Part A
The kit.ink website
This part covers personal data processed when you visit kit.ink or use the contact form.
1. Controller
luminoso GmbH is the controller for this website and for enquiries sent through the contact form.
- Legal name
- luminoso GmbH
- Country of establishment
- Germany
- Registered business address
- Zschierener Str. 12 c
01259 Dresden, Germany - Commercial register
- Amtsgericht Dresden · HRB 42407
- hello@kit.ink
- Website
- kit.ink
2. What we process and why
The site currently has no account area, order flow, analytics or advertising technology. It provides the contact form described below.
Website delivery and security
When the site is loaded, the hosting infrastructure may process the IP address, date and time, requested URL, referrer, browser and device information, and security events. This is technically necessary to deliver and protect the site.
Purpose: reliable delivery, abuse prevention, troubleshooting and security.
Legal basis: legitimate interests, Article 6(1)(f) GDPR.
Contact form and enquiries
When you use the contact form, we process your name, email address, optional company, selected topic, message, language and technical request metadata so that we can answer and follow up.
Purpose: responding to enquiries, discussing pilots and integrations, and taking steps before a contract where requested.
Legal basis: Article 6(1)(b) GDPR for requested pre-contractual steps; otherwise legitimate interests under Article 6(1)(f) GDPR.
Language preference
The site stores only the selected language (DE, EN or FR) in your browser under the key kit-ink-locale. It contains no name, account or customer identifier.
Purpose: remembering the language you explicitly selected.
This storage is technically necessary for the explicitly requested preference. No consent banner is used for it.
Social links
The site does not embed social media content. If you open an Instagram, LinkedIn or X link, you leave kit.ink and the selected platform processes data under its own privacy terms.
3. Hosting
The website and contact form are hosted by Netlify, Inc. Netlify may process request and security data to deliver and protect the site. Netlify Forms receives and stores contact-form submissions and can send notification emails to our Proton Mail inbox. We do not run audience analytics on this site.
Netlify privacy information4. Cookies and tracking
kit.ink sets no advertising, analytics or profiling cookies and loads no third-party fonts, scripts or embedded media. The local language preference described above is the only browser storage used by the site.
5. Retention
Language preference remains in your browser until you change it, clear site data or browser storage is removed. Enquiries are kept only as long as needed to answer, manage the business relationship, establish or defend legal claims, and meet statutory record-keeping duties. Hosting and security logs follow the configured provider retention periods and are removed or anonymised when no longer needed.
6. Recipients
Access is limited to authorised people at luminoso GmbH and the service providers needed for website hosting, security, form processing and the hello@kit.ink inbox, in particular Netlify and Proton. Providers act under contractual and confidentiality obligations where required.
Part B
The kit.ink Review app
This part covers personal data processed in the kit.ink Review app. Staff of our business customers use the app to check jersey personalizations before production.
7. What the app processes and why
Sign-in
You sign in with your account from your organization. We process the email address and a user identifier that your organization's account system gives us. We do not create or store a separate password for the app.
Purpose: identifying you as authorized staff and showing your organization's own cases.
Legal basis: legitimate interests, Article 6(1)(f) GDPR, and performance of the contract with your organization, Article 6(1)(b) GDPR.
Push notifications
If you turn on push notifications, we store a device token for that device so we can notify you when a case needs review. The token is deleted when you sign out or when your access is deactivated.
Purpose: telling you when a case is waiting, without you having to check the app.
Legal basis: legitimate interests, Article 6(1)(f) GDPR. You can turn push notifications off at any time in the app settings; the app works fully without them.
Business data you view
The app shows jersey personalizations that belong to your organization, so you can approve or reject them. This data belongs to your organization; we process it on your organization's behalf. We do not collect this data from you as an app user.
8. No advertising, no tracking, no sale of data
The app shows no advertising and uses no tracking or analytics technology. We never sell personal data.
9. Retention in the app
Sign-in data is kept for as long as your account with your organization is active. Push device tokens are kept until you sign out or your access is deactivated, whichever happens first.
10. Security
All data between the app and our servers travels encrypted.
11. Your rights in the app
You have the same rights described in section 14. Because your account belongs to your organization, please start with your organization's administrator. You can also contact us directly using the details in section 19; we forward requests to your organization where needed.
12. International transfers
Some infrastructure providers may process data outside the European Economic Area. Where no adequacy decision applies, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and supplementary measures where needed.
13. Processors
We use service providers to run the website and the app. The recipients named in section 6 are already fixed. The remaining providers for the app — in particular for backend hosting, sign-in and push delivery — are being finalized before the app is submitted to app stores; this list will be completed here first.
[List of processors — to be completed before publication]
14. Your rights
Depending on the circumstances, you may request access, rectification, erasure, restriction and data portability, or object to processing based on legitimate interests. You may withdraw consent at any time where processing is based on consent. Neither the website nor the app relies on consent-based tracking.
15. Complaints
You may contact us first so we can resolve the issue. You also have the right to lodge a complaint with the Saxon Data Protection and Transparency Commissioner or another competent supervisory authority.
Saxon data protection authority16. Automated decisions
Neither the website nor the app uses profiling or automated decision-making that produces legal or similarly significant effects. Decisions on jersey personalizations are made by human staff at your organization.
17. Children
The kit.ink website and the kit.ink Review app are business tools for staff of our business customers. Neither is directed at children, and we do not knowingly collect children's data through either.
18. Changes to this notice
We update this notice when the website, the app, providers or processing activities change. The date at the top shows the current version.
19. Privacy contact
For privacy questions or to exercise your rights, use the contact form, write to hello@kit.ink, or use the app's support page. We may need enough information to verify and handle your request securely.
Contact form