Legal

Privacy Policy

Last updated: April 19, 2026

1. Data Controller

The data controller responsible for processing your personal data is:

Olux.lu S.à r.l.-S
Steinfort, Luxembourg
Email: [email protected]

Olux.lu S.à r.l.-S operates the Olux Media platform (the "Service"), a digital advertising platform that connects businesses with high-intent buyers through cookieless, privacy-first advertising solutions.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Account Registration Data

When you register for an Olux Media account, we collect:

  • Your name and email address
  • Phone number (with country code)
  • Password (stored in hashed form only)
  • Company legal name, VAT number, and business registration number
  • Business address (street, number, postal code, city, country)

2.2 Contact and Inquiry Data

When you contact our sales team, request a demo, or submit a support inquiry, we collect your name, email, phone number, company name, and any message content you provide.

2.3 Payment Data

Payment transactions are processed by Stripe, Inc. We do not store your credit card numbers or bank details on our servers. Stripe acts as an independent data controller for payment data. Please refer to Stripe's Privacy Policy for details.

2.4 Technical and Usage Data

When you use the Service, we automatically collect:

  • IP address (stored in hashed form for cookie consent records)
  • Browser type and user agent
  • Pages visited and referring URLs
  • Language preference

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)): Processing your registration data and account information is necessary to provide the Service to you.
  • Legitimate interest (Art. 6(1)(f)): We use technical data to ensure the security of the Service, prevent fraud, and improve our platform.
  • Consent (Art. 6(1)(a)): For analytics and marketing cookies, which are only placed after you give explicit consent via our cookie banner.
  • Legal obligation (Art. 6(1)(c)): To comply with applicable tax, accounting, and regulatory requirements under Luxembourg law.

4. How We Use Your Data

We use your personal data to:

  • Create and manage your account
  • Process payments and generate invoices
  • Provide campaign analytics and performance reporting
  • Respond to your inquiries, demo requests, and support tickets
  • Send transactional emails (account confirmation, password resets, invoices)
  • Detect and prevent fraud, abuse, and security threats

5. Data Sharing and Third-Party Processors

We do not sell your personal data. We share data only with the following categories of service providers, each bound by data processing agreements in accordance with GDPR Article 28:

  • Stripe, Inc. (USA) — Payment processing. Transfers are covered by Stripe's EU-US Data Privacy Framework certification.
  • Brevo (Sendinblue) (France) — Transactional email delivery.
  • Microsoft Azure (EU region) — Cloud hosting, data storage, and infrastructure.
  • Cloudflare, Inc. (USA) — Bot protection and security (Turnstile). Transfers are covered by Cloudflare's EU-US Data Privacy Framework certification.
  • Geoapify GmbH (Germany) — Address geocoding for business location services.

We may also disclose your data when required by law, regulation, or court order, or to protect the rights, property, or safety of Olux.lu S.à r.l.-S, our users, or the public.

6. International Data Transfers

Your data is primarily stored and processed within the European Union (Microsoft Azure EU region). Where data is transferred to processors outside the EEA (Stripe, Cloudflare), such transfers are safeguarded by the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), or other appropriate mechanisms under GDPR Chapter V.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

  • Account data: Retained for the duration of your account, plus 30 days after deletion to allow recovery.
  • Billing and invoice data: Retained for 10 years as required by Luxembourg commercial and tax law.
  • Cookie consent records: Retained for 3 years as proof of consent under GDPR.
  • Contact form submissions: Retained for 12 months, then deleted unless they lead to a business relationship.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption in transit (TLS/HTTPS) and at rest
  • SHA-256 hashing for passwords and IP addresses
  • Bot protection via Cloudflare Turnstile on authentication forms
  • Role-based access controls

No method of electronic transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights:

  • Right of access (Art. 15) — Obtain a copy of your personal data and information about how it is processed.
  • Right to rectification (Art. 16) — Request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17) — Request deletion of your personal data, subject to legal retention obligations.
  • Right to restrict processing (Art. 18) — Request limitation of processing in certain circumstances.
  • Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format.
  • Right to object (Art. 21) — Object to processing based on legitimate interest or for direct marketing purposes.
  • Right to withdraw consent (Art. 7(3)) — Withdraw consent at any time where processing is based on consent. This does not affect the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Supervisory Authority

If you believe that our processing of your personal data infringes data protection laws, you have the right to lodge a complaint with the Luxembourg supervisory authority:

Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
Website: cnpd.public.lu

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on this page and updating the "Last updated" date. For significant changes, we may also notify you by email.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Olux.lu S.à r.l.-S
Steinfort, Luxembourg
Email: [email protected]