Privacy Policy

Hype Luxury is an ultra-luxury mobility platform. We arrange private aviation, superyacht charters, chauffeured ground transport and related concierge services for clients worldwide.

In this Policy, “Hype Luxury”, “we”, “us” and “our” mean the following companies:

GoHype Technologies Private Limited’s registered office is #43, WeWork Galaxy, Residency Road, Ashok Nagar, Bengaluru 560025, Karnataka, India. Hype Mobility Concierge Services FZCO is registered in Dubai Silicon Oasis, Dubai, UAE.

The company that handles your booking is the “data fiduciary” or “data controller” for your personal data. That means it decides why and how your data is used and is responsible for protecting it.

This Policy explains how we collect, use, share and protect personal data when you:

• visit hype.luxury or any of our related websites or landing pages (the “Website”);
• use our mobile application (the “App”);
• make an enquiry, booking or membership application, including GODDS Club membership;
• talk to us by email, phone, WhatsApp or other messaging channels; or
• deal with us as a partner, operator or supplier.

This Policy covers us only. It does not cover third-party websites, aircraft or yacht operators, or other services that we link to or work with. Those parties have their own privacy policies.

Laws we follow. We process personal data in line with the laws that apply to you and to us, including:

• India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025;
• India’s Information Technology Act, 2000 and the related rules;
• the UAE’s Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data;
• the EU General Data Protection Regulation and the UK GDPR, where we serve clients in Europe or the UK; and
• the California Consumer Privacy Act, as amended by the CPRA, where it applies.

Using our Website does not, on its own, mean you consent to everything in this Policy. Where we need your consent, we ask for it clearly and separately (see Section 5).

We collect only the data we need to plan, deliver and protect your journey.

3.1 Data you give us

• Identity and contact details: name, title, email address, phone and WhatsApp number, postal and billing address, nationality, date of birth.
• Travel and identity documents: passport details, visa information and government ID. Aviation and maritime safety, customs and immigration rules require these for passengers, guests and crew manifests.
• Booking details: routes, dates, aircraft or yacht preferences, passenger and guest lists, pickup and drop-off locations, flight and charter history.
• Preferences and special requests: catering, dietary requirements, accessibility needs, accommodation, pet travel details, and other requests you share so we can tailor your experience. Health-related details are treated as sensitive information (see Section 5).
• Payment details: billing information and transaction records. Card details are handled by our PCI-DSS-compliant payment processors. We do not store full card numbers.
• Membership information: application details, verification and KYC documents for GODDS Club and other membership programmes.
• Communications: emails, call notes, WhatsApp and chat messages, feedback, reviews and testimonials you choose to share.
• Data about other people: if you book for guests, family members, staff or pets, you confirm that you have their permission to share their details with us and that you have told them about this Policy.

3.2 Data we collect automatically

• Device and usage data: IP address, browser type, device type, operating system, pages viewed, time spent on pages, referring website and approximate location based on IP address.
• Cookies, pixels and similar technologies: see Section 7, which sets out our full cookie policy and the cookies we use.
• App data: if you allow it, precise location while a ground transport booking is active, so we can coordinate pickup. You can switch this off in your device settings at any time.

We do not access your contacts, call logs or SMS messages.

3.3 Data from third parties

• Aircraft, yacht and ground transport operators who carry out your booking.
• Payment processors, which confirm transaction status.
• Partners, advisors or concierge services who refer you to us.
• Identity verification and fraud prevention services.
• Advertising and analytics platforms such as Google and Meta, which send us summary campaign reports.

We do not sell your personal data. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects on you.

We rely on these legal grounds:

• Contract: to deliver the services you book or request.
• Consent: for marketing messages, non-essential cookies and tracking, precise location, and health-related information. You can withdraw consent at any time, and withdrawing will be as easy as giving it. Withdrawing does not affect processing we carried out before you withdrew.
• Legal obligation: for aviation and maritime manifests, tax records, KYC and anti-money-laundering checks, and lawful requests from authorities.
• Legitimate uses and legitimate interests: for fraud prevention, security, and defending legal claims, where the law permits this and your rights do not override it.

Where the Indian DPDP Act applies, we process your personal data only with your consent or for the legitimate uses the Act allows. We give you a clear notice of what we collect and why when we ask for your consent. You may give, manage or withdraw consent directly with us or through a Consent Manager registered with the Data Protection Board of India.

Our legitimate interests are keeping our platform, clients and partners secure, preventing fraud and misuse, and establishing or defending legal claims.

Do you have to give us your data? Identity, contact, passport and booking details are required to make and operate a booking, and some are required by aviation, maritime, customs and immigration law. If you do not provide them, we cannot complete your booking. Everything else, including marketing preferences and health-related information, is optional.

Sensitive information. Some information you share may reveal health details, such as dietary requirements, allergies, mobility or accessibility needs, or medical requirements during travel. We collect this only if you choose to share it, and only with your explicit consent. We use it only to deliver your booking safely, and we share it only with the operators and partners who need it for your journey, such as the caterer or crew. We never use it for marketing, profiling or AI training. You can withdraw this consent at any time. If you do, we may be unable to accommodate those needs.

We share personal data only when we need to, and only with parties who are bound to protect it.

Our service providers act on our instructions under written contracts that require confidentiality and security.

We do not sell your personal data. We do not “share” it for cross-context behavioural advertising, as the CCPA defines that term, unless you have consented to marketing cookies through our cookie banner. You can opt out at any time by rejecting marketing cookies in “Cookie Settings” in the Website footer, or by emailing privacy@hype.luxury.

We may share aggregated or anonymised data that cannot identify you.

This section is our cookie policy. It explains what cookies we use, why, and how you control them.

Cookies are small files stored on your device when you visit a website. We also use similar technologies such as pixels, tags, software development kits (SDKs) and local storage. In this Policy, we call all of these “cookies”.

7.1 Categories of cookies

7.2 Cookies we use

We review this list regularly. The current list is always available in “Cookie Settings” in the Website footer.

7.3 How third-party tracking works

When you consent to analytics or marketing cookies, tools from Google LLC and Meta Platforms, Inc. may collect information from your browser. This can include your IP address, device identifiers, pages viewed and actions taken on our Website. These companies use it to provide measurement and advertising services to us. They may also use it for their own purposes under their own privacy policies, available at policies.google.com/privacy and facebook.com/privacy/policy.

7.4 Your control

Non-essential cookies are placed only after you accept them through our cookie banner. The banner appears when you visit the Website and stays until you accept or reject. You can accept all, reject all, or choose by category. Rejecting is as easy as accepting. You can change your choice at any time through “Cookie Settings” in the Website footer. You can also delete or block cookies in your browser settings, but some parts of the Website may then not work properly.

7.5 Search engines and crawlers

Search engines such as Google index only the public pages of our Website. They cannot see your account, bookings, session data or the cookies stored on your device.

Our operations run on NORDZ, our own AI platform. We use it in 3 ways:

1. 1.
   Handling your requests. When you contact us by WhatsApp, email, phone or our Website, AI systems read your message to understand what you need. They route it to the right team and help prepare quotes and itineraries. Our team oversees this process.
2. 2.
   Personalising your service. We use your booking history and stated preferences to recommend aircraft, yachts, vehicles and options suited to you. You can ask us to stop personalising recommendations at any time.
3. 3.
   Improving our services. We train and improve our AI models using de-identified data, such as booking patterns, routes, pricing and service-quality trends. Before we use it, we remove names, contact details, passport details and payment information. We never use passport, payment or health-related information to train AI models.

AI providers. We use third-party AI model providers to process requests on our behalf. They act as our service providers under contracts that prohibit them from using your data to train their own models.

No significant automated decisions. AI does not make decisions that have legal or similarly significant effects on you. A member of our team confirms every booking and every membership decision.

Your choices. You can ask to speak with a person at any time. You can also opt out of personalised recommendations, or object to your data being used to improve our AI, by emailing privacy@hype.luxury.

We serve clients globally. To deliver your journey, your personal data may be transferred to and processed in countries other than your own, including India, the UAE, the UK, countries in the European Union, the United States, Japan, and wherever your flight, charter or transfer takes place.

When we transfer data across borders, we protect it with appropriate safeguards. These include contractual commitments such as the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, and transfers to countries the relevant authorities consider adequate. Some transfers are necessary to perform the service you requested, such as sending passenger details to a foreign operator or airport. We follow any transfer restrictions the Government of India notifies under the DPDP Act.

You can ask us for more information about the safeguards we use (see Section 15).

We keep personal data only while we need it to serve you. You can ask us to delete it at any time, and we will do so within 30 days. If you have not booked, logged in or contacted us for 3 years, we treat the purpose as complete. We will notify you 48 hours before deleting your data, so you can keep your account active if you wish. Records that the law requires us to keep are retained only for the legal minimum and used for no other purpose.

When the retention period ends, we delete or anonymise the data. If we cannot do this immediately, for example because the data is in backups, we keep it secure and isolated until we can delete it.

We use technical, organisational and physical safeguards suited to the sensitivity of the data our clients trust us with. These include encryption in transit and at rest, role-based access controls, multi-factor authentication, vendor security reviews, staff confidentiality agreements and logging of access to personal data.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will inform affected individuals without delay, explaining what happened, the likely consequences and the steps we are taking. We will inform the Data Protection Board of India without delay and send it a detailed report within 72 hours. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours.

Depending on where you live, you have some or all of these rights:

• Access: get a summary of the personal data we hold about you and how we use it.
• Correction and update: fix inaccurate or incomplete data.
• Erasure: ask us to delete your data, unless we must keep it by law.
• Withdraw consent: at any time, for any processing based on consent.
• Object or restrict: to certain processing, including direct marketing.
• Portability: get your data in a commonly used, machine-readable format.
• Opt out of sharing for advertising: by rejecting marketing cookies in “Cookie Settings” (California residents and others).
• Nominate: appoint another person to exercise your rights if you die or become incapacitated (India).
• Grievance redressal: raise a complaint with our Grievance Officer (Section 15).
• Complain to a regulator: including the Data Protection Board of India, the UAE Data Office, the UK Information Commissioner’s Office, or your local data protection authority in the EU.

How to exercise your rights. Email privacy@hype.luxury or write to our Grievance Officer. We may need to verify your identity before acting on your request. We will respond within 30 days, or sooner if the law requires. California residents: we will acknowledge your request within 10 business days and respond within 45 days. We will not treat you differently for exercising your rights.

To stop marketing emails, use the “unsubscribe” link in any email. To change your cookie choices, use “Cookie Settings” in the Website footer.

Our services are for adults aged 18 or older, or the age of majority where you live if that is higher. Children may travel only as passengers or guests on a booking made by a parent or lawful guardian.

Before we process a child’s personal data, we obtain verifiable consent from the parent or lawful guardian. We confirm that the person giving consent is an identifiable adult by checking their identity against the KYC and identity details we already hold for the adult making the booking, or by other verification methods the law permits.

We use a child’s data only to deliver the journey and to meet legal requirements, such as passenger manifests. We do not track or monitor children’s behaviour, and we never use their data for marketing, profiling or targeted advertising.

If we learn that someone under 18 has created an account or given us their data without verifiable parental consent, we will suspend the account and delete the data.

We may update this Policy to reflect changes in our services or the law. We will post the new version on this page with a new “Last updated” date. If the changes are significant, we will notify you by email or with a notice on the Website before they take effect. Where the law requires it, we will ask for your consent again.

You may request this Policy in English or in any language listed in the Eighth Schedule to the Constitution of India by emailing privacy@hype.luxury.

Under India’s Information Technology Act, 2000, the rules made under it, and the DPDP Act, 2023, our Grievance Officer is:

We will acknowledge your complaint within 24 hours and resolve it within 30 days.

UAE clients: Hype Mobility Concierge Services FZCO, Dubai Silicon Oasis, Dubai, UAE. Email: privacy@hype.luxury

General enquiries: care@hype.luxury

If you are not satisfied with our response, you may complain to the Data Protection Board of India or to your local data protection authority.