Go Luxus is designed to minimize the exposure of sensitive payment information by using trusted third-party payment gateways and secure payment-processing infrastructure.

The general payment architecture is:

Customer → Go Luxus Platform → Secure Payment Gateway → Banking/Card/UPI Network → Payment Gateway → Go Luxus → Booking/Travel Supplier

Payment authentication and processing may be performed by the relevant payment gateway, bank, card network, UPI provider or other authorized payment service provider.

Go Luxus does not intend to store complete card numbers, CVV numbers, card PINs or other sensitive card authentication information on its application servers unless such storage is specifically required, legally permitted and appropriately secured.

Where supported by the payment gateway, sensitive payment information is entered directly into the secure payment provider’s environment.

Payment Card Industry Data Security Standard (PCI DSS) is an industry security standard designed to protect payment card data.

Go Luxus may use payment service providers that maintain appropriate PCI DSS compliance or certification for the payment services they provide.

Where payment processing is outsourced to a PCI DSS-compliant payment provider, the payment provider remains responsible for the applicable portions of its payment-card environment.

Go Luxus will not claim to be PCI DSS certified unless it has obtained and maintains the relevant certification or validation.

Where supported by the payment provider, payment information may be tokenized.

Tokenization replaces sensitive payment information with a non-sensitive token that can be used for permitted payment-related purposes without exposing the original payment credentials.

The availability and implementation of tokenization may depend on the payment gateway and payment method.

Go Luxus uses reasonable security measures designed to protect information transmitted between customers and our Platform.

Secure communication technologies such as HTTPS/TLS may be used to protect information while it is transmitted over the internet.

Payment information processed by third-party payment providers is subject to the security controls implemented by those providers.

Depending on the payment method, customers may be required to complete additional authentication, including:

• UPI authentication
• 3-D Secure authentication
• Bank authentication
• Other payment-provider security mechanisms

Go Luxus does not request customers to disclose their confidential authentication credentials to our employees or representatives.

A typical transaction may follow this process:

1. Customer selects a travel service

↓

1. Go Luxus displays the booking amount

↓

1. Customer reviews and confirms the booking

↓

1. Customer is directed to or connected with the payment gateway

↓

1. Payment details are securely processed by the payment provider

↓

1. Payment provider communicates the transaction status

↓

1. Go Luxus verifies the payment status

↓

1. Go Luxus requests/receives supplier booking confirmation

↓

1. Booking confirmation, ticket or voucher is issued

This architecture is intended to reduce unnecessary exposure of sensitive payment information within the Go Luxus application environment.

Go Luxus may use secure server-to-server communication, payment gateway callbacks/webhooks and transaction-status verification to determine whether a payment has been successfully completed.

A customer-facing payment-success screen alone may not be treated as final confirmation until the transaction is appropriately verified.

Go Luxus may implement technical controls such as:

• Unique transaction IDs
• Booking references
• Idempotency controls
• Payment-status verification
• Webhook validation
• Transaction reconciliation

These measures are designed to reduce the risk of duplicate bookings or duplicate payment processing.

If a payment is unsuccessful, interrupted or remains pending, Go Luxus may verify the transaction status before allowing another payment attempt.

This helps reduce the possibility of duplicate charges.

Where an amount has been debited but the booking is not confirmed, Go Luxus may reconcile the payment and booking status before processing an eligible refund.

Access to payment-related systems and information may be restricted to authorized personnel and systems based on business requirements.

Go Luxus may use measures such as:

• Authentication
• Role-based access controls
• Limited administrative access
• System monitoring
• Logging
• Security controls
• Periodic review of access permissions

Go Luxus may work with authorized third-party payment service providers for processing transactions.

These providers may include payment gateways, banks, card networks, UPI providers and other regulated or authorized financial technology providers.

Payment providers may process information according to their own privacy policies, security standards and applicable laws.

Where UPI is supported, UPI transactions are processed through the relevant UPI ecosystem and payment service providers.

Go Luxus does not require customers to provide their UPI PIN to Go Luxus.

Customers should enter confidential UPI authentication information only within the authorized payment interface provided by their bank or payment service provider.

For card transactions, payment authentication and processing may be handled by the relevant payment gateway, acquiring bank, issuing bank and card network.

Go Luxus does not ask customers to provide their CVV, card PIN or OTP through email, telephone, WhatsApp or social media.

Go Luxus may use security monitoring, application monitoring, logging, fraud detection and other technical controls to identify suspicious activity, system errors and potential security threats.

Where necessary, suspicious transactions may be reviewed, blocked, delayed or referred for additional verification.

Once payment information is transferred to a third-party payment provider, the handling of that information is also subject to that provider’s security practices and terms.

Go Luxus selects payment providers based on appropriate business, security and regulatory considerations.

Customers should:

• Use only the official Go Luxus website or application.
• Keep their Go Luxus account credentials confidential.
• Never share OTPs.
• Never share UPI PINs.
• Never share card PINs or CVVs.
• Avoid making payments through unofficial links.
• Report suspicious payment requests immediately.

Go Luxus will never ask customers to disclose confidential payment authentication credentials.

If Go Luxus becomes aware of a security incident involving personal or payment-related information, it will take reasonable steps to investigate, contain and mitigate the incident and provide notifications where required by applicable law.

Go Luxus takes reasonable measures to protect payment and personal information. However, no electronic transmission, internet connection, application or storage system can be guaranteed to be completely secure.

Customers acknowledge that online transactions involve inherent technological risks.

Go Luxus may update this PCI DSS & Payment Security Architecture statement to reflect changes in technology, payment providers, security practices, regulatory requirements or applicable laws.

The latest version will be published on the Go Luxus Platform.