Data Retention Policy

1. Overview

At VoyageLux Travel & Hospitality, we understand that your personal data is precious. This Data Retention Policy outlines how long we retain different categories of information, why we retain it, and how you can manage your data lifecycle.

We are committed to collecting only the data necessary to deliver exceptional travel experiences, ensuring compliance with GDPR, CCPA, and other applicable data protection regulations worldwide. Data is never retained longer than strictly required for legal, operational, or security purposes.

2. Data We Collect

We categorize collected data based on its purpose and sensitivity. Each category has a specific retention lifecycle:

• Booking & Travel Data: Itineraries, flight details, hotel reservations, tour bookings, and travel preferences.
• Account & Profile Data: Name, email, phone, date of birth, passport/ID details (for visa/flight requirements), and loyalty program info.
• Payment & Financial Data: Transaction records, billing addresses, and secure payment tokens. We never store raw credit card numbers.
• Communication Records: Emails, chat logs, call recordings, and customer support tickets.
• Marketing & Preference Data: Newsletter subscriptions, destination interests, and promotional opt-ins.
• Technical & Analytics Data: IP addresses, browser fingerprints, device info, and site usage metrics.

3. Retention Periods

The following table details how long each data category is retained. Periods begin from the date of collection or the last interaction, whichever is later.

4. Legal & Business Basis for Retention

We retain data only when justified by one or more of the following:

1. Contractual Necessity: Fulfilling booked travel services, managing refunds, and providing post-trip support.
2. Legal Compliance: Adhering to tax laws, aviation regulations, immigration requirements, and financial auditing standards.
3. Legitimate Business Interests: Fraud prevention, platform security, service improvement, and personalized travel recommendations.
4. Consent: Marketing communications and preference tracking (withdrawable at any time).

5. Storage & Security Measures

All retained data is stored in ISO 27001 certified data centers with end-to-end encryption (AES-256). Access is strictly role-based and logged. Regular penetration testing and third-party security audits ensure continuous protection. Backups are encrypted and retained according to the same lifecycle policies as the source data.

6. Your Rights & Controls

Under applicable data protection laws, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Rectification: Correct inaccurate or outdated information.
• Erasure: Request deletion of data where retention is no longer legally required.
• Restriction: Limit processing while disputes are resolved.
• Portability: Receive your data in a structured, machine-readable format.
• Object: Opt out of marketing or legitimate interest processing.

You can manage many of these preferences directly through your VoyageLux account dashboard under Settings → Privacy & Data.

7. How to Request Data Deletion

To request deletion of your data before the standard retention period expires (where legally permissible), please:

1. Log into your VoyageLux account and navigate to the Privacy Center.
2. Submit a formal data subject request via our secure portal.
3. Alternatively, email our Data Protection Officer at the address below with verification details.

We will respond within 30 days. If your request involves active bookings or legal holds, we will inform you of any applicable exceptions while honoring the rest of your request.

8. Contact & Support

For questions regarding this policy, data retention practices, or to exercise your rights, please contact our dedicated privacy team: