Privacy policy

1.Who we are

LuxaPass is a brand of The Elephant B.V., a company registered in the Netherlands (KvK: 97165409), which is the data controller for the personal data described in this policy. You can reach us at Boris@luxapass.com or +31 6 41 34 95 51 for any question about this policy or your data.

2.What we collect

Website: this site has no accounts or forms. Our hosting provider processes technical data such as your IP address, browser type and the pages you visit in server logs, which are kept for a limited time for security purposes.

App (from launch): to provide the service we will collect the details needed to create your account (name, email address, phone number), your membership and booking history, payment information processed by our payment provider, and approximate location if you choose to share it to find studios near you.

3.Why we use it

We use your data to operate your membership and bookings, to process payments, to provide customer support, to keep the service secure and to improve LuxaPass. Where we rely on your consent, for example for marketing emails, you can withdraw it at any time.

4.Legal bases

We process personal data on the basis of your consent (marketing), the performance of a contract (your membership), our legal obligations (accounting and tax) and our legitimate interests (security, fraud prevention and service improvement), always balanced against your rights.

5.Who we share it with

We share data only with service providers who help us run LuxaPass, such as hosting (Vercel), email delivery, payment processing and the partner studio where you book a class, which receives the information needed to check you in. These providers act on our instructions and are bound by data processing agreements. We never sell your personal data.

6.International transfers

Some of our providers may process data outside the European Economic Area. Where that happens we rely on the European Commission's adequacy decisions or standard contractual clauses to make sure your data stays protected.

7.How long we keep it

Server logs are kept for a limited time for security purposes. Account data is kept for as long as your membership is active and for the period required by Luxembourg accounting and tax law afterwards, after which it is deleted or anonymised.

8.Cookies

This website only uses a strictly necessary cookie to remember your language preference. We do not use advertising or tracking cookies. If this changes, we will ask for your consent first.

9.Your rights

You have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent at any time. To exercise these rights, email Boris@luxapass.com. You also have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD, www.cnpd.lu).

10.Children

LuxaPass is intended for people aged 18 and over. We do not knowingly collect personal data from children.

11.Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page, and we will notify you of significant changes by email or in the app.