Privacy Policy

1. Data Controller

LuxWinAsia Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are registered in Hong Kong and operate the LuxWinAsia platform at luxejourneys.com.

2. Types of Data We Collect

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: To perform our contract with you, including managing your account, processing ticket purchases, and administering draws.
• Legitimate Interests: To improve our services, prevent fraud, ensure platform security, and send relevant service communications.
• Consent: For marketing communications, analytics cookies, and personalisation features. You may withdraw consent at any time.
• Legal Obligation: To comply with applicable laws, regulations, and legal processes, including anti-money laundering and identity verification requirements.

4. How We Use Your Data

• Creating and managing your account
• Processing ticket purchases and payments
• Conducting and administering draws
• Notifying winners and coordinating prize fulfilment
• Verifying your identity and age
• Communicating service updates and transactional emails
• Sending marketing communications (with your consent)
• Analysing platform usage to improve our services
• Preventing fraud, abuse, and ensuring fair play
• Complying with legal and regulatory obligations

5. Cookie Policy

We use cookies and similar technologies to provide, protect, and improve our services. You can manage your cookie preferences at any time via the cookie consent banner.

6. Third-Party Services

We share data with the following categories of third-party service providers:

• Stripe: Processes all payments securely. Stripe is PCI DSS Level 1 certified. Their privacy policy is available at stripe.com/privacy.
• Analytics Providers: We use analytics tools to understand platform usage and improve performance. Data is aggregated and anonymised where possible.
• Email Service Providers: To deliver transactional and marketing communications on our behalf.
• RandomDraws.com: Certifies the fairness of our random draw process. Receives ticket identifiers only, no personal information.
• Cloud Hosting: Our infrastructure providers store data in secure, encrypted environments within the European Economic Area (EEA) or under adequate safeguards.

We require all third parties to respect the security of your personal data and treat it in accordance with applicable data protection laws. We do not sell your personal data.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

• Account data: Retained for the duration of your account plus 3 years after closure.
• Transaction records: Retained for 7 years to comply with financial and tax regulations.
• Marketing preferences: Retained until you withdraw consent or for 2 years of inactivity.
• Support correspondence: Retained for 2 years after resolution.
• Analytics data: Anonymised and aggregated data may be retained indefinitely.

8. Your Rights

Under applicable data protection laws, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data where there is no compelling reason for continued processing.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Restriction: Request restriction of processing under certain circumstances.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

9. How to Exercise Your Rights

To exercise any of your rights, please contact our Data Protection Officer at dpo@luxwinasia.com. We will respond to your request within 30 days. You may also export your data directly from your account settings.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.