CREATECH

Privacy Policy

‌Effective Date: October 5, 2026‌

This Privacy Policy is issued by CREATECH S.à r.l., located at 44, rue de l’Ermitage, L-8833 Wolwelange, Luxembourg, contact email: [email protected], contact phone: +352 2661 5023, operating the e-commerce website www.createchoutdoor.com. We are fully committed to protecting the personal data and privacy rights of all users who access, browse, and make purchases on our platform, in strict compliance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and all applicable Luxembourg and European data protection laws. This document clearly outlines how we collect, process, store, share, and protect your personal information, as well as the full set of rights you hold over your data, to ensure complete transparency and fairness in all our data processing activities.

1. Scope of Application and Governing Compliance

This Privacy Policy applies to all data processing activities conducted by CREATECH S.à r.l. in connection with your use of the www.createchoutdoor.com e-commerce platform, including but not limited to account registration, product browsing, order placement, payment processing, after-sales service, participation in promotional activities, and customer support interactions. As an entity established in Luxembourg, our platform extends services to users across the European Union and global regions, and all data processing operations strictly adhere to the seven core principles of GDPR: lawful, fair and transparent processing, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

We explicitly confirm that no data processing activity on our platform will proceed without a valid legal basis as defined under GDPR Article 6. All operations are designed to uphold your fundamental right to personal data protection, while supporting the smooth operation of our outdoor gear e-commerce services.

2. Definitions of Key Terms

For the purposes of this Privacy Policy:

  • ‌Personal Data‌: Means any information relating to an identified or identifiable natural person (the “Data Subject”), directly or indirectly, such as name, identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • ‌Special Category Personal Data‌: Refers to personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, along with genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, which we only process under explicit legal exceptions as required by GDPR.
  • ‌Data Processing‌: Means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • ‌Data Controller‌: Refers to CREATECH S.à r.l., the entity that determines the purposes and means of the processing of personal data on the www.createchoutdoor.com platform.
  • ‌Data Processor‌: Means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller, under our explicit written instructions.

3. Categories of Personal Data We Collect, and Collection Purposes

We only collect personal data that is accurate, relevant, and limited to what is necessary for the specific, explicitly stated purposes outlined in this section, in full alignment with the data minimisation principle of GDPR. We will never collect personal data that is not directly required to deliver our e-commerce services, without first obtaining your separate, explicit consent.

3.1 Data Collected During Account Registration

When you create a user account on www.createchoutdoor.com, we collect your full name, valid email address, mobile phone number, and chosen account password. This data is processed for the sole purposes of verifying your identity as a registered user, managing your account credentials, sending important service notifications related to your account security, and enabling you to access personalised platform features such as saved favourite items, order history tracking, and one-click checkout settings.

3.2 Data Collected During Order and Purchase Processing

When you place an order for outdoor products on our platform, we collect the following categories of personal data to fulfill your purchase contract:

  • Full name, delivery address, and contact phone number of the designated recipient, to arrange the accurate dispatch and delivery of your ordered outdoor equipment
  • Payment related data, including billing address, bank account details, or payment card information, which we process only to complete transaction settlement and prevent payment fraud. All payment sensitive data is encrypted in transit and at rest, and we do not retain full payment card details after the transaction is successfully completed, except for the last 4 digits of the card number required for accounting and dispute resolution purposes
  • Order details including purchased product names, quantities, and order timestamps, to maintain your purchase history, process after-sales returns and warranty services, and fulfill our legal tax retention obligations under Luxembourg commercial law

3.3 Automatically Collected Technical Data When You Browse Our Website

When you access www.createchoutdoor.com, we automatically collect standard technical data through secure server logs and necessary functional cookies, including your device IP address, browser type and version, operating system, time of page access, page viewed duration, click interaction paths on product pages, and general geolocation data (no more precise than city level). This data is processed for our legitimate interest of maintaining the operational stability and security of our e-commerce platform, optimising website loading performance, troubleshooting technical errors, and preventing unauthorised access or cyber-attacks. We will not use this technical data to create detailed user behaviour profiles for targeted advertising without your separate explicit consent.

3.4 Additional Data Processed with Your Separate Consent

With your free, specific, informed and unambiguous consent, which you may withdraw at any time with no less ease than granting it, we may process additional personal data for the following optional features:

  • Precise geolocation data, to provide you with localised stock availability checks for outdoor products, or to arrange same-day local delivery services if available in your region
  • Your preference data for outdoor activities (such as hiking, camping, mountaineering), browsing history of product categories, and product click logs, to provide personalised product recommendations that match your outdoor activity needs
  • Your email address or mobile phone number, to send you optional newsletter updates, exclusive promotional offers for new outdoor gear, and event information for local outdoor community activities organised by CREATECH. You may unsubscribe from these marketing communications at any time, by using the one-click unsubscribe link included in every marketing email, or sending an unsubscription request to our contact email [email protected]
  • Your profile photo, social media account display name, if you choose to register or log in to our platform via third-party social media accounts, to sync your display profile information for community review features on our platform. We will never access or collect any of your private social media content without your separate explicit permission.

4. Legal Bases for Data Processing

All of our personal data processing activities strictly comply with GDPR Article 6, and are supported by at least one of the following valid legal bases:

  1. ‌Contract Performance Necessity‌: Processing your name, delivery address, payment information and order details is necessary for the performance of the sales contract you enter into with us when placing an order on www.createchoutdoor.com, to complete product delivery, process payment and fulfill all contractual after-sales obligations.
  2. ‌Legal Obligation Compliance‌: We process your order transaction data, billing information and financial records to comply with our legal obligations under Luxembourg tax law, commercial accounting regulations, and consumer protection laws that apply to us as an e-commerce operator established in Luxembourg.
  3. ‌Legitimate Interest Balance‌: Processing your website technical log data, IP address and general device information is based on our legitimate interest of maintaining the cybersecurity and operational stability of our e-commerce platform, as well as preventing fraud and unauthorised account access. We have conducted a strict balancing test to confirm that this legitimate interest does not override your fundamental privacy rights, and all such data processing activities are limited to the minimum necessary scope.
  4. ‌Explicit Consent‌: All processing activities for optional features, including personalised recommendations, marketing newsletter subscriptions, precise geolocation access, are conducted solely based on your free, specific, informed and unambiguous consent. You have the full right to withdraw any previously granted consent at any time, at no cost, and withdrawal of consent will not affect the lawfulness of processing conducted before the withdrawal.

5. Data Retention Period Policy

We strictly follow the storage limitation principle of GDPR, and will only retain your personal data for as long as it is absolutely necessary to achieve the specific purposes for which the personal data was collected. After the corresponding purpose is fulfilled, we will securely erase or anonymise your personal data in full compliance with our internal data deletion procedures:

  • For personal data related to your active user account, we will retain all relevant account information, order history and preference data for the entire duration that your account remains active on our platform. After you submit a valid account deletion request, all personal data in your account will be fully erased within 30 working days, except for the limited data that we are required to retain by applicable tax, commercial or consumer protection laws.
  • For order transaction data related to completed purchases, we will retain the relevant records for 10 years after the order completion date, in compliance with Luxembourg statutory commercial accounting and tax retention requirements.
  • For marketing communication related contact data (such as your email address subscribed to our newsletter), we will retain this data only until you choose to unsubscribe from our marketing communications, or submit a request for us to delete this contact information.
  • For automatically collected website technical log data, we will retain these records for a maximum period of 12 months, after which all such data will be completely anonymised so that it can no longer be linked back to any identifiable individual.
  • After the valid retention period expires, all personal data that is no longer required will be permanently deleted through secure overwriting procedures, and no residual copies will be kept on our production, backup or cloud storage systems.

6. Recipients of Personal Data and Cross-Border Data Transfers

We will never sell, rent or trade your personal data to any third party for commercial purposes, under any circumstances. We may only disclose your personal data to the following categories of recipients, only to the minimum extent required to fulfill the relevant service purpose, and all such recipients are bound by strict data protection contractual obligations that meet GDPR requirements:

  • ‌Authorised Logistics and Delivery Partners‌: We will share only your delivery recipient name, contact phone number and full delivery address with the courier service providers we cooperate with, solely for the purpose of completing the last-mile delivery of your ordered outdoor products. These logistics providers will never use your personal data for any other unrelated purposes.
  • ‌Certified Payment Service Providers‌: We will share necessary transaction payment data with our PCI-DSS compliant payment processing partners, only to complete the secure settlement of your order payment. All payment processing operations are conducted in full compliance with EU payment security regulations.
  • ‌Authorised Third-Party Cloud Service Processors‌: We use EU-based cloud infrastructure service providers to host our www.createchoutdoor.com platform and user data, all of which are located within the territory of the European Economic Area (EEA), and are required to implement the same level of data security protection as required by GDPR.

If in the future we need to transfer any of your personal data to a third country located outside of the European Economic Area (EEA), we will strictly comply with Chapter V of GDPR. We will only conduct such cross-border transfers if one of the following conditions is satisfied: (1) The European Commission has issued an adequacy decision for that third country, confirming that it provides an essentially equivalent level of personal data protection as required under GDPR; (2) We have implemented appropriate and enforceable data protection safeguards, such as signing the standard contractual clauses approved by the European Commission with the third-country data recipient, and we have completed a full transfer impact assessment to verify that the recipient can provide sufficient data protection. You may contact us at any time via the contact information listed in this Privacy Policy, to request a full copy of the relevant documentation for any cross-border data transfer of your personal data.

7. Security Measures for Personal Data Protection

We implement comprehensive technical and organisational security measures, to ensure the integrity and confidentiality of your personal data, and to protect it against unauthorised or unlawful processing, accidental loss, destruction or damage, in compliance with GDPR security requirements:

  • All data transmitted between your browser and the www.createchoutdoor.com platform is protected by TLS 1.3 end-to-end encryption, to prevent interception by unauthorised third parties during transmission
  • Sensitive personal data including payment information, identification data and account passwords are encrypted at rest using industry standard AES-256 encryption algorithms, and no plaintext versions of this sensitive data are stored on our servers
  • We implement strict role-based access control for all internal staff, only granting the minimum level of data access permissions that are strictly necessary for their respective job functions, and all data access operations are fully logged and audited on a regular monthly basis
  • All our operation and maintenance teams have completed mandatory GDPR data protection training, and are bound by non-disclosure confidentiality agreements that prohibit any unauthorised access or processing of user personal data
  • We have established a formal data breach response and notification procedure. In the unlikely event that a personal data breach occurs which poses a high risk to your rights and freedoms, we will notify the relevant Luxembourg supervisory authority within 72 hours after becoming aware of the breach, and notify all affected data subjects without undue delay, as required by GDPR Article 33 and 34.

8. Your Full Rights as a Data Subject

Under the General Data Protection Regulation, you hold a comprehensive set of rights over your personal data processed by our platform. You may exercise any of these rights at any time, free of charge, by submitting a request to our designated data protection contact email at [email protected]. We will respond to your valid request within one month of receipt, and we will never charge you any unreasonable fee or refuse your legitimate request unless it is manifestly unfounded or repetitive:

  1. ‌Right to Transparent Information (Right to Be Informed)‌: You have the right to receive clear, transparent and easily understandable information about how we process your personal data, which is fully provided to you in this Privacy Policy.
  2. ‌Right of Access‌: You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and where that is the case, you have the right to access a full copy of all your personal data held by us, along with complete details of the processing purposes, categories of personal data concerned, recipients we have shared your data with, the planned storage period, and all other information required under GDPR Article 15.
  3. ‌Right to Rectification‌: You have the right to obtain from us without undue delay the rectification of any inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.
  4. ‌Right to Erasure (“Right to be Forgotten”)‌: You have the right to request us to erase your personal data without undue delay, under circumstances including when the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, you withdraw the consent that the processing was based on, there is no other legal ground for the processing, or you object to the processing and there are no overriding legitimate grounds for our processing. This right does not apply when retaining the data is necessary for compliance with a legal obligation that requires processing under EU or Luxembourg law, or for the establishment, exercise or defence of legal claims.
  5. ‌Right to Restriction of Processing‌: You have the right to obtain from us restriction of processing of your personal data, in scenarios including where you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or you have objected to processing pending the verification whether our legitimate grounds override your grounds.
  6. ‌Right to Data Portability‌: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another data controller without hindrance from us, where the processing is based on your consent or on a contract, and the processing is carried out by automated means.
  7. ‌Right to Object‌: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interest public interest tasks, including profiling based on those provisions. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. You also have the absolute right to object to processing of your personal data for direct marketing purposes at any time, and once you submit such an objection, we will immediately cease all processing of your data for such direct marketing purposes.
  8. ‌Right to Object to Automated Decision-Making‌: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except for the scenarios explicitly allowed under GDPR Article 22(2). We will never implement any automated decision-making mechanism that may produce significant legal impacts on you, without your explicit separate consent.
  9. ‌Right to Withdraw Consent‌: You have the right to withdraw any consent you previously granted to specific data processing activities, at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Withdrawing your consent is as easy as submitting the original consent.

If you believe that the processing of personal data relating to you by our platform infringes your rights under GDPR, you also have the full right to lodge a complaint with the competent data protection supervisory authority in Luxembourg, or in the EU member state where you reside, work, or where the alleged infringement occurred.

9. Protection of Minors’ Personal Data

Our www.createchoutdoor.com e-commerce website is a general audience platform, and we do not knowingly collect personal data from minors under the age of 16. If you are under the age of 16, please do not provide any personal data to our platform without the explicit consent of your parent or legal guardian. If we become aware that we have collected personal data from minors under 16 without the verification of parental consent, we will immediately take all reasonable measures to delete that personal data completely from our systems. For users between the ages of 13 and 16, processing of their personal data for information society services will only be conducted if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

10. Amendments to This Privacy Policy

We may update and revise this Privacy Policy from time to time, to reflect changes in our data processing operations, new regulatory requirements, or new platform feature updates. When we make material amendments to this Privacy Policy, we will prominently post the updated version on the homepage of www.createchoutdoor.com, clearly mark the revised effective date, and send a separate notification to all registered users via email. We will not reduce your rights under this Privacy Policy without your explicit consent. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

11. Contact Information

If you have any questions, comments, concerns, or requests related to this Privacy Policy, or any matters related to our personal data processing activities, please contact our designated data protection representative via the following channels:

  • Company Name: CREATECH S.à r.l.
  • Registered Address: 44, rue de l’Ermitage, L-8833 Wolwelange, Luxembourg
  • Contact Email: [email protected]
  • Contact Phone: +352 2661 5023