Privacy Policy

1. Who is responsible for your data

Luvorel is the brand and concierge service described on this website. The formal legal entity that will act as data controller is being finalised and will be identified here before Luvorel begins commercial operations.

In the meantime, you can contact us about privacy through the enquiry form on this website or the WhatsApp concierge link in the footer.

Before commercial launch, the controller legal name, registered address and a monitored contact address (and any data protection officer, if one is ever appointed) must be confirmed and shown here.

2. Data we collect

We collect the information you choose to give us in an enquiry, plus limited technical information used to keep the service secure. Depending on your request, an enquiry may include:

• your name, email address and phone or WhatsApp number;
• the service and vehicle preference you are interested in, and whether it is self-drive or chauffeur-driven;
• pickup and destination locations, and any return locations, which you may select using address suggestions provided by Google;
• dates, times, passenger numbers and luggage information, including any special luggage details;
• flight information, hotel or villa name, itinerary and any notes you add;
• for self-drive requests, eligibility information such as a driver age band, how long a licence has been held and the licence country;
• limited technical and security information used to prevent abuse of our forms, such as an anti-abuse verification result, information derived from your connection for rate limiting, and basic timing signals; and
• simple attribution information, such as how you reached the site, where available.

We do not deliberately collect special categories of data through the enquiry form.

3. Browser and session storage

While you complete the enquiry form, your in-progress answers are saved temporarily in your browser using session storage, so that refreshing the page does not lose your progress. This stays in the current browser tab or session and is cleared when the enquiry is submitted or when the session ends.

For your privacy, your name, email, phone number and licence or identity fields are deliberately excluded from this in-progress storage. See our Cookie Policy for the full list of storage we use.

4. Why we use your data

We use personal data to:

• respond to your enquiry and take the steps you have asked us to take before any possible service;
• assess and arrange the services you request;
• communicate with you about your request;
• administer and improve our service;
• prevent fraud, spam and abuse, and keep the website and our systems secure; and
• comply with legal obligations where they apply.

5. Legal bases

Under the GDPR, we rely on the following legal bases:

• Steps at your request before a contract (Article 6(1)(b)): to handle and respond to your enquiry.
• Contractual necessity (Article 6(1)(b)): where a service is later confirmed with you.
• Our legitimate interests (Article 6(1)(f)): for proportionate security, fraud and abuse prevention, and to run our service, balanced against your rights.
• Legal obligations (Article 6(1)(c)): where the law requires us to process or keep certain data.
• Consent (Article 6(1)(a)): only where consent is legally required, for example for non-essential analytics or storage. We do not currently use non-essential analytics, and we do not ask you to consent to this policy in order to submit an ordinary enquiry.

6. Who we share data with

We use trusted service providers that process data on our behalf to operate the website and handle enquiries. These currently include:

• Supabase, to store enquiry data and run the database and admin sign-in;
• Vercel, to host and serve the website;
• Cloudflare, for the Turnstile anti-abuse check on our forms;
• Upstash, for rate limiting that protects the enquiry form;
• Resend, when configured, to deliver enquiry details by email to our operational team;
• Google, for the Maps and Places address suggestions used in the location fields; and
• relevant service suppliers, where sharing is necessary to respond to or arrange a service you have requested.

If you choose to contact us using a WhatsApp link, that message is handled by WhatsApp under its own terms. We do not currently send automated server-side notifications of your enquiry to WhatsApp or Meta.

This section must be revisited before enabling any WhatsApp Cloud API notifications, because Meta would then become an additional recipient or processor of enquiry data.

7. International transfers

Some of our service providers may process personal data outside the European Economic Area. Where applicable, such transfers must be protected using a mechanism permitted under data protection law. The safeguards applicable to each provider will be reviewed as part of our processor and data-transfer documentation before commercial launch.

8. How long we keep data

We keep personal data for as long as necessary for the purposes above, to respond to and arrange your request, to meet legal obligations, and to handle any queries or disputes. After that, it is deleted or anonymised.

Formal, specific retention periods are yet to be defined and should be set and documented before commercial launch.

9. How we protect data

We apply reasonable technical and organisational measures to protect personal data, including restricted and authenticated admin access with multi-factor authentication, an admin allowlist, database row-level security, server-side handling of secrets, rate limiting and anti-abuse verification. No system can be guaranteed to be completely secure, but we take security seriously and keep our measures under review.

10. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict or object to certain processing;
• receive certain data in a portable format;
• withdraw consent, where processing is based on consent, without affecting earlier processing; and
• lodge a complaint with a supervisory authority.

In Greece, the supervisory authority is the Hellenic Data Protection Authority (HDPA). Its contact details are published on its official website at www.dpa.gr. To exercise your rights with us, please use the contact methods in this policy.

11. Children

Our service is intended for adults arranging private mobility. It is not directed at children, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us so we can address it.

12. Automated decision-making

We do not currently make decisions producing legal or similarly significant effects about you that are based solely on automated processing. Our anti-abuse checks are used to protect the forms, not to make significant decisions about you.

13. Sharing with service suppliers

Where we need a third-party supplier to respond to or arrange a service you have requested, we share only the information reasonably necessary for that purpose. We do not send all of your details to every supplier.

14. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated. Significant changes will be reflected here.

15. Contact

For any privacy question or to exercise your rights, please use the enquiry form on this website or the WhatsApp concierge link in the footer. A monitored privacy contact address will be published on our Legal page before commercial launch.