NOTICE: This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Platform. By using the Platform, you consent to the practices described in this Policy. Please read it carefully.

1. Who We Are

Luminarix Sdn Bhd 202501044753 (1646161-D), with its registered address at No. 36B Jalan Tun Mohd Fuad 2, Taman Tun Dr Ismail, 60000 Kuala Lumpur, Wilayah Persekutuan, Malaysia (“we”, “us”, or “our”) operates an online marketplace at www.lumihive.shop (the “Platform”) connecting Clients with Service Providers across IT Solutions, Digital Campaigns, Creative Services, and Hardware.

We are the data controller responsible for personal data collected through the Platform. For all privacy queries or requests, contact us at cs@lmnrx.com.

2. Who This Policy Applies To

This Policy applies to all personal data we collect from:

• Clients — businesses and individuals who engage Service Providers through the Platform;
• Service Providers — businesses and individuals who list and deliver services or hardware on the Platform;
• Visitors — individuals who browse the Platform without a registered Account.

This Policy does not apply to third-party websites or services linked from our Platform. We encourage you to review the privacy policies of any third parties you interact with.

3. Personal Data We Collect

We collect only the personal data necessary to operate the Platform and deliver our services. The categories below outline what we collect, with examples and why.

NOTE: We do not collect payment card numbers, bank account details, or other sensitive financial data directly. All payments are handled by our third-party payment processor, which has its own privacy and security obligations.

4. How We Collect Personal Data

4.1 Data You Provide Directly

We collect data you give us when you:

• Register or update your Account;
• Create or update a Listing as a Service Provider;
• Confirm or respond to an Engagement;
• Communicate with us or other Users through the Platform;
• Submit reviews, ratings, or feedback;
• Contact our support team.

4.2 Data Collected Automatically

When you visit or use the Platform, we automatically collect usage and technical data via cookies, log files, and similar tracking technologies. See Clause 12 for details on how to manage your cookie preferences.

4.3 Data from Third Parties

We may receive personal data from:

• Social media or single sign-on providers (e.g., Google, LinkedIn) if you register using those services;
• Analytics partners (e.g., Google Analytics) who provide aggregated usage insights;
• Other Users, such as when a Client provides a Service Provider’s contact details for an Engagement referral.

5. Why We Process Your Data

Under the Personal Data Protection Act 2010 (Malaysia), we process your personal data on one or more of the following legal bases:

• Consent — you have given clear and informed consent to a specific use;
• Contract — processing is necessary to perform our agreement with you or to take steps at your request before entering into one;
• Legal obligation — processing is required by Malaysian law or a binding regulatory requirement;
• Legitimate interests — processing serves our or a third party’s legitimate interests and is proportionate to any impact on your rights.

Specifically, we use your data to:

• Create and manage your Account;
• Facilitate Engagements between Clients and Service Providers;
• Manage orders, generate records, and handle invoicing;
• Provide customer support and resolve disputes between Users;
• Detect and prevent fraud, abuse, and security incidents;
• Comply with applicable Malaysian legal and regulatory obligations;
• Improve the Platform, develop new features, and conduct internal analytics;
• Send you transactional notifications (e.g., order updates, account alerts);
• Send you marketing communications where you have opted in or where permitted by law;
• Enforce our Terms and Conditions, Refund Policy, and other Platform policies.

6. Who We Share Your Data With

6.1 Other Users

To facilitate Engagements, limited profile information is visible to other Users. Service Providers’ business name, service descriptions, portfolio, and ratings are publicly visible on their profile. When an Engagement is confirmed, the Client’s name and relevant project details are shared with the Service Provider for fulfilment purposes only.

6.2 Third-Party Service Providers

We engage trusted third parties to help us operate the Platform. These include:

• Cloud hosting and infrastructure providers;
• Payment processors (who handle transaction data under their own privacy frameworks);
• Customer support and helpdesk platforms;
• Analytics and marketing technology providers (e.g., Google Analytics, Meta Pixel);
• Cybersecurity and fraud detection services.

All third-party processors are bound by contractual obligations to process personal data only on our instructions, maintain appropriate security, and not use data for their own purposes.

6.3 Legal and Regulatory Disclosure

We may disclose personal data to competent authorities where required or permitted by Malaysian law, including the Malaysian Communications and Multimedia Commission (MCMC), the Companies Commission of Malaysia (SSM), or law enforcement agencies acting under a lawful mandate.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of our business, personal data may be transferred to the relevant successor entity. We will notify Users of any such transfer and of any material changes to this Policy that result from it.

6.5 No Sale of Data

We do not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes, under any circumstances.

7. Cross-Border Data Transfers

Some of our third-party service providers operate infrastructure outside Malaysia (including in Singapore and the United States). Where your personal data is transferred outside Malaysia, we ensure adequate protection is in place by:

• Transferring only to countries or processors that provide a comparable standard of data protection;
• Requiring data processing agreements with appropriate contractual protections;
• Where relevant, relying on legally recognised transfer mechanisms such as Standard Contractual Clauses.

NOTE: If you are based in a jurisdiction with specific cross-border data transfer rules (e.g., the EU under GDPR), additional protections may apply to your data. Contact cs@lmnrx.com for more information.

8. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

9. How We Protect Your Data

We apply appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, or misuse. These include:

• Encryption of data in transit (TLS/SSL) and encryption of sensitive data at rest;
• Role-based access controls so only authorised personnel can access personal data;
• Regular security assessments and vulnerability monitoring;
• Incident response procedures for detecting, containing, and reporting data breaches;
• Contractual security requirements imposed on all third-party processors.

No system is completely immune from security risks. In the unlikely event of a data breach that poses a risk to your rights, we will notify you and the relevant regulatory authority in accordance with applicable law.

10. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights regarding your personal data:

We will respond to all valid requests within 21 days of receipt. We may request proof of identity before processing your request. Some requests may be declined where permitted by the PDPA 2010 or where fulfilment would affect the rights of others.

GDPR NOTE: If you are located in the European Economic Area, you may have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with your local data protection supervisory authority.

11. Children’s Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children without verifiable parental or guardian consent. If we discover that we have inadvertently collected a child’s data, we will delete it promptly.

If you are a parent or guardian and believe your child has provided data to us without your consent, please contact us at cs@lmnrx.com.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Platform, understand how Users interact with it, and deliver relevant content. The types of cookies we use are:

You can manage cookie preferences via our Cookie Settings panel or your browser settings. Disabling certain cookies may limit Platform functionality.

13. Marketing Communications

With your consent, or where otherwise permitted under the PDPA 2010 and the Communications and Multimedia Act 1998, we may send you updates about new features, promotions, and relevant offerings on the Platform.

You can opt out at any time by:

• Clicking the unsubscribe link in any marketing email;
• Updating your preferences in Account Settings;
• Emailing cs@lmnrx.com.

Opting out of marketing does not affect transactional communications such as order confirmations, account alerts, and policy updates, which are necessary for Platform operation.

14. Service Providers’ Data Responsibilities

Service Providers may receive Client personal data (such as names, contact details, and project information) in the course of an Engagement. As an independent data controller in respect of such data, each Service Provider is responsible for:

• Complying with the PDPA 2010 and all applicable data protection laws;
• Using Client data only for the purpose of delivering the relevant Engagement;
• Not retaining Client data beyond what is necessary for the Engagement;
• Not sharing Client data with third parties without the Client’s explicit consent;
• Implementing reasonable security measures to protect Client data.

The Platform is not liable for any misuse of personal data by a Service Provider. If you believe a Service Provider has mishandled your data, please notify us at cs@lmnrx.com and contact the Personal Data Protection Commissioner of Malaysia.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or Platform features. Material changes will be communicated via email or a prominent Platform notice at least 14 days before taking effect.

The Effective Date at the top of this Policy shows when it was last revised. We encourage you to review it periodically. Continued use of the Platform after any update constitutes acceptance of the revised Policy.

16. Complaints

If you have a concern about how we handle your personal data, please contact us at cs@lmnrx.com first. We will acknowledge your complaint within 5 business days and aim to resolve it within 21 business days.

If you remain unsatisfied, you may escalate to the Personal Data Protection Commissioner of Malaysia:

17. Contact Us

For any privacy-related queries, data subject requests, or concerns: