Privacy isn't optional at FlyLuxEx — it's foundational. This policy sets out what personal data we collect about you, why, how we protect it, and the rights you hold over it.
1. Data Controller
The data controller for personal data collected via flyluxex.com is FlyLuxEx, reachable at info@flyluxex.com for any matter relating to your personal data.
2. Data we collect
We collect only the data strictly required to deliver our services and process your requests.
Data you provide via our forms:
- Full name, email, phone, country of residence
- Company or organisation (where applicable)
- Request details (itinerary, dates, preferences, specific requirements)
- The person who referred you (for the Signature Membership programme)
- Any further information you choose to share
Technical data collected automatically:
- IP address, browser type, operating system
- Pages visited, session duration, traffic source
- Strictly necessary cookies and anonymised analytics cookies
3. Why we process your data
Your data is used solely to:
- Respond to your requests and deliver the services you instruct
- Tailor the service to your pace and preferences
- Communicate with you in the context of active mandates
- Improve the performance, security and experience of the site
- Meet our legal and accounting obligations
Your data is never sold, traded, or rented to third parties for marketing purposes.
4. Legal basis
Under the EU General Data Protection Regulation (GDPR):
- Performance of the contract or pre-contractual measures, when processing your enquiries and mandates
- Our legitimate interest in operating, securing and improving the service
- Your consent, for non-essential cookies and any marketing communication
- Compliance with legal obligations (accounting retention, fraud prevention, etc.)
5. Who has access
Your data is accessible only to:
- The FlyLuxEx team assigned to your mandate, each bound by a signed confidentiality agreement
- Our vetted operational partners (carriers, FBOs, hotels, ground transport, security providers), strictly to the extent required to deliver your request and under signed confidentiality undertakings
- Our contracted technical providers: hosting (Vercel Inc.) and email (LWS)
- Competent authorities when legally required
6. Retention
We retain your data for the period strictly required:
- Unconverted enquiry data: 12 months from last contact
- Executed mandate data: 5 years after closure (accounting requirement)
- Accounting and tax records: 10 years (French Commercial Code)
- Analytics cookies: 13 months maximum
Beyond these periods, your data is deleted or anonymised.
7. Your rights
Under GDPR you hold the following rights:
- Right of access — obtain a copy of your data
- Right to rectification — correct inaccurate data
- Right to erasure — request deletion of your data
- Right to object — object to processing
- Right to restriction — temporarily restrict processing
- Right to portability — receive your data in a structured format
- Right to withdraw consent at any time
To exercise these rights, write to info@flyluxex.com. We respond within one month at the latest.
If you believe our practices don't comply, you may lodge a complaint with the French Data Protection Authority (CNIL) — www.cnil.fr
8. International transfers
Some of our technical providers may process your data from servers located outside the European Union (notably Vercel Inc., United States).
These transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards, ensuring a level of protection consistent with EU requirements.
9. Security
We apply strict technical and organisational measures to protect your data:
- TLS encryption across all communications
- Hosting on certified infrastructure
- Least-privilege access — restricted strictly to those who need it
- Signed confidentiality undertakings from every team member and partner
- Regular audits and an incident response plan
10. Cookies
Our site uses a limited number of cookies:
- Strictly necessary cookies (language preference, session)
- Anonymised analytics cookies (Vercel Analytics), GDPR-compliant
You can configure your browser at any time to block non-essential cookies.
11. Updates to this policy
This policy may be updated to reflect legal, technical or organisational changes. The date of the last update appears at the top of the document. For substantive changes we'll notify you by email where possible.
12. Contact
For any question, request or complaint relating to your personal data: info@flyluxex.com