Privacy Policy

1. Introduction

This Privacy Policy describes how Olux S.à r.l.-S ("Olux", "we", "us", or "our"), located at 70a Rue de Luxembourg, L-8440 Steinfort, Luxembourg, collects, uses, stores, and protects personal data when you use the Olux Professional website (pro.olux.lu) and related services. We are committed to protecting your privacy and processing your data in compliance with the EU General Data Protection Regulation (GDPR) and applicable Luxembourg data protection law.

2. Data Controller

The data controller responsible for your personal data is:

Olux S.à r.l.-S

70a Rue de Luxembourg, L-8440 Steinfort, Luxembourg

Email: [email protected]

3. Information We Collect

We collect the following categories of personal data:

3.1 Information you provide directly

• Account information — name, email address, phone number, and password when you create an account
• Business information — company name, business address, VAT number, industry, and business description
• Listing content — product or service descriptions, photos, pricing, and other content you publish
• Payment information — billing address and payment details (processed securely by our payment provider; we do not store full card numbers)
• Communications — messages you send through our contact forms, support requests, or chat
• Verification documents — identity or business documents you upload for account verification

3.2 Information collected automatically

• Device and browser data — IP address, browser type and version, operating system, device type, and screen resolution
• Usage data — pages visited, time spent on pages, clicks, referral source, and navigation patterns
• Cookies and similar technologies — as described in our Cookies Policy

3.3 Information from third parties

• Authentication providers — if you sign in through a third-party service, we may receive your name and email from that provider
• Payment processors — transaction confirmations and billing status from our payment partners

4. How We Use Your Information

We use your personal data for the following purposes:

5. Information Sharing

We do not sell your personal data. We may share your information with the following categories of recipients:

• Service providers — hosting, email delivery, payment processing, analytics, and translation services that process data on our behalf under contractual safeguards
• Olux platform users — your business name, listing content, and contact details are publicly visible to buyers on the Olux marketplace as part of the service
• Legal authorities — when required by law, court order, or to protect our rights, safety, or property
• Business transfers — in connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity

6. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). When we use service providers located outside the EEA (for example, certain cloud or analytics providers), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or adequacy decisions, to protect your data in accordance with GDPR requirements.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data — retained for the duration of your account and for up to 12 months after account closure
• Listing content — retained while your account is active; removed within 30 days of deletion
• Billing and transaction records — retained for 10 years as required by Luxembourg commercial and tax law
• Support communications — retained for up to 3 years after the last interaction
• Analytics data — aggregated and anonymised; raw data retained for up to 26 months
• Cookie consent records — retained for the duration required to demonstrate compliance

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication mechanisms for internal systems
• Regular security assessments and monitoring
• Secure password hashing

While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements
• Right to restriction — request that we limit the processing of your data in certain circumstances
• Right to data portability — receive your data in a structured, commonly used, machine-readable format
• Right to object — object to processing based on legitimate interest or for direct marketing purposes
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. You also have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD), the Luxembourg supervisory authority.

10. Cookies

We use cookies and similar tracking technologies on our website. For detailed information about the types of cookies we use, their purposes, and how to manage your preferences, please see our Cookies Policy.

11. Children's Privacy

Olux Professional is a business-to-business service and is not directed at children. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that we have collected data from a child without appropriate parental consent, we will take steps to delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. Any updates will be posted on this page with a revised "Last updated" date. If we make material changes that affect how we process your personal data, we will notify you via email or through a prominent notice on our website.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:

Olux S.à r.l.-S

70a Rue de Luxembourg, L-8440 Steinfort, Luxembourg

Email: [email protected]