Privacy Policy

Last updated: October 2026

1. Data Controller

Kölbl Korbinian
Trivastraße 9, 80638 Munich, Germany
Email: hello@luxhw.com
Phone: +49 176 28801958
Website: www.luxhw.com

2. General Information

We take the protection of your personal data very seriously. Your personal information is processed in compliance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

This Privacy Policy explains which personal data we collect, how we use it, and what rights you have under data protection law.

3. Collection and Purpose of Data Processing

We collect and process personal data that you provide to us voluntarily - for example via email, phone, WhatsApp, social media, or through our website.

We process your data for the following purposes:

Travel planning, consultancy, and brokerage of travel services
Communication with clients, partners, and service providers
Processing bookings via partners such as Little Emperors or Myler
Social media communication (e.g. Instagram DMs)
Invoicing, accounting, and legal obligations

Legal basis:

Art. 6 (1) (a) GDPR – consent
Art. 6 (1) (b) GDPR – contract performance
Art. 6 (1) (f) GDPR – legitimate interest

4. Data Disclosure to Third Parties

Your data will only be shared with third parties where necessary for the performance of our contractual obligations, legal requirements, or if you have provided consent.

This includes:

Hotels, airlines, visa agents, and other service providers for bookings
Hotel partner programs (e.g. SLH Within, LHW Vita, Hyatt Privé, Marriott Stars) to provide exclusive benefits
Payment processors such as Stripe (used by partners like Little Emperors or Myler)
IT and software providers:
- Microsoft (Outlook, 365)
- Hostinger (website hosting)
- Notion (internal organization and travel planning)
- Finom (banking services)

All partners are contractually bound to comply with GDPR requirements. Data transfers outside the EU occur only under appropriate safeguards in accordance with Art. 46 GDPR (e.g. EU Standard Contractual Clauses).

5. Credit Card Data and Payment Processing

During travel arrangements, LUXHW may enter clients’ credit card details into booking systems operated by partners (e.g. Myler or Little Emperors).

Storage and processing of this data are handled exclusively by the relevant payment processor (e.g. Stripe). Stripe is a PCI DSS Level 1 certified payment provider. All card data is encrypted and tokenized directly by Stripe.

LUXHW does not store or retain full credit card numbers or security codes and has no access to such information once it has been entered. Stripe processes payment data solely for the purpose of payment handling, in compliance with European data protection standards under Art. 46 GDPR.

For more details: https://stripe.com/privacy

6. WhatsApp Business

We use WhatsApp Business to communicate with clients. Provider: WhatsApp Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

By contacting us via WhatsApp, you voluntarily provide your phone number and any additional personal information shared in messages. The legal basis for processing is consent (Art. 6 (1) (a) GDPR) or contract fulfilment (Art. 6 (1) (b) GDPR).

More information: https://www.whatsapp.com/legal/privacy-policy-eea

7. Website & Cookies

Our website is hosted by Hostinger International Ltd. Hostinger processes personal data on servers in the EU, including Germany, France, Lithuania and the Netherlands.

We use only technically necessary cookies, which are essential for the proper functioning of the website. These cookies do not collect personal information and do not require consent.

When you contact us via the website’s contact form, the personal data you provide (such as name, email address, and message) is processed to handle your enquiry. Legal basis: Art. 6 (1) (b) GDPR.

We operate an official Instagram profile under @luxuryhotelsworld

When you interact with our profile (likes, comments, messages), personal data may be collected and processed jointly with Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, under Art. 26 GDPR (joint controllership).

Further information on Meta’s privacy practices: https://www.facebook.com/privacy/policy

11. Data Security

We employ appropriate technical and organizational security measures under Art. 32 GDPR to protect your data from unauthorized access, loss, or misuse. Our website uses SSL encryption for secure data transmission.

12. Data Retention

We store personal data only as long as necessary for the respective purpose or for as long as legally required (e.g. tax retention obligations). Once the purpose ceases or statutory retention periods expire, data will be deleted or anonymized.

13. Your Rights

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the competent supervisory authority:

Bavarian Data Protection Authority (BayLDA)
Promenade 27, 91522 Ansbach, Germany

14. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal, technical, or organizational requirements. The current version is always available on our website.