PRIVACY POLICY

Olux SARL-S

At Olux, your privacy is our priority, and we are committed to being transparent about how we collect, use, and protect your personal data. This Privacy Policy explains our practices regarding the processing of your personal information when you use our classifieds marketplace platform and related services.

We advise you to read this entire Privacy Policy to understand what information we collect, why we use it, and how long we retain it. This policy may be updated from time to time, and we recommend that you review it regularly.

I. WHO ARE WE?

1. Data Controller

Olux SARL-S, a simplified limited liability company registered in Luxembourg, processes personal data provided by you or otherwise acquired during the provision of our services, acting as the data controller in accordance with the General Data Protection Regulation (GDPR) and Luxembourg data protection legislation.

1. Company name: Olux SARL-S
2. Registered address: 70a Rue de Luxembourg, L-8440 Steinfort, Luxembourg
3. RCS Luxembourg: B306442

2. Contact Details

For any questions regarding this Privacy Policy or to exercise your rights, you may contact us:

1. Email: contact+privacy@olux.lu
2. Website: www.olux.lu

II. WHAT PERSONAL DATA DO WE COLLECT?

We only collect the essential information needed to provide our services. Depending on how you interact with our platform, here are the types of data we may process:

If you are a platform user (buyer or individual seller):

1. Identity information: name, surname, username, date of birth
2. Contact details: email address, phone number, postal address
3. Account credentials: password (encrypted), authentication data
4. Listing data: items you list for sale, descriptions, photographs, prices, categories
5. Search and preference data: saved searches, favorites, browsing history on the platform
6. Communication data: messages exchanged with other users or our support team
7. Technical data: IP address, device type, browser type, operating system, location data

If you are a business partner (retailer or professional advertiser):

1. Business identification: company name, trade name, RCS number, VAT number, business address
2. Representative information: name, surname, position, contact details of authorized representatives
3. Financial data: banking details (IBAN), billing address, payment history
4. Advertising data: advertisement content, campaign performance metrics, product catalogs
5. Contract data: service agreements, terms accepted, subscription details

When we request information to access a service or feature, certain fields will be marked as mandatory. If you choose not to provide this information, we may be unable to offer you these services.

III. HOW DO WE USE YOUR PERSONAL DATA?

1. Purposes and Legal Basis

Depending on the purpose for which we use your data, we may need to process different information. Here is how we use your data based on your interaction with our platform:

Performance of contract (Article 6(1)(b) GDPR):

1. Creating and managing your user or business account
2. Publishing and managing your classified advertisements
3. Facilitating communication between buyers and sellers
4. Processing payments for advertising services and subscriptions
5. Providing customer support and responding to inquiries
6. Delivering advertising campaigns for business partners

Legal obligations (Article 6(1)(c) GDPR):

1. Complying with accounting and tax obligations
2. Responding to requests from judicial or regulatory authorities
3. Managing requests related to your data protection rights
4. Retaining records as required by applicable laws

Legitimate interests (Article 6(1)(f) GDPR):

1. Analyzing platform usage to improve our services and user experience
2. Detecting and preventing fraud, abuse, and security threats
3. Protecting our rights and interests in case of disputes
4. Conducting market research and statistical analysis
5. Personalizing your experience based on your preferences and behavior
6. Sending service-related communications (updates, maintenance notices)

Consent (Article 6(1)(a) GDPR):

1. Sending marketing communications about our services and offers
2. Creating personalized search alerts and notifications
3. Using analytical and advertising cookies and tracking technologies, including the Meta Pixel operated by Meta Platforms Ireland Ltd.
4. Measuring the performance of our advertising campaigns on third-party platforms (including Meta/Facebook and Instagram)
5. Building custom audiences for remarketing based on your interactions with our platform
6. Displaying targeted advertisements on third-party platforms based on your preferences and browsing behavior

You may withdraw your consent at any time through our cookie preferences center, accessible from the footer of our website. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

2. Profiling and Automated Decision-Making

We may use your personal information, such as your search preferences, saved items, and browsing behavior, to better understand your interests through automated analysis. This allows us to provide you with more relevant search results and recommendations.

No automated decisions with legal or similarly significant effects are made about you without human intervention. You have the right to object to profiling at any time by contacting us at contact+privacy@olux.lu.

IV. HOW DO WE SHARE YOUR PERSONAL DATA?

To ensure the protection of your privacy, only authorized personnel have access to your data. However, in some cases, we must share certain information with third parties:

1. With other users: When you publish a listing, your contact information may be visible to potential buyers or sellers as necessary to facilitate transactions.
2. With service providers: IT infrastructure providers, payment processors, email service providers, and analytics providers who help us operate our platform.
3. With advertising partners: Where necessary to deliver advertising services, with your consent where required.
4. Joint Controllership with Meta Platforms Ireland Ltd.

When you consent to marketing cookies, we use the Meta Pixel and related Meta Business Tools to measure the effectiveness of our advertising on Facebook and Instagram, to build custom audiences, and to deliver targeted advertisements.

In accordance with the judgment of the Court of Justice of the European Union in Fashion ID (C-40/17), Olux SARL-S and Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) act as joint controllers for the collection and transmission of your personal data through the Meta Pixel. The respective responsibilities of each controller are defined in Meta's Controller Addendum, available at: https://www.facebook.com/legal/controller_addendum

Under this arrangement:

1. Olux is responsible for obtaining your consent before the Meta Pixel is activated and for providing you with the information set out in this Privacy Policy.
2. Meta is responsible for the subsequent processing of data once transmitted, including storage, further use for advertising purposes, and responding to requests to exercise your rights in relation to that data.

For any request concerning the processing carried out by Meta after transmission (access, erasure, objection), you may contact Meta directly via https://www.facebook.com/privacy/policy or the Meta Data Protection Officer at: https://www.facebook.com/help/contact/540977946302970

1. You may also exercise your rights by contacting us at contact+privacy@olux.lu, and we will forward your request to Meta where appropriate.
2. With authorities and regulators: When required by law or in response to valid legal requests.
3. In case of corporate transactions: If Olux is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction.

International Data Transfers

Some of our service providers, including Meta Platforms, Inc. (United States), may process your data outside the European Economic Area (EEA). In such cases, we ensure your data is protected through appropriate safeguards, including:

1. Adequacy decisions of the European Commission, notably the EU-US Data Privacy Framework for transfers to certified US organizations (Meta Platforms, Inc. is certified under this framework);
2. Standard Contractual Clauses approved by the European Commission, where applicable;
3. Additional technical and organizational measures to protect transferred data.

You may request a copy of the safeguards applied by contacting us at contact+privacy@olux.lu.

V. HOW LONG DO WE RETAIN YOUR DATA?

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

1. Account data: Retained for the duration of your account activity. You may delete your account at any time.
2. Listing data: Active listings are retained while published; expired listings are archived for 12 months, then anonymized.
3. Transaction records: Retained for 10 years in accordance with Luxembourg commercial and tax law.
4. Marketing preferences: Until you withdraw consent or unsubscribe.
5. Customer support communications: Retained for 3 years after resolution of the inquiry.
6. Analytics data: Anonymized after 26 months.

VI. YOUR RIGHTS

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data. You may exercise these rights free of charge by contacting us at contact+privacy@olux.lu:

Right of access: You may request confirmation of whether we process your personal data and, if so, obtain access to that data along with information about how it is processed.

Right to rectification: You may request the correction of inaccurate personal data or the completion of incomplete data.

Right to erasure: You may request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose.

Right to restriction: You may request that we limit the processing of your data in certain circumstances, such as when you contest its accuracy.

Right to data portability: You may request to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to object: You may object to the processing of your data based on legitimate interests, including profiling. For direct marketing, you may object at any time.

Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

Right to lodge a complaint: If you believe your rights have been violated, you may file a complaint with the Commission Nationale pour la Protection des Données (CNPD), the Luxembourg supervisory authority, at https://cnpd.public.lu.

VII. DATA SECURITY

Olux is committed to protecting your personal data. We implement appropriate technical and organizational security measures to ensure the confidentiality, integrity, and availability of your information and to prevent unauthorized access, loss, misuse, alteration, or destruction.

Our security measures include encryption of data in transit and at rest, secure authentication mechanisms, regular security assessments, access controls limiting data access to authorized personnel, and monitoring systems to detect and respond to security incidents.

VIII. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to facilitate your browsing experience, understand how you interact with our platform, and, where you have consented, to display personalized content and advertisements.

Types of Cookies and Tracking Technologies We Use

Essential cookies — Required for the platform to function properly (authentication, session management, security, load balancing, cookie consent storage). These cannot be disabled and do not require your consent.

Functional cookies — Enable enhanced functionality and personalization, such as remembering your language preference, saved searches, and favorites. Activated only with your consent.

Analytics cookies — Help us understand how visitors interact with our platform (pages visited, time spent, navigation paths) so we can improve our services. Activated only with your consent.

Marketing and advertising cookies — Used to deliver relevant advertisements on our platform and on third-party platforms, to measure campaign performance, and to build audiences for remarketing. Activated only with your consent.

Within the marketing category, we use the following third-party tracking technologies:

1. Technology: Meta Pixel
2. Provider: Meta Platforms Ireland Ltd.
3. Purpose: Advertising measurement, conversion tracking, custom audiences, remarketing on Facebook and Instagram
4. Cookies/Identifiers: _fbp (first-party), _fbc (first-party, set when arriving via a Meta ad)
5. Retention: Up to 90 days

When activated, the Meta Pixel may collect: pages visited on olux.lu, timestamp, IP address, user agent (browser and device information), referring URL, and interactions with our platform (such as viewing a listing, submitting a contact form, or creating an account). Where you are logged in to Facebook or Instagram on the same device, Meta may associate this data with your Meta account.

Managing your preferences

You may accept, reject, or customize your cookie choices at any time via our cookie preferences center, accessible from the "Cookie preferences" link in the footer of our website. You may also configure your browser to block or delete cookies; however, disabling essential cookies may affect the functioning of the platform.

For additional information on how Meta processes your data, please refer to Meta's Privacy Policy (https://www.facebook.com/privacy/policy) and Cookies Policy (https://www.facebook.com/policies/cookies/).

IX. THIRD-PARTY SERVICES

Our platform integrates with third-party services, including:

1. Meta Platforms Ireland Ltd. — for advertising measurement and audience building via the Meta Pixel (subject to your consent);
2. Social media platforms — for login, sharing, and embedded content features;
3. Payment processors — for handling transactions related to business subscriptions and advertising services;
4. Analytics providers — to measure platform usage and performance.

These third parties process your data under their own privacy policies and, where applicable, as joint controllers or independent controllers. We encourage you to review their respective policies. We remain responsible only for the processing activities we carry out directly or jointly, as described in this Privacy Policy.

X. CHILDREN'S PRIVACY

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us immediately, and we will take steps to delete such information.

XI. CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time. Any changes will be posted on this page with an updated revision date. For significant changes, we will provide prominent notice, such as by email or through a notification on our platform. We encourage you to review this policy periodically to stay informed about how we protect your data.

XII. CONTACT US

If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about how we handle your personal data, please contact us:

Olux SARL-S

Email: contact+privacy@olux.lu

Website: www.olux.lu

Registered address: 70a Rue de Luxembourg, L-8440 Steinfort, Luxembourg

Thank you for trusting Olux with your personal data.