Privacy Policy

Lemorange Ltd ("Lemorange", "we", "us" or "our") is a company registered in Cyprus, based in Nicosia. We operate the website at lemorange.com, the client portal, the LemDesk remote desktop service, and related services (together, the "Services"). This policy explains how we collect, use, share and protect personal data when you use these Services, or contact us or our sales team.

We are the controller of the personal data described in this policy. This covers website visitors, people who contact us, client portal users, and our business contacts and customers.

Lemorange Attendance is covered separately. Lemorange Attendance is a workforce product that we provide to businesses. When a business uses Attendance, that business is the controller of the data of its staff and visitors, and we are its processor. The legal documents for Attendance are on attendance.cy:

• Privacy Notice: attendance.cy/privacy
• Terms of Use: attendance.cy/terms
• Data Processing Terms: attendance.cy/dpa
• List of sub-processors: attendance.cy/sub-processors
• Visitor notice: attendance.cy/visitor-privacy

If you are a worker or a visitor whose data is in Attendance, read the Attendance Privacy Notice, not this policy. This policy does not apply to that data, except where we say we are the controller of an enquiry or a business contact.

2.1 Information you provide

• Account registration. Name, email address, phone number and password when you create an account or accept a team invitation.
• Contact form and enquiries. Name, email, company, phone number, project type, budget range, timeline, technical requirements and any other details you choose to give. This includes enquiries about Lemorange Attendance that you send through lemorange.com or attendance.cy.
• Sales and demo requests. Your role, the size of your organisation, your current attendance method, the notes from our calls and emails with you, and quotations and orders.
• Portal usage. Support tickets, project files, documents (including collaborative editing content), chat messages and any attachments you upload.
• Payment information. When you pay invoices, your card details are collected and processed directly by Stripe. We do not store your full card number. We receive only a confirmation of payment, partial card details and transaction identifiers.
• Team management. Names, email addresses and roles of team members you invite to your company account.
• Video content. Videos uploaded by administrators for client viewing, with titles, descriptions and related metadata.
• Company information. Company name, email, logo and other organisational details you provide in setup or in your settings.

2.2 LemDesk remote desktop data

• Device registration. Device ID, host name, operating system and last-seen time for devices registered with LemDesk.
• Connection data. Session metadata such as connection times, duration and relay server use. Screen content, keyboard input and clipboard data sent during a remote session are streamed in real time and are not stored on our servers.
• Authentication. Sign-on tokens and session data used to authenticate your LemDesk connections with your Lemorange account.

2.3 Data collected automatically

• Authentication tokens. Encrypted tokens stored in secure, HTTP-only cookies to keep your session.
• Preferences. Dark mode and sidebar state, stored on your device.
• Push notification subscriptions. If you opt in to browser notifications, we store the subscription address and keys.
• Analytics data. Through Google Analytics, we collect information about how you use our website, such as pages visited, session length, referral source, approximate location (city level), device type and browser. IP addresses are anonymised. On attendance.cy, analytics run only after you allow them.
• Login activity. Time of your last login, and rate-limiting data (IP address with email) to prevent brute-force attacks. Rate-limiting data is short-lived and is not kept permanently.
• Contact form security data. The contact form on attendance.cy stores the submission time, the source page and a one-way hash of the IP address, not the address itself.

• Service delivery. To provide, run and maintain the client portal, project management, document collaboration, support, invoicing, chat, video sharing and LemDesk.
• Communication. To answer your enquiries, prepare quotations and demonstrations, send support updates, invoice notices, payment confirmations, ticket replies and team invitations.
• Sales. To follow up on enquiries and demonstration requests, and to keep a record of our business relationship. We send marketing messages only as the law allows.
• Payment processing. To collect invoice payments through Stripe and track payment status.
• Security. To authenticate users, enforce access controls, prevent fraud and unauthorised access, and apply rate limits.
• Administration. To manage accounts, company assignments, team roles and permissions.
• Support. Our administrators may access your account, including with an impersonation feature, to solve a reported problem. We do this only to give support.
• Record keeping. To keep company and contact information in our internal business systems.
• Content assistance. We may use AI services to help rewrite or draft content in the platform, only when an authorised user starts it.

• Performance of a contract, or steps before a contract at your request: account management, project delivery, quotations, invoicing and support.
• Legitimate interest: security monitoring, fraud prevention, improving our services, sales follow-up to business contacts, and internal administration, where these do not override your rights.
• Consent: for example browser notifications, optional analytics, and marketing messages where the law requires consent. You may withdraw consent at any time.
• Legal obligation: where the law requires us to process data.

We share data with these providers only as far as needed to deliver our services.

• Stripe (payments). Processes card payments for invoices. Stripe receives card details directly and is certified to PCI DSS Level 1. We receive payment confirmation, partial card identifiers and transaction details.
• SMTP2GO (email). Delivers service emails for us, such as invoices, ticket updates, payment confirmations and invitations. It receives recipient names, email addresses and message content.
• Hetzner (hosting). Hosts our servers in the European Union.
• Cloudflare (DNS and CDN). Provides domain name and content delivery services for our websites.
• Zoho Books (CRM and accounting). Used internally for accounting and client records. Company names and contact details may be synchronised. No portal documents or messages are shared with Zoho.
• Anthropic (AI services). Provides AI content assistance when an authorised user starts it. Fragments of content are sent for processing under Anthropic's data handling terms. Nothing is sent automatically.
• Google Analytics and Google Tag Manager. Help us understand how visitors use our websites. We do not use advertising features or Google signals. Google processes the data under its own privacy policy.
• Meta (WhatsApp Business). Used to message business contacts, where a contact has used WhatsApp to reach us or has agreed to it.

We do not sell, rent or trade your personal data. We do not use third-party advertising or remarketing services.

We use technical and organisational measures to protect your data, including:

• passwords hashed with a strong algorithm and never stored as plain text;
• authentication tokens in HTTP-only, secure cookies with strict same-site rules;
• TLS encryption for connections to our services in production;
• rate limiting of login attempts;
• role-based access controls;
• end-to-end encryption for LemDesk connections, with relay infrastructure that we host ourselves;
• checks of file type and size on upload;
• single-use OAuth codes that expire within 60 seconds.

No method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

Lemorange operates from offices in Cyprus (EU), the United Kingdom and China. Authorised staff in those places may be able to access personal data for the purposes in this policy, and may access Attendance customers' data for support and engineering, as the Attendance documents say. For the United Kingdom, we rely on the European Commission's adequacy decision. For China, we use the EU Standard Contractual Clauses (Decision 2021/914), a transfer impact assessment and supplementary measures: access only when there is a support need, logged access, least-privilege roles, encryption in transit and at rest, and no bulk export. Where data is transferred elsewhere outside the European Economic Area, we use appropriate safeguards such as standard contractual clauses, an adequacy decision or another mechanism recognised by the GDPR. Service providers such as Stripe, Anthropic, Google, Meta and Cloudflare may process data outside the EEA under their own transfer mechanisms.

• Account data. For as long as your account exists, and then for a reasonable time to meet legal and contract duties.
• Project and support data. For the client relationship and up to 7 years afterwards for records and legal compliance.
• Invoices and payment records. At least 7 years, as tax and accounting rules require.
• Chat messages. For the client relationship. We may delete them when the account ends.
• Contact form submissions and sales enquiries. Up to 2 years from submission, unless a business relationship starts.
• LemDesk device data. While the device stays linked to your account. Connection metadata for up to 12 months.
• Email logs. Up to 2 years for delivery tracking and dispute handling.

Under the GDPR and applicable law, you may ask us for:

• access to a copy of your personal data;
• rectification of inaccurate or incomplete data. You can update your name, email and phone number in your portal settings;
• erasure, subject to our legal retention duties. See our Data Deletion page for what we remove and what we must keep;
• restriction of processing in some cases;
• portability in a structured, commonly used, machine-readable format;
• objection to processing based on legitimate interests;
• withdrawal of consent, where processing is based on consent, without affecting what was done before.

To use these rights, write to [email protected]. We reply without undue delay and within one month. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy) or to the authority where you live or work.

If your data is in Lemorange Attendance, write to the organisation that uses Attendance for you. See the Attendance Privacy Notice.

Our Services are for business use and are not meant for people under 18. We do not knowingly collect personal data from children. If we learn that we have, we will delete it promptly.

We may update this policy to reflect changes in our practices, technology or the law. If a change is material, we will update the "Last updated" date at the top of this page and, where the law requires, tell you in another way.

If you have any questions about this Privacy Policy or our data practices, please contact us: