Privacy policy
Last updated: September 7, 2026
This policy explains what personal data we process when you use www.kayandleo.com, what we use it for, who we share it with and what rights you have. We have written it to be understood; if anything is unclear, write to us.
1. Data controller
- Controller: Luminary Global Media LLC
- Address: 1915 140th Ave NE #1664, Bellevue, WA 98005, United States
- EIN: 36-5172604
- Email for privacy matters: contact@luminaryglobalmedia.com
- Representative in the European Union (art. 27 GDPR): [REPRESENTANTE_UE]
We process your data in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and the LSSI-CE, as well as any legislation applicable in your country of residence.
2. Who this applies to
Anyone who visits the website, subscribes to the newsletter, downloads materials, buys in the shop or writes to us. Our services are addressed to adults; we do not knowingly collect children's data. See the Child protection page.
3. What data we process and where it comes from
All data is provided by you directly, except for technical browsing data, which is generated when you use the website.
| Situation | Data |
|---|---|
| Newsletter | Email address; optionally name, language and country. Date and form of subscription (double opt-in), email opens and clicks. |
| Downloading materials | An adult's email address; material downloaded. |
| Shop purchase | Full name, delivery and billing address, email, phone number (for the carrier), order placed, amount and purchase history. Payment details are collected directly by the payment gateway; we only receive the confirmation and the last digits or the method used. |
| Contact | Name, email and the content of the message. |
| Browsing | IP address, browser and device type, pages visited, date and time, technical server logs and strictly necessary cookies (see Cookie policy). |
| Content sent for publication | Photographs, reviews or comments, and the data they contain. |
We do not process special categories of data (health, ideology, etc.) and we ask you not to send them to us.
4. What we use the data for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Sending you the newsletter with news, activities and information about the series | Your consent (art. 6.1.a GDPR). You can withdraw it at any time. |
| Delivering the materials you download | Performance of the requested contract/service (art. 6.1.b). |
| Managing your order: payment, shipping, invoicing, returns and warranty | Performance of the contract (art. 6.1.b) and legal tax and accounting obligations (art. 6.1.c). |
| Answering your queries | Legitimate interest in assisting you (art. 6.1.f) or performance of the contract if they concern an order. |
| Sending you information about books similar to those you have bought | Legitimate interest in communications to customers about similar products (art. 21.2 LSSI-CE). You can object at any time. |
| Publishing the content you send us for that purpose | Your consent (art. 6.1.a). |
| Keeping the website secure and preventing fraud | Legitimate interest (art. 6.1.f). |
| Handling the exercise of rights and legal obligations | Legal obligation (art. 6.1.c). |
We do not make automated decisions with legal effects on you, nor do we build profiles beyond basic newsletter segmentation (for example, language or whether you have already bought).
5. How long we keep the data
- Newsletter: until you unsubscribe. After that, we keep your email on a suppression list so we never write to you again.
- Downloads: the email joins the newsletter only if you consent; otherwise it is deleted within 30 days.
- Purchases: for the duration of the contractual relationship and, afterwards, for the time required by tax and commercial law (in general, 6 years for accounting documentation in Spain) and the limitation period for actions arising from the contract.
- Queries: until resolved and, at most, 12 months afterwards.
- Technical logs: a maximum of 12 months, unless needed to investigate a security incident.
- Published content: until you withdraw your consent.
6. Who we share the data with
We do not sell your data. We only share it with providers we need in order to serve you, who act as processors under contract and following our instructions:
- Web hosting and domain: Vercel
- Newsletter platform: [PLATAFORMA_NEWSLETTER]
- Payment gateway: Stripe (acts as an independent controller with respect to payment data)
- Transport and logistics: [TRANSPORTISTA]
- Management, accounting and advisory tools of the company
We may also disclose data to public authorities when the law requires it, and to our legal advisers if necessary to defend our rights.
If you buy our books on Amazon or from another retailer, that retailer processes your data under its own policy; we do not receive your personal data from that purchase.
7. International transfers
Luminary Global Media LLC is established in the United States, so your data is processed outside the European Economic Area. Some of our providers may also be located in the United States or other countries.
For these transfers we apply the safeguards provided for in the GDPR: the EU–US Data Privacy Framework adequacy decision where the provider is certified, and otherwise the Standard Contractual Clauses approved by the European Commission, together with additional security measures. You can request a copy of the safeguards applied by writing to contact@luminaryglobalmedia.com.
8. Your rights
You can exercise the following rights at any time:
- Access: know what data of yours we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer necessary.
- Objection: object to processing based on legitimate interest, including receiving commercial communications.
- Restriction: ask us to suspend processing in certain cases.
- Portability: receive your data in a structured format to take it to another provider.
- Withdrawing consent: without affecting the lawfulness of prior processing.
To exercise them, write to contact@luminaryglobalmedia.com stating which right you want to exercise. If we have reasonable doubts about your identity, we may ask you to prove it. We will reply within one month at most, extendable by two further months in complex cases, and exercising your rights is free of charge.
If you believe we have not handled your rights correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or with the supervisory authority of your country of residence.
9. Minors
Our services are reserved for people aged 18 or over. We do not knowingly request or process children's data. If we detect that we have received a minor's data without the authorization of those responsible for them, we will delete it. More information under Child protection.
10. Security
We apply technical and organizational measures appropriate to the risk: encrypted connections (HTTPS), restricted access to data, strong passwords and reinforced authentication in our tools, backups and providers selected with guarantees. If we suffered a security breach posing a high risk to you, we would notify you as required by law.
11. Social media
When you interact with our social media profiles, each platform processes your data under its own policy, over which we have no control. We only see the public information of your profile and the messages you send us, and we use them to reply to you and manage the community.
12. Changes to this policy
We will update this policy when the law, our services or our providers change. We will publish the new version on this page with its date and, if the change is significant, we will notify you by email if you are subscribed.
13. Contact
Luminary Global Media LLC · contact@luminaryglobalmedia.com · 1915 140th Ave NE #1664, Bellevue, WA 98005, United States.