SECURITY POLICY

on the processing of personal data

of S.R.L. “GLOBAL LUX TRAVEL”

Version: 1.0

Approval date: 10.09.2026

Effective date: 10.09.2026

1. General provisions

This Security Policy on the processing of personal data establishes the rules, principles, and organisational and technical measures applied by S.R.L. “GLOBAL LUX TRAVEL” to ensure an appropriate level of protection and security for personal data processed in the course of the company's activities.

The Policy has been developed in accordance with:

Law No. 195/2024 on personal data protection;
applicable legislation and regulations concerning personal data protection and information security;
the principles of Regulation (EU) 2016/679 (GDPR), transposed into national legislation through Law No. 195/2024;
other legislation and regulations applicable to the activities of S.R.L. “GLOBAL LUX TRAVEL”.

From 23 August 2026, the general framework applicable to personal data protection in the Republic of Moldova is established by Law No. 195/2024 on personal data protection.

This Policy applies to all personal data processing carried out by S.R.L. “GLOBAL LUX TRAVEL”, whether through IT systems, applications, websites, paper documents or other means.

2. Personal data controller

The personal data controller is:

S.R.L. “GLOBAL LUX TRAVEL”

IDNO:

Registered office: 17 Harrier Way, London, England

Website: globalluxtravel.co.uk

S.R.L. “GLOBAL LUX TRAVEL” determines the purposes and means of processing personal data and is responsible for ensuring that processing complies with applicable legislation.

3. Purpose of the Policy

The purpose of this Policy is to:

a) protect the rights and freedoms of individuals during the processing of personal data;

b) prevent unauthorised access to data;

c) prevent the loss, destruction, unauthorised alteration or disclosure of data;

d) establish the responsibilities of employees and collaborators who have access to data;

e) ensure the confidentiality, integrity and availability of data;

f) reduce the risks associated with the processing of personal data;

g) ensure an adequate level of security in relation to the nature, volume and risks of processing.

4. Data processing principles

S.R.L. “GLOBAL LUX TRAVEL” processes personal data in accordance with the following principles:

lawfulness, fairness and transparency;
purpose limitation;
data minimisation;
data accuracy;
storage limitation;
integrity and confidentiality;
accountability of the controller.

Personal data is collected and used only to the extent necessary for the stated purposes and for fulfilling applicable legal or contractual obligations.

5. Categories of individuals whose data may be processed

Depending on its activities, S.R.L. “GLOBAL LUX TRAVEL” may process data relating to:

customers;
prospective customers;
individuals requesting information or offers;
individuals making bookings;
individuals using the globalluxtravel.co.uk website;
representatives of partners and suppliers;
individuals included in travel documentation;
employees and collaborators;
other individuals whose data is necessary for providing travel services or fulfilling legal obligations.

6. Categories of personal data

Depending on the purpose of processing, the following categories of data may be processed:

6.1. Identification data

surname;
first name;
date of birth;
nationality;
details from travel documents, where necessary for making a booking or providing a service.

6.2. Contact details

telephone number;
email address;
permanent or current residential address, where necessary.

6.3. Travel service data

destination;
travel dates;
preferences regarding travel services;
booking information;
information necessary for issuing travel documents;
information regarding customer requests and communications.

6.4. Technical data

When the website and online services are used, the following data may be processed, depending on the user's settings and the applicable legal basis:

IP address;
browser type and version;
operating system;
technical identifiers;
device data;
website access data;
data obtained from cookies and similar technologies.

6.5. Communication data

Information relating to requests submitted to the company may be retained, including:

the content of the request;
the date and time of the communication;
contact details;
the history of communications with the customer.

7. Purposes of processing

Personal data may be processed for:

providing travel services;
requesting and managing offers;
making and managing bookings;
issuing documents required for travel;
communicating with customers;
performing contracts;
fulfilling legal obligations;
managing relationships with partners and suppliers;
handling complaints and requests;
ensuring the security of IT systems;
preventing fraud and misuse of services;
improving services and website functionality;
conducting statistical analyses in accordance with the law;
sending marketing communications where an appropriate legal basis exists;
protecting the company's rights and legitimate interests within the limits of the law.

Data will not subsequently be used in a manner incompatible with the purposes for which it was collected.

8. Legal bases for processing

Personal data is processed only on a legal basis provided for by applicable legislation.

Depending on the circumstances, the legal basis may be:

the data subject's consent;
the necessity of performing a contract or taking steps at the individual's request before entering into a contract;
compliance with a legal obligation;
the protection of vital interests;
the performance of a task carried out in the public interest, where applicable;
the legitimate interests of S.R.L. “GLOBAL LUX TRAVEL” or a third party, with due regard for the data subject's rights and freedoms.

Consent will not be used as a legal basis where processing can and must be carried out on another applicable legal basis.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

9. Data processing through the globalluxtravel.co.uk website

The globalluxtravel.co.uk website may use technologies for storing and accessing information, including cookies and similar technologies.

Cookies that are strictly necessary for the operation of the website may be used to the extent permitted by applicable legislation.

Cookies or technologies used for analytics, advertising, marketing or other purposes requiring consent will be activated only where the data subject has given valid consent.

Users must be able to:

accept the categories of cookies to which they wish to consent;
reject cookies that require consent;
change their preferences at a later stage;
withdraw their consent.

Cookie management is described in detail in the Cookie Policy of S.R.L. “GLOBAL LUX TRAVEL”.

10. Disclosure of data to third parties

For the purpose of providing travel services, personal data may be disclosed, to the extent necessary, to:

tour operators and travel service providers;
hotels and accommodation providers;
airlines;
transport operators;
transfer companies;
insurance companies;
booking systems;
IT service providers;
communications service providers;
payment service providers;
public authorities and other entities where disclosure is required or permitted by law.

Data will be disclosed only to the extent necessary to achieve the relevant purpose and on an appropriate legal basis.

11. Data processors and service providers

Where a third party processes data on behalf of S.R.L. “GLOBAL LUX TRAVEL”, the company will take measures to ensure that processing is carried out under contractual terms and with appropriate security and confidentiality safeguards.

Data processors will process data only in accordance with the controller's instructions and for the specified purposes.

12. International data transfers

Where personal data is transferred to recipients outside the Republic of Moldova or in other jurisdictions, S.R.L. “GLOBAL LUX TRAVEL” will apply the requirements of applicable legislation concerning international data transfers.

Transfers will be carried out only where a basis and appropriate safeguards provided for by applicable legislation exist.

13. Employee access to data

Employees are granted access to personal data on a “need-to-know” basis. Each employee will have access only to the data necessary to perform their duties.

Employees and collaborators who have access to data are required to:

maintain the confidentiality of data;
use data exclusively for professional purposes;
not disclose data to unauthorised persons;
not copy or transfer data without authorisation;
comply with internal security procedures.

The duty of confidentiality continues after the end of employment or collaboration, to the extent provided for by law and contract.

14. Technical security measures

S.R.L. “GLOBAL LUX TRAVEL” applies appropriate technical measures proportionate to the identified risks, including, where applicable:

the use of secure connections;
system access control;
user authentication;
individual passwords and measures to protect them;
restrictions on access rights;
software and system updates;
protection against malware;
data backups;
monitoring of system access;
logging of relevant events;
database protection;
segmentation of access to resources;
measures to protect devices used for data processing;
other technical measures determined on the basis of risk assessments.

15. Organisational measures

The company applies organisational measures to protect data, including:

defining staff responsibilities;
regular employee training;
rules governing access to data;
incident management procedures;
procedures for exercising data subjects' rights;
risk assessments;
periodic checks of security measures;
oversight of suppliers and data processors;
updates to internal data protection documentation.

16. Security incident management

Any employee or collaborator who identifies or suspects:

unauthorised access;
data loss;
accidental disclosure;
data destruction;
unauthorised alteration;
a compromised account;
a cyberattack;
the loss of a device containing data;

must immediately inform the responsible person designated by the company.

S.R.L. “GLOBAL LUX TRAVEL” will assess the incident and take the necessary measures to limit its consequences, document the incident and, where appropriate, notify the competent authority and/or inform the data subjects in accordance with applicable legislation.

17. Risk assessment

S.R.L. “GLOBAL LUX TRAVEL” assesses the risks associated with personal data processing and applies measures proportionate to the level of risk.

The assessment will take into account, where applicable:

the nature of the data;
the volume of data;
the number of data subjects;
the purposes of processing;
the technologies used;
the recipients of the data;
international transfers;
the likelihood of an incident occurring;
the potential impact on data subjects.

For processing likely to result in a high risk to the rights and freedoms of individuals, the company will assess the need to conduct a data protection impact assessment.

18. Data retention period

Personal data is retained only for the period necessary to achieve the purpose for which it was collected or for the period required by applicable legislation.

After the relevant period has expired, data is:

deleted;
destroyed;
anonymised; or
archived where retention is required by law.

Retention periods will be determined according to the category of data and the purpose of processing.

19. Data subjects' rights

Data subjects have the applicable rights under the conditions laid down by law, including:

the right to be informed;
the right of access to data;
the right to rectification of data;
the right to erasure of data;
the right to restriction of processing;
the right to data portability, where applicable;
the right to object;
the right to withdraw consent;
rights relating to automated processing and profiling, where applicable.

Requests from data subjects are reviewed in accordance with the time limits and procedures established by applicable legislation.

20. Exercising rights

To exercise their rights concerning personal data, data subjects may contact S.R.L. “GLOBAL LUX TRAVEL” using the contact details published on the company's website or through other official communication channels.

The company may request additional information necessary to verify the identity of the requester where this is necessary to protect data and prevent unauthorised access.

21. Minors' data

Where the provision of travel services involves processing minors' data, S.R.L. “GLOBAL LUX TRAVEL” will process such data only to the extent necessary to achieve the legitimate purpose and in accordance with applicable legal requirements.

Minors' data will not be used for purposes incompatible with the purpose for which it was collected.

22. Personal data included in travel documents

Where data from identity or travel documents is required for booking or providing travel services, it will be requested only to the extent necessary to provide the service or fulfil a legal obligation.

Access to this data will be restricted to individuals who need it to perform their duties.

23. Use of email and communication systems

S.R.L. “GLOBAL LUX TRAVEL” may use email, telephone and other means of communication for:

handling requests;
communicating about bookings;
providing services;
sending documents;
providing information about changes to services;
marketing communications where an appropriate legal basis exists.

Marketing communications will comply with legal requirements concerning direct marketing and the individual's right to object or unsubscribe.

24. Responsibilities

The management of S.R.L. “GLOBAL LUX TRAVEL” is responsible for ensuring the resources necessary to implement data protection measures.

Designated individuals within the company are responsible, within the scope of their duties, for:

implementing security measures;
managing access;
monitoring incidents;
training staff;
handling data subjects' requests;
working with suppliers;
periodically reviewing security measures.

If the company appoints a Data Protection Officer (DPO), their contact details will be communicated to data subjects and published in the company's relevant documents.

25. Policy review

This Policy is reviewed periodically and whenever:

legislation changes;
new IT systems are introduced;
new processing activities are introduced;
new categories of data arise;
new risks are identified;
security incidents occur;
the company's organisational structure or responsibilities change.

The updated version of the Policy will be approved by the company's management.

26. Final provisions

This Policy is binding on employees, collaborators and individuals who have access to personal data in the course of their activities for S.R.L. “GLOBAL LUX TRAVEL”.

No person may process personal data beyond the purposes and scope of authority established by the company and applicable legislation.

This Policy enters into force on the date of approval.