Privacy notice

Lux Express Estonia AS and all the associated legal entities (all together and each separately) that carry out Estonian domestic as well as international regular passenger bus transportation under the Lux Express brand (hereinafter referred to as "Lux Express" or "us", “our”) highly value their customers (hereinafter “You” or “Your” ) privacy.

The purpose of this privacy notice is to help you understand why and how we process your personal data and what are your rights in relation to your personal data. We explain what we do to securely process your personal data.

This privacy notice applies to you if travel with us, visit our website or if purchase a ticket from our website. The privacy notice also applies if you subscribe to our newsletter or have expressed a wish to receive our offers, as well as if you submit an information request in our online environment.

Depending on the country in whose territory personal data is processed, the Lux Express personal data processing principles contained in this document apply to the extent that they do not conflict with local legislation.

1.    Who is the controller of your personal data?
Data "controller" means the entity that makes decisions about how your data is used and is responsible for how it stores personal data about you.

Lux Express Estonia AS (registration number 10092807) Lastekodu tn 46, Tallinn, 10113, Estonia is the responsible controller for all personal data referred to in this privacy notice, unless explicitly stated otherwise. The data controller can be contacted by e-mail at info[at]luxexpress.ee

2.    Why do we collect and process personal data?
Personal data is any data about an identified or identifiable natural person. A person can be identified directly or indirectly based on, for example, name, personal identification number or location information. Processing of personal data means any operation with personal data such as collection, arrangement, structuring or storage.

We process your personal data in order to provide you with a convenient and safe passenger transport service. We will not use your personal data for purposes other than those outlined in this privacy notice.

3.    What personal data do we process, for what purpose and on what legal basis?
Data that you provide to us yourself
In order to buy Lux Express tickets online, you provide us with the following information on the website www.luxexpress.ee, through agents or at our points of sale:

Information we receive from you when you buy tickets online
In addition, we collect data about which of our services and how you use them, for example, when you visit our website, we store information about this. We collect the following data about the use of our services:

* According to the current legislation, the ticket is essentially a contract between the customer and Lux Express for the provision of passenger transport services.

** In the case of international trips, we have an obligation under the Estonian State Border Act to ask for the customers' first and last names when issuing the ticket.

*** Consent can be withdrawn at any time by using the option to change preferences in the footer of each newsletter or promotional offer.

Processing of personal data of minors

Lux Express offers discount tickets for preschool children (up to 7) and children (up to 16 years old), the passenger chooses the discount ticket that suits them, we do not ask for or record in our sales system the passenger's age, but we could ask for a document proving the discount when the passenger enters the bus. The discount applies to both named and unnamed tickets.

Processing personal data with CCTV

Lux Express has installed CCTV in the buses to ensure the safety of employees and passengers and to protect the company's property. The CCTV is angled in a way as to avoid as much as possible identification of passengers. The cameras record images and sound.

We have also installed traffic monitoring cameras on buses traveling on certain routes, which are directed to the road to monitor the road traffic, but the camera's field of view may also include the number plates of other vehicles. The cameras record images and do not record sound.

We have installed video cameras in some ticket sales points to ensure the safety of employees and to protect the company's property. The cameras record images and sound.

The use of CCTV is marked with appropriate signs.

CCTV recordings are stored for 14 days, after which the recording is permanently deleted, unless there is a crime on the recording for which the police is investigating and has requested the video footage.

How do we process your personal data on Lux Express Facebook page?

You can join or like Lux Express Facebook page in which case we will see your name and clicking on that name we would also see your public profile’s information. With the Facebook page you have to keep in mind that:

- the page is visible to everybody;

- anyone can comment the posts on page;

- posts are published in page official language (for example: Estonian,, Latvian, English, Russian). We permit automatic translation of posts to readers in other languages;

- we apply automatic filtering of the content of the poster’s message, which means that Facebook automatically prevents the publication of posts that contain generally known offensive expressions (the Profanity Filter setting – medium);

- you can contact us privately via Facebook;

- everybody can refer to the page of Lux Express and to its public content;

- we receive the statistical data of use collected by Facebook in a de-personalised format. Facebook prepares the statistics by collecting your personal data. How Facebook manages your privacy you can read in Meta’s Privacy Centre.

4.    Security of personal data processing
We use adequate organizational and technological measures to protect your data from unauthorized access, modification, disclosure or breach.

To ensure data security:
1. We treat all personal data as confidential. Our employees have signed a confidentiality agreement and received the relevant training.
2. We encrypt services where possible using SSL or other methods with a similar level of security.
3. We limit access to personal information by giving access only to those employees and contractors who need the information to perform their work duties. They are subject to strict contractual confidentiality obligations and are subject to sanctions or termination if they fail to meet these obligations.
4. We keep personal data in digital form and not on paper to ensure faster and safer execution of access control.
5. The personal data repository is protected by the necessary IT technical and organizational protection measures. Information security standards are in place and appropriate contracts have been concluded with service providers.

5.    Third parties, authorized persons and cross-border transfer of personal data
Lux Express transmits personal data only to such third parties and authorized processors with whom an appropriate data protection agreement has been concluded and who implement adequate security measures to ensure the security of personal data protection.

Lux Express transfers personal data to authorized third parties for the following purposes:
- to the provider and developer of the technical solution of the ticket sales system;
- at the customer's request, to mediate the application for travel insurance or to mediate the application for a visa necessary for the customer to cross the border;
- to send newsletters and marketing messages.

Lux Express mostly processes customer data within the European Union/European Economic Area. We transfer personal data outside the borders of the European Union/European Economic Area, if there is a legal requirement for this, e.g. fulfilment of a legal obligation, for example, the destination of the trip is in the Russian Federation. In accordance with the legislation of the Russian Federation, Lux Express transmits personal data necessary for crossing the border of the Russian Federation to the unified national information system of Russia. Lux Express applies appropriate security measures to the cross-border transfer of personal data.
 

6.    Rights of the data subject
In accordance with the General Data Protection Regulation (EC 2016/679), you have a right to:
• access to your personal data, which means asking what data we process about you and getting an extract from this data.
• correct your data.
• request that we delete your data. Not all data can always be deleted, for example if we process your data to comply with a legal obligation, we cannot delete it before the legal deadline.
• Request the restriction of the processing of your personal data.
• To request the transfer of your personal data to another controller, if it is technologically feasible.
• Always withdraw consent to the processing of personal data. To withdraw your consent, either use the preferences link in the footer of the e-mail sent to you or write to us at [email protected].

We do not profile you based on personal data or make any automated decisions.

We have a legal obligation to ensure that personal data is disclosed only to you, therefore we need to uniquely identify you. If we cannot identify you, we cannot send you personal data. To exercise your rights and forward your request, please contact us as specified in the "Contact" section of this document.

Please note that you can request the deletion of your personal data, restriction of processing only if it is in accordance with applicable laws on data protection.

If you request the restriction or deletion of, or you object to, personal data processing, this may partially or completely stop the services we provide to you.

In case of complaints, you have the right to file a complaint with the competent data protection authority. We cooperate with relevant regulatory authorities, including local data protection authorities, to resolve complaints related to the transfer of personal data.

7.    Storage of personal data
Lux Express stores personal data as long as it is necessary to fulfil the purposes of personal data processing. After the end of the retention period, Lux Express securely destroys and/or deletes all personal data.

In order to comply with the legal requirements, we store data as long as the retention period specified in the law, for example, issued travel tickets, if we store the initial accounting documents for 7 years from the date of issuance of the ticket in accordance with the Estonian Accounting Act.

We store personal data processed on the basis of the client's consent as long as it is necessary to fulfil the purposes for which the personal data is processed on the basis of consent or until the consent is withdrawn.

8.    Cookie settings
Lux Express uses cookies on the websites www.luxexpress.eu and www.luxpress.ee to make the user experience on the website more convenient and to enable the purchase of tickets online.

A cookie is a small text file that is automatically saved by the web browser on the device used by the person. We use cookies:
- Functionality cookies are used for essential functions during your visit to the website. These include identifying the country and language used, processing the transaction, identifying the version of the website being used (whether mobile or desktop), fraud detection and prevention and ensuring compliance and website stability. These cookies are classified according to the needs of keeping the website up and running.
- Performance cookies collect information about the performance of our website and your use of the website, such as the pages you visit and whether you experience any errors, so that it is easier for Lux Express to fix website problems. They also identify how much you use different parts of the website. These cookies usually collect anonymous statistical data. All information is anonymous and is used only to help us enrich your experience on our website, understand your interests and measure marketing effectiveness.
- Service cookies improve user comfort. It stores information about the choices you make. With this, we can show you more relevant and personal information.

Users can make changes to their browser's cookie settings at any time. By changing these settings, the user can block the automatic processing of cookies in the web browser settings or set up a notification about cookies every time they enter the website. More detailed information about the options to manage cookies is available in the user manual of the web browser software used by the end user, and at www.aboutcookies.org. If cookies are not used, websites may not work correctly and all services may not be available.

9.    Changes to the Privacy Notice
Lux Express regularly updates this privacy notice. We always publish the most up-to-date version of the privacy notice on the website.

10.    Contact
For all questions, concerns or suggestions regarding the processing of personal data, you can contact the data controller at the following contacts: [email protected]