Privacy Policy

1. Data controller

The data controller is:

Luxival
Operated by Olakunle Oluwarotimi Shopeju
Varikkokaarre 7A 40, 01700 Kivistö, Finland
Email: rotimikun@gmail.com

2. What data we collect and why

Contact and project enquiries

When you submit the contact form we collect your name, email address, optional phone number, company name, and your message. We use this data solely to respond to your enquiry and, if applicable, to fulfil a service contract.

Legal basis: Legitimate interest (responding to your direct enquiry) and, where a contract follows, performance of that contract.

Airport transfer bookings

When you book a ride we collect your name, email, phone number, pickup address, destination, preferred date and time, and flight details. We use this to organise and deliver the transport service you requested.

Legal basis: Performance of a contract.

Newsletter subscriptions

If you subscribe to the Luxival newsletter we collect your email address and, optionally, your name. You may unsubscribe at any time via the link in any newsletter email.

Legal basis: Consent.

Website analytics

We do not currently use third-party analytics or advertising trackers. We may in future use a privacy-respecting analytics tool (such as Plausible or Fathom) and will update this policy if we do.

3. Data storage and processors

Form submissions and booking data are stored in Supabase, a PostgreSQL-based platform operated by Supabase Inc., whose servers are located in the European Union (AWS eu-central-1, Frankfurt). Supabase is our sole data processor for this data and processes it only on our instructions.

Email communication happens through standard email infrastructure. No data is sold or shared with third parties for marketing purposes.

4. How long we keep your data

• Contact enquiries: retained until the enquiry is resolved and for up to 2 years thereafter for business records.
• Ride bookings: retained for 3 years after the service date for legal and accounting compliance under Finnish law.
• Newsletter subscriptions: retained until you unsubscribe. After unsubscribing, your email is removed within 30 days.

5. Your rights under GDPR

You have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: request deletion of your data where we have no legal obligation to retain it.
• Restriction: ask us to pause processing while a dispute is resolved.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: for newsletter subscriptions, unsubscribe at any time.

To exercise any right, email us at rotimikun@gmail.com. We will respond within 30 days.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

6. Cookies

This website does not set any tracking or advertising cookies. No cookie consent banner is shown because no consent is required. If this changes we will update this policy and add an appropriate notice.

7. Security

All data in transit is encrypted via HTTPS. Data at rest is encrypted in Supabase. Access to the database is restricted by row-level security policies — public visitors can only submit data, not read it. Admin access uses separate credentials with elevated privileges and is not exposed to the public site.

8. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Significant changes will be noted on this page.