Privacy, International Data & Cookies Policy
Privacy, International Data & Cookies Policy
LUXURRE — PRIVACY AND INTERNATIONAL DATA PROCESSING NOTICE
Company: LUXURRE LTD
Company Registration Number: 17063390
Website: https://www.luxurre.com
Privacy and Compliance Contact: info@luxurre.com
Regulatory Framework: UK GDPR, Data Protection Act 2018, Data (Use and Access) Act 2025, applicable PECR requirements and other applicable data protection laws.
Document Version: 1.1
Revision Date: 17 October 2026
1. Controller and Contacts
The controller responsible for determining the purposes and means of personal data processing through the LUXURRE website and its core platform-account activities is:
LUXURRE LTD
A private limited company registered in England and Wales.
Company Registration Number: 17063390
Website: https://www.luxurre.com
Email: info@luxurre.com
Requests concerning privacy, personal data, data subject rights and data protection complaints may be submitted to info@luxurre.com.
The published address is the registered office. Any separate operational or service address must be disclosed where legally required.
LUXURRE may operate within an international commercial network involving separately registered companies:
LUXURY ESTATE BROKER LTD
Company Number: 15763591
86–90 Paul Street, London EC2A 4NE, United Kingdom
Email: info@luxuryestatebroker.com
LUXURY REAL ESTATE GROUP LTD
Company Number: 15824358
86–90 Paul Street, London EC2A 4NE, United Kingdom
Email: info@luxuryrealestate-group.com
MCRE GLOBAL LTD
Company Number: 15620679
86–90 Paul Street, London EC2A 4NE, United Kingdom
Email: info@mcre.global
Each company is a separate legal entity. In respect of separately contracted activities, the relevant company may act as an independent controller, processor or joint controller according to its actual responsibilities and applicable law.
Where joint controllership applies, the relevant parties will determine their respective obligations and make the essence of the arrangement available to affected individuals.
No company is treated as a controller or joint controller merely because it belongs to a commercial network.
2. Persons Covered by this Notice
This notice applies to personal information relating to identifiable individuals who interact with LUXURRE.
These individuals may include:
* Buyers, investors, private clients and prospective principals.
* Directors, corporate officers and authorised representatives.
* Family office personnel, trustees and beneficial owners.
* Property owners, developers, sellers and intermediaries.
* Brokers, consultants, professional partners and service providers.
* Job applicants and professional candidates where relevant.
* Website visitors, registered account holders and correspondents.
LUXURRE focuses on private-access and professional commercial activities. Access may be subject to identity verification, professional qualification, eligibility criteria and separate approval.
Personal data protection also applies when information is collected in a business-to-business context.
3. Categories and Sources of Personal Data
Depending on the services requested and the functions used, LUXURRE may process:
Identity and contact information: Names, business email addresses, telephone numbers, country of residence, preferred language, professional titles and corporate affiliations.
Account information: Registration details, account identifiers, authentication and verification records, permissions, access levels, application status and user preferences.
Professional and corporate information: Company names, representative authority, business roles, professional qualifications and beneficial ownership information where relevant.
Commercial and transaction information: Property requirements, budgets, acquisition criteria, seller instructions, asset descriptions, property records, offers, service enquiries and transaction-related correspondence.
Submitted materials: Photographs, videos, property documents, applications, presentations and other user-supplied files.
Verification and compliance information: Proof of authority, identity documentation, source-of-funds material and relevant due diligence records where lawfully required.
Financial and administrative information: Invoice details, payment references, transaction status, commercial agreements and records of fees or remuneration. Full payment-card information should be handled through an appropriately protected payment process.
Technical and security information: IP addresses, browser and device information, session data, authentication events, access logs and fraud-prevention indicators.
Communications and preferences: Messages, support requests, subscription choices, consent records and marketing objections.
Information may be supplied directly by individuals or their authorised representatives, through relevant commercial counterparties, professional partners or legally accessible public sources where permitted.
Where providing particular information is necessary to enter into an agreement, satisfy a legal obligation or complete identity checks, individuals will be informed of the relevant requirement and the potential consequences of not providing it.
Special-category personal data and criminal-offence information must not be collected routinely. Such information may be processed only when justified by a specific purpose, an applicable legal condition and appropriate safeguards.
4. Purposes and Legal Bases for Processing
Personal data may be processed for the following purposes, subject to an appropriate legal basis under the UK GDPR.
Performance of a contract — Article 6(1)(b):
* Administration of contracts with individual customers.
* Processing steps requested by an individual before entering into a contract.
* Provision of agreed account and platform services where the individual is the contracting party.
Where a contract is with a company rather than the individual concerned, Article 6(1)(b) is not automatically applicable to that individual’s information.
Compliance with legal obligations — Article 6(1)(c):
* Statutory accounting and taxation.
* Compliance with applicable financial-crime obligations.
* Legally required identification and verification.
* Regulatory reporting and cooperation.
* Preservation of legally required records.
Legitimate interests — Article 6(1)(f):
* Operating and protecting the platform.
* Responding to professional business enquiries.
* Preventing fraud and unauthorised access.
* Maintaining business records and contractual evidence.
* Facilitating legitimate commercial introductions.
* Protecting legal interests and investigating misuse.
* Improving security and services using proportionate methods.
Processing based on legitimate interests is subject to an assessment of necessity, reasonable expectations and the rights and freedoms of affected individuals.
Consent — Article 6(1)(a), where applicable:
* Optional marketing communications.
* Tracking activities requiring consent.
* Optional personalisation.
* Other specifically consent-based activities.
Consent may be withdrawn without affecting the lawfulness of processing undertaken before withdrawal.
Where special-category data or criminal-offence data are processed, the applicable additional conditions and safeguards must be identified and documented.
5. Recipients, Service Providers and Professional Network
Personal information may be disclosed, where necessary and legally justified, to:
* Authorised LUXURRE personnel and operators.
* Contracted technology and hosting providers.
* Business communication and email service providers.
* Payment and invoicing service providers.
* Security, authentication and fraud-prevention providers.
* Approved document storage and technical support providers.
* Relevant companies within the professional commercial network.
* Authorised brokers, agents and transaction counterparties.
* Legal, accounting, tax and other professional advisers.
* Competent regulatory, judicial and public authorities when legally required.
Data sharing is limited to the information reasonably necessary for the relevant purpose.
Membership of a commercial network does not constitute unrestricted permission to exchange customer files, confidential transactions or identity records.
Private-market opportunities, unpublished asset information and commercially sensitive documents remain subject to applicable access restrictions, confidentiality obligations and separate verification procedures.
Where a third-party service provider processes personal data on behalf of LUXURRE, an appropriate processor agreement and other necessary safeguards must be implemented.
Independent professional partners remain responsible for their own processing where they act as independent controllers.
This notice does not authorise the sale of personal information to third parties.
6. Automated Translation, Artificial Intelligence and Digital Assistance
LUXURRE may use automated systems to assist with language translation, content preparation, search functionality, classification and digital platform administration.
Information suitable for approved translation processes may include publicly authorised property descriptions, general marketing materials, published website content and other non-confidential information.
Identity documents, unpublished confidential transaction files, source-of-funds records, private correspondence and restricted commercial information must not be submitted to unapproved public AI or translation services.
Before personal data are processed using external AI or translation providers, the relevant provider, purposes, legal grounds, contractual arrangements, processing locations and international transfer safeguards must be assessed.
AI-generated information and translations may be incomplete or inaccurate.
Material legal, commercial, financial and regulatory information requires appropriate professional or human verification.
Where any solely automated decision-making with legal or similarly significant effects is introduced, LUXURRE must provide the required information and implement the protections applicable under data protection law.
7. International Processing and Cross-Border Transfers
LUXURRE operates an internationally accessible platform and may facilitate professional introductions or commercial opportunities involving parties in different jurisdictions.
International commercial activity does not automatically mean that all personal information is transferred to every country in which LUXURRE or its partners may be active.
Any restricted transfer of personal information must be assessed by reference to the actual recipient, destination, purpose and applicable legal requirements.
Where necessary, relevant safeguards may include:
* UK adequacy regulations.
* The UK International Data Transfer Agreement (IDTA).
* The UK Addendum to the European Commission’s Standard Contractual Clauses.
* Applicable EU Standard Contractual Clauses for transfers subject to EU GDPR.
* Other legally valid safeguards or permitted exceptions.
Where required, appropriate transfer-risk assessments or data protection tests and supplementary security measures must be completed.
International recipients must receive only the personal information necessary for their authorised activities.
Information about applicable safeguards and requests for available copies may be directed to info@luxurre.com, subject to appropriate confidentiality protections.
The actual hosting locations, subprocessors, overseas support access, AI providers and recipient countries must be documented in LUXURRE’s operational international transfer register and reflected in this notice or an accessible supplementary disclosure before the relevant processing takes place.
8. Personal Data Retention and Deletion
Personal information is retained only for as long as necessary for the purposes for which it is processed, subject to legal obligations, legitimate legal claims and any applicable statutory retention requirements.
The following retention principles apply:
Account information: Retained while an account is active and subsequently only to the extent necessary to complete outstanding obligations, meet applicable retention requirements or protect justified legal interests.
Professional enquiries and applications: Retained for the period necessary to assess the request, administer the relevant opportunity and manage any resulting engagement. Unsuccessful or abandoned applications are subject to periodic deletion review.
Commercial correspondence: Retained for the relevant business relationship and any further legally justified evidential or dispute period.
Accounting, invoices and tax records: UK company tax records generally must be retained for six years from the end of the relevant financial year, subject to applicable exceptions and longer requirements.
Identity verification and AML documentation: Where the UK Money Laundering Regulations apply to the relevant activity, applicable customer due diligence and transaction records are generally subject to a five-year retention period following the end of the business relationship or completion of the relevant occasional transaction, subject to statutory exceptions.
Marketing preferences: Subscription information is retained while marketing is authorised or otherwise lawfully carried out. Limited suppression records may be retained to ensure that opt-out requests continue to be respected.
Security and access information: Retained according to documented security, investigation and system-integrity requirements, with periodic review and restricted access.
Automated translation materials: Retained only where needed for the approved content workflow, associated publication, quality review or other legitimate purpose.
Backups: Subject to documented recovery, access and deletion controls, including appropriate expiry or overwriting procedures.
Where a legal hold, regulatory investigation or active dispute justifies further retention, the affected records may be preserved for the necessary period.
Once retention is no longer justified, personal information must be securely deleted or anonymised.
Specific operational retention periods for categories not governed by statutory requirements must be approved, implemented and documented in the controller’s retention schedule.
9. Data Protection Rights and Complaints
Individuals have rights under applicable data protection law, subject to statutory conditions and exceptions.
These may include:
* Access to their personal information.
* Correction of inaccurate information.
* Erasure where legally applicable.
* Restriction of processing.
* Data portability in applicable circumstances.
* Objection to processing based on legitimate interests.
* Withdrawal of consent.
* Protections concerning applicable automated individual decision-making.
Individuals have the right to object to direct marketing at any time.
Requests may be submitted to:
info@luxurre.com
Where the UK GDPR applies, requests will generally be answered within one month, subject to legally permitted extensions and other applicable rules.
Reasonable identity verification may be required where necessary.
Data Protection Complaints
Individuals may also raise complaints directly with LUXURRE concerning the handling of personal information.
Under the Data (Use and Access) Act 2025, applicable UK requirements include providing an accessible complaints process, acknowledging data protection complaints within 30 days, investigating appropriately and communicating the outcome.
10. Cookies, Website Technologies and Direct Marketing
The LUXURRE website may use technologies necessary for secure operation, authentication, language preferences, account access and protection against unauthorised activity.
Such technologies may include strictly necessary session and security cookies.
Other technologies, such as optional analytics, advertising tracking or profiling tools, are subject to applicable UK PECR, UK GDPR and other jurisdictional requirements.
Where consent is required, users must receive clear information and a valid opportunity to grant or refuse consent before the relevant technology is activated.
Any applicable statutory exception to consent must be individually assessed.
Cookie and similar-technology disclosures must identify the actual technologies used, their purposes, providers, storage periods and applicable choice mechanisms.
Cookie preferences must be manageable through an effective mechanism appropriate to the technologies actually deployed.
Marketing Communications
LUXURRE may communicate about its services and professional opportunities only where permitted under applicable privacy and direct marketing laws.
UK PECR distinguishes corporate subscribers from individual subscribers, including sole traders and certain partnerships.
Commercial communications must use an appropriate lawful basis where personal information is involved.
Direct marketing messages must identify the sender and provide an effective means of opting out where required.
Marketing objections must be respected.
11. Information Security and Personal Data Incidents
LUXURRE is responsible for implementing technical and organisational measures appropriate to the nature, scope and risks of its processing.
Such measures should include, where appropriate:
* Role-based access and controlled permissions.
* Appropriate authentication and account security.
* Encryption in transit and at rest where justified.
* Restricted access to confidential documents.
* Secure file handling and storage.
* Appropriate contractual controls over processors.
* Security logging and monitoring.
* Access reviews and incident-response procedures.
* Secure deletion and backup management.
Security measures must be reviewed and improved as risks and technical requirements change.
No internet-connected platform can guarantee complete security against every possible threat.
Personal data breaches must be assessed, documented and reported to the competent supervisory authority where legally required.
Affected individuals must be informed where the applicable legal threshold for individual notification is met.
12. Adults, Professional Access and International Jurisdiction
LUXURRE is directed primarily towards adults, qualified professional users, private clients and authorised representatives of relevant commercial entities.
Restricted services may require verification of professional status, legal capacity, authority or eligibility.
The platform is not designed for use by children, and individuals under 18 should not register or submit personal information.
The use of corporate accounts, professional-access requirements or electronically accepted terms does not remove statutory data protection rights or any mandatory consumer protections that apply to a particular individual or transaction.
Where personal information is subject to the laws of another jurisdiction, applicable mandatory requirements remain effective.
Separate service engagements may require additional local privacy information.
13. Policy Revisions, Accountability and Contact
LUXURRE may update this notice to reflect changes in its services, processing activities, applicable law or organisational arrangements.
Material changes to processing must be accompanied by appropriate updates to relevant privacy information and, where necessary, additional notices, consents, contracts, assessments and technical measures.
The controller is responsible for maintaining accurate processing records, appropriate internal policies and applicable data protection safeguards.
Data Controller: LUXURRE LTD
Company Number: 17063390
Contact: info@luxurre.com
Website: https://www.luxurre.com