Privacy Policy

This policy explains how Luxio handles information in connection with the Luxio website, web applications, Luxio Atlas™, My Atlas, our professional workspaces, our mobile applications where available (including iOS and Android), and any other current or future Luxio interface or service (together, the “Services”), and in connection with the journeys and travel services we arrange and operate.

The organisation responsible for the information described in this policy is Luxio Inc., 8 The Green, Dover, Delaware 19901, United States (“Luxio”, “we”, “us”).

Information you give us

• Enquiries and conversations — your name, contact details, the nature of your enquiry, the organisation you represent where relevant, and the details you choose to share about an intended journey.
• Newsletter and communications — where you sign up for updates, the contact details you provide and your communication preferences.
• Account information — the details used to create and administer access to the Services, including identifiers, contact details and authentication data. Where the Services provide sign-in, authentication credentials are stored in a protected form and are not accessible to us in plain text.
• Profile information — the personal and travel preferences you choose to record.

Traveller and journey information

Where a journey is planned, arranged or operated, we handle the information necessary to deliver it. This may include traveller names and contact details; itinerary structure and timings; accommodation, room type and rooming arrangements; flights and other transport; transfers; experiences, reservations and events; and the confirmations, references and supplier records associated with them.

This may include travel reference information such as booking references, passenger name record (PNR) data, ticket numbers and supplier confirmations, where these form part of the arrangements.

Where you make arrangements for other people — companions, family members, colleagues or clients — you provide their information to us, and this policy applies to it. You are responsible for ensuring you are entitled to share it and that those individuals are informed of how it will be used.

Emergency contacts

Where an emergency contact is recorded for a traveller, we handle that person’s name, relationship and contact details for the purpose of contacting them in connection with that journey.

Special requirements

Where you tell us about dietary requirements, allergies, accessibility needs, mobility requirements or other assistance needed for a journey, we handle that information so the arrangements can be made and communicated to the providers who need to act on it.

Some of this information may reveal health or similar sensitive details. Where applicable law treats it as a special category of personal information, we handle it only where we have a valid basis to do so and, where required, on the basis of your explicit consent. You may choose not to provide it, but some arrangements may not then be possible or safe.

Children

Where a child travels as part of a journey, we handle the information necessary for those arrangements, including name, age or date of birth where a provider requires it, and any special requirements. That information is provided to us by the adult responsible for the booking, not by the child, and the Services are not directed to children.

Travel documents and identity information

Where a journey requires it, and where this capability is enabled, we may handle identity and travel document information such as passport or national identity document details, nationality, date of birth, visa information and, where a provider requires it, an image or scan of a document.

We collect this only where it is needed for the arrangements in question or to meet a legal or supplier requirement, and share it only with those who require it for that purpose.

Documents you provide

Where document upload or storage is enabled, we handle the files you or your agency add to a journey, together with the information contained in them. Where automated extraction is enabled, we may process a document’s contents to identify travel details such as dates, references and provider information, in order to populate the journey record. Extraction of this kind assists the journey record; it does not make decisions about you.

Payments

Where payment is enabled, payment is processed by a payment provider. We receive the information needed to identify and reconcile a transaction, such as confirmation of payment, the amount, and limited card identifiers such as the last digits and card type.

We do not receive or store complete payment card numbers. Card data is handled by the payment provider under its own terms and privacy policy.

Connectivity services

Where Luxio Connect or eSIM services are enabled, we handle the information needed to provision and support that service, which may include device compatibility information, activation identifiers, the plan and destination selected, and service status. Usage of the connectivity service itself is handled by the connectivity provider under its own terms.

Location, maps and mapping providers

When you open or activate a map feature, such as Luxio Map or another embedded map, map content, tiles, imagery or related mapping resources may be delivered by third-party mapping providers, and your browser or device connects to those providers directly as part of that. Those providers receive your IP address and technical request information as part of that connection, and may set their own cookies or identifiers, under their own privacy policies.

The mapping providers we currently use are:

• OpenFreeMap — provides the map background, including map tiles, place-name fonts and map symbols, for Luxio Map and the other interactive maps in the Services. When one of these maps loads, your browser requests those resources from OpenFreeMap, which receives your IP address, standard browser request information such as your browser type, the address of the Luxio website, and the map tiles requested, which reflect the area and zoom level you are viewing.
• Google Maps — provides the embedded location maps shown on some hotel, restaurant, experience and event pages and on places in My Atlas. When such a page displays its map, your browser loads it directly from Google, which receives your IP address, standard browser request information such as your browser type, the address of the Luxio website, and the coordinates of the place shown.

We do not send your name, contact details or account information to either provider, and these maps do not use your device location.

Where a feature uses your device location, it is requested through your browser or device and only with your permission, which you can withdraw at any time in your browser or device settings. Recording a place in a journey is not the same as tracking your location, and we do not continuously track the location of travellers through the Services.

Using Luxio Map may require you to accept our Terms of Use, as described in the Terms of Use. That acceptance is a condition of using the feature, separate from the cookie preferences described below, and does not itself change them.

Technical information

When you use the Services, we and our hosting and infrastructure providers process technical information generated by your browser or device, including IP address, browser and device characteristics, language, referring page, pages and resources requested, timestamps and error information, together with server and security logs.

Terms of Use acceptance

Where the Services present an explicit action to accept our Terms of Use — including to use Luxio Map, and as part of any future account, invitation or authenticated activation flow — we keep a record of that acceptance, consisting of the version of the terms accepted and the date and time of acceptance. Where acceptance is associated with an account, invitation or other authenticated identity, we also record the relevant account or invitation identifier.

For anonymous use of the public website and Luxio Map, that record is presently held only as state in a first-party cookie on your browser, which lets the Services recognise that you have already accepted the current version on that device. It is browser-state persistence for that purpose, not a definitive legal audit trail of acceptance. Where an authenticated flow requires acceptance, we intend to keep an additional server-side record linked to your account, invitation or other identifier, alongside the version and timestamp, providing a more durable, account-linked record for that context.

Cookies and similar technologies

We use cookies and similar technologies only where they are necessary to operate and secure the Services — for example, to operate core functionality, to support security and access, and, where the Services provide sign-in or you set preferences, to keep you signed in and remember them.

If we introduce cookies or similar technologies for analytics, measurement or marketing, we will describe them and, where required, obtain your consent before they are set. We do not use the Services for advertising or behavioural profiling. Content embedded from third parties, including mapping providers, may set its own cookies or identifiers as described above.

Your cookie preferences are independent from acceptance of our Terms of Use: accepting the Terms of Use, including to use Luxio Map, does not change your cookie preferences, and your cookie preferences do not affect whether the Terms of Use have been accepted. Once optional cookie categories exist, declining them will not prevent you from using the Services normally, except where a particular technology is strictly necessary to provide a specific feature you have asked to use, and you will be able to change your preference at any time through the Services.

We use information to:

• respond to enquiries and communicate with you;
• create and administer accounts, access and professional workspaces;
• plan, prepare, arrange, operate and support journeys and travel services;
• assemble and maintain the journey record in My Atlas and keep it current;
• communicate operational information before and during travel, including changes, timings and practical detail;
• pass to providers the information they need to deliver the arrangements;
• handle special requirements and safety-relevant needs;
• provide support and resolve issues, complaints and disputes;
• send newsletters and updates where you have asked to receive them, or where otherwise permitted, always with a way to opt out;
• operate, maintain, secure, troubleshoot and improve the Services;
• prevent, detect and investigate fraud, misuse and security incidents;
• keep business, financial and legal records; and
• comply with legal, regulatory and supplier obligations.

We do not use the information you provide for a materially different purpose without telling you first.

Where data protection law requires a legal basis for handling personal information, we rely on the basis appropriate to the purpose. Depending on the purpose and on where you are located, that may be the performance of a contract with you, our legitimate interests in operating and improving the Services, your consent, or compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

Journey providers and suppliers

To deliver a journey, we share with the providers involved the information they need to perform their part of it. Those providers may include hotels and other accommodation; airlines and transport operators; transfer, chauffeur and vehicle providers; experience, activity and event providers; restaurants and venues; destination management and ground handling partners; and insurers where applicable.

We share only what a provider needs for its part of the arrangements. What that is depends on the provider — a hotel may need names, dates, rooming and any special requirements; a transport provider may need names, timings and travel document details where required by law. Providers use that information under their own terms and privacy policies, and for legally required purposes they may act independently of us.

Travel agencies and professional workspaces

Where a journey is arranged through a travel agency or other travel professional, we share journey information with that organisation and with the users it has authorised in its workspace, so that it can manage the arrangements for its clients. The agency is responsible for its own handling of that information and for its relationship with the traveller. Where an agency uses the Services to manage travellers, the agency determines what it records about those travellers, and each organisation’s workspace is designed to be separated from every other organisation’s.

Invitations, companions and shared access

A journey may be shared with the people travelling on it or with others invited to view it. Where you invite someone, we use the contact details you provide to send that invitation, and the person invited may then see the journey information shared with them. Where you travel as part of someone else’s journey, the person or organisation that created it may see the journey information relating to it.

Service providers

We use service providers to operate the Services and our business, which may include hosting and infrastructure, storage and backup, email and messaging, support tooling, security services, payment providers where payment is enabled, and professional advisers. These providers act on our instructions under contract, or otherwise as required to deliver the service you have requested.

Legal and corporate

We may disclose information where required by law, court order or a competent authority; to establish, exercise or defend legal claims; to protect the rights, safety or property of travellers, our people or the public; and in connection with a corporate transaction such as a merger, acquisition or transfer of assets, subject to appropriate protections.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Luxio operates internationally, and travel is by nature cross-border. Information may be processed in, and transferred to, countries other than the one you are in — including where our providers are located and where the journey itself takes place. Those countries may have different data protection laws.

Where such a transfer is subject to legal restrictions, we rely on an appropriate safeguard or exception. In particular, where information is transferred to a provider in a destination in order to perform a journey you have asked us to arrange, that transfer may be necessary for the performance of those arrangements.

We retain information only for as long as necessary for the purposes described in this policy.

Journey records are retained for the duration of the journey and afterwards for the period needed to support the traveller, resolve disputes and meet accounting and legal obligations. Account and profile information is retained while the account is active and for a period afterwards. Enquiry and correspondence records are retained for the period needed to handle the matter and keep a record of our dealings. Newsletter contact details are retained until you unsubscribe, after which we keep only a minimal suppression record of the address so that it is not added back to the list. Technical, server and security logs are retained for a short operational period.

Identity and travel document information, where handled, is retained no longer than needed for the arrangements requiring it or for any legally required period, and is then deleted. When information is no longer required, we delete it or render it no longer attributable to an individual.

We apply technical and organisational measures intended to protect information against unauthorised access, disclosure, alteration and loss. These include encryption of data in transit; access controls that limit access to those who need it for their role; separation between organisations’ workspaces where professional workspaces are provided; protected storage of authentication credentials where sign-in is provided; logging and monitoring; and, where sensitive categories such as identity documents and special requirements are handled, additional restrictions on access to them.

We keep these measures under review as the Services develop. No system can be guaranteed completely secure, and we cannot guarantee absolute security.

Depending on where you are located, you may have rights in relation to your information. These may include access to it; correction of inaccurate or incomplete information; deletion; restriction of processing; objection to processing, including to direct marketing at any time; portability; and withdrawal of consent where processing is based on consent. You may also have the right to complain to a supervisory authority in your country.

You can unsubscribe from newsletters at any time using the link in the message or by contacting us.

To make a request, contact us using the details in section 12. We may need to verify your identity, and we may need to explain where a right does not apply — for example where we must retain information to complete a journey already under way or to meet a legal obligation. We will respond within the period required by applicable law. Where a journey has been arranged by an agency or by another person, we may need to direct part of your request to that organisation or individual.

The Services link to and embed content from third parties, including mapping providers and the websites of destinations, properties, experiences and events. Those services operate under their own terms and privacy policies. We do not control them and are not responsible for their content or practices.

We may update this policy as the Services develop. The date at the top shows when it was last updated. Where a change is significant, we will take reasonable steps to bring it to your attention before it takes effect, and where the law requires consent for a change, we will obtain it.

For privacy questions, or to make a privacy request, write to us at Luxio Inc., 8 The Green, Dover, Delaware 19901, United States, or reach us through the contact options on this website.