Privacy Policy for Services and Data

Top

1.2 Scope of this Privacy Notice

• EssilorLuxottica and all its Affiliates place great importance on the processing, confidentiality, and security of your Personal Data. The purpose of this Privacy Notice is to provide you with clear, simple, and comprehensive information about the processing of Data that you provide to us or that we collect through various points of contact (stores, customer care, websites, events, etc.), about any possible transfer of such Data to third parties, and about your rights, in accordance with applicable law.

  This Notice may be updated at any time; in such case, we will provide you with an updated copy as soon as reasonably possible (see Section 9).

  We may also provide you with separate and/or additional privacy notices for specific activities, programmes, or offers. This Notice does not apply to services provided by third parties (e.g. franchisees, licensees, or social media platforms), which are subject to their own privacy notices.

Top

1.3 What Is This Privacy Notice About? Key Definitions

• Affiliate/ Affiliates	An entity that controls, is controlled by, or is under common control with EssilorLuxottica S.A. (control meaning ownership of 50% or more of the capital or voting rights).
  Supervisory Autorithy	Independent public authority (e.g. CNIL, Irish Data Commission, ICO, Garante Privacy – Italy) responsible for enforcing data protection laws.
  Controller	The entity that determines the purposes and means of Processing, either alone or jointly with others.
  Processor	The entity that processes Personal Data on behalf of the Controller, following its instructions.
  EssilorLuxottica Group	EssilorLuxottica SA (ultimate parent company) and all its Affiliates.
  GDPR	Regulation (EU) 2016/679 (General Data Protection Regulation).
  Joint Controller	When two or more Controllers jointly determine the purposes and means of the Processing.
  Personal Data	Information relating to an individual (Data Subject) that identifies them (e.g. name, contact details, identifiers, etc.).
  Personal Data Breach	Security breach resulting in the destruction, loss, alteration, or unauthorised disclosure of, or access to, Data.
  Processing	Any operation performed on Data (collection, recording, organisation, storage, modification, transfer, erasure, access, consultation, etc.).
  Product/ Service(s)	Frames, lenses (including contact lenses), and other goods; in-store and online services (e.g. virtual try-on, eye examinations).

  Likewise, this Privacy Notice applies to the following Data Subjects:

  Customers	Purchasers of Products/Services (in-store or via www.oliverpeoples.com – the “Website”).
  Prospects	Individuals who have shown interest but have not yet made a purchase.
  Website Users	Individuals who browse the Website.
  Registered Users	Individuals who have created an account on the Website.
  User of eye care services	Individuals who have undergone an eye examination (where the service is available).
  Marketing Communication Users	Individuals who have signed up for marketing communications (may include Customers and Prospects).
  Social Media Users	Individuals who follow Oliver Peoples on social media platforms.

Top

2. WHERE DO WE COLLECT YOUR PERSONAL DATA?

1. Provided directly by you

Data provided in-store, when creating an account, placing an order, or participating in programmes, contests, or events, or when contacting customer care. Customer service calls may be recorded (for a limited time) for training and quality purposes.

2. Through automatic tracking systems

Use of technologies (cookies and tracking tools) that collect information about your use of the Website and Services. For details, please refer to the Cookie Notice available on the Website.

3. During in-store visits and through other offline technologies

Data collected during purchases and eye examinations (or from prescriptions provided). Stores are equipped with video surveillance systems for security, fraud prevention, loss prevention, and operational purposes (see the specific notice available in-store).

4. From other sources

We may obtain Data from analytics, marketing, advertising, or anti-fraud providers, from other suppliers acting on our behalf, or from public sources. We may also generate information derived from our analysis of the Data collected.

Top

3. WHAT PERSONAL DATA MAY WE PROCESS?

3.1 Categories of Personal Data

• CATEGORY OF DATA	TYPES OF DATA	DATA SUBJECT
  Personal and Contact Information	First name, last name, email, gender, date of birth, country of residence, postal address, phone number	Customers, Prospects, Website Users, Registered Users, Eye Care Service Users, Marketing Communication Users, Social Media Users.
  Payment Data	Purchase/payment method (secure platform, encryption) and details of the products purchased.	Customers, Registered Users.
  User Profile and Commercial Data	Billing and delivery addresses; purchase details (in-store/online: order, tracking, invoices, amount/type); interests and preferences; feedback and surveys.	Customers, Registered Users.
  Marketing and Communication Data	Marketing and contact channel preferences; information contained in exchanged correspondence.	Customers, Prospects, Registered Users, Marketing Communication Users.
  Health-Related  and Medical Data (where applicable)	Optical prescriptions, eye examination results, measurements (optical correction, pupillary distance, etc.), adjustments, and information relevant to visual health.	Customers, Registered Users, Website Users, Eye Care Service Users.
  Health Insurance Data ( where applicable )	Name of the organisation/platform; health insurance coverage information.	Customers, Eye Care Service Users.
  Device Information	IP address or other device identifier; login status (registered/non-registered user); referring URL; time zone and location; browser and language.	Customers, Prospect, Registered Users, Website Users, Marketing Communication Users, Social Media Users
  Browsing Data	Interactions with the Website/Services/emails/Products/advertising and related statistics.	Customers, Prospects, Registered Users, Website Users, Marketing Communication Users, Social Media Users

Top

3.2 Processing of Special Categories of Data

• Some Data (e.g. health, medical, or insurance data) are considered “sensitive data” under Article 9 of the GDPR. We process such Data only when required or permitted by applicable law, with appropriate safeguards, and when one of the conditions set out in Article 9 of the GDPR applies. If your explicit consent is required and not provided, it will not be possible to purchase certain Products or benefit from specific Services.

Top

4. WHY DO WE PROCESS YOUR PERSONAL DATA?

• We use your Data for purposes connected with our relationship with you. Depending on the context, the Data may be used for one or more of the following purposes:

  PURPOSES	DETAILS	LEGAL BASIS
  Order follow-up and fulfilment; after-sales; additional services	Quotations; management of sales orders (purchase, delivery, supply of Products/Services); invoicing and warranty; after-sales support; management of healthcare insurance claims (where applicable).	Performance of a contract
  Payment management and potential overdue payments	Payment security and invoice issuance; management of payment issues/charges; handling of outstanding balances (identification, communications, settlement procedures.	Performance of a contract
  Creation and management of customer account/profile	Registration on the Website/in stores; provision of Services (bookings, cart reminders, etc.); management of customer profile.	Performance of a contract
  Management of subscriptions	Engagement programmes (including loyalty schemes, where applicable), participation in games/contests/initiatives.	Consent
  Communications and interactions	Commercial/promotional communications and updates (email, phone, SMS/MMS, WhatsApp, mail, etc.), including lookalike/retargeting/exclusion campaigns (using masked email); personalised offers (e.g. birthday offers); responses to requests (information, eye exam booking, “share with a friend,” “back in stock,” store locator).	Consent
  Execution of eye examinations (where applicable)	Management of appointments/prescriptions; eye/face measurements; use of results/prescriptions for the manufacture and delivery of Products.	Consent
  Use of virtual try-on tools (where applicable)	Virtual try-on of eyewear using devices (including in-store). See the dedicated notice provided at the time of use.	Consent
  Compliance with legal obligations	Regulatory obligations; decisions of Authorities; management of privacy rights; product traceability; accounting/tax record-keeping; anti-fraud measures.	Legal obligation
  Legitimate Interest	E-mails regarding Products/Events/Services similar to those already purchased (opt-out always available); exercise or defence of rights (ours/Group/representatives); technical management of the Website/Services; fraud or abuse prevention and detection; extraordinary corporate transactions (mergers/transfers); surveys and market research; anonymisation for statistical purposes, R&D, device improvement, AI model training.	Legitimate Interest

Top

5.HOW DO WE PROCESS YOUR PERSONAL DATA?

• Processing is carried out, both electronically and manually, only to the extent necessary to achieve the purposes described above.

  We are committed to protecting your Personal Data (see Section 6).

Top

5.1 Do we share your Data with other Group Affiliates?

• EssilorLuxottica is a global organisation, and many Processing activities are carried out through global applications and repositories used by its Affiliates. Most Processing is performed through the services of Essilor International and Luxottica Group S.p.A.

Top

5.2 Is your Data Shared with Third Parties?

Your Data may be processed by our employees, who are bound by confidentiality and act under our instructions. It may also be shared with third parties acting as Processors (under Article 28 of the GDPR) or as independent Controllers (e.g. payment providers). We require all such parties to implement appropriate security and confidentiality measures.

Sale or merger: In the event of extraordinary corporate transactions, your Data may be disclosed or transferred to the third parties involved.

Social media links: By clicking on social media icons on the Website, you will be redirected to external platforms, which are subject to their own privacy policies.

Legal proceedings: Your Data may be disclosed to authorities, courts, or authorised third parties when required by law or to protect our rights.

Other cases: We do not sell or transfer your Data. Any additional disclosures to third parties will only take place with your explicit consent.

Top

5.3 Is your Data Transferred Abroad?

• To provide you with personalised services wherever you are, some Data may be transferred to, stored in, or accessed from outside your country of residence, including countries outside the EEA. In such cases, we apply appropriate safeguards (intra-Group agreements, common rules, contractual clauses, and guarantees pursuant to Articles 44 et seq. of the GDPR).

Top

5.4 How Long Do We Retain Your Data?

• We retain Data only for as long as necessary to comply with legal or contractual obligations and to achieve the purposes for which it was collected. In general, Data is kept for 10 years for accounting and invoicing purposes (unless different retention periods are required by law).

For marketing purposes based on consent: 10 years from the last interaction for Customers, and 2 years for Prospects (the last interaction meaning the most recent traceable contact).

As a general Group rule, Data is retained or archived for no longer than 10 years from the date of initial registration, consent renewal, or other relevant interaction, unless different or additional legal obligations apply. Data may be anonymised for statistical analysis, R&D, device improvement, or AI model training.

Top

6. HOW DO WE PROTECT YOUR PERSONAL DATA?

• Protecting your Data is a priority. We keep Data accurate and up to date, reduce duplication, and apply technical, organisational, and security measures (including Group privacy and information security policies, as well as IT and physical safeguards at our sites, offices, and stores).

We have a policy in place to manage suspected Data Breaches and will notify you and the competent Authority when required. Access to Data is limited to individuals who need it for their duties and are bound by confidentiality obligations. Regular training is provided to our staff.

On our  Website: please use secure passwords and log out after each session. Payments are processed through a secure system (SSL) with fraud detection measures in place.

Top

7. DATA SUBJECT RIGHTS

Pursuant to Chapter 3 of the GDPR, you may exercise the following rights, subject to identity verification and applicable legal exceptions, which will be assessed on a case-by-case basis:

1. Right of Information and Access - to obtain confirmation as to whether your Data is being processed, and to access its content and origin, including a copy of the Data processed.
   
   
2. Right to rectification – to correct or complete any inaccurate or incomplete Data.
   
   
3. Right to restriction of processing – in specific circumstances (e.g. while verifying accuracy; when objecting to processing based on legitimate interest; when Data is no longer needed by us but required by you to defend legal claims).
   
   
4. Right to object – to processing based on legitimate interest and, at any time, to direct marketing..
   
   
5. Right to erasure – in certain cases (e.g. Data no longer necessary; consent withdrawn; unlawful processing; your interests overriding ours).
   
   
6. Right to data portability – to receive your Data in a structured, commonly used, and machine-readable format, and to transmit it to another Controller.
   
   
7. Right to withdraw consent – at any time, where processing is based on consent.
   

To exercise your rights, you may use the dedicated Form (where available) or contact us at privacy@luxottica.com. You may also update your Data and preferences directly from your account (Registered Users).
If you are not satisfied with how your Data is handled, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it).

Top

8. HOW CAN YOU CONTACT US?

8.1 Data Controller Contact Details

• The Data Controllers are listed in Section 1.1. For any questions or comments about this Notice or about the Processing of your Data, you may write to the postal address indicated therein and/or to the email address specified in Section 7 or below (DPO).

Top

8.2 Data Protection Officer (DPO) Contact Details 

• Luxottica has appointed a Data Protection Officer (DPO), who can be contacted at dpo@luxottica.com (or through the channels indicated in Sections 7 and 8.1).

Top

9. HOW CAN YOU KEEP TRACK OF CHANGES TO THIS NOTICE?

• For legal or organisational reasons, this Notice may change. Please check the most recent version regularly (the date of the last update is shown at the top).
  An updated version will always be available on the Website/Services, and you will be notified if any changes materially affect your rights.
  

Top

10. ADDITIONAL INFORMATION ON OUR MARKETING ACTIVITIES

• As further described in this Privacy Policy, we ask for your consent to receive marketing communications separately for each of the following contact details: e-mail address; phone number (i.e., phone calls, SMS/RCS, WhatsApp and/or any other messaging tool from mobile); and postal address. Based on that, we will send you commercial and promotional communications and periodical updates related to our Products, Services, initiatives and events only using the contact detail which you have given your consent for. You may withdraw your consent at any time, separately for each contact detail which you originally gave your consent for, by using the unsubscription/opt-out link included in our marketing communications, or through any other unsubscription mechanism made available by us. 

  Please note that, whatever the contact detail used, our marketing communications are generally personalised based on the analysis of your data, preferences and interactions with us (for example, for sending you birthday offers). As we do not offer generic, non-personalised marketing communications as a separate option, if you do not wish to receive personalised communications, the only way to avoid them is to opt out of our marketing communications altogether, by withdrawing your consent for each contact detail for which you have opted in. Withdrawing your consent for a given contact detail will stop the marketing communications sent through it, including their personalisation. 

  If you have consented to receive marketing communications at your e-mail address, and where permitted by applicable law, please note that our commercial and promotional e-mails may also include tracking pixels or similar technologies. Tracking pixels are small and usually invisible elements that may be embedded in our marketing e-mails and allow us to collect information relating to your interaction with them, such as whether and when an e-mail was opened, whether you interacted with its content, and certain technical information relating to your device or e-mail environment. We may use this information to measure and optimise the performance of our marketing campaigns, understand the effectiveness of our communications, adapt the frequency or content of our messages, and improve the relevance and effectiveness of our commercial and promotional communications. Please note that your consent to receive marketing communications at your e-mail address also covers the initial use of tracking pixels and similar technologies in such e-mails. However, you may opt out of the use of such technologies at any time, through the dedicated opt-out mechanism made available by us, without withdrawing your consent to receive marketing communications by e-mail. If you exercise this option, you may therefore continue to receive our marketing e-mails, but we will no longer use tracking pixels or similar technologies to collect information about your interaction with them. This is without prejudice to cases where the use of technical tracking pixels or similar technologies is exempt from consent under applicable law, for example where such technologies are used solely for strictly necessary technical, security or deliverability purposes, and not for marketing profiling, campaign performance measurement or personalisation purposes. In any case, the use of such technologies is subject to the limits set by applicable law and to the principles of transparency, necessity and data minimization. 

  Furthermore, please note that if you have consented to receive marketing communications at your e-mail address and/or phone number, and always to the extent permitted by applicable law, we may use the corresponding identifiers (i.e. your e-mail address and/or mobile number) to create or manage audiences on social media and online platforms for advertising purposes. More specifically, we may: 

  1. place targeted advertising, so that you may see advertising on such platforms based on your previous interactions with us or based on audience criteria we define ("retargeting"); 

  2. exclude you from certain campaigns that we believe are not relevant to you ("exclusion"); and 

  3. ask the platform to identify users with similar characteristics to existing audiences ("lookalike" or similar audience features), in order to extend the reach of our campaigns. 

  Before sharing such identifiers with the social media and online platforms for matching purposes, we always apply pseudonymisation techniques, such as hashing. However, please note that this does not prevent the relevant platform from matching that information against the data it already holds because provided to the platform directly by you or recovered by the platform from other sources. Withdrawing your consent for communications at your e-mail address and/or phone number will prevent us from sending marketing communications using the relevant contact detail(s) and from using the corresponding identifier(s) for advertising on social media and online platforms. 

  Finally, please note that, where you receive a discount code from us (for example, by e-mail or on our website), in some cases you may be given the option to add it to your Google Wallet and/or Apple Wallet apps. If you choose to do so, you may receive push notifications on your device relating exclusively to that specific discount code. Such notifications are sent only as a consequence of your choice to add the discount code to your wallet and are therefore not conditional upon your consent to receive marketing communications through any of the contact details described above. To enable these notifications, we share with Google and/or Apple the information necessary to manage the discount pass, including information relating to the discount (such as its name, code, terms and conditions and expiry date) and the identifier of the pass saved on your device; the association between the pass and your customer data is carried out internally by us. From Google and/or Apple, we only receive information on the status of the pass (i.e., whether it is active or has been removed from your wallet). If you do not wish to receive these notifications, you may disable them through the settings of the relevant wallet application or remove the discount code from your wallet at any time.