Privacy policy

Data controller

Controller

LUXRIDE LTD

Company number

208836864

Office address

37 Hristofor Kolumb Blvd, Sofia

Privacy email

luxrideltd@gmail.com

Data protection officer, if applicable

not applicable

Last updated: 31 August 2026

Data we process

Depending on your action, we may process:

• name, contact details and language preference;
• date of birth/age band, licence and identity-document details where required for the contract or law;
• reservation, flight, location, date, driver and extra details;
• payment status, amount, currency and reference; LuxRide records the card details in the rental agreement and may take a transaction after the vehicle is returned;
• agreement, condition report, damage, fines, communications and support history;
• IP address, device, logs, consent choices and analytics/advertising identifiers according to your choice;
• other information you voluntarily submit.

Do not send full card data, sensitive identity documents or health information through a free-text field unless a secure, expressly requested channel is provided.

Purposes and legal bases

• answering an enquiry: legitimate interest;
• creating and performing a reservation/agreement: performance of a contract;
• payment, accounts and tax obligations: a legal obligation;
• eligibility checks, fraud prevention and fleet security: legitimate interest;
• damage, fines, disputes and claims: legitimate interest;
• necessary website technology: legitimate interest;
• analytics and personalised advertising: only under consent, collected by the site's own banner;
• direct marketing: We do not send direct marketing.

Recipients and processors

We may share the minimum necessary data with verified providers and authorities where a legal basis exists:

• payment provider: None. We do not take payments online;
• booking/CRM platform: our own database, with no third-party CRM;
• hosting, email, SMS and support: Vercel for hosting and Railway for the database;
• analytics and advertising: Google Ireland Limited (advertising, only after consent) and Vercel Inc., USA (anonymous visit statistics, cookieless);
• approved vehicle-class fulfilment partner: We do not use a partner fleet, so no data is passed on;
• insurers, roadside assistance, accountants, legal advisers and competent authorities: We do not pass data to other recipients.

International transfers and safeguards: Google and Vercel process data outside the EU as well, under standard contractual clauses.

Retention

• Enquiries without a reservation: 12 months, if the enquiry does not become a booking
• Reservations and agreements: 5 years after the rental ends
• Accounting/tax records: 10 years, under the Accountancy Act
• Damage, fines and claims: 5 years, while the limitation period runs
• Security and technical logs: 12 months
• Analytics/advertising identifiers: 14 months

After the period expires, data is deleted or anonymised unless law or an active claim requires otherwise.

Your rights

Where applicable, you may request access, correction, deletion, restriction, objection or portability and may withdraw consent without affecting earlier processing. Email luxrideltd@gmail.com; reasonable identity verification may be required.

You may complain to Bulgaria's Commission for Personal Data Protection using its current details at cpdp.bg.

Security, children and changes

Security measures: an encrypted connection, team-only access and a separate database. The service is not intended for independent reservations by anyone below 18. Material changes appear here and, where required, are communicated through publishing the new date on this page.

Frequently asked questions