept in that channel and deleted on the same terms as a message from the form. Your browser holds a session token for the chat until you close the tab. That is session storage, not a cookie, and it never leaves your browser.
If you write to info@lunolake.com instead, your mail is kept in that mailbox under the same terms.
The partner portal
The portal at portal.lunolake.com is for people at the partners who sell LunoLake and at the companies that use it. You reach it with the Microsoft work account you already have. We never see your password: Microsoft tells us who you are, which company you belong to, your name and your address, and we keep those so we know whose screen we are showing.
While you use it we record the things somebody may have to answer for afterwards. When you accept an agreement we keep your name, the role you typed, the exact version you accepted and its fingerprint, the time, the address your browser came from and which browser it was, because an acceptance that cannot be shown is not worth having. When you download a package we keep who, which package, for which company and from what address. And every act that changes something is written down with who did it and when.
The basis is the agreement between us and your company, and our own legitimate interest in being able to show what was agreed and who took what. We keep it for as long as the agreement runs and then for five years, counted from the end of the financial year the agreement ended in, which is what Danish bookkeeping law asks of the records behind an invoice. Our financial year is the calendar year, so an agreement that ends in March 2026 is kept until the end of 2031. A support case and what is written in it follow the same rule.
When those five years are up we take your name out of what is left rather than deleting the record. We keep that your company accepted a particular version of a document on a particular date, and that your company was given a particular package, because those are the things we have to be able to show. Your name, the role you typed, your signature, the address your browser came from and which browser it was all go. From then on we can no longer produce your signed copy of the agreement, so download one from the portal if you want to keep it.
Anybody at your own company who uses the portal sees your name and your address on the people list, and so do LunoLake and, if you are a customer, the partner who sells to you. Nobody else does.
What the portal shows about your trading
The portal shows how many documents an installation has sent and received this month, which environment the module is running in, and a single document looked up by its number. For that one document it shows when it went, which kind it was, which trading partner it was with, what happened to it and why if it failed, and the document itself in the forms it took on the way through. That means the contents: an invoice opened in the portal shows what was invoiced.
The documents are not kept here. They are read from the platform when the page is opened and are gone when you close it. The platform holds them for 30 days, and for a further 30 days a deletion can still be undone.
The counts are kept here. How many documents an installation sent and received in a day and in a month is stored, because an invoice rests on it and a month that has been invoiced has to stay the number it was invoiced on. A count carries nothing out of a document. We also keep what a person typed: which installation belongs to which company, and which environment somebody confirmed it ought to run in.
Who sees it: the company itself, LunoLake, and the partner that sells to that company, because the partner runs the installation and answers the first support call. A company can withdraw its partner’s access to its document contents in the portal at any time; the counts and the delivery history stay, so that the partner can still support it and still be invoiced. Nobody else sees any of it, and one company never sees another’s.
Who else sees it
The site, the portal, the mailbox and Teams run on Microsoft Azure and Microsoft 365 in the West Europe region. Microsoft processes the data on our instructions under its own data protection terms, and it is the only supplier that does: the whole list is on our sub-processors page. We do not sell your data, we do not pass it to anyone for their own purposes, and nobody outside LunoLake reads your message unless the law obliges us.
If you said yes to being counted, Google processes that on our instructions under its own data processing terms, and it is the one thing here that can leave the EU and EEA. Google states where it processes and under which safeguards, and those terms are between us and them. It is also the only part of this page you can switch off, and the Cookies link at the bottom of any page is how.
Your rights
You can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong;
- delete it;
- limit what we do with it while a disagreement is settled;
- hand it to you or to someone else in a machine readable form;
- stop using it, where we rely on our legitimate interest.
Write to info@lunolake.com and we answer within a month. It costs you nothing. If you are not satisfied with our answer you can complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.
Changes
If we change how we handle your data, we change this page and the date at the top. We do not keep old versions online, so write to us if you need to know what it said on a given day.