1. Responsible party in terms of the GDPR
The responsible party in terms of Art. 4 No. 7 GDPR is:
Luxiety GmbH
Merkatorweg 5 22119
Hamburg
Germany
E-Mail: datenschutz@luxiety.de
2. Access to the Website and Server Logfiles
When you access our website, information is automatically transmitted to our web server (hosted via our ERP platform Odoo) by the browser used on your device. This information is temporarily stored in so-called server logfiles. The following information is collected:
The anonymized IP address of the requesting device
Date and time of access
The specific page or file accessed
The amount of data transferred and a message about the successful retrieval
The browser used along with its version and the user's operating system
If applicable, the previously visited website (referrer URL)
This data is used exclusively for administrative purposes, particularly to ensure the uninterrupted operation of the website, for error analysis, and to defend against unauthorized access. The processing is based on Art. 6 para. 1 lit. f GDPR and serves our legitimate interest in providing a stable and secure online service.
3. Use of Cookies and Consent Management
Our website uses cookies. These are text files that are either temporarily stored for the duration of a session (session cookies) or permanently stored on your device. Cookies are used to make the use of our website more user-friendly, effective, and secure.
We use the integrated consent management features of Odoo or our chat provider to obtain and document users' consent for the use of technically non-essential cookies in a legally compliant manner.
Technically necessary cookies are set based on § 25 Abs. 2 TDDDG and Art. 6 Abs. 1 lit. f GDPR, as they are required for the operation and basic functions of the website.
Technically non-essential cookies (e.g., for optional features of the chat widget) are loaded only after explicit consent in accordance with Art. 6 Abs. 1 lit. a GDPR. You can revoke your consent at any time via the consent banner.
4. Statistical evaluation and web analysis
For statistical evaluation and optimization of our website, we exclusively use the standard integrated, privacy-friendly on-board statistics features of Odoo. These analyses run locally on the hosting infrastructure of our website and do not transmit data to independent third parties. The IP addresses of visitors are anonymized as early as possible. The processing is based on Art. 6 Abs. 1 lit. f GDPR (legitimate interest in the needs-based design and optimization of our web offerings).
5. Contact forms and interactions (Odoo Standard)
If you use the contact or inquiry forms integrated on our website, we process the personal data you provide (e.g., name, email address, phone number, message text) directly in our Odoo system. The processing is carried out solely for the purpose of handling and responding to your inquiry.
The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR) or on the implementation of pre-contractual measures or the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR). The collected data will be deleted or archived as soon as the purpose of their collection is fulfilled and no legal retention obligations oppose.
6. Live chat and customer interaction via Superchat
We use a chat widget from the service Superchat (SST Technologies GmbH, Rheinsberger Str. 76/77, 10115 Berlin, Germany) on our website.
Data processing: When you use the chat widget, the data you enter (e.g., name, message content) as well as technical connection data (e.g., IP address) will be transmitted to Superchat servers to provide the chat service and efficiently process your request.
Legal basis: The use of the chat is based on your consent within the framework of our consent banner (Art. 6 para. 1 lit. a GDPR) or for the implementation of pre-contractual measures or for the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR), if you make specific booking inquiries.
Order processing: We have concluded a contract for order processing (AVV) with SST Technologies GmbH in accordance with Art. 28 GDPR. The data will be processed on servers within the European Union.
7. Use of our mobile app and backend infrastructure (Supabase)
We provide our customers with a mobile app through which flights can be requested, booked, and managed.
Infrastructure and data storage via Supabase: For the operation of our app, user management (authentication), storing profile and booking data, as well as providing app features, we use the backend platform Supabase (Supabase Inc., USA). The data is stored on servers of Supabase or their infrastructure subcontractors (e.g., Amazon Web Services - AWS) within the European Union (hosting region Frankfurt am Main, Germany).
Data processing: When you register in the app, create a profile, or make bookings, your registration data (email, password hash), your contact details, and your entire booking history are processed in the Supabase database. The processing is carried out for the fulfillment of the contract or for the implementation of pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR.
Order processing: We have concluded a contract with Supabase for order processing (Data Processing Addendum - DPA) in accordance with Art. 28 GDPR. In the event that data is transmitted to the USA in exceptional cases, Supabase is certified under the EU-US Data Privacy Framework, which guarantees an adequate level of data protection.
8. Customer communication via WhatsApp Business API
To enable fast and exclusive customer communication, we offer contact via the messaging service WhatsApp. We use the professional WhatsApp Business API for this purpose. Unlike the private WhatsApp app, this prevents the reading of contact data from the device's address book.
Processed data: If you contact us via WhatsApp, we process your name (first and last name) registered with WhatsApp, your phone number, and the entire content of the chat history (including transmitted documents, images, or flight requests).
Purpose and Legal Basis: The processing is carried out to handle your inquiries, to prepare flights, and to conduct customer communication in the context of bookings. The legal basis is the performance of pre-contractual measures or the fulfillment of the contract in accordance with Art. 6 para. 1 lit. b GDPR.
Transfer to Third Countries: The service provider is Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). The chat content is processed via Meta's servers. For any potential transfer of data to the parent company Meta Platforms Inc. in the USA, the EU standard contractual clauses and Meta's certification under the EU-US Data Privacy Framework apply.
9. Data Processing in Contract Execution, Flight Brokerage, and Package Tours
If you make a binding inquiry or booking for flight brokerage (private jet charter, shared flights, empty legs, scheduled flights) or a package tour via our website, our app, WhatsApp, or other communication channels, we process your data as well as the data of the passengers you registered for contract fulfillment in accordance with Art. 6 para. 1 lit. b GDPR.
Categories of Data: Full names, dates of birth, passport and ID data (including copies for security checks and for reporting to authorities), visa information, nationalities, baggage data, and if applicable, specific passenger requirements (e.g., medical restrictions or catering requests).
Mandatory Disclosure to Airlines and Operators: For the contractual execution of the flights, the transfer of your personal data is essential. Luxiety transmits this data to the respective executing airlines (Operators), airlines, accommodation providers, transfer service providers, as well as to the handling companies (FBOs) at the respective airports.
Authority notifications: In addition, the Operators and we are legally obligated to transmit passenger data (so-called Passenger Manifests) to national and international border, customs, immigration, and security authorities. Depending on the chosen flight destination (especially for flights outside the EU), the data will be transmitted to recipients in third countries. This transmission is mandatory for the fulfillment of the transport contract (Art. 49 para. 1 lit. b GDPR).
10. Integration of Google Fonts
11. Order processing
If we engage external service providers (e.g., the website host Odoo, the platforms Supabase, WhatsApp API, or Superchat) as part of an order processing according to Art. 28 GDPR, this is done only on the basis of a corresponding contract that guarantees compliance with the legal data protection standards.
12. Storage duration and deletion
Personal data will be deleted or anonymized as soon as the purpose of their collection ceases to exist, unless legal retention periods (e.g., 6 years according to HGB or 10 years according to AO for accounting documents and contractual chat logs) require us to store them longer.
13. Rights of the affected persons
As an affected person, you have the following rights:
Access to your data stored with us (Art. 15 GDPR)
Correction of incorrect data (Art. 16 GDPR)
Deletion of your data, unless there are retention obligations (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Withdrawal of consents with effect for the future (Art. 7 para. 3 GDPR)
Objection to processing based on legitimate interests (Art. 6 para. 1 lit. f GDPR), in accordance with Art. 21 GDPR.
To exercise these rights, simply contact: datenschutz@luxiety.de.
14. Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: The Hamburg Commissioner for Data Protection and Freedom of Information Ludwig-Erhard-Str. 22, 20459 Hamburg E-Mail: mailbox@datenschutz.hamburg.de
15. Current status and changes to this privacy policy
This privacy policy is current as of: July 2026. Due to technical developments or changes in legal requirements, adjustments may be necessary. The current version is permanently available on our website and in the app.