Privacy Policy

Privacy Policy

​

Last updated: July 19, 2026

 

1. INTRODUCTION

 

GoLux Benefits Sarl ("GoLux", "we", "our", or "us") respects your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Luxembourg data protection laws.

​

This Privacy Policy explains how we collect, use, disclose and protect your personal data when you visit our website, use the GoLux mobile application, contact us and interact with our partner network.

​​

2. WHO IS THE DATA CONTROLLER

​

GoLux Benefits S.à r.l.
Registered office: 5 place de la Gare, L-1616 Luxembourg
RCS Luxembourg: B304493

Phone: +352 621 777 317
Email: info@golux.lu

Website: www.golux.lu

​​

3. PERSONAL DATA WE COLLECT

 

WEBSITE

​

When you visit our Website, we may process personal data in the following circumstances:

​

• Contact Us: If you contact us through the Contact Us form or by email, we process the information you provide (such as your name, email address and the content of your message) in order to respond to your enquiry.

• Website operation: Our Website is hosted by Wix, which processes certain technical information necessary for the operation, security and maintenance of the Website.

• Cookies: Our Website uses cookies and similar technologies. For more information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

 

GOLUX USER APPLICATION

 

Information Provided by Your Employer

 

Where GoLux is provided as an employee benefit, your employer provides us with certain personal data necessary to create and administer your GoLux account. This information may include your first name, last name, work email address (or, where appropriate, a personal email address), the name of your employer, where available, your telephone number.

​

GoLux administrators create user accounts based on the information received from the employer. Once an account has been created, the user receives an email with instructions for accessing the application. Upon the first login, users are required to set a new password before they can begin using the GoLux services.

 

Usage Information

​

When you use the GoLux application, we collect information about your use of the services. This may include:

​

• visits to participating wellness providers;

• the date and time of each visit or check-in;

• the wellness provider visited;

• points used or redeemed through the GoLux programme; and

• other information necessary to administer your membership and provide the GoLux services.

​

Application Diagnostics

​

To improve the reliability, stability and security of the GoLux application, we collect technical crash reports and diagnostic information when the application experiences an unexpected error. Crash reports are processed using Firebase Crashlytics and may include technical information about the device, operating system, application version and other diagnostic information necessary to identify and resolve software issues.

​

Location Services

​

The mobile application may request access to your device's location solely for the purpose of displaying nearby wellness partners. We do not store your location on our servers.

Your device provides the location directly to the application, which uses it only during the search process.

​

You may disable location access at any time through your device settings, although certain features may no longer function properly.

 

Source of Personal Data

​

We obtain personal data from the following sources:

​

• directly from you when you use the GoLux application, contact us or update your profile information; and

• from your employer, where GoLux is provided as part of an employee wellness programme. In such cases, your employer provides the information necessary for us to create and administer your GoLux user account.

​

4. HOW WE USE YOUR INFORMATION

​

We process personal data in order to:

• create and administer user accounts based on information provided by participating employers, including sending account activation and access instructions;

• display nearby partners;

• improve application performance;

• diagnose technical issues;

• comply with legal obligations;

• protect against fraud or misuse;

• administer user memberships;

• record visits to participating wellness providers, calculate and manage point usage;

• provide users with their usage history;

• provide wellness providers with their scan history;

• administer payments to participating wellness providers where applicable;

• respond to enquiries and customer support requests received by email;

• authenticate users and manage secure access to the application;

• send transactional and service-related communications, such as account activation emails, password reset emails and other important service notifications.

 

​

5. LEGAL BASIS

​

Depending on the processing activity, we rely on one or more of the following legal bases:

• performance of a contract;

• legitimate interests;

• compliance with legal obligations;

• your consent (where required, such as certain cookies or device permissions).

 

Where your employer provides your personal data to enable your access to the GoLux platform as part of an employee wellness programme, we process your personal data for the purpose of providing the GoLux services and administering your user account.

 

6. SHARING OF PERSONAL DATA

​

We do not sell personal information. We may share personal data only where necessary with carefully selected third-party service providers, including:

​

• Google Firebase Authentication – user authentication and secure login;

• Firebase Crashlytics – application crash reporting and diagnostics;

• Amazon Web Services (AWS) – hosting of the GoLux application and backend infrastructure within the European Union (Frankfurt, Germany);

• Resend – delivery of transactional emails, including account-related notifications and password reset emails;

• Google Workspace – processing and storage of email communications with users, partners and other contacts;

• Wix – hosting and operation of the GoLux website.

​

7. CONFIDENTIALITY OF WELLNESS ACTIVITY

​

GoLux recognises that information relating to users' wellness activities is personal and sensitive from a privacy perspective. Accordingly, GoLux does not share individual wellness activity or visit history with employers. Access to such information is restricted to authorised GoLux personnel only where necessary to operate, maintain and support the GoLux platform.

​

GoLux does not disclose individual wellness activity, visit history or point usage to employers. Employers receive only information necessary for the administration of the corporate wellness programme, unless disclosure is required by applicable law or expressly authorised by the user.

​

8. INTERNATIONAL TRANSFERS

​

GoLux primarily stores application data within the European Union using Amazon Web Services in Frankfurt, Germany.

​

Some of our service providers, including Google (Firebase and Workspace), Resend, may process or access personal data outside the European Economic Area. Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with the GDPR, such as the European Commission's Standard Contractual Clauses or reliance on an adequacy decision where applicable.

​

​

​

9. DATA RETENTION

​

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes and protect our legitimate interests.

 

As a general rule:

​

• account information and wellness usage history are retained while your account remains active and for up to 3 years after account closure, unless a longer retention period is required by law;

• technical logs and crash reports are retained for up to 12 months;

• email correspondence is retained for up to 3 years after the matter has been resolved;

• accounting and tax records are retained for the period required by applicable law.

​

​

10. YOUR RIGHTS

​

Under the GDPR, you have the right to:

​

• request access to your personal data;

• request correction of inaccurate or incomplete personal data;

• request the deletion of your personal data ("right to be forgotten");

• request the restriction of the processing of your personal data;

• object to the processing of your personal data where applicable;

• request the transfer of your personal data to you or another organisation (data portability), where applicable;

• withdraw your consent at any time where processing is based on your consent (this does not affect the lawfulness of processing carried out before consent was withdrawn); and

• lodge a complaint with the Luxembourg National Commission for Data Protection (Commission nationale pour la protection des données – CNPD) if you believe your personal data has been processed in violation of applicable data protection laws.

 

To exercise any of these rights, please contact us at info@golux.lu. To help us identify your account, please include your first name and last name. If available, please include your User ID to help us locate your account more efficiently. For security reasons, we may request additional information to verify your identity before processing your request.

​

11. SECURITY

​

We implement appropriate technical and organisational measures to protect personal data, including secure hosting, encrypted communications (TLS), access controls, authentication mechanisms and monitoring of application stability and security. User passwords are protected using industry-standard cryptographic techniques through our authentication provider and are never stored in plain text.

 

12. COOKIES

​

Our website uses cookies and similar technologies through Wix.

Some cookies are necessary for the operation of the website, while others may be used for analytics or functionality.

​

Where required by law, we will request your consent before placing non-essential cookies. For more detailed information about the cookies we use and how to manage your cookie preferences, please refer to our Cookie Policy.

​

13. CHILDREN'S PRIVACY

​

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

​

14. CHANGES TO THIS POLICY

​

We may update this Privacy Policy from time to time. The latest version will always be published on our website.

​

15. CONTACT

 

If you have questions regarding this Privacy Policy or wish to exercise your GDPR rights, please contact: info@golux.lu.