Klaviero
Last updated: 20 July 2026
This Privacy Policy explains how La Lumière Consulting SRL processes personal data in connection with the Klaviero application and website (the "Service"). It is provided in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Belgian law.
The controller responsible for the processing of your personal data is:
La Lumière Consulting SRL
Avenue Louise 323, 1050 Ixelles, Belgium
Enterprise number (BCE/KBO): 0762.735.942
VAT number: BE 0762.735.942
Email: frederic@lalumiereconsulting.be
We have not appointed a Data Protection Officer, as our processing does not meet the criteria of Article 37(1) GDPR. You may contact us at the address above for any question relating to this Policy.
We process the following categories of personal data for the purposes and on the legal bases set out below.
| Category | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Email address | To create and administer your account and to send account and billing communications. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Username and, if provided, avatar image | To identify you within the Service and on leaderboards you take part in. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Password (stored only as a bcrypt hash) | To authenticate you. We do not have access to your password. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Google account identifier | To authenticate you where you choose to sign in with Google. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Gameplay data (scores, accuracy, streaks, experience points, pieces played, friend connections) | To provide practice tracking, progress, rankings and leaderboards. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Payment and invoice data | To take payment and issue invoices. This data is processed by Stripe (see Section 4). | Performance of a contract, Art. 6(1)(b), and compliance with a legal obligation, Art. 6(1)(c). | 10 years, as required by Article 60 of the Belgian VAT Code. |
| IP address | To apply rate limiting to sign-in and registration and to maintain the security of the Service. | Legitimate interests, Art. 6(1)(f), namely network and information security. | Processed transiently; not retained beyond the request. |
We do not use advertising, tracking or analytics technologies, we do not carry out profiling, and we do not sell personal data.
The Service uses only storage that is strictly necessary to provide the functionality you request, such as a login session token and locally stored settings and progress. No consent is required for this storage under Article 5(3) of the ePrivacy Directive. Details are set out in our Cookie and Storage Policy.
We disclose personal data to the following recipients:
Your account and gameplay data are stored on servers located within the European Union, and no transfer outside the EU takes place for that data. Where Stripe or Google process data in the United States, such transfers are made under the European Commission's adequacy decision of 10 July 2023 concerning the EU-US Data Privacy Framework, to which those recipients are certified, and under the European Commission's Standard Contractual Clauses as a further safeguard. A copy of the relevant safeguards is available on request.
We retain personal data for as long as your account remains active. When your account is deleted, the associated personal data is erased or anonymised, except for invoice and accounting records, which we are required to retain for 10 years under Article 60 of the Belgian VAT Code.
Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, and to receive it in a portable format. You may exercise the principal rights within the Service:
If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
The Service is not directed at young children. Our processing of account and gameplay data is based on the performance of our contract with you and on our legitimate interest in security, and is not based on consent. In Belgium the age at which a child may consent to information society services is 13; a child below that age should use the Service only with the involvement of a parent or guardian. Only a person aged 18 or over may enter into a paid plan. If you believe that a child has provided us with personal data without the involvement of a parent or guardian, please contact us and we will delete it.
We apply appropriate technical and organisational measures to protect personal data, including the hashing of passwords, encryption of connections in transit, session expiry and access controls. No method of storage or transmission is entirely secure. We will notify affected individuals and the competent supervisory authority of any personal data breach where required under Articles 33 and 34 GDPR.
We may update this Policy from time to time. The date at the top of this page indicates when it was last revised. Where a change materially affects your rights, we will inform you within the Service or by email.
Questions about this Policy may be sent to frederic@lalumiereconsulting.be.