1. INTRODUCTION

• 1.1 Who are we?
  • When you are a customer or prospect of Persol Stores: Luxottica Retail UK Ltd, with registered office at The Kensington Building Level 2 1 Wrights Lane London W8 5RY United Kingdom, Company registration number 02767938 a company which is part of the EssilorLuxottica Group (“Luxottica Retail UK”) is the party that determines the Purposes and the means of the Processing, so being the Data Controller over your Personal Data. In certain specific instances, Luxottica Retail UK may be Joint Controller with other entity(ies) over the Processing of your Personal Data: this means that, in such cases, Luxottica Retail UK is jointly responsible with these entities for deciding on the Purposes and the means of the Processing. More specifically, please note that Luxottica Retail UK is in a joint controlling relationship over your Personal Data with: Luxottica Group S.p.A., with registered office at Piazzale Cadorna no. 3 – 20123 Milan, Italy, inscribed in the Milan Trade Registry under the number 00891030272, VAT no. 10182640150, a company which is part of the EssilorLuxottica Group (“Luxottica”) for the hosting and management of customers’ and prospects’ Personal Data for marketing and communication Purposes.
  • When you are a customer or prospect or user of Persol E-Commerce Website: Luxottica Group S.p.A., with registered office at Piazzale Cadorna no. 3 – 20123 Milan, Italy, inscribed in the Milan Trade Registry under the number 00891030272, VAT no. 10182640150, a company which is part of the EssilorLuxottica Group (“Luxottica”) is the party that determines the Purposes and the means of the Processing of your Personal Data, so being the Data Controller over your Personal Data.
  • Further in this Privacy Notice, when it is made reference to “Persol” or “we” or “us” or “our”, we refer jointly to Luxottica Retail UK and Luxottica if you are a customer or prospect of Persol stores, or to Luxottica only if you are a customer, prospect or user of Persol e-commerce website.
• 1.2 What does this Privacy Policy apply to?
  • EssilorLuxottica and all its Affiliates (as defined below) attach particular importance to the Processing, confidentiality and security of your Personal Data.
  • The purpose of this Privacy Policy is to inform you in a clear, simple and complete manner about the Processing carried out on the Personal Data that you provide us with, or that we can collect from the different points of contact that you may have with us (e.g. stores, customer care, websites, events, social networks, etc.), their possible transfer to third parties as well as your privacy rights and the options that you have to control your Personal Data and to protect your privacy, in accordance with the applicable legislation.
  • We may update this Privacy Policy at any time, but if we do so we will provide you with an updated copy of this Privacy Policy as soon as reasonably possible as per Section 9 below.
  • We may also provide you with different and/or additional privacy policies in connection with certain activities, programs and offerings: in such cases, please refer to the relevant privacy policy governing the activity, program and/or offering you are benefiting to understand more about the Processing of your Personal Data in that specific circumstance.
  • Please also note that this Privacy Policy does not apply to the services provided by other companies acting on their own account, such as franchisees and licensees, or when you share information on social networks or other online platforms owned and managed by third companies, even when their links are included on our websites. These other companies have their own privacy policies in place, so remember that the way they use any Personal Data you give them will be subject to their own rules. Persol encourages you to review the privacy policies of these third parties before connecting and/or providing them with your Personal Data.
• 1.3 What is this Privacy Policy about? Key definitions
  • Affiliate(s): Any legal entity that, directly or indirectly, controls, is controlled by, or is under the common control of EssilorLuxottica S.A. (as the ultimate holding company of the EssilorLuxottica Group), where “control” means the ownership, direct or indirect, of at least 50% of the share capital or voting rights in such a legal entity.
  • Data Controller: The natural or legal person, department or organisation which, alone or jointly with others, determines the Purposes and means of the Processing of Personal Data.
  • Data Processor: The natural or legal person, department or other body which processes Personal Data on behalf of and on the instructions of the Data Controller.
  • EssilorLuxottica Group (or, simply, EssilorLuxottica or Group): EssilorLuxottica as global organization, i.e. jointly EssilorLuxottica (as ultimate holding company) and all its Affiliates.
  • Joint Controller(s): The party which, together with others, decides about Purposes and means for the Processing of Personal Data. So, we speak about Joint-Controllership over Personal Data, when two or more data controllers jointly determine Purposes and means of the Processing.
  • GDPR: The Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation”).
  • UK GDPR: The GDPR enacted into English law, and which took effect on 31 January 2020.
  • Personal Data (or simply Data): Any information about an individual (Data Subject(s)) from which that person can be identified (e.g., name, contact details, identification number, etc.). The categories of Personal Data that we may process are enumerated below in this Privacy Policy.
  • Personal Data Breach: A breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Personal Data transmitted, stored or otherwise processed.
  • Processing (of Personal Data): Any action conducted concerning your Personal Data such as, the collection, recording, organization, storage, modification, transfer, deletion, access, consultation, etc. of such Data.
  • Product(s): Frames, lenses, contact lenses and any other goods provided for sales in our stores or on our websites.
  • Purpose(s): The purpose(s) of the Processing; in other words, the reasons why Personal Data is collected.
  • Service(s): The services we provide our Data Subjects with, both in store and online (e.g., virtual try on, eye exams, etc.).
  • Supervisory Authority: An independent public authority, which is established by a Member State of the European Union or a state for which there is an adequacy decision in order to enforce the applicable data protection laws (such as, but not limited, the CNIL in France, the Irish Data Commission in Ireland, the ICO in the UK, the Garante per la protezione dei dati personali in Italy).

  Likewise, this Privacy Policy will apply to the following Data Subjects:

  • Clients: Data Subjects who purchase Products or Services offered by Persol, whether in store or on www.persol.com (the “Website”).
  • Prospects: Data Subjects who showed an interest in Persol Products or Services, but who have not made any purchase yet.
  • Web Users: Data Subjects who access the Website.
  • Registered Users: Data Subjects who have registered and created a personal account on the Website.
  • Eyesight Checks Users: Data Subjects who have undergone an eye exam / eyesight check (where the Service is active).
  • Marketing Communication Users: Data Subjects who have subscribed to receive marketing communications from Persol. They may include both Customers and Prospects.
  • Social Media Users: Data Subjects who voluntarily follow Persol activity on social media.

2. WHERE ARE PERSONAL DATA COLLECTED FROM?

The Personal Data we collect depends on the point of contact through which you interact with us, as well as the purposes of such an interaction, and are also limited to those which are relevant and appropriate for it.

We use different methods and various sources to collect Personal Data from and about you, namely we collect Personal Data:

• Provided directly by you

  We collect the Personal Data you provide us with during the registration process in our stores, the creation of an account on the Website, when completing a purchase order or joining our engagement programs, prize competitions and events and when you contact us for request, feedback or complaint. We also record customer service calls and maintain a transcript of chats for a limited period of time for training Purposes and quality assurance.

• By using automatic tracking systems

  We use some technologies (e.g., cookies and automatic tracking systems) that automatically collect certain items of information relating to the way in which you utilize the Website and the Services. For further information on the use of Personal Data collected through automatic tracking systems, please read carefully our Cookie Notice available here.

• In occasion of your store visits and through other offline technologies

  Where we have stores and you visit them, information may be collected during the purchasing process and the eyesight checks that we may carry out there (or from the eye prescriptions that you may deliver to us) for the purchase of our Products. We also use CCTV in our stores for safety, security, fraud and loss prevention, and for operational Purposes. For more information regarding the Data collection through CCTV systems, please refer to the dedicated privacy policy present in the relevant store.

• From other sources

  We may obtain information about you from other sources, such as data analytics providers, marketing or advertising service providers, fraud prevention service providers, vendors that provide services on behalf of us, or publicity available sources. We create also information based on our analysis of the information we have collected from you.

3. WHAT PERSONAL DATA MAY WE PROCESS ABOUT YOU?

Categories of Personal Data

Processing of Special Personal Data

• Certain categories of Personal Data we may process for the Purposes set out below, are qualified as “sensitive” Personal Data, as they fall within the definition of special categories of Personal Data provided for by art. 9 of the GDPR/UK GDPR (“Special Personal Data”). This is particularly the case of Health and Medical Data and Data related to your care, as described above, that we may process.
• However, please note that we only process such Sensitive Data:
  • where it is required or allowed under local applicable legislation,
  • while implementing adequate safeguards to ensure the protection of such Special Personal Data, and
  • where one of the alternative conditions set out at Article 9 of the GDPR/UK GDPR is fulfilled.
• However, please note that, when your explicit consent is required to process your Health and Medical Data and Data related to your care and you don’t grant it to us, you will not be able to purchase certain Products and/or benefit of certain Services for which Processing of Sensitive Personal Data is mandatorily required.

4. WHY DO WE PROCESS YOUR PERSONAL DATA?

We are required to use your Data for Purposes defined according to the nature of our relationships. Thus, depending on the context in which your Data is collected, it may be used for one or more of the following Purposes:

5. HOW DO WE PROCESS YOUR PERSONAL DATA?

The Processing of your Personal Data is carried out, electronically and manually, only within the limits necessary to pursue the Purposes outlined above. We undertake to protect your Personal Data. To better understand how we protect your Personal Data please refer to Section 6 below.

• Do we share your Personal Data with other Affiliates of the Group?

  EssilorLuxottica is a global organization with offices and operations throughout the world and most of your Personal Data is stored and processed within a range of global applications that is used globally by the Affiliates of our Group. The majority of the Processing of your Personal Data is carried out through the concentrated services of two entities: Essilor International and Luxottica Group S.p.A.

• Is your Personal Data transferred to third parties?

  Your Personal Data will be processed by our employees bound by confidentiality and privacy obligations and based on specific authorizations and instructions from us. Your Data may, also, be communicated to the external parties below, which will process your Personal Data as Data Processors or independent Data Controllers depending on the circumstances. More information about such third parties is available on request pursuant to Section 8 of this Privacy Policy.

  • Service providers: We may disclose your Personal Data with our third-party service providers that provide us with their services, assistance and advice, with special – but not exclusive – reference to technology, accounting, administrative, legal, insurance, IT, marketing, payment, customer service, Data Subjects requests management, Data analysis matters. Each service provider may act, depending on the case and on the specific nature of our relationship, as Data Processors (on behalf of and in accordance with the instructions received from us, by virtue of a specific agreement in place per Article 28 of the GDPR/UK GDPR) or as independent Data Controllers (such as payment providers). Please note that we require that any such third-party providers are subject to strict control and implement appropriate guarantees of security and confidentiality of your Personal Data.
  • Sale or merger: We may also disclose your Personal Data in the event that we sell, buy, merge with, are acquired by, or partner with other companies or businesses, or sell some or all of our assets, or in the unlikely case we are part of a bankruptcy. In such cases, we may disclose your Personal Data to the prospective purchaser of such business or assets or business counterparts in general, and your Personal Data may be among the transferred assets as well.
  • Click on social network icons present on the Website: Where present on our Website, if you click on the icons dedicated to social networks (e.g., X (Twitter), Facebook, TikTok, YouTube, Instagram, etc.), you are redirected to these external websites. Persol does not either collect or process Data about you or the sharing that you make via social network. When you are redirected to the social network, your interactions and information are collected by the social network itself and are subject to that social network’s own privacy policy.
  • Legal process: We may disclose your Personal Data to any authority, court, administrative body, and/or other authorized third party (including, without limitation, external legal counsel), where the disclosure of such Personal Data is required by law, regulation or court order, or where such a disclosure is necessary for the protection and defense of our rights.
  • Other instances: Please note that we do not sell, rent, or lease your Personal Data to any third parties. Anyhow, in certain instances, we may ask you if you would like us disclosing your Personal Data to other third parties who are not described elsewhere in this Privacy Policy, as well as we might also, from time to time, contact you on behalf of external business partners about a particular offering which may be of interest to you. Please note that, in all these cases, without your explicit consent, your Personal Data will not be transferred in any way and to anyone.
• Is your Personal Data transferred across the border?

  Given the presence of the EssilorLuxottica Group in many countries around the world and in order to provide you with personalized services worldwide, some of your Personal Data may be transferred to, made accessible from and/or stored outside your country of residence, including in countries which do not have data protection laws equivalent to those existing within the European Economic Area (EEA). In such cases, Persol ensures that, at all times, appropriate safeguards are implemented to ensure that your Personal Data is processed in accordance with applicable legislation (for instance, via specific intra-group transfer agreements and standard contractual clauses pursuant to Art. 44 et seq. of the GDPR/UK GDPR).

• For how long do we retain your Personal Data?

  We retain all or part of your Personal Data for the time strictly necessary to meet applicable legal/statutory requirements, contractual obligations, and to carry out each of the Purposes mentioned in this Privacy Policy.

  • Your Personal Data will be retained for a period of 10 years for our invoicing and accounting Purposes, save for circumstances where applicable laws provide for different retention requirements.
  • For marketing Purposes based on consent, Data will be retained for 10 years as of your last interaction with us if you are a customer, and for 2 years as of your last interaction with us if you are a prospect.
  • As a general rule within EssilorLuxottica Group, retention and archiving of Personal Data will not exceed 10 (ten) years overall calculated as of the first record and/or consent renewal and/or any other relevant interaction, exception made for further legal hold obligations.
  • Data may be anonymized for statistical analysis, monitoring and enhancing medical devices, R&D Purposes, or training AI models.

6. HOW DO WE PROTECT YOUR PERSONAL DATA?

• We regard the protection of Personal Data as an essential priority.
• We are aware that we have the responsibility for the security and accuracy of the Personal Data that we process and also for keeping your Data up to date. To this extent, we have taken reasonable steps to eliminate duplicates of your Personal Data and to facilitate your updating of that Data which may change over time.
• We have also implemented appropriate technical, organizational and security measures and safeguards to protect the Personal Data we process (including Group Data Protection and Information Security policies, as well as physical security measures employed at sites and offices).
• We have implemented a policy to deal with any suspected Personal Data Breach, and we undertake to notify you and any applicable regulator of such a breach where legally required to do so.
• Access to your Personal Data is strictly limited to employees, agents, contractors, and third parties who have a business need to know, bound by strict confidentiality duties and ongoing training.
• For the Website: please use a sufficiently secure password and log out after each session. Credit card payments and transactions are handled via secure platforms using standard SSL (Secure Sockets Layer) encryption and anti-fraud monitoring.

7. YOUR RIGHTS

Pursuant to Chapter 3 of the GDPR/UK GDPR, you can exercise any of the following rights, subject to verification of your identity where necessary:

• Right of Information and Access: You may ask us for confirmation of the existence of your Personal Data, be informed on its content and source, and obtain a copy of the Personal Data our databases currently contain.
• Right to Rectification: You may request us to rectify or complete your Personal Data if it is incorrect or missing important information.
• Right to Restriction of the Processing: You have the right to request restriction of processing in specific cases (e.g., while verifying accuracy, pending assessment of overriding legitimate grounds, or when needed by you to establish, exercise or defend legal claims).
• Right to Object to the Processing: You have the right to object in writing to processing based on legitimate interests, as well as an absolute right to object at any time to processing for direct marketing Purposes.
• Right to Erasure: You have the right to request that we erase your Personal Data where it is no longer necessary, where consent is withdrawn, where processing is unlawful, or where no overriding legitimate grounds exist.
• Right to Data Portability: You may request copies of your Personal Data in a structured, commonly used and machine-readable format, and have it transmitted to another Data Controller where technically feasible.
• Right to Withdraw your Consent: Where Processing is based on consent, you may withdraw your consent at any time, whereupon we will cease processing.

In order to exercise your rights, please use this Privacy Form. Alternatively, you may contact us at privacy@luxottica.com.

If you are not satisfied with the way we process your Personal Data and/or respond to your request, you can lodge a complaint with the relevant Supervisory Authority (for UK, the ICO – Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF – https://ico.org.uk/make-a-complaint/).

8. HOW CAN YOU CONTACT US?

• 8.1 Contact of the Data Controller

  The Data Controllers over the Processing of your Personal Data are set out in Section 1.1 of this Privacy Policy. Should you have questions or comments, we may be contacted at the postal address set out in Section 1.1 above and/or at the email address: privacy@luxottica.com.

• 8.2 Contact of the Data Protection Officer

  Luxottica has appointed a Data Protection Officer, who can be contacted at the email address: dpo@luxottica.com, or through the contact channels provided in Sections 7 and 8.1 above.

9. HOW CAN YOU KEEP TRACK OF CHANGES TO THIS PRIVACY POLICY?

• For legal and/or organizational reasons, this Privacy Policy may undergo changes. We suggest, therefore, checking this Privacy Policy on a regular basis and referring to the latest version of it (we will post the date it was last updated at the top of this Privacy Policy).
• In any case, an updated version of the Privacy Policy will be always available on the Website and the Services, and we will provide additional notice to you if we make any changes that materially affect your privacy rights.