DEEP FLOW SOFTWARE SERVICES – FZCO

Privacy Policy

Lumora

Update Date: 12.08.2026

This Privacy Policy for Deep Flow Software Services - FZCO (“Company”), explains which personal data we collect, store, use, and share ("process") when you visit our website https://try-lumora.com ("Website") in relation to Lumora ("Lumora"). Lumora is a bedside sunrise light and sound device, which is a product concept currently in development and is not yet available for purchase. The Website currently serves as an informational landing page where you may join a waitlist to receive updates about the product. This Privacy Policy applies when you:

• visit the Website, submit your e-mail address to join the waitlist, or otherwise interact with the Website, or
• interact with us in other related ways, such as through pre-launch, support, or marketing activities.

Important Notice: Lumora is currently in the pre-launch phase and is not available for purchase. The "Buy Now" button on the Website does not initiate a purchase transaction; clicking it will display a pop-up informing you that the product is coming soon and allowing you to join the waitlist by providing your e-mail address. Joining the waitlist does not constitute an order, a pre-order, a deposit, or any binding commitment to purchase. No payment is collected, and no payment information is requested. All product images, specifications, features, and pricing information displayed on the Website are preliminary and subject to change without notice prior to the official product launch.

Medical Disclaimer: Lumora is a consumer electronics product (bedside sunrise light and sound device) and is not a medical device. It is not intended to diagnose, treat, cure, or prevent any disease or health condition. Any sleep-related, light-related, sound-related, or wellness-related information that Lumora may provide upon its release is for general informational purposes only and should not be considered medical advice. We do not collect any health data through the Website.

This Privacy Policy further describes how and why we collect your personal data; how we intend to use, store, protect and share your personal data, and what are your rights and how to exercise them.

Summary of Key Points

This summary outlines the key highlights of our Privacy Notice. For more detailed information on any specific topic, please refer to the table of contents below to navigate to the relevant sections.

What personal data do we process? When you visit our Website, we may process your personal information based on your interactions with us, the choices you make, and the features that you access. The personal data of users processed by the Company, in particular, are as follows:

• your name and surname, e-mail address and phone number which we may receive if you contact the Company,
• your Internet Protocol Address (IP address), collected primarily for spam prevention purposes and additionally for website analytics,
• page interaction data (such as sections viewed, scroll depth, and buttons clicked), advertising source information (UTM parameters), a single-session identifier (session ID), and device type,
• consent checkbox status and the timestamp of your consent, collected when you join the waitlist.

Do we process sensitive personal data? No, we do not process any sensitive personal data. We do not collect your name, address, phone number, date of birth, payment information, location data, or health data through the Website.

How do we process your information? We process your personal data to operate and maintain the Website, manage the waitlist, communicate with you regarding product updates, safeguard security, prevent spam and fraud, and comply with legal obligations. All processing activities are conducted only in accordance with valid legal bases.

When do we share personal information? We only share your personal data with third parties when necessary to operate the Website, comply with legal obligations, protect our rights, or prevent fraud and security threats. This may include service providers and legal authorities. All data sharing is carried out in compliance with applicable data protection laws and is subject to appropriate safeguards to ensure the security of your personal data.

How do we keep your personal data secure? We implement administrative and technical measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction, ensuring its security.

What are your rights? Depending on your region, you may have specific rights concerning your personal data. These rights may include the right to access, correct, delete, restrict processing, object to processing, and data portability. Additionally, you may have the right to withdraw your consent.

How can you exercise your rights? You can simply exercise your rights by reaching out to us directly. We will diligently review and address any request in compliance with applicable data protection laws.

Table of Contents

1. The Data Controller and the Objective

Your personal data, which you provide to the Company through the Website (see Section 10 for contact information), and/or obtained by our Company through automated means when you visit the Website, may be processed by our Company as “Data Controller”.

The Company aims to process the personal data of Website visitors and waitlist registrants in accordance with general principles of privacy and the provisions of the applicable data protection legislation, particularly, where applicable, Law on Personal Data Protection No. 6698 of the Turkish Republic (“PDP Law”) and other applicable laws and regulations.

We are committed to complying with this Privacy Policy in accordance with all applicable laws in each region in which we operate. To ensure compliance with regional legal requirements, we provide additional privacy notices for specific jurisdictions. Accordingly, where applicable, this Privacy Policy includes additional information regarding the European Union's General Data Protection Regulation (GDPR) (EU Regulation 2016/679). For individuals in the European Economic Area, the United Kingdom, and Switzerland, please scroll down to Section 11. For California residents, please scroll down to Section 12.

In accordance with this Privacy Policy, personal data are processed by the Company as a data controller in line with the basic principles named here: (i) being in accordance with law and good faith, (ii) being accurate and, where necessary, up-to-date, (iii) being processed for specific, explicit and legitimate purposes, (iv) being limited for the purpose for which they are processed and data minimization; and (v) being stored for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

Capitalized terms in this Privacy Policy shall have the meanings specified in the Terms and Conditions unless defined separately in this Privacy Policy.

2. Collection of Personal Data and Method

The Company may process the following data for the purposes specified in this Privacy Policy.

Identity and Contact Information: When you join the waitlist through the Website, we process your e-mail address, consent checkbox status, and the timestamp of your consent. If you separately contact us, such as via e-mail or our phone number, we may process your name, surname, phone number and e-mail address, (if relevant) other contact information and the content of your communication. If you contact us by post, we may additionally process your address if entailed in the communication.

Technical Information: When you visit the Website, we may collect the following information:

• Usage Data: We may collect data on how you interact with the Website. This includes page interaction data such as sections viewed, scroll depth, buttons clicked, and advertising source information (UTM parameters).
• Log Data: We may collect log data generated while you are visiting the Website. This log data may include your Internet Protocol (“IP”) address (collected primarily for spam prevention purposes and additionally for website analytics), device type, a single-session identifier (session ID), browser type and version, language preference, time zone, and the date and time of your visit.
• Device Information: We may collect basic information about the device you use to access the Website, such as device type.
• Identifiers: A single-session identifier (session ID) assigned during your visit to the Website.

Explanation on the Source of Information

We may collect your above-mentioned data directly from you through the Website (when you submit your e-mail address to join the waitlist) and automatically from your device and browser when you visit the Website, for the purposes of operating the Website, managing the waitlist, compliance with legal obligations, and improving the Website experience.

3. Purposes of Processing Personal Data and Legal Bases

Your personal data will be processed via automatic or non-automatic means for the purposes stated below, in accordance with the applicable legislation and articles 5 and 6 of the PDP Law, where: (i) it is expressly permitted by the laws; (ii) it is necessary for the legitimate interests of the Company, provided that your fundamental rights and freedoms are protected; and/or (iii) it is necessary in order to fulfil our legal obligations.

For individuals in the European Economic Area, the United Kingdom, and Switzerland, please scroll down to Section 11.

a) Purposes of Processing Personal Data

Your personal data is processed for the following purposes in accordance with the general principles referred to above as well as the legal bases identified below:

• management of the waitlist and communication with waitlist registrants regarding product updates,
• operation and maintenance of the Website,
• conducting storage and archive activities,
• execution of communication activities,
• execution of activities in compliance with legislation,
• execution/auditing of business activities,
• execution of information security processes,
• conducting audit/ethical activities,
• conducting activities to ensure business continuity,
• compliance with legislation and protection of persons’ rights, privacy and safety,
• providing information to authorized persons, institutions and organizations,
• prevention of crimes and other illegal acts,
• analysing Website usage to understand visitor preferences and improve the Website experience,

Additionally, if you give us explicit consent by joining the waitlist, your e-mail address may be used to send you product updates, launch announcements, and related communications. You may withdraw your consent at any time by using the unsubscribe link in any such communication or by contacting us.

Besides, the purposes of processing personal data may be updated in line with our obligations arising from our Company policies and legislation; in particular,

• Carrying out strategic planning activities,
• Following up on requests and complaints.

b) Purpose of Processing and Legal Basis

In addition to the above purposes, the following personal data may be processed based on your explicit consent.

• If you give us explicit consent (by joining the waitlist and consenting to receive communications), your e-mail address may be processed for communicating with you to send information about product updates, launch announcements, and related communications. You may withdraw your consent at any time by using the unsubscribe link in any such communication or by contacting us.

4. Third Party Websites/Applications, Cookies and Notifications

The Website may contain links to other websites or apps that are unknown to the Company and whose content is not controlled. These linked websites or apps may contain terms and conditions other than the Company texts. The Company cannot be held responsible for the use or disclosure of information that these websites or apps may process. Likewise, the Company shall not have any responsibility for any links from other sites or apps provided to the Website.

We collect information by fair and lawful means, with your knowledge and consent. We also let you know why we’re collecting it and how it will be used. You are free to refuse our request for this information, with the understanding that we may be unable to provide you with some of your desired services without it.

While using the Website, you may provide information through third party websites and apps to the Company. Please be aware that your liability and obligations against third party apps or websites will continue and the Company shall not be held responsible for any terms, conditions, rules or policies determined by third parties.

Cookies

Cookies are little text files that are stored on the browser or hard drive of your computer or mobile device when you visit a webpage.  Cookies allow a website to run more efficiently in addition to ensuring the presentation of personalized web pages in order to make you live a faster visit experience which is more fit for your specific personal needs and demands. Containing only data on your website visit history via the internet, cookies do not collect any information, including your personal data/files stored on your computer or mobile device. We may use cookies when it is necessary for operating the Website, to enhance Website performance and functionality, and to analyse how visitors interact with the Website. You can delete cookies which are already present on your computer and prevent the recording/location of cookies on your internet explorer.

Internet browsers are predefined to automatically accept the cookies as default. As the management of cookies varies from browser to browser, you may look at the help menu of the browser or application to get detailed information. For more information about the cookies we use, please refer to our Cookie Policy.

Push Notifications

The Company may occasionally send you notifications via the Website or e-mail regarding product updates or other communications about our Services. You can always opt out of such communications by using the unsubscribe link provided or by contacting us.

5. Data Storage

Your data will be stored for the duration specified in the applicable legislation or for a reasonable time until the purpose of processing ceases to exist, or during legal periods of limitation. In particular:

• Waitlist records: Until the product launches and we have contacted you, until you unsubscribe, or 24 months from collection, whichever occurs first.
• Usage and marketing data: 14 months, after which it is deleted or anonymised.
• If the product concept is discontinued: The waitlist is deleted and, where we hold your e-mail address, we inform you that this has been done.

The Company may continue to store your personal data after the expiry of the purpose of its use provided that this is required by other laws or by a separate consent granted by you. Such data shall be deleted, destroyed or anonymised upon the expiry of such additional time or once the purpose of processing no longer exists. Upon withdrawal of your consent, your personal data shall be deleted within thirty (30) days, unless retention is required by applicable law.

6. Technical and Administrative Measures

The Company stores the personal data it processes in accordance with relevant legislation for periods stipulated in relevant legislation or required for the purpose of processing. The Company undertakes to take all necessary technical and administrative measures and to take the due care to ensure the confidentiality, integrity and security of personal data. In this context, it takes the necessary measures to prevent unlawful processing of personal data, unauthorized access to data, unlawful disclosure, modification or destruction of data.

Accordingly, the Company takes the following technical and administrative measures, as applicable and proportionate to the nature and scope of the data processing activities, regarding the personal data it processes:

Anti-virus application. On all computers and servers in the Company's information technology infrastructure, a periodically updated anti-virus application is installed.

Firewall. The data center and disaster recovery centers hosting the Company servers are protected by periodically updated software-loaded firewalls; the relevant next generation firewalls control the internet connections of all staff and provide protection against viruses and similar threats during this control.

VPN. Suppliers can access the Company servers or systems through SSL-VPN defined on Firewalls. A separate SSL-VPN identification has been made for each supplier; with the identification made, the supplier only provides access to the systems that it should use or is authorized to use.

User identifications. The Company employees' authorization to the Company systems is limited only to the extent necessary by job descriptions; in case of any change of authority or duty, systemic authorizations are also updated.

Information security threat and event management. Events that occur on the Company servers and firewalls, are transferred to the “Information Security Threat and Event Management” system. This system alerts the responsible staff when a security threat occurs and allows them to respond immediately to the threat.

Encryption. Sensitive data is stored with cryptographic methods and if required, transferred through environments encrypted with cryptographic methods and cryptographic keys are stored in secure and various environments.

Logging. All transaction records regarding sensitive data are securely logged.

Two-factor authentication. Remote access to sensitive data and registration/creation of an account is allowed through at least two-factor authentication.

Penetration test. Periodically, penetration tests are performed on servers in the Company system. The security gaps created as a result of this test are closed and a verification test is performed to show that the relevant security gaps have been closed. Besides, the Information Security Threat and Event Management System automatically performs penetration tests. Test results are recorded.

Information Security Management System (ISMS). At the ISMS meetings made within the Company, the topics contained in the control forum are audited monthly by the director of information technology and the director of financial operations.

Training. In order to increase the awareness of the Company employees against various information security violations and to minimize the impact of the human factor in information violation incidents, training is provided to employees at regular intervals.

Physical data security. It ensures that personal data on papers is necessarily stored in lockers and accessed only by authorized persons. Adequate security measures (for situations such as electric leakage, fire, deluge, thievery etc.) are taken based on the nature of the environment where sensitive data is stored.

Backup. Company periodically backs up the data it stores. As a backup mechanism, it uses the backup facilities provided by the cloud infrastructure providers, as well as the backup solutions it develops when deemed necessary, provided that it is in compliance with relevant legislation and provisions of this Policy.

Non-disclosure agreement. Non-disclosure agreements are concluded with employees taking part in sensitive personal data processing.

Transfer of sensitive personal data. If transfer of sensitive personal data is required through email; such transfer is done through (i) encrypted corporate email or (ii) Registered Email.

In the event that the personal data is damaged as a result of attacks on the Website or on the Company system, despite the Company taking the necessary information security measures, or the personal data is obtained by unauthorized third parties, the Company notifies this situation to Users immediately and, if necessary, to relevant data protection authority and takes necessary measures.

7. Age Limitation

We do not permit the use of the Website or our Services by children under the age of 16.

We do not knowingly collect or process personal data from anyone under the age of 16. If you learn that someone under the age of 16 has provided us with personal information, please contact us via email.

Users under 18 must have permission from their parents or legal guardians to use the Website or our Services.

8. Transferring Personal Data to Third Parties

The procedures and principles to be applied for transferring of personal data are regulated in articles 8 and 9 of the PDP Law, and your personal data may be transferred to third parties within the country or abroad since we may use servers and cloud systems located abroad.

We implement the following mechanisms to ensure your data is transferred abroad securely and in accordance with applicable data protection laws:

• We rely on the Standard Contractual Clauses as issued by the Turkish Data Protection Authority pursuant to Article 9/4)(c) of the PDP Law.

Your following personal data may be transferred abroad to our service providers on the legal bases explained above (Section 3.b.) and in the respective Standard Contractual Clauses, for the following purposes:

• Your Technical Information and Waitlist Information for the purpose of conducting storage and archive activities (including cloud services and database services) that are required to maintain our operations.
• Your Technical Information for the purposes of maintaining, troubleshooting, and improving the Website's technical infrastructure.

The Company may share Technical Information with analytics service providers for the purpose of analysing Website usage and improving the Website experience.

We may have to share personal information with authorized public institutions and organizations, and judiciary bodies for the purpose of complying with our legal obligations and requirements on the legal basis that it is necessary in order to fulfill our legal obligation.

For individuals in the European Economic Area, the United Kingdom, and Switzerland, please scroll down to Section 11. For individuals in California please scroll down to Section 12.

9. Your Rights as the Data Subject

Pursuant to Article 11 of the PDP Law, you may request from the Company the exercise of the following rights regarding your personal data:

• Learn whether or not your personal data have been processed.
• Demand for information as to if your personal data have been processed.
• Learn the purpose of the processing of personal data and whether data are used in accordance with their purpose.
• Know the third parties in the country or abroad to whom your personal data have been transferred.
• In case the personal data is processed incompletely or inaccurately, request notification of the transactions made under this scope to third parties to whom personal data have been transferred.
• Request deletion, destruction or anonymization of personal data if the reasons for the processing have disappeared and request notification of the transactions made under this scope to third parties to whom personal data have been transferred.
• Object to the occurrence of any result that is to your detriment by means of the analysis of personal data exclusively through automated systems.
• Request compensation for the damages in case you incur damages due to unlawful processing of your personal data.
• Right to withdraw explicit consent from processing data based on explicit consent at any time.

In the request where you outline your rights as a data subject and specify the rights you wish to exercise, your request must be clear and understandable. If your request pertains to your own personal data or if you are acting on behalf of another individual, you must be specifically authorized to do so, and such authorization must be properly documented. Additionally, the application must include your identity and address details, and supporting documents verifying your identity must be attached.

Our Company will enable you to file such requests via email. In accordance with Article 13 of the PDP Law, our Company will finalize your requests, free of charge, within 30 (thirty) days at the latest, depending on the nature of the request. In case the request is rejected, the reason or reasons for the rejection will be notified in writing or electronically along with its justification.

For individuals in the European Economic Area, the United Kingdom, and Switzerland, please scroll down to Section 11. For individuals in California please scroll down to Section 12.

10. Contact Information

If you have any questions or comments regarding this Privacy Policy that is not covered here or if you have any request or would like to exercise your rights, you may contact us via the following email address or by post at the following Company address:

11. For Individuals in the European Economic Area, the United Kingdom, and Switzerland:

Where General Data Protection Regulation (GDPR), the UK Data Protection Act, or the Swiss Federal Act on Data Protection is applicable, for a complete understanding of our data practices, please read this privacy notice together with our Privacy Policy outline above.

Purposes of Processing Personal Data and Legal Bases

Your personal data may be processed for the following purposes on the following legal bases.

In addition to the above purposes, we will only process the following personal data with your consent. You may withdraw your consent at any time by contacting us via email or by using the unsubscribe link in any communication. Withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal.

• If you give us consent (by joining the waitlist and consenting to receive communications), your Waitlist Information (e-mail address) may be processed for communicating with you to send information about product updates, launch announcements, and related communications. You can withdraw your consent by clicking on the "unsubscribe" link in the e-mail that is sent to you or by contacting us.

Transferring Personal Data to Third Parties

We implement the following mechanisms to ensure compliance with applicable data protection laws when transferring Personal Data outside the European Economic Area (EEA), Switzerland, or the United Kingdom (UK):

• Adequacy Decisions: We rely on adequacy decisions issued by the European Commission in accordance with Article 45(1) of the GDPR, when transferring Personal Data to countries that have been deemed to provide an adequate level of data protection. You can find the current list of adequate countries here.
• Standard Contractual Clauses (SCCs) & Supplementary Measures: For transfers to jurisdictions not covered by an adequacy decision, we implement the Standard Contractual Clauses as adopted by the European Commission under Article 46(2)(c) of the GDPR. We also apply additional safeguards where necessary, such as:
• Encryption of personal data in transit & at rest,
• Data minimization & anonymization where possible,
• Technical access controls to limit third-party access,
• Ongoing Transfer Impact Assessments (TIA) to monitor local laws.
• Binding Corporate Rules (BCRs): Where applicable, we rely on Binding Corporate Rules (BCRs) as approved by the competent supervisory authority in accordance with Article 46(2)(b) and Article 47 of the GDPR.

Your following personal data may be transferred abroad to our service providers on the legal bases explained above for the following purposes:

• Your Technical Information and Waitlist Information for the purpose of conducting storage and archive activities (including cloud services and database services) that are required to maintain our operations.
• Your Technical Information for the purposes of maintaining, troubleshooting, and improving the Website's technical infrastructure.

The Company may share Technical Information with analytics service providers for the purpose of analysing Website usage and improving the Website experience.

We may have to share personal information with authorized public institutions and organizations, and judiciary bodies for the purpose of complying with our legal obligations and requirements on the legal basis that it is necessary in order to fulfill our legal obligation.

Your Rights Regarding Data Transfers

• You have the right to request a copy of the safeguards applied (e.g., SCCs, BCRs) by contacting us via email.
• If you believe your data has been transferred unlawfully, you can lodge a complaint with your local data protection authority or the European Data Protection Supervisor (EDPS).

Your rights as the Data Subject

Under the GDPR, you have the following rights:

• Right of Access (Article 15 GDPR) – You can request a copy of your personal data and details on how we process it.
• Right to Rectification (Article 16 GDPR) - To request the rectification of information that you believe is inaccurate or the completion of information that you believe is incomplete by the Company.
• Right to Erasure (Article 17 GDPR, “Right to be Forgotten”) – You can request deletion of your personal data, except when we are required to retain it for legal obligations, public interest, or legal claims.
• Right to Restriction of Processing (Article 18 GDPR) – To request the restriction of the processing of personal data under the conditions stipulated in the GDPR.
• Right to Data Portability (Article 20 GDPR) – You can request a copy of your data in a structured, commonly used, machine-readable format such as CSV or JSON, or request direct transfer to another provider where technically feasible.
• Right to Object (Article 21 GDPR) – You can object to processing based on legitimate interests. If you object to direct marketing, we will stop processing immediately. For other objections, we will assess whether our legitimate interests override your rights.
• Automated Decision-Making and Profiling (Article 22 GDPR) – We do not currently make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. If this changes in the future, you will have the right to request human intervention, express your views, and contest the decision.
• Right to Withdraw Consent (Article 7(3) GDPR) – If we process your data based on consent, you can withdraw it at any time. This does not affect prior processing.

You may exercise these rights by submitting your request via email. We will respond to your request within one month, as required under GDPR. If your request is complex, we may extend this by an additional two months, in which case we will notify you.

If you believe that we or someone with whom we have transferred your data is violating your rights, you can file a complaint to the local data protection authority in your country (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) and to other competent supervisory authorities. For any unresolved complaints relating to the UK you can reach out to the Information Commissioner's Office (https://ico.org.uk/) and for Switzerland, to the Federal Data Protection and Information Commissioner⁠ (https://www.edoeb.admin.ch/en).

12. For California Residents

For a complete understanding of our data practices, please read this privacy disclosure together with our Privacy Policy outline above.

Your rights

If you are a California resident, you have certain rights. These include the right to know what personal information we collect, use, disclose, and sell; the right to request deletion of your personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of your personal information; and the right to limit the use and disclosure of sensitive personal information; and right to non-discrimination. We do not sell your personal information in the traditional sense, but we may share usage data with third-party service providers for analytics and functionality purposes. We do not collect sensitive personal information (please refer to Section 2 for more information). To exercise any of these rights, or to designate an authorized agent to make a request on your behalf, please contact us via email. We will not discriminate against you for exercising any of your privacy rights.

We may verify your identity before responding to your request to protect your privacy and security.

We are committed to complying with all applicable laws and we endeavour to ensure that our practices respect users' privacy rights.

Disclosure regarding the collection of personal data

We may collect the following categories of personal information: identifiers (e.g., e-mail address, IP address, session ID); device information (e.g., device type); and network activity information (information about how visitors interact with our Website, such as pages viewed, scroll depth, and buttons clicked).

Please refer to the Section 2 above for a complete description of what information we collect and how we collect it. Please refer to the Section 3 above for which purposes we use your personal information.

Disclosure regarding the use of third-party tools

We may use third-party analytics tools (such as Google Analytics or similar web analytics services) to understand Website usage and improve performance. These tools may collect information such as device type, session identifiers, and page interaction data.

Under California law, the use of certain analytics tools may be considered a “sale” or “sharing” of personal information. We do not sell your personal information for monetary compensation. We may share limited Technical Information with analytics providers for the purpose of improving the Website experience.

California residents may opt out of any such sharing by contacting us.

Please refer to Section 8 for more information.

Retention of Personal Information

Please refer to Section 5 for how long we retain your personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will state the date at the top of this Policy.  

If we make material changes (changes that significantly affect your rights or the way we handle your data), we will provide you with prominent notice before the changes take effect. This notice may be provided through the Website interface (e.g., a pop-up notification), by sending an email to the address associated with your waitlist registration (if applicable), or through other reasonable means appropriate to the circumstances.

We encourage you to review this Privacy Policy periodically. Your continued use of the Website after the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated terms, unless applicable law requires a different form of acceptance (such as explicit consent for certain types of changes).