Privacy policy

LYS LUXURY CLUB - FZCO, DSO-IFZA, Dubai, United Arab Emirates — contact@lysluxuryclub.com.

As our clients are international, this policy complies with the UAE personal data protection law (Federal Decree-Law No. 45 of 2021, "PDPL") and, for people residing in the European Union, the United Kingdom or Switzerland, with the General Data Protection Regulation (GDPR) and its equivalents.

• Identity and contact: name, email, phone, country of origin (optional), language.
• Account: login details (encrypted password) or sign-in with Google or Apple.
• Requests: dates, places, flights, number of people, preferences, messages, including your WhatsApp messages and the transcript of your voice notes.
• Documents: passport, ID or ticket, only when the service requires it (ID requested by the hotel; passport and ticket for an airport meet and greet).
• Payment: amount, currency, date and payment reference. Your card details are handled by Stripe; we never receive them in full.
• Preferences (optional): allergies, diet, reduced mobility, greeting language, companions… Some are sensitive data: they are only stored with your explicit consent, which you can withdraw from your members' area.
• Club: grade, points, cashback, referral.
• Reviews: rating, comment, first name and initial of the surname.
• Technical data: IP address (security and anti-abuse limit), technical logs, and settings stored on your device (language, currency, theme, cookie choice).

• Handle your requests and arrange the service with the chosen partner — performance of the contract.
• Collect payment, issue invoices and credit notes, keep the accounts — performance of the contract and legal obligation.
• Manage grades, cashback and referral — performance of the contract.
• Send you messages about your bookings, by email or WhatsApp — performance of the contract.
• Pass an ID document only to the establishment that requires it — performance of the contract.
• Secure the site and prevent abuse — legitimate interest.
• Measure audience anonymously — legitimate interest.
• Send you our newsletter or marketing messages — consent, which you can withdraw at any time.
• Remember your preferences for future requests — explicit consent.
• Publish your review — consent, given by submitting it.

• The Lys Luxury Club team.
• The partner in charge of your service, for the necessary information only (name, phone, times, places, and where relevant the document required by the hotel).
• Our technical providers, listed below, acting on our instructions.
• People you choose to share your itinerary link with.
• Authorities, only where required by law.

Your data is never sold or rented.

• Supabase — database, accounts and files (European Union, Frankfurt).
• Vercel — site hosting and cookie-free anonymous audience measurement (global network).
• Stripe — card, Apple Pay and Google Pay payments.
• Resend — sending emails.
• Meta (WhatsApp Business), via 360dialog — WhatsApp messages.
• Groq — text transcription of your WhatsApp voice notes (only the text is kept).
• Google and Apple — only if you choose to sign in with them.
• OpenStreetMap (Nominatim) — address suggestions: only the text typed in the address field is sent to them.
• LibreTranslate — occasional translation of a message by our team.
• Sanity — editorial content of the site, with no client data.

No personal data: weather (Open-Meteo), public holidays (Nager.Date), exchange rates, the list of phone country codes, and QR code generation, which contains only your request number.

Automatic reading of a document (passport, ticket) happens on your device: the image is not sent to any third party. If you use voice dictation in a form, your browser transcribes your voice, under its publisher's rules (Google, Apple…).

Some providers process data outside the United Arab Emirates or the European Economic Area (notably in the United States). These transfers are covered by appropriate contractual safeguards, such as the European Commission's standard contractual clauses.

• Account and requests: as long as your account is active. After 3 years with no request and no sign-in, the account is anonymised: name, email, phone and contact details in your requests are erased.
• Request sent without an account: contact details erased 3 years after the request.
• Passports, IDs and tickets: deleted 30 days after the service, or 30 days after the request is cancelled.
• Invoices, credit notes and accounting data: period required by law (at least 5 years in the United Arab Emirates).
• Preferences: until you delete them, or with your account.
• Record of your cookie choices: 3 years.
• IP address stored for the anti-abuse limit: 24 hours.
• Newsletter: until you unsubscribe; an unconfirmed subscription is deleted after 30 days.

Depending on where you live, you can request access to your data, its rectification or erasure, restriction of or objection to processing, its portability, and withdraw any consent at any time.

Write to us at contact@lysluxuryclub.com: we reply within 30 days. From your members' area, you can also export your data and request deletion of your account. You may also contact the data protection authority of your country (for example the CNIL in France, or the UAE Data Office in the Emirates).

The site uses only strictly necessary cookies and local storage: keeping you signed in, language, currency, theme and remembering your cookie choice. They do not require prior consent.

No advertising cookies are used. Audience measurement (Vercel Analytics) sets no cookies and cannot identify you. To suggest a currency or phone code, the site reads the language set on your device, without sending anything to a third party.

Your grade (Silver, Gold, Diamond) is calculated automatically from the points of your paid bookings. This calculation only determines commercial benefits and has no legal effect. You can ask at any time for it to be checked by a member of our team.

Exchanges with the site are encrypted, passwords are never stored in clear, and access to data depends on each person's role (client, partner, team). ID documents are kept in a private space that only the team can open.

In the event of a data breach posing a high risk to you, we will inform you as soon as possible, as required by the GDPR and UAE law.

Our services are reserved for adults. When a booking concerns a child (passenger, traveller), their information is provided by the adult making the booking, under their responsibility.

For our partners (chauffeurs, meet-and-greet agents, hotels), we use: identity and contact details, languages spoken, vehicle or establishment, availability, mission history, internal quality assessment, and bank and tax details for their payouts.

This data is used to select partners, assign them missions and pay them. It is kept for the duration of the collaboration, then for the legal accounting period as regards payments.

This policy may change; the date of the last update is shown at the top of the page. For any question: contact@lysluxuryclub.com.