Privacy & Security

Last updated: April 2026

Sportlux is committed to protecting the privacy and security of personal data processed in connection with its operations. This Privacy & Security Policy sets out the basis on which personal data collected from individuals who visit sportlux.com, engage with the Company, or interact with any brand within the Sportlux portfolio will be processed.

This Policy applies to all personal data processing activities conducted by Sportlux in its capacity as a global brand operator and should be read in conjunction with any supplementary notices issued by the individual brands we operate, which govern data processing within their respective consumer relationships.

By accessing or using our website or services, you acknowledge that you have read and understood the terms of this Policy. Where processing of your personal data relies on consent, separate consent will be obtained as described in this Policy.

1. Identity of the Data Controller

Sportlux operates as a global brand operator with registered offices in Dubai, New York, and Lugano. For the purposes of applicable data protection legislation, SPORTLUX GENERAL TRADING FZCO, 121035003 acts as the data controller in respect of personal data collected through its corporate website and direct communications channels.

Privacy enquiries may be directed to: Email: contact@sportlux.com Telephone: 04-8356418

2. Categories of Personal Data Collected

Sportlux collects and processes personal data across the following categories, limited to what is necessary for the purposes described in this Policy:

2.1 Data Provided Directly by the Individual Personal data submitted voluntarily through contact forms, job applications, or partner enquiries including but not limited to: full name, email address, telephone number, company affiliation, country of residence, curriculum vitae, portfolio materials, and the content of any correspondence.

2.2 Data Collected Automatically Technical data generated upon access to sportlux.com, including IP address, browser type and version, device identifiers, referring URL, pages accessed, session duration, and related interaction metadata. This data is collected for the purposes of site security, performance monitoring, and analytics.

2.3 Data Received from Third Parties Personal data transmitted to Sportlux by recruitment platforms, analytics service providers, and authorised business partners, where the individual has provided appropriate consent for such disclosure.

3. Purposes and Use of Personal Data

Sportlux processes personal data solely for legitimate business purposes. Specifically, personal data is used to:

Manage and respond to enquiries, requests, and correspondence.
Assess, process, and administer job applications and recruitment activities.
Establish, maintain, and manage commercial and partner relationships.
Distribute communications, updates, and publications to which individuals have subscribed.
Monitor, analyse, and improve the performance and security of our digital platforms.
Detect, investigate, and prevent fraudulent activity, security incidents, or misuse.
Comply with applicable legal, regulatory, and contractual obligations.

Sportlux does not sell personal data. Personal data is not used as the basis for automated decision-making processes, including profiling, that produce legal or otherwise significant effects on individuals.

4. Legal Bases for Processing

Where Sportlux is subject to the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the General Data Protection Regulation (GDPR), the UK GDPR, or equivalent legislation in Switzerland, all processing of personal data is conducted on one or more of the following lawful bases:

Consent — where the individual has provided freely given, specific, informed, and unambiguous consent to the processing of their personal data for one or more defined purposes.
Performance of a Contract — where processing is necessary for the execution of, or in preparation for entering, a contractual arrangement with the individual.
Legitimate Interests — where processing is necessary for the purposes of the legitimate interests pursued by Sportlux, provided such interests are not overridden by the fundamental rights and freedoms of the individual.
Compliance with a Legal Obligation — where processing is required to fulfil a statutory, regulatory, or judicial obligation to which Sportlux is subject.

5. Disclosure of Personal Data

Sportlux does not disclose personal data to third parties except where necessary for the conduct of its business operations or as required by law. Personal data may be disclosed to the following categories of recipients:

Authorised Service Providers — third-party vendors engaged to provide website hosting, email infrastructure, analytics, and recruitment support services, operating under binding data processing agreements and subject to strict confidentiality obligations.
Portfolio Brands and Affiliates — entities within the Sportlux brand portfolio, where the individual’s interaction is directly connected to a specific brand’s operations.
Legal and Regulatory Authorities — government bodies, courts, regulators, or law enforcement agencies, where disclosure is required or permitted by applicable law or judicial order.
Professional Advisors — legal counsel, auditors, insurers, and financial advisors, acting in their professional capacity and subject to applicable confidentiality duties.

In the event that Sportlux, or any brand within its portfolio, is subject to a merger, acquisition, divestiture, or corporate restructuring, personal data may be transferred as part of that transaction, subject to equivalent data protection obligations.

6. International Transfers of Personal Data

In the course of its global operations across Dubai, New York, and Lugano, personal data may be transferred to and processed in jurisdictions outside the individual’s country of residence. Where such transfers involve the export of personal data from the United Arab Emirates, Sportlux ensures compliance with the requirements of the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Where such transfers involve the export of personal data from the European Economic Area, the United Kingdom, or Switzerland, Sportlux ensures that appropriate safeguards are implemented in accordance with applicable data protection law, including:

Standard Contractual Clauses as approved by the European Commission
The UK Addendum to Standard Contractual Clauses, where applicable
The Swiss Federal Act on Data Protection equivalent mechanisms, where applicable.

7. Data Retention

International transfers Personal data is retained only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The Company's standard retention periods are as follows:

Category of Data	Retention Period
General enquiry and contact correspondence	24 months from date of last interaction
Active recruitment and application data	Duration of the relevant recruitment process
Retained recruitment data (future consideration)	12 months post-process, subject to individual consent
Financial, legal, and regulatory records	As prescribed by applicable statutory requirements

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with the Company’s data disposal procedures.

8. Security of Personal Data

Sportlux implements a comprehensive framework of technical and organisational measures to ensure the security, integrity, and confidentiality of personal data. These measures include, but are not limited to:

End-to-end encrypted data transmission protocols (TLS/SSL).
Role-based access controls restricting data access to authorised personnel only.
Secure, enterprise-grade hosting infrastructure
Regular internal security assessments and third-party audits.
Mandatory data protection training for all relevant personnel.

Whilst Sportlux takes all reasonable precautions to safeguard personal data, no method of electronic transmission or storage can be guaranteed as entirely secure. In the event of a personal data breach, Sportlux will take immediate remedial action and fulfil all applicable notification obligations in accordance with relevant legislation.

9. Rights of Data Subjects

Subject to applicable data protection legislation and the jurisdiction in which an individual resides, the following rights may be available in respect of personal data held by Sportlux:

Right of Access — to obtain confirmation of whether personal data is being processed and to receive a copy of such data.
Right to Rectification — to request correction of inaccurate or incomplete personal data
Right to Erasure — to request deletion of personal data where there is no legitimate or legally mandated basis for its continued retention.
Right to Restriction of Processing — to request that processing be suspended pending resolution of a disputed matter.
Right to Object — to object to processing carried out based on legitimate interests, including processing for direct marketing purposes.
Right to Data Portability — to receive personal data in a structured, commonly used, machine-readable format for transfer to another controller.
Right to Withdraw Consent — to withdraw previously granted consent at any time, without prejudice to the lawfulness of processing conducted prior to withdrawal.
Right to Lodge a Complaint — to refer a complaint to the relevant supervisory authority in the individual’s jurisdiction.

Requests to exercise any of the above rights should be submitted in writing to contact@sportlux.com. Sportlux will respond within the timeframes prescribed by applicable legislation.

10. Minors

Sportlux’s website and services are not directed at, nor intended for use by, individuals under the age of 16. The Company does not knowingly collect or process personal data relating to minors. Should the Company become aware that personal data has been collected from an individual under the age of 16 without appropriate parental or guardian consent, such data will be deleted promptly. Any concern in this regard should be reported to contact@sportlux.com.

11. Amendments to This Policy

Sportlux reserves the right to amend this Policy at any time in response to changes in applicable law, regulatory guidance, or the Company’s internal data processing practices. Any amendments will be published on this page with an updated effective date. Where amendments are material in nature, affected individuals will be notified through appropriate communication channels and, where required by applicable law, fresh consent will be obtained before any materially changed processing activities take effect.

12. Contact and Complaints

All enquiries, requests, or complaints relating to the processing of personal data by Sportlux should be directed to:

Email: contact@sportlux.com Telephone: 04-8356418 Offices: Dubai · New York · Lugano

Individuals who are not satisfied with the Company’s response retain the right to escalate their complaint to the relevant data protection supervisory authority in their jurisdiction.