Privacy Policy

Lumineer, the professional practice of Aneta Kosinska is the organisation accountable for the personal information described here. In Canadian law it is the organisation under the Personal Information Protection and Electronic Documents Act (PIPEDA). Where the General Data Protection Regulation applies, it is the controller.

Aneta Kosinska, Privacy Officer is the individual accountable for this policy and for answering requests about it, as PIPEDA’s first principle requires. Contact details are at the foot of this page.

The practice is a single-practitioner consultancy. There is no marketing department and no data broker relationship. In practice, the person reading your enquiry is the person who wrote this policy.

This policy covers this website, the forms and free tools on it, the email you receive from the practice, and the administration of paid engagements — the Business Momentum Sprint, the e-book and the monthly room.

It does not cover:

• Anything you tell a third-party platform directly, such as LinkedIn or Instagram. Their own policies govern that.
• Confidential material discussed inside a paid engagement, which is governed by the engagement agreement and the confidentiality terms in the purchase and engagement terms. Those terms are stricter than this policy, not looser.

Only what is needed for the stated purpose, which is PIPEDA’s fourth principle and the GDPR’s minimisation requirement. There is no field on this website that exists to profile you.

Sensitive information

The enquiry form and the Sprint invite you to describe what is not working. People sometimes volunteer information about health, stress, burnout or personal circumstances in that answer. None of it is requested, none of it is required, and it is never used to make a decision about you beyond deciding whether the work would help.

If the GDPR applies to you, any special category information in a free text answer is processed only on the basis of your explicit consent, given by choosing to write it. You are welcome to keep your answer to the business facts and to raise anything personal on the call instead.

Almost all of it comes from you, directly. The exceptions are:

• Your email provider, which reports whether a message was delivered, opened or clicked.
• Your browser and network, which necessarily reveal an IP address and request headers in order to load a page at all.
• A person who refers you, where a client or contact passes on your name and email so an introduction can be made. If that happens and you would rather not be contacted, say so and the record is deleted.

Nothing is bought from a list broker, scraped, or enriched from a third-party data provider.

Where consent is the basis, it is asked for at the point of collection and never bundled into something else. Submitting the enquiry form is consent to be replied to. Asking for the written read of your Momentum Score is consent to be sent it. Neither is consent to be added to a marketing list without a separate, obvious opt-in.

You may withdraw consent at any time, subject only to legal or contractual limits — an invoice cannot be unissued, and tax records must be kept. Write to aneta@lumineer.partners or use the unsubscribe link in any email. Withdrawal takes effect promptly and does not affect the lawfulness of what came before it.

Canada’s Anti-Spam Legislation (CASL) governs commercial electronic messages sent from Canada. It is stricter than the rules in most countries, and the practice follows it for everyone rather than keeping two standards.

That means:

• Every commercial message identifies the sender, gives a mailing address, and carries a working unsubscribe link that is honoured within ten business days — in practice, immediately.
• Express consent is obtained before marketing email is sent, and a record of when and how it was given is kept.
• Implied consent is relied on only where CASL allows it, such as an existing business relationship, and only for the period the statute permits.
• Transactional messages — a reply to your enquiry, your Momentum Score, a booking confirmation, an invoice, the e-book download — are not marketing and are sent because you asked for them.

Unsubscribing from marketing does not stop transactional messages about something you have actually bought or requested.

The Business Momentum Score is calculated by a formula, with no human involvement at the moment it is produced. Transparency about how it works matters more than mystique, so:

• Your eighteen answers are scored across six dimensions. Each dimension is weighted; direction and inner load count for slightly more than the others because they sit upstream of the rest.
• The score is recalculated on the server from your raw answers, so the number cannot be forged by editing the page.
• Your result travels in the page address. That is what lets you bookmark or forward it — and it means anyone you send the link to can see the same result. Treat the link as you would the result.
• If you do not ask for the written read, your answers are not stored at all. They are scored in the request and discarded.

The score has no legal or comparable significant effect on you. It does not price anything, decide whether you can buy anything, or feed a credit, employment or insurance decision. For GDPR purposes it is not automated decision-making of the kind Article 22 restricts. You can still ask for a human read of your result — that is what the call is for.

The practice runs on a small number of established services. Each is bound by a written data processing agreement, may use your information only to provide the service, and may not use it for their own purposes.

Payment information

Card numbers are never received, seen or stored by the practice or by this website. Card data is collected directly by the payment provider on their own infrastructure, which is certified to PCI DSS. What comes back is a confirmation and the last four digits.

Other disclosures

Your information may also be disclosed where the law requires it — a court order, a lawful demand from a regulator, or a tax audit — and to professional advisers such as an accountant or lawyer under a duty of confidence. If the practice were ever sold or reorganised, records could transfer to the successor, who would be bound by this policy or by terms no less protective.

The practice is in Toronto and its clients are international, so some information is processed outside Canada. The table above names where.

PIPEDA permits transfers for processing provided the information receives a comparable level of protection by contract, and provided you are told it happens — which is the purpose of this section. It also means that while your information is in another country, the courts and law enforcement of that country may be able to compel access to it under their own law. That is true of any organisation using international infrastructure, and it is stated here plainly rather than buried.

Where the GDPR applies, transfers outside the EEA or the UK rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision — including the Commission’s finding that Canada offers adequate protection for commercial organisations. A copy of the clauses relied on for any given service is available on request.

Information is kept only as long as the purpose requires, or as long as the law demands, and then deleted. The schedule is:

Where you unsubscribe or ask to be deleted, a minimal suppression record — effectively your email address and the fact you asked — is kept indefinitely. That is deliberate: it is the only way to guarantee you are not contacted again, and keeping it is a legitimate interest recognised under both PIPEDA and the GDPR.

Safeguards are proportionate to the sensitivity of the information, as PIPEDA’s seventh principle requires. Concretely:

• The whole site is served over TLS. Form submissions are encrypted in transit.
• API credentials are held as server-side environment variables and are never included in anything sent to your browser.
• No payment card data is handled, so none can be lost.
• Forms are rate limited and carry a hidden honeypot field to blunt automated abuse. IP addresses used for rate limiting stay in memory and are never written to a database.
• Accounts on the underlying services use unique credentials and multi-factor authentication where the service supports it.
• Access is limited to the practitioner and, where strictly necessary, a contracted developer under a confidentiality obligation.

No safeguard is perfect and nobody honest claims otherwise. What is promised is a proportionate standard of care, prompt action if something goes wrong, and the notifications described below.

This website sets no cookies of its own unless you allow traffic measurement, stores nothing in your browser’s local storage beyond the record of that choice, and runs no advertising or social tracking pixels. The typeface is served from this domain rather than from a font network, so loading a page does not tell a third party that you did.

Two embedded third parties can set their own cookies once you interact with them, and traffic measurement runs only where you allow it. All of it is set out in the cookie policy, including what will change and what consent will be asked for before it does.

Two things qualify that, and both are set out below in full: an embedded booking calendar and a checkout on another domain can set their own cookies once you interact with them, and two further tools are planned.

A cookie is a small file a website asks your browser to keep and hand back on the next request. It is how a site recognises a returning visitor.

The law in this area is not really about cookies as a file format. It covers any technology that stores information on your device or reads information already there — local storage, session storage, pixels and clear GIFs, software development kits, and device fingerprinting. Everything in that list is treated the same way in this policy, and the honest position for each is the same: none of it is used by this site.

Three specifics, because “we respect your privacy” is not information:

• The typeface is served from this domain. It is downloaded at build time and delivered with the site, so loading a page does not tell a font network that you visited.
• The Momentum Score keeps nothing on your device. Your answers and your result live in the page address itself. That is what lets you bookmark or forward the result — and it is why closing the tab loses it, because there is no cookie remembering you.
• Nothing remembers you between visits unless you allow it. There is no login and no basket. Decline traffic measurement and a second visit is indistinguishable from a first.

Your IP address is necessarily visible to the server in order to send a page back to you, and is used briefly to rate limit the forms against automated abuse. That is not storage on your device and is covered in the privacy policy.

These are not controlled by this practice. Where a cookie is set, it is set by them, under their policy, and they are the ones who can read it.

If you never open the booking calendar and never click through to the checkout, none of the above happens.

One tool is intended and is not in place yet. It is named here in advance so this page is never behind the site.

You do not have to take anyone’s word for this. Open your browser’s developer tools, look at the Application or Storage panel, and read what is actually there while you browse this site.

Every major browser lets you block or delete cookies, block third-party cookies specifically, and run a private window that discards everything on close. Those controls are in your browser’s privacy settings.

Blocking third-party cookies will not break anything on this site. It may affect the embedded booking calendar, in which case you can book directly on Cal.com or simply email aneta@lumineer.partners and arrange a time that way.

Some browsers send a Do Not Track header or a Global Privacy Control signal. Because this site does not track you across sites and does not sell or share personal information, there is nothing for either signal to switch off — the outcome they ask for is already the default.

If cookie-based analytics is ever introduced, a Global Privacy Control signal will be treated as a valid refusal of consent without your having to interact with a banner at all.

This page is updated whenever a tool is added or removed, and before a new one starts operating rather than after. The date at the top is the date of the last substantive change.

It sits alongside the privacy policy, which covers everything that happens to information once it reaches the practice.

Under PIPEDA you may:

• Ask what is held about you, how it is used and to whom it has been disclosed, and receive a copy.
• Correct it where it is inaccurate or incomplete.
• Withdraw consent, subject to legal and contractual limits.
• Challenge how the practice handles it, and receive a substantive answer.

Requests are answered within 30 days, which is the statutory limit. There is no charge. Enough information will be asked for to be confident you are who you say you are, and no more. In the narrow cases where access must be refused — for example where granting it would reveal personal information about somebody else — the reason and your right to complain will be given in writing.

The practice takes clients in Europe, so the GDPR and the UK GDPR apply to those relationships. If you are in the EEA, the UK or Switzerland you additionally have the right to:

• Access your information and receive a copy of it.
• Have inaccurate information rectified.
• Have it erased, where there is no overriding reason to keep it.
• Restrict processing while a dispute about it is resolved.
• Receive it in a portable, machine-readable form, and have it sent elsewhere.
• Object to processing based on legitimate interests, and to direct marketing at any time and absolutely.
• Withdraw consent at any time.
• Lodge a complaint with your supervisory authority.

Where legitimate interests are relied on, the interest is the ordinary operation of a professional practice — answering enquiries, keeping the site secure, and understanding in aggregate what people read. A balancing assessment has been carried out in each case and is available on request.

Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, gives you rights beyond PIPEDA, including a right to the de-indexing of information in defined circumstances and a right to be informed before personal information is used for automated decision-making.

Those rights are honoured for Quebec residents. The Momentum Score is the only automated processing on this site, and section 07 above explains what it does and does not decide. Documents are available in English only at present; if you would prefer to correspond in French, write and it will be arranged.

Several US states now give residents privacy rights, including California under the CCPA as amended by the CPRA, and Colorado, Connecticut, Virginia, Texas and others under comparable statutes. Where those laws apply you may request access to, correction of, deletion of, and a portable copy of your personal information, and you may appeal a refusal.

Two disclosures those statutes specifically require:

• Your personal information is not sold, and is not shared for cross-context behavioural advertising. There is therefore nothing to opt out of, and no “Do Not Sell or Share” link is required.
• You will not be discriminated against for exercising any of these rights. There is no different price or worse service for people who ask.

An authorised agent may make a request on your behalf with written proof of authority.

This is a business-to-business practice. Its services are directed at founders, owners and executives, and nothing on this site is intended for or marketed to children.

Personal information is not knowingly collected from anyone under 16. If you believe a child has submitted information, write and it will be deleted without delay.

Under PIPEDA, a breach of security safeguards that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and notified to the people affected as soon as feasible, and a record of every breach must be kept for two years. Those obligations are accepted and will be met.

Where the GDPR applies, notifiable breaches are reported to the lead supervisory authority within 72 hours of becoming aware of them, and to you without undue delay where the risk to you is high.

A notification will tell you what happened, what information was involved, what is being done about it, and what you can do to protect yourself. It will not be written to minimise the event.

Raise it directly first — write to Aneta Kosinska, Privacy Officer at aneta@lumineer.partners. You will get a substantive written answer, not an acknowledgement.

If the answer does not satisfy you, you can escalate:

• Canada: the Office of the Privacy Commissioner of Canada, at priv.gc.ca, which can investigate independently.
• Quebec: the Commission d’accès à l’information du Québec.
• EU: the data protection authority of the member state where you live or work.
• UK: the Information Commissioner’s Office, at ico.org.uk.

Going to a regulator does not cost you anything and does not affect any other legal remedy you have.

This policy will change as the practice and its tools change. The date at the top is the date of the last substantive change.

Where a change materially affects how your information is used — a new purpose, a new category of recipient, or a new tool that tracks you — you will be told before it takes effect, by email if you are on the list, and fresh consent will be sought where the law requires it. Material changes are not made quietly and backdated.