Legal
Privacy Notice
Last updated
This notice explains what personal data we collect, why, who we share it with, how long we keep it and how you can use your rights.
1. Who we are and what this notice covers
Lumera is run by Pixel Image India Private Limited, a company registered in India (CIN U72900PN2001PTC130524), with its registered office at Pixel House, Lane E, North Main Road, Koregaon Park, Pune, Maharashtra 411001. In this notice "Lumera", "we" and "us" mean that company. We decide how and why your personal data is used. Under Indian law we are the Data Fiduciary. Under UK and EU law we are the controller.
This notice explains what personal data we collect, why, who we share it with, how long we keep it and how you can use your rights. It covers personal data we collect when you:
- visit vialumera.com;
- book online, by scanning the QR code at the fort, or through a group, corporate or school booking;
- hire a tablet at our kiosk at Jaigarh Fort;
- use a Lumera tablet on the tour, including the map, treasure hunt, selfie and feedback features; or
- contact us.
We sell to you and take your payment. Our group company Pixel Image Limited (UK) licenses the Lumera technology to us. It does not sell to visitors or take payments.
Jaigarh Fort is managed by the Jaigarh Public Charitable Trust. Your fort admission ticket is sold by the Trust and is covered by the Trust's own privacy terms, not this notice.
This notice stands on its own. It is not part of our Terms and Conditions and you are not asked to agree to it. Where we need your consent for something, we ask for it separately, at the point it matters.
2. Summary
- We collect only what we need to book your visit, run your tour and send you your tickets, receipt and selfies.
- Lumera tablets never connect to the internet. Everything on a tablet is wiped when you return it.
- Selfies are taken only if you choose to, and are deleted 72 hours after we confirm you have received them.
- Soon after your visit we delete your contact and tour details. We keep payment records for 10 years because tax law requires it, and a basic record of your hire, without your contact details, for 2 years so we can answer any complaint.
- Your personal data is kept in India.
- We never sell your personal data and we do not use it for advertising.
- Tablets are hired only to adults, or to schools for their pupils. We do not track or profile children.
- To ask a question, use your rights or make a complaint, email grievance@vialumera.com or speak to us at the kiosk.
3. The personal data we collect and why
Items marked "Required" are needed to provide the service. If you do not give them we cannot complete your booking or hire. Everything else is your choice.
| Personal data | Where we collect it | What we use it for | Required? |
|---|---|---|---|
| Your name | Booking form, kiosk | To issue your booking in your name and find it if you lose your confirmation | Required |
| Email address or mobile number (one of the two) | Booking form, kiosk | To send your confirmation, tickets and receipt by email or SMS, to find your booking and to reach you while you have one of our tablets | Required |
| Booking details: date, time slot, number and type of tickets, tour language, Booking ID and ticket QR codes | Booking form, kiosk | To manage your booking and have a tablet ready for you | Required |
| Ticket type (for example Indian resident, foreign visitor, student, senior) | Booking form, kiosk | To charge the correct price. Staff may ask to see proof of a concession at the kiosk. We look at it and hand it back. We do not copy or keep ID documents, and we do not hold ID against the tablet | Required |
| Group, corporate and school bookings: organisation name, contact person, email, phone, billing address and GST number | Group booking form, payment link | To take the booking, issue a GST invoice and contact the organiser | Required for these bookings |
| Payment details: transaction reference, amount, payment method, receipt and GST invoice | Razorpay online, card or UPI terminal at the kiosk | To take payment, issue refunds and keep the tax records the law requires. Your full card number, CVV and UPI PIN go only to Razorpay. We never see or store them | Required |
| Tablet settings: language, volume, subtitles, text size and the topics you want to see | Booking form, kiosk, tablet settings screen | To set up your tablet the way you want it. Accessibility mode and wheelchair route are set only at the kiosk when you collect the tablet, and are never saved with your booking | Optional |
| Your headphone or device name, if you pair your own Bluetooth headphones | Tablet | To connect your audio. Cleared when the tablet is wiped | Optional |
| Tablet hire record: tablet ID, tag number, Booking ID, issue and return times and condition on return | Kiosk | To keep track of our tablets and apply any late-return or damage charge under our Terms and Conditions | Required |
| Tour use: the points of interest you visit, which room or area you are in (from Bluetooth beacons, not GPS), time at each stop, route, tour length and treasure hunt progress | Tablet | To show where you are on the map, play the right scene and unlock treasure hunt rewards. After your visit this is made anonymous and used to improve the tour | Needed for the tour to work |
| Selfie photographs | Tablet camera | To create your souvenir picture and send it to you (see section 5) | Optional, with consent |
| Email address for selfie delivery | Tablet or kiosk | To send you your selfies | Optional |
| Feedback scores and comments | Tablet on return, online survey | To improve Lumera. Feedback is linked only to your ticket type, not to you. If you ask us to contact you about it, we use the details you give only for that | Optional |
| Messages and requests you send us | Email, kiosk, phone | To answer you and keep a record of what we did | As needed |
| Website data: IP address, browser and device type, pages visited and cookie data | vialumera.com | To run and secure the website (see section 14) | Needed for the site to work |
We do not use facial recognition, we do not create biometric data from selfies and we do not make decisions about you by automated means.
4. Our legal basis
Indian law lets us use your personal data with your consent, or without it for certain "legitimate uses", such as data you give us voluntarily for a stated purpose, or meeting a legal duty. UK and EU law has a different list of bases. The table shows which we rely on for each purpose.
Where we rely on data you give us voluntarily, you can tell us at any time that you do not want us to use it. We will then stop, although we may no longer be able to provide the service.
| Purpose | India (DPDP Act 2023) | UK and EU (GDPR) |
|---|---|---|
| Taking and managing your booking, sending tickets and confirmations | Data you provide voluntarily for this purpose (section 7(a)) | Necessary for our contract with you |
| Payments, refunds, receipts and tax records | Data you provide voluntarily (section 7(a)) and compliance with law (section 7) | Contract and legal obligation |
| Setting up your tablet and running the tour, including room-level location on the map | Data you provide voluntarily (section 7(a)) | Contract |
| Tablet hire record and late-return or damage charges | Data you provide voluntarily (section 7(a)) | Contract |
| Keeping business contact details on file for a year | Consent | Consent |
| Selfies and sending them to you | Consent | Consent |
| A selfie that includes a child | Consent of the child's parent | Consent of the person with parental responsibility |
| Using a selfie in Lumera publicity | Separate consent, off unless you switch it on | Consent |
| Feedback | Consent | Consent |
| Answering your messages and requests | Data you provide voluntarily (section 7(a)) | Legitimate interests in responding to you, or legal obligation for rights requests |
| Running and securing the website | Data you provide when you use the site (section 7(a)) and compliance with law (section 7) | Legitimate interests in keeping the site secure and working |
| Security records the law requires us to keep | Compliance with law (section 7) | Legal obligation and legitimate interests in security |
| Anonymous statistics | Not personal data once anonymised | Not personal data once anonymised |
We only hold information about disability if you choose to tell us, for example to request help. Staff check disability concessions at the kiosk without recording the reason.
5. Selfies
The selfie feature places you into a historical scene. It is switched on for your tablet only if you agree at the kiosk when you collect it.
- What we take: the pictures you choose to capture, with the email address you give us to send them to.
- How they reach you: the tablet stores your pictures until you return it. They are then passed to our central system over the kiosk link and emailed to you, with the scene name, location and date added.
- How long we keep them: we delete them 72 hours after we confirm they have been delivered. If delivery fails we try again, then delete them 7 days after your visit whether or not they were delivered.
- Publicity: we will only use your selfie to promote Lumera if you tick a separate box to allow it. That box is off unless you switch it on. You can change your mind at any time and we will stop using it in new material.
- Other people: please ask before you photograph anyone else.
- Changing your mind: tell staff before you return the tablet and we will delete your pictures without sending them. After that, reply to your selfie email and we will delete our copy straight away.
We do not use selfies to recognise faces or identify anyone.
6. Children and school groups
Under Indian law anyone under 18 is a child. We apply the same age to every visitor.
- Bookings and hire are for adults only. We do not take a booking from, or hire a tablet to, anyone under 18, except through a school as set out below.
- Children share an adult's tablet. We do not issue tablets to children outside school groups, so we hold no tour data about a child.
- Selfies: a selfie that includes a child is taken only after the child's parent gives consent at the kiosk. The pictures are sent to the adult's email address, not the child's.
- No tracking or profiling: we do not track, monitor the behaviour of, or target advertising or offers at children.
School groups. Schools can hire a tablet for each pupil on these terms:
- The school books as an organisation. A teacher or other authorised adult makes the booking and collects and returns the tablets.
- Each tablet is registered to the school's booking, not to a pupil. We do not ask for pupils' names or contact details.
- A pupil's tablet records no tour data. Location is used only to show the map on screen at that moment. Everything on the tablet is wiped when it is returned.
- Selfies, feedback and treasure hunt rewards are switched off on pupils' tablets.
- The school supervises its pupils and is responsible for the tablets it hires.
If you think we hold a child's personal data without a parent's consent, contact us and we will delete it.
7. Who we share your data with
We share personal data only with the organisations below, only what each needs, and only under a written contract that requires them to keep it secure and use it only for us.
| Who | What they receive | Why |
|---|---|---|
| Hosting and network security providers | Data stored in or passing through our booking and tour system | To host the website, booking system and database securely in India |
| Razorpay Software Private Limited, our payment provider | Payment details, and your name and contact details for the transaction | To process payments and refunds |
| Email and SMS providers | Name, email or mobile number, tickets, receipts and selfies | To deliver your messages |
| Professional advisers, auditors and tax authorities | Payment and tax records, and other records as needed | To meet our legal and accounting duties |
| Police, courts and regulators | What the law requires | Only when the law requires it |
The Jaigarh Public Charitable Trust receives anonymous statistics and hire counts only. It does not receive your personal data.
Our tablets are leased. The leasing company manages the devices but does not receive any visitor data. Tablets are wiped on return.
If we sell or transfer the Lumera business, your data may pass to the new owner, who must use it on the terms of this notice.
8. Where your data is stored
Your data moves through three places:
- The tablet. It never connects to the internet. It passes data only to our kiosk over a local link, and is wiped when you return it.
- Our on-site system at Jaigarh Fort. It holds data, encrypted, only until it can send it to our central system.
- Our central system, hosted in Mumbai, India. This is where your booking, receipt and selfies are held until they are deleted.
We keep your personal data in India. If a service provider ever needs to handle it outside India, for example to deliver an email, we will do so only where Indian law allows and under a contract that protects it.
If you are from the UK or EU, your data is held in India. Section 13 sets out your further rights.
9. How long we keep your data
We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires.
| Data | How long we keep it |
|---|---|
| Contact details, tablet settings, tour use linked to you, selfies and the selfie email address | Deleted 72 hours after we confirm your tickets, receipt and any selfies have been delivered. If delivery cannot be confirmed, deleted 7 days after your visit |
| Cancelled bookings | Deleted when your refund is complete, apart from the payment record |
| Bookings not used | Deleted at the end of the booked time slot, apart from the payment record |
| Payment records, receipts and GST invoices | 10 years, held separately with restricted access, to meet Indian tax and company law |
| Group, corporate and school booking contacts | Deleted once the invoice is paid. If you ask us to keep your details on file, we keep them for 1 year from your last booking |
| Tablet hire record (Booking ID, tablet ID, issue and return times, condition on return) | Your name and contact details are removed once the tablet is back and any charge or dispute is settled. The rest of the record, linked only to your Booking ID, is kept for 2 years so we can answer any complaint about your hire |
| Feedback | Linked only to your ticket type, so kept as anonymous statistics. Contact details you give us with feedback are deleted once we have replied |
| Records of rights requests and complaints | 2 years from when we close them |
| Security and access logs | Up to 1 year |
| Selfies you allowed us to use for publicity | Until you withdraw consent, or 2 years after your visit, whichever is sooner |
| Anonymous statistics | Kept, because they cannot identify you |
The 2-year periods match the time limit for bringing a consumer complaint in India (Consumer Protection Act 2019, section 69).
10. Security and data breaches
We protect your data with:
- tablets that never connect to the internet and are wiped on return;
- encryption of data in transit and when stored;
- access limited to staff who need it, with logs of who accessed what;
- backups so data is not lost if a system fails; and
- contracts that require every provider in section 7 to meet the same standard.
If a breach affects your personal data, we will tell you without delay, using the contact details you gave us. We will explain what happened, when, the likely effect on you, what we are doing about it, what you can do to protect yourself and who to contact. We will also report it to the Data Protection Board of India and any other authority the law requires. For UK and EU visitors we will report it to the relevant data protection authority within 72 hours where the law requires.
11. Your rights
Whoever you are and wherever you live, you can ask us to:
- tell you what personal data we hold about you, what we have done with it and who we have shared it with;
- correct, complete or update it;
- delete it, unless the law requires us to keep it;
- withdraw any consent you have given, at any time;
- stop using data you gave us voluntarily, by telling us you no longer agree; and
- name another person (a nominee) to use your rights if you die or are unable to act.
UK and EU visitors have further rights, set out in section 13.
How to ask. Email grievance@vialumera.com or speak to staff at the kiosk. Give us your Booking ID and the email address or mobile number you booked with, so we can find your data and check it is you. We will reply within one month.
Withdrawing consent is as easy as giving it.
- Selfies: tell staff at the kiosk, or reply to your selfie email.
- Publicity use of your selfie: reply to your selfie email or email us.
- Business contact details kept on file: email us.
- Feedback: leave the question blank, or ask us to delete your answers.
Withdrawing consent does not affect anything we did before you withdrew it. Because we delete most data within days of your visit, please contact us soon after your visit if you want to use your rights.
12. Questions, grievances and complaints
Our Grievance Officer answers questions about how we use personal data and handles complaints.
- Role: Director of Heritage Operations, Pixel Image India Private Limited
- Email: grievance@vialumera.com
- Post: Pixel House, Lane E, North Main Road, Koregaon Park, Pune, Maharashtra 411001
We will respond to a grievance within one month of receiving it.
If you are not satisfied with our response, you can complain to the Data Protection Board of India. Indian law asks you to use our grievance process first.
UK visitors can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. EU visitors can complain to the data protection authority in the country where they live or work.
13. Additional information for UK and EU visitors
If you live in the UK or the European Economic Area, the UK GDPR or EU GDPR gives you the rights below in addition to those in section 11.
- Controller: Pixel Image India Private Limited, trading as Lumera (contact details in section 12).
- Legal bases: set out for each purpose in section 4. Where we rely on legitimate interests, it is to keep our website secure and to answer your messages. You can object to this at any time.
- Further rights: to restrict how we use your data while a concern is checked, to object to our use of it, and to receive data you gave us in a common electronic format.
- Providing data: your name and an email address or mobile number are needed to make a booking. Without them we cannot take it. Everything else is optional.
- Automated decisions: we do not make decisions about you by automated means alone, and we do not profile you.
- Where your data goes: see section 8.
- Complaints: to the Information Commissioner's Office in the UK, or the data protection authority where you live or work in the EU. We would welcome the chance to put things right first.
14. Cookies and the website
vialumera.com uses small files called cookies. We use only the cookies the site needs to work: to keep your booking basket, to secure the site and to let Razorpay's checkout work. They are always on because the site cannot work without them.
We do not use advertising cookies or allow advertisers to track you on our site. If we add optional cookies, such as website statistics, we will ask for your consent first and you will be able to change your choice at any time.
Our website may link to other sites, such as the Trust's. Their privacy terms apply when you visit them.
15. Languages, changes and contact
Languages. This notice is in English. A Hindi version is being prepared.
Changes. We will post any change here with a new date. If a change affects how we use data we already hold about you, we will tell you before it applies.
Contact. grievance@vialumera.com or the postal address in section 12.
Version 1.0, 9 October 2026.