Privacy Policy

Last updated: October 29, 2026

Luxavoy is a luxury hotel advisory brand of TWG Holidays Ltd., a travel advisory business based in British Columbia, Canada. This policy applies to luxavoy.com and to bookings made through Luxavoy. This page explains what personal information we collect, how we use it, and how we protect it — especially your credit card details. If you have any questions, email us at info@luxavoy.com.

1. What we collect

• When you ask for a quote: your name, email, phone number, travel dates, number and ages of travellers, the hotels or trips you are interested in, and anything else you write to us.
• When you send us booking details: guest names as shown on ID, contact details, loyalty program numbers, special requests, billing address, and the credit card used to guarantee or pay for the booking.
• When you submit a card form: the time of submission, your IP address and browser type, kept as proof that the authorization came from you.
• When you subscribe to our newsletter: your email address.
• When you browse our website: like most websites, we use cookies, browser storage and analytics tools to understand how our pages are used. Our booking and payment forms do not load these tools.

2. How we use it

• To answer your questions, prepare quotes, make and manage your bookings, send confirmations, and help you before and during your trip.
• To send our newsletter, only if you subscribed. Every newsletter has an unsubscribe link.
• We do not sell or rent your personal information to anyone.

3. Who we share it with

• Hotels, cruise lines, tour operators and our booking partners, only the information needed to make and manage your booking (for example, guest names, dates, and the card that guarantees your room).
• Service providers that host our website and deliver our emails.
• Government authorities, only when the law requires it.

4. How we protect your credit card

• Your card number, expiry date and security code are encrypted in your own browser with public-key encryption (RSA-OAEP) before they are sent. Our web server and our emails only ever receive the encrypted text and the last four digits.
• The key that can decrypt it is not on the web server. It is kept offline on a single computer, and only one designated person can use it.
• We decrypt your card only to make the booking you authorized, and give it only to the hotel or travel supplier for that booking. The decrypted number is not saved to a file or sent by email.
• Your security code is encrypted and stored separately, and deleted once we have made your booking (in any case within 30 days).
• For a hotel guarantee, we do not charge your card. The hotel holds it and can only charge it under the cancellation or no-show policy shown in your quote.
• Every page on our website uses HTTPS. Please do not send card numbers by email; use our secure form instead.

5. How long we keep it

We keep booking and authorization records for as long as needed to look after your booking, and afterwards for accounting, tax and dispute purposes (Canadian law generally requires business records to be kept for six years). Card details are only ever kept in encrypted form.

6. Your choices

• You can ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent to marketing emails at any time.
• Email info@luxavoy.com and we will reply within 30 days.
• If you are not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner for British Columbia.

7. Changes to this policy

If we change this policy, we will update it on this page and change the date at the top.