1.Who we are
In short
LuxeFlow runs this website, the business web app and the LuxeFlow app. For the records a business keeps about its own clients and staff, that business is in charge and we process data for it.
LuxePulse Limited, RC 9632158, Lagos, Nigeria. Contact: [email protected].
LuxeFlow is the data controller for business owner accounts, LuxeFlow app accounts and visitors to this website.
LuxeFlow is a data processor for the client and staff records a business keeps in LuxeFlow. The business decides what to collect and is the controller of that data.
2.What we collect
In short
Account details, booking and payment records, verification details for businesses, and how you use our site and apps. We never receive your full card number or PIN.
- Business owners and staff: first and last name, email, phone, business details, branch addresses, identity and verification details for KYC (ID document, selfie or liveness check, BVN where required), payout bank account, subscription and billing history.
- LuxeFlow app users: first and last name, email, phone, profile photo (optional), bookings, reviews, rewards, referral codes, approximate or precise location (only with your permission, to show nearby businesses), push notification token.
- Clients of businesses (held for the business): name, contact details, booking and visit history, notes the business adds, payments.
- Payments: handled by a trusted payment gateway. LuxeFlow receives a payment reference, amount, last four card digits and card type, never the full card number or PIN.
- Connected accounts: if a staff member connects Google Calendar, we access only the calendar needed to add and update their LuxeFlow bookings. LuxeFlow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Messages: chats between clients and businesses inside LuxeFlow, and email, SMS, WhatsApp and push messages sent through the platform.
- Website and app usage: device, browser, IP address, pages viewed, crash reports, and cookies (see the Cookie Policy).
3.Why we use it, and our lawful basis
In short
We use data to run bookings and payments, keep the platform safe, improve it, and, with your agreement, for marketing and location features.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing bookings, payments and accounts | Account, booking and payment data | Contract |
| Identity checks (KYC) and fraud prevention | Verification details, payment records | Legal obligation and legitimate interest |
| Product analytics | Usage data and analytics cookies | Consent (cookie banner) |
| Marketing emails to business owners | Name and email | Consent, or legitimate interest with an easy opt-out |
| Showing nearby businesses | Location | Consent |
| Customer support | Account details and messages | Contract and legitimate interest |
4.AI features
In short
Where LuxeFlow uses AI, we send only what the feature needs, it is not used to train other companies' models, and you can turn it off.
Some features use AI, for example to answer questions about a business's services. When they do, we send only the data the feature needs (such as service names, prices and opening hours).
Data sent to an AI provider is not used to train that provider's models. Business owners can turn AI features off in their settings.
6.International transfers
In short
Some providers process data outside Nigeria. When they do, we use the safeguards the NDPA requires.
Some of our providers process data outside Nigeria, for example in the European Union or the United States. Where this happens we rely on the safeguards in Part VIII of the NDPA: an adequacy decision, standard contractual clauses, or your consent where that is the right basis.
7.How long we keep it
In short
As long as your account is active, plus any period the law permits us to keep it.
| Data | How long |
|---|---|
| Active account data | For the life of the account |
| Financial and transaction records | As long as the law permits |
| KYC records | As long as the law permits |
| Deleted account data | Removed within 30 days; backups within 90 days |
| Marketing consent records | Until you withdraw consent |
8.Your rights
In short
You can see, correct, delete, move or limit the use of your data, and withdraw consent at any time. We reply within 30 days.
You have the right to access, correct and delete your data; to restrict or object to how we use it; to data portability; to withdraw consent; and not to be subject to decisions made purely by automated means.
Use your in-app account settings or email [email protected]. We reply within 30 days.
If you are a client of a business that uses LuxeFlow, please contact that business first for records it keeps about you. We will help it respond.
9.Deleting your account
In short
You can delete your account from the app or the web app. Some anonymised transaction records stay because the law requires them.
- LuxeFlow app users: open the app, go to your Profile, tap Delete Account and confirm.
- Business owners: in the web app, go to Settings, then Account, then Close account. Your business data is kept for 90 days in case you return or want an export, then deleted.
- Or email [email protected] from the address on your account.
What remains: anonymised transaction records the law requires us to keep.
10.Security
In short
We encrypt data, limit who can see it and watch for problems. If a serious breach happens, we tell the NDPC within 72 hours and tell you without delay.
We use encryption in transit and at rest, access controls and role permissions, password hashing, monitoring and staff training.
If a breach is likely to put people at risk, we notify the Nigeria Data Protection Commission within 72 hours and affected users without delay.
11.Children
In short
LuxeFlow accounts are for people aged 16 and over.
A parent or guardian may book for a child; the booking is held in the parent or guardian's account.
12.Marketing choices
In short
You can unsubscribe from marketing at any time. We still send messages about your bookings and payments.
Every marketing email has an unsubscribe link, and you can turn off marketing push notifications in the app's settings.
Service messages, such as booking confirmations, reminders and receipts, are still sent because they are part of the service.
13.Changes to this policy
In short
We tell you by email and in the app 14 days before any important change.
Earlier versions of this policy stay available on request and in our legal archive.
14.Complaints
In short
Talk to our complaints team first. You can also complain to the Nigeria Data Protection Commission.
Contact our complaints team at [email protected]. You can also complain to the Nigeria Data Protection Commission.
