PRIVACY POLICY
At Olux, your privacy is our priority, and we are committed to being transparent about how we collect, use, and protect your personal data. This Privacy Policy explains our practices regarding the processing of your personal information when you use our classifieds marketplace, our communities, and related services.
We advise you to read this entire Privacy Policy to understand what information we collect, why we use it, and how long we retain it. This policy may be updated from time to time, and we recommend that you review it regularly.
Olux.lu SARL-S, a simplified limited liability company registered in Luxembourg, processes personal data provided by you or otherwise acquired during the provision of our services, acting as the data controller in accordance with the General Data Protection Regulation (GDPR) and Luxembourg data protection legislation.
Where Communities are concerned, Olux is not always the only controller. When you join a community, the person who created that Community also determines some of what happens to your data. Section IV.4 explains this in full and is the part of this policy to read if you take part in Communities.
For any question regarding this Privacy Policy or to exercise your rights:
We only collect the information needed to provide our services. Depending on how you interact with the Platform, we may process the following:
Profile data shared with the Community: the profile fields visible to that Community, including any fields the Community Owner requires you to complete before joining.
When we request information to access a service or feature, certain fields are marked as mandatory. If you choose not to provide that information, we may be unable to offer you the service.
A note on membership questions. Community Owners set their own questions, and we do not see them in advance. Owners are contractually required to ask only what is relevant and proportionate to their community and are prohibited from asking questions designed to reveal your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, or sex life or sexual orientation. You are never obliged to answer a question you are uncomfortable with; you may decline and not join. If you think a community is asking for more than it needs, tell us at legal@olux.lu.
creating and operating Communities, processing membership requests, delivering discussion threads and community listings, managing events and registrations, issuing and validating event QR codes, and sending invitations and community notifications
meeting our obligations under Regulation (EU) 2022/2065 (the Digital Services Act), including acting on notices of illegal content, providing statements of reasons for moderation decisions, and handling complaints against those decisions
moderating listings and messages, including those published within private Communities, to keep the Platform safe and lawful; and keeping a record of administrative actions taken within a community so that Owners and Olux can establish who did what
You may withdraw your consent at any time through our cookie preferences center. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Community notifications are not marketing. Notifications about a Community you belong to — a membership decision, a reply to your thread, an event reminder — are part of the service and are sent based on our contract with you, not your marketing consent. You can change how they are delivered in your settings, and you can leave a community at any time to stop receiving them.
We may use your search preferences, save items, and browsing behavior to understand your interests through automated analysis, so that we can provide more relevant search results and recommendations.
We also use automated tools to detect fraud, spam, prohibited items, and breaches of our Terms and Conditions. Where a decision producing legal effects concerning you, or similarly significantly affecting you, is taken solely by automated means, you have the right to obtain human intervention, to express your point of view, and to contest the decision. You can do so by writing to legal@olux.lu, and Section 6.5 of our Terms and Conditions explains the complaints procedure.
You have the right to object to profiling at any time by contacting us at legal@olux.lu.
Only authorized personnel have access to your data. In some cases, we must share information with third parties:
When you publish a listing, other users can see the listing, its images, your username and general area, and can contact you through the Platform's messaging system. We do not display your email address, telephone number, or exact address on a listing, and our Terms prohibit you from including contact details in a listing title or description.
IT infrastructure providers, email service providers, payment processors for advertising services, and analytics providers who help us operate the Platform. Our hosting provider is Microsoft Azure (West Europe region). These providers act as processors on our instructions.
Where necessary to deliver advertising services, with your consent where required. See Section VIII for the tracking technologies involved.
When you join a Community on Olux, two parties handle your personal data.
Olux.lu SARL-S provides and secures the Platform. We are responsible for your account, for the security of the systems, for moderating listings and messages, for storing Community data, and for responding to your data protection requests.
The Community Owner — the person who created the Community, and any administrators they appoint — decides who joins, what questions applicants are asked, who is removed or banned, which events take place, and who is recorded as attending. For those decisions the Community Owner is a joint controller with Olux under Article 26 GDPR. This is set out in the Community Owner Agreement, which every Owner and administrator must accept before they can run a community.
What this means for you. You can exercise all your rights under the GDPR — access, rectification, erasure, restriction, portability, and objection — against either Olux or the Community Owner. In practice, please contact us at legal@olux.lu. We will handle your request and, where it concerns a decision taken by a Community Owner, we will pass it to them and reply to you within the one-month period the law allows. If the Owner does not respond to us, we will answer you ourselves and act on the data directly.
What Community Owners may and may not do. Community Owners see your profile as shared with the Community, your membership answers, the content you publish there, and your event registrations and attendance. They are contractually bound not to use that information for marketing, profiling, or resale, not to pass it to anyone outside the Community, and not to keep copies of it outside Olux. If you believe a Community Owner has misused your information, tell us at legal@olux.lu.
How long Community information is kept. The periods are set out in Section V below.
Your choices. You can leave a community at any time, which stops further processing by that Community Owner. You can decline invitations and switch off Community notifications in your settings. You can also complain to the Commission Nationale pour la Protection des Données (CNPD) at cnpd.public.lu.
When you consent to marketing cookies, we use the Meta Pixel and related Meta Business Tools to measure the effectiveness of our advertising on Facebook and Instagram, to build custom audiences, and to deliver targeted advertisements.
In accordance with the judgment of the Court of Justice of the European Union in Fashion ID (C-40/17), Olux.lu SARL-S and Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) act as joint controllers for the collection and transmission of your personal data through the Meta Pixel. The respective responsibilities of each controller are defined in Meta's Controller Addendum, available at facebook.com/legal/controller_addendum.
Under this arrangement, Olux is responsible for obtaining your consent before the Meta Pixel is activated and for providing you with the information in this policy. Meta is responsible for the subsequent processing of data once transmitted, including storage, further use for advertising purposes, and responding to requests concerning that data. You may contact Meta directly or write to us at legal@olux.lu and we will forward your request where appropriate.
Where required by law or in response to a valid legal request, including orders to act against illegal content under the Digital Services Act. Where we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place, or is likely to take place, we will inform the competent authorities as Article 18 of that Regulation requires.
If Olux is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction.
Some of our service providers, including Meta Platforms, Inc. (United States), may process your data outside the European Economic Area. In such cases we rely on adequacy decisions of the European Commission, notably the EU-US Data Privacy Framework, on Standard Contractual Clauses approved by the European Commission, and on additional technical and organizational measures. You may request a copy of the safeguards applied by contacting legal@olux.lu.
We retain your personal data only for as long as necessary for the purposes for which it was collected. Where the law requires a longer period — for example to establish, exercise, or defend a legal claim, or to comply with an order from a competent authority — data may be retained for that purpose only, and is otherwise restricted.
| Data | Retention period | Runs from |
| Account data | Duration of your account | Deletion of your account |
| Active listings | While published | Expiry or removal |
| Expired listings | 12 months, then anonymized | Expiry of the listing |
| Messages between users | 24 months | The last message in the exchange |
| Moderation decisions and their reasons | 3 years | The decision |
| Customer support communications | 3 years | Resolution of the enquiry |
| Business partner transaction records | 10 years (Luxembourg commercial and tax law) | The transaction |
| Marketing preferences | Until you withdraw consent or unsubscribe | — |
| Analytics data | Anonymized after 26 months | Collection |
The following periods apply to data generated in Communities. They match the periods in the Community Owner Agreement, which binds Community Owners to the same limits.
| Data | Retention period | Runs from |
| Membership request and answers — approved | Duration of membership, then 6 months | Leaving or being removed |
| Membership request and answers — rejected, withdrawn, expired | 30 days | The rejection, withdrawal, or expiry |
| Membership record (join date, role, status) | Duration of membership, then 12 months | Leaving or being removed |
| Ban record and recorded reason | 12 months; permanent bans, 3 years | The ban being lifted, or the date of a permanent ban |
| Invitations sent but not accepted | 90 days, or earlier expiry set by the sender | The invitation being sent |
| Invitations declined | 30 days | The invitation being declined |
| Discussion threads and replies | Duration of the Community | Closure of the Community |
| Event details and registrations | 12 months | The date of the event |
| Event check-in and attendance records | 12 months | The date of the event |
| QR codes issued to participants | 30 days, then invalidated and deleted | The date of the event |
| Community audit trail | 24 months | The action recorded |
| Community logo, gallery, description | Duration of the Community | Closure of the Community |
| All Community data after closure | 30-day grace period, then permanent deletion | Closure of the Community |
A Community Owner may delete membership answers, ban records, and attendance data earlier, and is required to do so where the data is no longer needed.
Under the GDPR you have the following rights. You may exercise them free of charge by contacting legal@olux.lu.
Requests concerning Communities. If your request concerns something a Community Owner decided, we will forward it to them and coordinate the response, as described in Section IV.4. This may mean we use the full month allowed by Article 12(3) GDPR rather than replying immediately. We will tell you if that is the case.
A limit worth knowing about. Content you have posted in a community — a thread, a reply, a listing — may have been seen, quoted, or replied to by others. We can delete your content and disconnect it from your account, but we cannot retrieve what other people have already read or reproduced elsewhere.
We implement appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of your information and to prevent unauthorized access, loss, misuse, alteration, or destruction. These include encryption of data in transit and at rest, secure authentication, regular security assessments, access controls limiting data access to authorized personnel, and monitoring to detect and respond to incidents.
Private Communities are private from other users, not from Olux. Setting a community to private means it is not discoverable and that joining requires approval or an invitation. It does not mean the content is encrypted, hidden from Olux, or exempt from moderation. Listings and messages in private Communities are moderated in the same way as anywhere else on the Platform, and we may act on any content when we become aware of a problem with it.
We use cookies and similar technologies to facilitate your browsing, understand how you interact with the Platform, and, where you have consented, to display personalized content and advertisements.
Meta Pixel — provider Meta Platforms Ireland Ltd. Purpose: advertising measurement, conversion tracking, custom audiences, and remarketing on Facebook and Instagram. Identifiers: _fbp (first party) and _fbc (first party, set when arriving via a Meta advertisement). Retention: up to 90 days. When activated, the Meta Pixel may collect pages visited on olux.lu, timestamp, IP address, user agent, referring URL, and interactions with the Platform such as viewing a listing or creating an account. Where you are logged in to Facebook or Instagram on the same device, Meta may associate this data with your Meta account.
Google Ads — provider Google Ireland Limited. Purpose: measuring the performance of our advertising campaigns, conversion tracking, and remarketing on Google services and partner sites. Identifiers: Google advertising and conversion cookies set on activation. Retention: as set by Google, up to 24 months for conversion identifiers. When activated, Google may collect pages visited on olux.lu, timestamp, IP address, user agent, and conversion events. Further information is available in Google's privacy policy and its advertising technologies notice.
You may accept, reject, or customize your cookie choices at any time through our cookie preferences center, which you can open from the "Cookie preferences" link in the footer of every page. You may also configure your browser to block or delete cookies, although disabling essential cookies may affect how the Platform works.
Our services are not directed to individuals under the age of 18, and you must be at least 18 to hold an Olux account. We do not knowingly collect personal data from children. This applies equally to Communities: a community may be created for the benefit of a school, a youth club, or a similar body, but every account holder must be an adult. If you believe that a child has provided us with personal data, contact us at legal@olux.lu and we will delete it and close the account.
We may modify this Privacy Policy. Any change will be posted on this page with an updated effective date. For significant changes we will give prominent notice, by email or through a notification on the Platform, at least thirty (30) days before the change takes effect.
Olux.lu SARL-S, société à responsabilité limitée simplifiée
Registered address: 70a Rue de Luxembourg, L-8440 Steinfort, Grand Duchy of Luxembourg
RCS Luxembourg: B306442 · Person responsible for publication: João Lopes
Data protection and privacy: legal@olux.lu · Website: www.olux.lu