PRIVACY POLICY

1. DATA CONTROLLER & BUSINESS IDENTIFICATION

For the purposes of applicable data protection laws, Uxel Limited acts as:

• Data Controller regarding personal data collected from our corporate customers, website visitors, and account admin users.
• Data Processor regarding end-customer booking data uploaded or processed through the Platform by our B2B travel operator clients.

Official Corporate Identification:

• Legal Entity: Uxel Limited
• Hong Kong Business Registration No.: 80932841
• Registered Office Address: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Hong Kong S.A.R.
• Official Data Protection Email: support@uxel.io
• Customer Support Phone: +905326061290

2. CATEGORIES OF DATA WE COLLECT

We collect personal data necessary to deliver our B2B SaaS channel management software and process subscription transactions. The categories of data collected include:

2.1 Account & Corporate Identification Data

• Full name, job title, and corporate email address of client representatives.
• Company name, registered business address, company registration/tax number, and telephone number.
• User account credentials (usernames, hashed passwords, API access keys).

2.2 Payment & Financial Information

• Billing contacts, invoicing address, and tax identification numbers.
• Payment card details, IBAN/SEPA bank transfer records, and transaction logs. (Note: Full credit card numbers are processed directly by our PCI-DSS compliant payment processing partner, Airwallex, and are never stored on Uxel servers).

2.3 Technical & Platform Usage Data

• IP address, browser type, operating system, device parameters, and login time stamps.
• Usage metrics, API request logs, system activity, and feature interaction data.

2.4 B2B Customer & Travel Inventory Data (Processed on Behalf of Clients)

• Guest/passenger names, reservation IDs, channel partner source, travel dates, and itinerary information synced via API connections from tour operators and distribution channels.

3. HOW WE COLLECT YOUR DATA

We collect data through the following methods:

• Direct Interaction: When you create an account on Uxel.io, subscribe to a pricing tier, submit a support ticket, or contact us via email/phone.
• Automated Technologies: As you navigate through the Site or access our API endpoints, automated logging scripts collect technical diagnostic data and usage statistics.
• Third-Party Integrations: Payment updates and verification statuses received from our payment gateway partners (Airwallex / Stripe).

4. PURPOSE & LEGAL BASIS FOR PROCESSING

We process personal data strictly under valid legal grounds as defined under Hong Kong PDPO and GDPR Article 6:

5. DATA DISCLOSURE & THIRD-PARTY SHARING

Uxel does not sell, trade, or rent personal data to third parties or advertisers. We share personal data only with trusted service providers who perform critical infrastructure functions under strict confidentiality and security obligations:

• Payment Service Providers: Payment processing and billing adjustments are securely routed through Airwallex (Hong Kong) Limited and its affiliate entities.
• Cloud Infrastructure & Hosting: Enterprise cloud hosting, encrypted database backups, and server infrastructure providers located in secure data centers.
• Professional Advisors: External auditors, legal advisors, and tax consultants in Hong Kong solely for regulatory compliance and annual audit filings.
• Legal & Regulatory Authorities: When required by law, court order, or governmental authorities (such as the Hong Kong Inland Revenue Department or Hong Kong Police Force).

6. CROSS-BORDER DATA TRANSFERS

Because Uxel operates a global B2B channel management platform, personal data may be transferred, stored, and processed in Hong Kong, Europe, or other secure data center regions where our cloud servers operate. Where data originating from the European Economic Area (EEA) is transferred internationally, Uxel ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and adherence to equivalent security standard practices under the Hong Kong PDPO.

7. DATA SECURITY & RETENTION

7.1 Security Measures

We implement appropriate technical and organizational measures to safeguard personal data, including:

• Transport Layer Security (TLS 1.3) encryption for all data in transit across uxel.io and API endpoints.
• AES-256 bit encryption for data at rest.
• Role-based access control (RBAC) and strict authentication protocols for technical administrators.
• Continuous server monitoring and vulnerability scanning.

7.2 Retention Period

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active Account Data: Retained for the duration of your active SaaS subscription.
• Financial & Billing Records: Retained for seven (7) years following the end of the relevant financial year in compliance with Hong Kong tax and corporate accounting laws.
• Deleted Account Logs: Purged or anonymized within ninety (90) calendar days of subscription termination, unless longer retention is required by applicable law.

8. YOUR DATA PROTECTION RIGHTS

Under applicable privacy legislation (including the Hong Kong PDPO and EU GDPR), you possess the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data held by Uxel regarding your account.
• Right to Correction / Rectification: You may request that incomplete or inaccurate data be corrected.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data when it is no longer needed for the purposes for which it was collected (subject to legal retention requirements).
• Right to Restrict or Object to Processing: You may object to data processing carried out under legitimate interest grounds.
• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format.

To exercise any of these rights, please contact our Data Protection team at support@uxel.io. We will respond to verified requests within thirty (30) calendar days.

9. COOKIES & TRACKING TECHNOLOGIES

Our Site uses essential cookies and session tokens strictly necessary for platform functionality, secure login authentication, and load balancing:

• Essential Session Cookies: Required to maintain secure authenticated user sessions on https://uxel.io.
• Analytical Cookies: Aggregated, non-identifiable usage statistics used strictly to monitor site speed and optimize user experience.

You may configure your web browser to reject non-essential cookies, though doing so may limit your access to certain interactive dashboard features.

10. CHANGES TO THIS PRIVACY POLICY

Uxel reserves the right to update or modify this Privacy Policy at any time to reflect operational, legal, or regulatory updates. Any changes will be posted on this page with an updated "Last Updated" date at the top. We encourage client representatives to review this policy periodically.

11. CONTACT US & DATA PROTECTION INQUIRIES

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data handling practices, please contact us:

• Uxel Limited
• Attn: Data Protection Officer
• Registered Address: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Hong Kong S.A.R.
• Email: support@uxel.io
• Phone: +905326061290