Privacy Policy
How we handle your website enquiries and personal information.
Last updated: 29 October 2026
1. Scope of this policy
This Privacy Policy explains how CRE World Group, Inc. handles personal data in connection with luxoracard.com, website enquiries and email support. It covers the informational website and its contact form.
Card applications, identity verification, accounts and payment services may involve separate providers and additional privacy notices. Those notices must be reviewed before using the relevant service. This website policy does not describe an unconfirmed card provider or identity-verification arrangement.
2. Who is responsible
CRE World Group, Inc.
Registered office:
1603 Capitol Ave, Suite 310
Cheyenne, WY 82001
United States of America
For website privacy enquiries and rights requests, contact info@luxoracard.com. For general card enquiries, contact support@luxoracard.com.
3. Visiting this website
When you access the website, technical information is processed to deliver pages and maintain reliable, secure operation. This can include your IP address, the requested page or file, request time, browser and operating-system information, referring page and technical status or error information.
We use this information to provide the website, identify errors, investigate abuse and protect our systems. Server and security logs are separate from the information stored with a contact-form submission.
4. Contact form and email
Our contact form asks for your name, email address and message. We process the information you submit and related correspondence to understand your enquiry, respond to you and maintain a record of the conversation. Required fields are marked in the form. Without a usable email address, we may be unable to reply.
The form uses SureForms within our WordPress website. Submissions are stored in the website administration system and sent to our team by email. An acknowledgement email is sent to the address you provide. Email delivery uses SureMail with the World4You SMTP service; our mailboxes are provided through World4You Internet Services GmbH, Austria.
The form is configured not to store your IP address, browser name or device name in its submission entries. This does not prevent technical processing by the web server, mail system or security measures.
Please do not send passwords, full card numbers, security codes, identity documents or other sensitive information through this general contact form. Contacting us does not itself subscribe you to marketing emails.
5. Why we process data and the legal bases
Where the EU General Data Protection Regulation applies, the relevant legal basis depends on the purpose:
- Website operation, security and general enquiries: our legitimate interests in running a reliable website, preventing misuse and communicating with visitors, under Article 6(1)(f).
- Requests about a proposed or existing contract: processing necessary to take steps at your request before a contract, or perform a contract with you, under Article 6(1)(b), where applicable.
- Legal obligations: processing required by an applicable legal obligation, under Article 6(1)(c).
- Optional activities based on consent: Article 6(1)(a), where consent is the applicable basis. You may withdraw consent for future processing.
We use only the basis relevant to the particular processing activity. A general enquiry is not consent to unrelated marketing or other optional processing.
6. Cookies and consent choices
Google Analytics 4
With your consent to Analytics Cookies, we use Google Analytics 4 through Site Kit by Google to understand visits and improve this website. The provider is Google, including Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Analytics processes pseudonymous identifiers, page views and related interaction data, referral sources, browser and device information and approximate location. Technical connection data, including your IP address, is processed when your browser connects to Google. Google states that GA4 does not log or store individual IP addresses; this does not make all Analytics data anonymous.
Our Google tag is blocked until you allow the Analytics category. SureCookie communicates your choices through the WP Consent API and Site Kit Consent Mode. You can refuse or withdraw consent using Cookie Preferences. Withdrawal stops Analytics on subsequent page loads and does not invalidate earlier lawful processing. Where the GDPR applies, we rely on your consent under Article 6(1)(a) and, where required, consent for storage or access on your device.
Analytics uses first-party cookies such as _ga and _ga_<identifier> to distinguish browsers and maintain session information. Google’s default cookie duration is up to two years and may be renewed on a later visit with consent. You can delete these cookies in your browser. Cookie duration and the retention of data already held in Analytics are separate.
Processing may involve Google group companies and servers outside your country, including the United States. Google’s applicable data-processing terms and transfer arrangements apply; information about safeguards is available in Google’s documentation and on request. Transfers can involve different legal protections. We do not link Analytics to Google Ads or AdSense. Automatic enhanced measurement is disabled; names, email addresses, contact-message text, payment-card details, wallet private keys and recovery phrases must not be sent as Analytics data.
See Google’s Privacy Policy, Google Analytics data safeguards and our Cookie Policy. You can also use Google’s Analytics opt-out browser add-on.
7. Who may receive information
Access is limited to people and service providers who need the information for the purposes described here. Depending on the activity, recipients can include authorised company personnel, website hosting and technical support providers, email infrastructure providers, security service providers and professional advisers.
World4You Internet Services GmbH provides the email service used for our correspondence. SureForms and SureMail operate as plugins in our WordPress installation; naming a plugin does not mean every message is sent to its developer.
Information may also be disclosed to public authorities or other recipients where required by law or necessary to establish, exercise or defend legal claims.
8. International processing
CRE World Group, Inc. is registered in the United States, and our email infrastructure includes an Austrian service provider. Depending on where authorised personnel and service providers are located, processing or access may take place outside your country of residence, including in the United States.
Where EU or EEA data-protection law applies, transfers to a country outside the EEA require an applicable legal transfer basis. Such a basis may include an applicable adequacy decision or appropriate contractual safeguards, where their legal conditions are met. Company registration in the United States does not itself establish such a basis.
Contact us at info@luxoracard.com for information about the destinations and safeguards applicable to your data and how to obtain relevant details.
9. How long information is kept
Contact-form entries and correspondence are kept for as long as needed to handle the enquiry and relevant follow-up. When determining retention, we consider whether the enquiry is resolved, an ongoing service relationship exists, or records are needed for a legal obligation or to establish, exercise or defend a legal claim.
Technical logs are retained according to their operational and security purpose. Records subject to a justified legal hold may be retained longer. Backup copies may remain until the relevant backup cycle replaces them.
10. Security
We use technical and organisational measures intended to protect personal data, including encrypted website connections, access controls and restrictions on administrative access. No internet transmission or storage system can be guaranteed completely secure.
If you believe information has been exposed or a message is suspicious, contact us using the details on this page.
11. Your privacy rights
Depending on the law that applies, you may have the right to request access to your personal data, correction, deletion, restriction of processing and data portability. You may also object to processing based on legitimate interests on grounds relating to your situation.
Where processing is based on consent, you may withdraw it at any time without affecting processing carried out lawfully before withdrawal. You may object to direct marketing at any time.
Send requests to info@luxoracard.com. We may request proportionate information to verify your identity before disclosing or changing personal data. We respond within the period required by applicable law. Rights can be subject to legal conditions and exceptions.
Where the GDPR applies, you may lodge a complaint with a supervisory authority, particularly in the EU or EEA country where you habitually reside, work or consider an infringement occurred. You do not need to contact us before making a complaint.
12. External links and future services
When you follow a link to a website operated by another organisation, that organisation is responsible for its own processing. Review its privacy information before providing personal data.
If we introduce card onboarding, identity verification, analytics, marketing subscriptions or other new processing, this policy and any service-specific notices will need to reflect the actual providers and processing before those functions are offered.
13. Changes and contact
We may update this policy when website functions, processing arrangements or legal requirements change. The date at the top identifies this version.
Privacy enquiries: info@luxoracard.com
Website contact form: Contact Luxora Card
Company details: Legal information