Privacy Policy

lulo ("we", "us", "our") respects your privacy. This policy explains what information we collect through luloai.com, how we use it, and the rights you have over your data.

1. Who We Are

lulo is an independent AI and machine learning consulting practice based in Germany, founded by Sara Ortiz Drada and Yesid Leonardo López Sierra. We work with clients in Europe and Latin America, including Colombia.

For questions about this policy or to exercise your rights, contact us at saradrada@luloai.com or yesidlopez@luloai.com.

2. Information We Collect

We only collect personal data that you choose to send us through our contact form. This includes:

• Name
• Email address
• Company name (optional)
• Service of interest, timeline and budget range
• Any message you write in the free-text fields

We do not require an account, and we do not knowingly collect special-category data (health, biometric, political opinions, etc.).

3. How We Use Your Information

We use the information you submit solely to:

• Reply to your inquiry and discuss a possible engagement
• Keep a record of business communications
• Comply with legal or tax obligations where applicable

4. Legal Basis for Processing (GDPR)

Under Articles 6(1)(b) and 6(1)(f) of the General Data Protection Regulation, we process your data on the basis of:

• Steps taken at your request prior to entering into a contract
• Our legitimate interest in operating and improving our business website

5. Analytics

We use a self-hosted instance of Umami to understand how visitors use our site. Umami is privacy-friendly: it does not set cookies, does not store personal data, and the metrics we see are aggregated and anonymized.

6. Sharing and Disclosure

We do not sell your personal data. We do not share it for advertising or marketing purposes. We may disclose information only when required by law or to protect our legal rights.

7. Data Retention

We keep contact-form submissions for as long as is necessary to respond to your inquiry and, where a business relationship begins, for the period required by applicable accounting and commercial law (typically up to 10 years in Germany). After that, we delete or anonymize the data.

8. Your Rights

If you are in the European Economic Area, the United Kingdom, Colombia, or another jurisdiction with comparable data protection laws, you have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Object to or restrict our processing of your data
• Request portability of the data you provided
• Lodge a complaint with a supervisory authority (in Germany, the Berliner Beauftragte für Datenschutz und Informationsfreiheit; in Colombia, the Superintendencia de Industria y Comercio)

To exercise any of these rights, email us at the addresses listed below.

9. International Transfers

Our infrastructure is hosted in the European Union. If we need to transfer data outside the EEA — for example, when corresponding with clients in Colombia — we rely on adequacy decisions or the Standard Contractual Clauses adopted by the European Commission.

10. Children's Privacy

Our services are aimed at businesses. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. The current version, with its effective date, is always available on this page.

12. Contact

For privacy questions or to exercise your rights, write to: