LUX24 Privacy Policy

1. Who We Are

KEY24 INC., operating as LUX24, is a Canadian technology and booking platform for chauffeured transportation. LUX24 LIMO is a luxury ground transportation service operated by KEY24 INC., a federally incorporated Canadian corporation (Corporation No. 1693552-4), and KEY24 INC. is the contracting legal entity for LUX24 services. LUX24 provides booking, dispatch, payment-facilitation, communication, trip-management, safety and support functions. Transportation is generally performed by approved independent transportation providers.

LUX24 remains accountable for personal information under its control, including information processed by a service provider on LUX24's behalf. An independent transportation provider may also have separate privacy obligations for information it independently collects or controls. This Policy identifies when information is shared for a booking and why LUX24 processes it.

2. Services Covered by This Policy

LUX24 website

The website provides service information, quote and booking entry points, account access, forms and support. It may process technical, security, preference, form and consent information.

Booking Platform

The Booking Platform processes information needed to price, request, confirm, manage, pay for and support a journey, including pickup, destination, schedule, passenger, luggage, service-class, payment and trip-status information.

Rider App

The Rider App supports account access, booking management, assigned chauffeur and vehicle details, available trip-status and communication functions, payments, receipts, safety and support. Device permissions are requested when required for a disclosed feature.

• LUX24 Rider App on Google Play
• LUX24 Rider App on the App Store

Driver App

The Driver App supports chauffeur eligibility, booking opportunities, accepted journeys, operational location, navigation-related functions, communication, documentation, payouts, safety and Driver Support.

LUX24 Driver App on Google Play. An Apple Driver App link will be added only after that application is publicly available.

App-specific permissions and SDK disclosures are also provided through the applicable app store and just-in-time notices. LUX24 reviews and corrects any inconsistency between those disclosures and this Policy.

3. Information We Collect

The information collected depends on your role, requested service, features used, device permissions and applicable requirements.

Account and contact information

Name, preferred name, telephone number, email address, authentication information, language, communication preferences, profile photograph and account identifiers.

Booking and trip information

Pickup, destination, stops, date, time, service type, vehicle class, passenger and luggage count, airport, terminal, flight or travel information, special instructions, assigned provider, trip status, route, distance, duration, waiting time, cancellation, no-show, charge, tip, refund, rating, complaint and related communication.

Bookings for another person

A company, hotel, travel arranger, assistant or other authorized person may provide passenger information needed for a booking. That person must have authority to provide it and should inform the passenger. LUX24 may contact the passenger with necessary trip, safety and privacy information.

Device and technical information

Device type, operating system, app and browser version, IP address, language, identifiers, authentication events, security logs, crash and diagnostic information, page or feature interactions and consent choices.

Sensitive or optional information

Accessibility, mobility, service-animal, child-seat, emergency, identity, licence, screening or incident information is processed only for an identified service, safety, eligibility or legal purpose. Do not place unrelated sensitive information in free-text booking instructions.

LUX24 requests only information reasonably necessary for the disclosed purpose. If information is required for a new purpose, LUX24 provides an appropriate notice and seeks consent where required before using it for that purpose.

4. Location and GPS Information

With the required device permission, LUX24 processes precise or approximate location for pickup selection, arrival status, an active journey, fare and route records, safety, support, fraud prevention and trip verification. Location information is not used as authority for unrelated monitoring.

Rider location

The Rider App may process location while the app is open, from a booking request until the journey ends or is cancelled, and for up to five minutes after journey completion where background access is enabled for trip completion, safety or drop-off accuracy. A Rider may change device permissions and, where the feature permits, enter an address manually. Selecting Always in device settings may permit background access; LUX24 limits its use to the purposes described here.

Chauffeur and vehicle location

The Driver App processes operational location while a chauffeur is Online or Available, reviewing or travelling to a pickup, Waiting or completing an Active Trip, including when the app remains active in the background. Required location access supports matching, dispatch, arrival, route, fare, safety and support functions. New location transmission stops when the chauffeur changes status to Offline; LUX24 may retain the final operational point as part of the journey or availability record.

Who can see live location

During the applicable booking stage, live vehicle location may be shown to the passenger and the person who made the booking. Authorized LUX24 Safety and operational personnel may access it where required for the active journey, support or safety. A Corporate Account administrator receives completed corporate-trip and billing information but does not receive live vehicle location through the corporate dashboard.

Retention

Precise journey GPS records are ordinarily retained for six months after journey completion. Access is restricted and the records may be preserved longer only where a documented legal hold, open safety investigation, payment dispute, insurance claim, regulatory requirement or legal proceeding applies.

5. Payment Information

Payment-card and digital-wallet transactions are processed through Stripe, Apple Pay or Google Pay, depending on the method selected. Complete payment-card numbers and security codes are not stored on LUX24 servers.

LUX24 may receive and retain a payment token, payment-method type, limited card details where supplied by the processor, transaction identifier, authorization result, amount, currency, taxes, fees, tip, refund, chargeback, invoice and receipt information. Payment providers, banks, wallet providers and card networks may process payment, device, security and fraud-prevention information under their own notices and legal obligations.

Financial, invoice, receipt, refund, chargeback, tax and accounting records are ordinarily retained for seven years from the end of the taxation year to which they relate, or longer where an audit, dispute, investigation, legal hold or other legal requirement applies.

6. Chauffeur, Applicant, Fleet and Vehicle Information

LUX24 may collect identity, contact, date-of-birth, photograph, driver's licence, work-eligibility, driving-record, legally permitted screening, permit, registration, inspection, insurance, vehicle, business, tax, banking, payout, training, compliance, booking, earnings, rating, complaint, device and operational-location information.

Access to identity, driving, screening, insurance and eligibility information is limited to authorized personnel and providers who require it for verification, safety, compliance, support or a documented legal purpose. Persona and Jumio support identity, document and face/selfie verification, and Checkr supports legally permitted background screening. Where a provider supplies a result, LUX24 limits retention of unnecessary raw provider data.

Verification records and raw documents

LUX24 separates the evidence that a review was completed from the raw material used during the review. An eligibility audit record may include the document type, review date, reviewer or provider, decision and expiry date. That audit record may be retained for seven years where needed to demonstrate eligibility, compliance or the handling of a dispute. A current driver's licence, insurance, registration or inspection document may be retained while it remains necessary to confirm active eligibility and is removed or replaced when it expires, is superseded or is no longer required, subject to a legal hold.

Raw identity, document, background-screening and face/selfie material is retained only for the verification, review, appeal, fraud-prevention or legal period that applies to it. LUX24 does not use face/selfie material to train a general-purpose artificial-intelligence model. Documents from an unsuccessful chauffeur application are removed when the applicable review and appeal period ends unless a complaint, fraud concern, regulatory requirement or legal hold requires continued retention.

Biometric verification

Where identity verification involves capturing or deriving biometric characteristics or measurements, LUX24 requests express consent and provides the notice required by applicable law before the process begins. Where reasonably available, a person may request an alternative verification method by contacting privacy@lux24.limo. LUX24 completes any required privacy assessment or regulatory notification before deploying a biometric verification technique or creating a biometric database, and biometric information is securely destroyed when the identified purpose and applicable legal retention requirement end.

7. How We Use Personal Information

• Create, secure and administer accounts.
• Calculate and present fares and service options.
• Arrange, dispatch, manage and support bookings.
• Connect passengers, customers, chauffeurs and authorized travel arrangers.
• Process payments, refunds, payouts, receipts and corporate billing.
• Provide route, arrival, flight-monitoring and trip-status functions.
• Review identity, documents, eligibility and vehicle information.
• Provide accessibility, safety, emergency, support and lost-property processes.
• Prevent fraud, misuse, duplicate bookings, account compromise and payment risk.
• Meet tax, accounting, insurance, licensing, legal and regulatory obligations.
• Improve reliability and performance using information and choices permitted by law.

LUX24 does not use personal information for an unrelated new purpose without an appropriate notice and legal authority, including consent where required.

8. Consent and Other Legal Authority

LUX24 relies on the authority appropriate to the specific purpose and applicable law. This may include a requested service or contract, a legal obligation, a reasonable and necessary business or safety purpose, or meaningful consent.

LUX24 does not require consent to an unnecessary collection, use or disclosure as a condition of receiving the core service. Where processing is optional, the choice and consequence of declining are explained before the information is used. Consent may be withdrawn subject to legal or contractual restrictions and reasonable notice.

Reading this Policy or using the Platform does not replace express consent required for optional analytics, advertising, precise device location, camera or photo access, recording, sensitive information or another non-essential use.

9. Automated Processing and Artificial Intelligence

LUX24 uses rules-based or automated tools to assist with fare calculation, matching, fraud detection, document and face/selfie verification, support summaries and suggested responses, safety-report prioritization and account-risk review. The information considered depends on the function and may include route, schedule, vehicle class, provider availability, operational location, account, payment, booking, device, document and security indicators.

Automated outputs support the service or a human review. LUX24 does not rely solely on an automated result to make a material account-suspension, deactivation or eligibility decision without human review.

When applicable law requires notice of a decision based exclusively on automated processing, LUX24 provides that notice no later than the decision. On request, LUX24 provides information required by law about the personal information used and principal reasons, factors or parameters involved, and gives the person an opportunity to submit observations to a staff member able to review the decision. Challenges may be sent to privacy@lux24.limo.

Personal information submitted to public-facing support tools should be limited to what is necessary for the request. LUX24 does not authorize unrelated sensitive or confidential information to be entered into an AI-assisted interaction.

10. How We Share Personal Information

Recipients receive only information reasonably necessary for their role and purpose. Access should end when the booking, support function or legal need ends. A passenger using a corporate profile is informed that completed corporate-trip and billing information will be available to the authorized corporate administrator.

LUX24 may also disclose information to approved hosting, mapping, communication, analytics, security, identity, screening, legal, accounting, insurance and other service providers; to authorities where permitted or required by valid legal process; or in a proposed or completed business transaction subject to appropriate protections.

LUX24 does not sell personal information for monetary payment as part of its ordinary business model. Where applicable law treats an advertising or analytics disclosure as a sale, sharing or targeted advertising, LUX24 provides the required notice and choice.

11. Dashcams, Audio, Video and Vehicle Systems

A Transportation Provider may operate a road-facing or inward-facing dashcam, telematics or other safety system only where permitted by applicable law. When a chauffeur has registered an inward-facing dashcam with LUX24, the Rider App provides notice before the journey. The chauffeur must also provide any notice and obtain any consent required in the place where the recording occurs. LUX24 does not authorize covert or unlawful recording, entertainment recording, social-media publication or unrelated surveillance.

LUX24 does not continuously receive or monitor every provider dashcam recording. If a provider or passenger submits a recording for a safety report, accident, claim or dispute, LUX24 processes the submitted copy for that documented purpose and restricts access accordingly.

Customer Communications and Call Recording

LUX24 does not currently provide or operate a customer-support call-recording feature.

Telephone conversations between LUX24 support personnel, passengers and chauffeurs are not recorded by LUX24 through its platform.

LUX24 may process booking communications, support messages and related technical metadata where necessary to provide transportation services, investigate reported issues, maintain security and comply with applicable legal obligations.

Any future introduction of call-recording functionality will require an update to this Privacy Policy and appropriate notice or consent in accordance with applicable law.

Submitted recordings follow the retention period applicable to the support, safety, accident, insurance or legal matter and any legal hold.

12. Service Providers and External Services

LUX24 uses approved providers to support payment, communications, flight information, identity and eligibility checks, hosting, storage, analytics, security and advertising measurement. Current provider categories and examples include:

• Stripe, Apple Pay and Google Pay — payment processing and digital-wallet functions.
• Twilio, SendGrid and Sinch — email, SMS, WhatsApp, VOIP, push-notification and conversation functions.
• FlightAware — flight-status information used for applicable airport bookings.
• Persona and Jumio — identity, document and face/selfie verification.
• Checkr — legally permitted background-screening services.
• Hetzner in Nuremberg, Germany; AWS; Google Cloud; and KEY24 infrastructure in Canada — hosting, databases, storage, backup and related infrastructure.
• Google services — maps, address functionality, analytics, reCAPTCHA, app distribution and advertising measurement.
• Mixpanel, Twilio Segment and Sentry — product analytics, event routing, diagnostics and error monitoring.
• Meta Pixel, TikTok Pixel and Microsoft Advertising — advertising measurement or remarketing where active, permitted and consistent with the user's consent choice.

Provider data categories

A provider receives only the information reasonably necessary for its documented function and is subject to applicable contractual, confidentiality, security and legal requirements. Providers may maintain independent legal obligations and privacy notices. LUX24 maintains an internal provider register and updates this disclosure when a provider materially changes how personal information is processed.

13. Cookies, Analytics and Marketing Choices

LUX24 uses cookies, browser storage, mobile SDKs, identifiers and similar technologies for essential operation, preferences, analytics and, where active, advertising measurement. Non-essential technologies remain disabled until required consent is obtained.

LUX24 does not currently send promotional email or SMS messages. Transactional email, SMS, WhatsApp or push notifications may be sent to confirm or support an account or booking. Advertising or remarketing technologies may be used only where permitted and subject to applicable consent choices.

You can review the technologies and available controls in the Cookie Settings and Policy, use available in-app controls, email privacy@lux24.limo, or adjust browser and device settings. Rejecting optional analytics or advertising does not prevent core booking functions.

Analytics and advertising controls

• Mixpanel and Twilio Segment: optional product analytics remain subject to the consent choice available through Cookie Settings or the applicable in-app privacy control.
• Sentry: limited crash, error and security diagnostics may operate where reasonably necessary to maintain reliability and protect the Platform; information not required for that purpose is not used for optional advertising.
• Meta Pixel, TikTok Pixel and Microsoft Advertising: advertising measurement or remarketing remains disabled until the consent required for the user's location and device has been obtained.

Technology names, providers, purposes and durations are described in the LUX24 Cookie Policy.

14. Processing Outside Your Province or Country

LUX24 is based in Canada and uses providers and infrastructure that may process information in Canada, Germany, the United States or another disclosed provider location. Information processed outside your province or country may be subject to the laws and lawful-access requirements of that jurisdiction.

Before communicating personal information outside Quebec where applicable law requires it, LUX24 evaluates relevant privacy factors, including sensitivity, purpose, safeguards, contractual protections and the legal framework of the destination. LUX24 uses the transfer only when the assessment and applicable agreement support appropriate protection.

15. How Long We Keep Information

LUX24 retains identifiable information only while its purpose, a documented dispute, a legal hold or a statutory requirement remains active.

A record may be kept longer for an audit, active dispute, safety investigation, insurance claim, legal proceeding, regulatory requirement or documented legal hold. A deletion request does not require deletion of a separately retained booking, payment, tax, safety, insurance, eligibility or legal record before its applicable period ends. When the ordinary six-month GPS period ends, LUX24 deletes the precise coordinates or irreversibly anonymizes and aggregates them so they can no longer reasonably be linked to an individual or journey. Service providers may maintain a separate retention period disclosed in the verification notice and their applicable privacy notice. When other identifiable information is no longer required, LUX24 securely deletes, destroys or irreversibly anonymizes it. Temporary residual copies may remain in protected backups until the applicable cycle ends.

16. Security and Privacy Incidents

LUX24 uses safeguards proportionate to the sensitivity and risk of information. Controls include encrypted transmission, password hashing, role-based access, login monitoring, audit logging, backups, vulnerability management and incident-response procedures. Access to sensitive information is limited to authorized personnel with a documented operational, safety, support, legal or compliance need.

No electronic system can guarantee absolute security. Users should protect credentials and promptly report suspected unauthorized access.

Where a breach creates a real risk of significant harm or another reporting obligation, LUX24 takes the steps required by applicable law, including applicable notice to affected individuals and regulators. LUX24 maintains required breach records.

17. Your Privacy Rights and Requests

Depending on applicable law, you may request information about LUX24's processing; access to or correction of personal information; withdrawal of eligible consent; deletion of an account or information; information about an applicable automated decision; or review of a privacy complaint. Rights may be subject to identity verification, legal exceptions and records LUX24 must retain.

1. Email privacy@lux24.limo.
2. Provide your name, account email or phone, request type and relevant booking or date range.
3. LUX24 verifies identity using the least additional information reasonably necessary.
4. LUX24 responds to a verified access request as quickly as possible and ordinarily within 30 calendar days, subject to a legally permitted extension.
5. An extension or lawful refusal includes the explanation and complaint information required by applicable law.

Do not send a password, complete payment-card number, authentication code or unnecessary identity document by ordinary email.

18. Account Deletion

A customer may request deletion through an available account feature or privacy@lux24.limo. After identity verification and completion of the request, LUX24 deletes or irreversibly de-identifies the account profile within 30 days.

Account deletion does not mean that every record connected with the account is erased immediately. LUX24 separates and retains only records required for completed or disputed bookings, GPS and route history, payments, refunds, chargebacks, tax and accounting, fraud prevention, safety investigations, chauffeur eligibility, insurance claims, legal obligations, restricted-account enforcement or proceedings. Those records are restricted from unrelated use and deleted, destroyed or anonymized when their applicable retention period ends.

19. Children, Teen Accounts and Family Profiles

A person must be at least 18 years old to create and independently manage a standard LUX24 account. Where LUX24 makes a Teen Account or Family Profile available, it must be created, authorized and supervised by a parent or legal guardian through the applicable family-account process. LUX24 does not knowingly collect personal information directly from a child under 14 in Quebec without the consent of a parent or legal guardian, except where collection is clearly for that child's benefit and is otherwise permitted by law.

Teen and family privacy at a glance

• The parent or legal guardian authorizes and supervises the eligible Teen Account or Family Profile.
• LUX24 explains which account, booking, journey, location and safety information the family feature makes visible to the parent or guardian.
• Information about a minor is limited to what is reasonably necessary for account operation, transportation, guardian controls, safety, support and law.
• Permission to create or supervise the account is not treated as permission for optional advertising or analytics.
• The parent, guardian or eligible account holder may request access, correction or deletion through the Privacy Officer, subject to identity, authority and required retention.

Before a Teen Account or Family Profile is activated, the parent or guardian receives the applicable privacy notice and information about the account controls, journey information and location or safety information that may be visible through the family-account feature.

A minor may travel only through an eligible Teen Account, Family Profile or an adult-accompanied booking that the Platform permits. Availability, guardian controls and journey eligibility may vary by region and service. A standard adult account must not be used to conceal an unauthorized unaccompanied-minor journey.

LUX24 limits information about a minor to what is reasonably needed for the account, guardian controls, booking, safety, support and legal obligations. A parent, guardian or eligible account holder may contact privacy@lux24.limo to ask about access, correction or deletion, subject to identity, authority and legal-retention requirements. If you believe a minor's information was submitted without appropriate authority, contact the Privacy Officer promptly.

20. Changes to This Policy

LUX24 updates this Policy when services, technology, providers, practices or legal requirements materially change. The revised version is posted with an updated review date.

When a change introduces a new purpose, material disclosure or consent-dependent practice, LUX24 provides additional notice and seeks renewed consent where required before the new practice begins. Updating the date alone does not replace required notice or consent.

21. Contact the LUX24 Privacy Officer

Privacy complaints

LUX24 encourages you to contact the Privacy Officer first so the concern can be investigated. You may also have the right to complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec or another authority with jurisdiction.

Official Privacy Resources

These external government resources are provided for general information and do not limit any rights or obligations:

• Office of the Privacy Commissioner of Canada — meaningful consent
• OPC — responding to access requests
• OPC — privacy breach obligations
• OPC — AI, privacy and business
• Commission d'accès à l'information du Québec — Law 25 changes
• Canada Revenue Agency — electronic record retention

This Policy describes LUX24 practices and is not consumer legal advice. External authority pages are maintained by their respective organizations.

Key Definitions

An Account is a customer, chauffeur, fleet, corporate or other authorized user account. A Booking is a requested or confirmed transportation arrangement. A Corporate Customer is an organization that books, pays for or manages travel. A Guest is a passenger for whom another person or organization books. The Platform means the LUX24 website, Booking Platform, Rider App, Driver App and connected booking, dispatch, payment, communication and support systems. A Transportation Provider is an independent chauffeur, fleet operator or transportation business that reviews or performs a booking. Personal information means information about an identifiable individual or information that can reasonably be linked to one.

Additional Privacy Details

Information received from other sources

LUX24 may receive information from a person booking for you; a Corporate Customer, employer, hotel, travel agency, airline, event organizer or family member involved in your journey; an assigned Transportation Provider; or an approved payment, identity, background-screening, fraud-prevention, insurance or technology provider. LUX24 may also verify information against legally available government, licensing or public records. Information received from another source is used only for the booking, account, verification, safety, support, payment, legal or other disclosed purpose for which it was provided.

Communications and customer support

When you contact LUX24 or communicate through the Platform, LUX24 processes the email, SMS, in-app message, chat, WhatsApp message, support form, ticket number, call details, voicemail, attachment, screenshot and related date or delivery information required for the interaction. Customer-support calls are recorded only after a recording notice is provided at the beginning of the call. LUX24 does not routinely record calls between passengers and chauffeurs, although call-routing metadata may be retained. Temporary, relayed or VOIP contact methods may be used to reduce disclosure of personal telephone numbers. Communications may be reviewed to arrange a booking, provide support, investigate a complaint or safety report, resolve a dispute, prevent fraud, protect an account and meet legal obligations.

Authorized representatives

Where permitted by law, an authorized representative may make a privacy request for you. LUX24 may require signed authority, evidence of the representative's identity and authority, and confirmation from you before releasing or changing personal information. LUX24 uses the least additional information reasonably necessary to verify the request.

Limits that may apply to a request

Privacy rights are not absolute. LUX24 may refuse, limit or redact a response where permitted or required by law—for example, when a record includes another person's information, is protected by legal privilege, cannot be reliably associated with the requester, must be preserved for tax, accounting, fraud, safety, insurance, licensing, investigation or legal-claim purposes, or cannot be disclosed without creating a serious safety risk. Where required, LUX24 explains the reason, the available review process and how to contact the appropriate privacy authority.

Aggregated, anonymized and de-identified information

LUX24 may create aggregated statistics or information that has been anonymized or de-identified so that it no longer reasonably identifies an individual. This information may be used for service planning, reliability, fraud and safety analysis, business reporting and product improvement. LUX24 does not attempt to re-identify properly anonymized information, except where permitted for security testing, validation of the de-identification process or legal compliance.

Legal, safety and government disclosures

LUX24 may preserve, use or disclose information where reasonably necessary and legally permitted to respond to an emergency; protect a passenger, chauffeur or the public; investigate fraud, misuse, a collision, injury, safety concern or privacy incident; manage an insurance claim or legal proceeding; enforce applicable agreements; or respond to a valid court order, warrant, subpoena, regulator or other lawful demand. LUX24 may seek clarification, narrow or challenge a request that appears invalid, excessive or unlawful.

Related LUX24 Policies and Safety Information

This Privacy Policy should be read with the policy or guidance that applies to the feature or service you use:

• Cookie Policy — cookies, SDKs, analytics, advertising measurement and consent choices.
• Terms and Conditions — rules governing accounts, bookings and use of the Platform.
• Safety Standards — LUX24 operational safety and verification standards.
• Rider Safety — passenger verification, trip tools, reporting and emergency guidance.
• Driver Safety — chauffeur responsibilities, reporting and safe-operation guidance.
• Accessibility and Booking Assistance — accessibility requests and service limitations.

If another LUX24 notice conflicts with this Policy about how personal information is handled, contact the Privacy Officer for clarification. A feature-specific notice may provide additional detail for that feature but does not reduce rights provided by applicable law.