Privacy Policy for Services and Data

What is the purpose of this privacy policy?

• The purpose of this privacy policy is to inform you in a transparent, simple, and comprehensive manner about the processing of personal data that you provide to us, or that any of our affiliated entities may collect from your various contacts with us (for example stores, customer service, websites, services, events, social networks, etc.), their potential transfer to third parties, as well as your rights and the actions available to you to control your personal data and protect your privacy, in accordance with applicable law.

  We may provide different or additional privacy policies related to certain activities, programs, and offers. We may also provide additional “just-in-time” policies that may supplement or clarify our privacy practices or offer you additional choices regarding your personal data.

What does this privacy policy cover?

• AFFILIATED COMPANIES

  Refers to subsidiaries of the EssilorLuxottica Group, its ultimate holding company and its subsidiaries, or companies it controls, that are controlled by it or are under common control, as well as its service providers and strategic business partners.

  BRANDS

  The brands owned by companies belonging to the EssilorLuxottica Group.

  DATA CONTROLLER

  Refers to the natural or legal person, department, or organization that, alone or jointly with others, determines the purposes and means of processing personal data.

  DATA PROCESSOR

  Refers to a natural or legal person, department, or other entity that processes personal data on behalf of and according to the instructions of the data controller.

  ESSILORLUXOTTICA GROUP (OR SIMPLY ESSILORLUXOTTICA OR THE GROUP)

  EssilorLuxottica as a global organization, meaning jointly EssilorLuxottica (as the ultimate holding company) and all its affiliated companies.

  GDPR

  Regulation (EU) 2016/679 (General Data Protection Regulation).

  JOINT CONTROLLER

  Refers to two or more data controllers who jointly determine the purposes and means of processing.

  PERSONAL DATA (OR SIMPLY DATA)

  Any information concerning an individual (the subject) from which that person can be identified (name, contact details, identification number, etc.). The categories of personal data we may process are listed in this privacy notice.

  PROCESSING (OF PERSONAL DATA)

  Any action concerning your personal data, such as collection, recording, organization, storage, modification, transfer, deletion, access, consultation, etc. of such data.

  PURPOSE

  Refers to the purpose of processing. In other words, the reasons for collecting personal data.

  RECIPIENT (OF PERSONAL DATA)

  The natural or legal person, public authority, department, or any other entity that receives communication of personal data, whether or not a third party.

  Similarly, this policy will apply to the following data subjects:

  CLIENTS

  Clients who purchase the offered products or services

  INTERNET USERS

  Users who access the said website (the “website”)

  MARKETING COMMUNICATION USERS

  Users subscribed to Marketing communications

  SOCIAL MEDIA USERS

  Users who voluntarily follow the data controller's activity on social media.

Where is personal data collected?

• The personal data we collect depends on the point of contact through which you interact with us, as well as the purposes of that interaction, as described in this privacy policy. Additionally, it is limited to data that is relevant and appropriate for that interaction.

  We use different methods and various sources to collect data from you and about you. We collect and obtain information

  1. PROVIDED DIRECTLY BY YOU

     During the registration process, when you fill out an order form or quote, participate in our engagement programs, contests, and events, and when you contact us with a request or complaint. We also record customer service calls and keep a transcript of conversations for quality assurance purposes.

  2. USING AUTOMATED TRACKING SYSTEMS

     We use technologies (cookies and automated tracking systems) that automatically collect certain information related to how you use the website and services. For more information on the use of personal data collected by automated tracking systems, please read section 9 below carefully.

  3. THROUGH STORE VISITS AND OTHER OFFLINE TECHNOLOGIES

     When you visit our stores, we may also collect information during the purchase or adjustment process of purchased products. We also use video surveillance in our stores for security, fraud and loss prevention, and operational purposes.

  4. FROM OTHER SOURCES

     We may obtain information about you from other sources, such as data analytics providers, marketing or advertising service providers, fraud prevention service providers, vendors providing services on our behalf, or publicly available sources. We also generate information based on our analysis of the information we have collected from you.

What personal data may we process about you?

• The personal data we collect depends on the point of contact through which you interact with us, as well as the purposes of that interaction, as described in this privacy policy. Additionally, it is limited to data that is relevant and appropriate for that interaction.

  CATEGORIES OF PERSONAL DATA

  DATA CATEGORY	DATA TYPES	DATA SUBJECTS
  Identifying information	For example, first and last name, email address, gender, date of birth, country of residence, postal address, and phone numbers	Clients, Internet users, Marketing communication users, and social media users
  Payment information	Including data related to your bank card for product purchases and information about products you have purchased from us.	Clients
  Profile and commercial data	Including billing and shipping addresses, information on products and services you have purchased from us (including your order, tracking and invoices, amount and type of purchase) as well as your interests, preferences, feedback, and responses to surveys.	Clients
  Marketing and communications data	Including your Marketing preferences, communication preferences, and information contained in any correspondence or requests you send to us or that we request from you, as well as purchased services or products indicated.	Clients and prospects
  Device information	Including your IP address or any other unique code of your device (computer, mobile phone, or other), technical information that may include the URL you came from, time zone and location, browser information, and language.	Clients, Internet users, and social media users
  Browsing information	Including information regarding your interactions with our website, services, emails, products, or advertisements, as well as statistical data related to these interactions.	Internet users and social media users

Why do we process your personal data?

• We are required to use your data for purposes defined according to the nature of our relationships. Thus, depending on the context in which your data is collected, it may be used for one or more of the following purposes:

  PURPOSES	INFORMATION	LEGAL BASIS
  Tracking and fulfillment of your orders, management of after-sales services and complementary services	Formalize a quote Manage product sales and orders (purchase, delivery, and provision of products and services) Manage your billing and warranty Manage tracking and provide after-sales service and customer relations (including, for example, returns, warranty, and customer support)	CONTRACT PERFORMANCE
  Management of transactions and potential unpaid amounts	Process secure payments (in terms of billing obligations) Manage payment and debt-related issues Handle potential unpaid amounts: o Identify known unpaid amounts o Inform you of the unpaid amount, the means available to regularize it, the possibility to provide comments, and to request a review of your situation if necessary	CONTRACT PERFORMANCE
  Management of registrations	Allow you to join our engagement programs Allow you to participate in our contests, competitions, and initiatives	CONSENT
  Communications and interactions between us	Send you commercial and promotional communications and periodic updates (for example, via email, phone, SMS/MMS, WhatsApp and/or any other mobile messaging tool, postal service, social network, and newsletter) related to our products, services, initiatives, and events Manage our personalized commercial offers based on the analysis of your personal data regarding spending volume, product category, date of birth, and purchase methods Respond to your requests (for example, managing information requests, finding the store nearest to you, etc.)	CONSENT or LEGITIMATE INTEREST
  Compliance with legal obligations	Comply with the requirements of laws, regulations, protocols, and national and European legislation (including legislation on medical devices) Implement decisions of public authorities Manage requests for the exercise of your rights Ensure product traceability Retain data for accounting and tax obligations Prevent fraud	LEGAL OBLIGATIONS
  Pursuit of legitimate interests	Send you commercial emails about products, events, and services similar to those you have already received, unless you object to such processing at the time of collection and on each occasion of communication Exercise or defend rights in legal, administrative, or extrajudicial proceedings related to our rights, those of companies in our Group, and/or those of our representatives, shareholders, officers, and directors Ensure the technical management of the website and services as well as its operational functions, including troubleshooting, testing, updates, and upgrades that cannot be performed using non-personal data · Prevent or identify fraudulent or abusive activities in the use of the website and services or against the EssilorLuxottica Group and/or users of the website and services Proceed with a merger, asset sale, transfer of all or a significant part of its business, or a financing transaction by disclosing and transferring personal data to the third party(ies) involved in the transaction as part of the operation Conduct surveys and market research regarding our products and services via mail, phone, or email Anonymize personal data (for example, for statistical analysis, control and/or improvement of our medical devices, research and development purposes, etc.)	LEGITIMATE INTEREST

How do we process your personal data?

• WHAT METHODS DO WE USE TO PROCESS YOUR PERSONAL DATA?

  The processing of your personal data is carried out, electronically and manually, only to the extent necessary to pursue the purposes described above. We are committed to protecting your personal data.

  All personal data you provide is stored on secure servers, with adequate security measures to protect it against unauthorized access, maintain its accuracy, and ensure proper use of the information.

  Additionally, we use a secure system for credit card payment authorization and fraud detection.

  SHARING YOUR PERSONAL DATA WITH OTHER AFFILIATED GROUP COMPANIES

  Sunglass Hut France is an entity of the EssilorLuxottica Group, a global organization with offices and operations worldwide, and most of your personal data is stored and processed in a range of global applications used worldwide by EssilorLuxottica affiliated companies.

  We may therefore share your personal data with certain affiliated companies or brands of the EssilorLuxottica Group, based on your preferences and interests regarding these affiliated companies or brands, for the purposes stated in this privacy policy, in each case within or outside your country, as permitted and required by applicable law and/or in other circumstances with your consent.

  We may also share your information for internal business purposes.

  IS YOUR PERSONAL DATA TRANSFERRED TO THIRD PARTIES?

  1. Service providers

     We may disclose your personal data to our third-party service providers responsible for processing activities who provide us with services or assistance and advice, particularly—but not exclusively—in the areas of technology, accounting, administration, legal, insurance, IT, Marketing, customer service, data subject request management, and data analysis.

     Each service provider acts as a data processor on our behalf and in accordance with instructions received from us, under a specific agreement in place pursuant to Article 28 of the GDPR, which defines its obligations and ensures the implementation of appropriate technical and organizational measures to comply with applicable law and protect your rights.

     We require that all third-party vendors be strictly monitored and implement appropriate safeguards for the security and confidentiality of your personal data.

  2. Sale or merger

     We may also disclose your personal data:

     • In the event of a business or asset sale, in which case we may disclose your personal data to the prospective buyer of that business or assets; or
     • If we sell, purchase, merge with, are acquired by, or partner with other companies or businesses, or if we sell all or part of our assets. In such transactions, your personal data may be part of the transferred assets.

      

     We may share all information we collect as part of a significant business transaction, such as the sale of a website, a merger, consolidation, asset sale, or in the unlikely event of bankruptcy.

  3. Legal proceedings

     We may disclose your personal data to any authority, court, administrative body, or other authorized third party (including, but not limited to, a lawyer) when disclosure of personal data is required by law, regulation, or court decision, or when such disclosure is necessary to protect and defend our rights.

  4. Other cases

     We may ask you if you wish to disclose your information to other third parties not described elsewhere in this privacy policy. Additionally, we do not sell or rent your personal data to third parties, but we may, from time to time, contact you on behalf of external business partners regarding a particular offer that may interest you. In these specific cases, without your consent, your personal data will not be transferred to the third party.

     The aforementioned recipients will process your personal data as data controllers, data processors, or persons responsible for processing, depending on the circumstances.

     Further information about the categories of data processors is available upon request in accordance with section 8 of this privacy policy.

• IS YOUR PERSONAL DATA TRANSFERRED ABROAD?

  Your personal data may be accessed and/or transferred to countries that do not have data protection laws equivalent to those required within the European Economic Area (EEA).

  In such cases, Sunglass Hut France ensures that appropriate safeguards are implemented at all times to ensure your personal data is processed in accordance with applicable law. In this regard, when your personal data is processed by another EssilorLuxottica entity, the safeguards are based on commitments made through (i) a specific transfer agreement binding the EssilorLuxottica entity involved in the processing and (ii) a set of common rules applicable to the entity under the Group’s data protection policy.

  When your data is processed by third parties located outside the European Economic Area, Sunglass Hut France ensures that specific contractual protections are implemented to guarantee that this requirement is met in accordance with applicable law under Articles 44 and following of the GDPR.

  For more information regarding appropriate or adequate safeguards and how to obtain a copy, you may contact us as described in section 8 of this privacy policy.

• HOW LONG DO WE KEEP YOUR PERSONAL DATA?

  We retain all or part of your personal data for the period strictly necessary for the following reason:

   

  1. to comply with applicable legal data retention requirements;
  2. to fulfill our legal and/or contractual obligations;
  3. for the duration necessary to achieve each of the purposes mentioned in this privacy policy, including to meet any legal, accounting, or informational requirements.

   

  To determine the appropriate retention period for personal data, we consider jointly the quantity, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal data, our ability to achieve these purposes by other means, and applicable legal requirements.

  In particular, we specify that your personal data will be retained for 10 years for billing and accounting purposes, except where applicable laws may require different retention periods.

  Additionally, if you have consented to the processing of your personal data for Marketing activities (e.g., commercial and promotional communications, newsletters, personalized offers, periodic updates related to our products, services, initiatives, and events, etc.), this data will be retained for 10 years from the last interaction for clients and 2 years from the last interaction for prospects. The last interaction is defined as the last contact you established, which is traceable by our systems or sales representatives.

  In any case, please note that, generally, within the EssilorLuxottica Group, the retention and archiving of personal data will not exceed 10 (ten) years in total, calculated from the first recording and/or renewal of consent and/or any other relevant interaction, except for legal retention obligations.

  In some cases, we may anonymize your personal data so that it can no longer be associated with you, in which case we may use this information without notifying you (e.g., for statistical analysis, monitoring and/or improving our medical devices, Research & Development purposes, etc.).

  For further information on the retention of your personal data, you may contact us at the email address provided in section 8 of this privacy policy.

• SECURE, UPDATED, AND ACCURATE DATA

  Sunglass Hut France is responsible for the security and accuracy of the personal data it processes about you, as well as for updating the data and has taken measures to eliminate duplicate data and to facilitate updating data that may change over time.

How do we protect your personal data?

• Sunglass Hut France considers the protection of your personal data a priority.

  In this regard, Sunglass Hut France has implemented appropriate measures and safeguards to protect the personal data it processes. This is reflected in the EssilorLuxottica Group procedures described in the Group's programs, guidelines, and data protection policies, as well as in the concrete measures implemented throughout the Group.

  We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed without authorization, altered, or disclosed. Furthermore, we limit access to your personal data to employees, agents, subcontractors, and other third parties who need to know it for professional reasons. They will process your personal data only under our instructions and are bound by confidentiality. These measures range from technical security measures that protect IT systems to physical security measures employed at EssilorLuxottica Group sites. Additionally, Solaris requires its staff to participate in information security training. You can obtain details of these measures from the Group Information Security department.

  We have procedures in place to respond to any suspected data security breaches and will notify you, as well as any applicable regulatory body, in the event of a breach when legally required to do so.

Your rights

• You may exercise each of the following rights, subject to verification of your identity where applicable:

  1. Right to information and access

     You may request confirmation of the existence of your personal data, information about its content and source, and obtain a copy of the personal data currently held in our databases.

  2. Right to rectification

     You may request the correction of personal data currently held in our databases. We may not comply with your request to modify personal data if we believe it would violate a law or legal obligation or render the information incorrect.

  3. Right to restriction of processing

     Where applicable, you may limit the processing of your personal data. We will inform you if such restriction is not possible. You may also exercise any other rights under this Privacy Policy, including withdrawing your consent to the processing of your personal data.

  4. Right to object to processing

     Where applicable, you have the right to object to the processing of your personal data for reasons related to your personal situation if the processing is based on our legitimate interest. You may also object at any time to the processing of personal data for direct marketing purposes, including profiling if it is related to such direct marketing.

     If such objection is not possible, we will inform you accordingly. You may then choose to exercise any other rights under this Privacy Policy, including withdrawing your consent to the processing of your personal data.

  5. Right to erasure

     You may request the erasure of your personal data. Upon receipt of such request, we will acknowledge it and confirm once your personal data has been deleted.

  6. Right to data portability

     Upon request, to the extent possible and if permitted by applicable local law, we may provide you with a copy of your personal data. We will inform you if your request cannot be fulfilled. You may also exercise any other rights under this Privacy Policy, including withdrawing your consent to the processing of your personal data. Where applicable, we will ensure that such changes are shared with trusted third parties.

  7. Right to withdraw your consent

     If the processing of your personal data is based on your consent, you may withdraw it at any time. We will acknowledge receipt of your withdrawal request and then cease all processing of your personal data.

  8. Right to lodge a complaint with the competent data protection authority

     If you are not satisfied with the way we process your personal data or with our response to a request to exercise your rights, you may lodge a complaint with the competent data protection authority.

  To exercise your rights, please use this Privacy Form.

  You may also contact us at privacy@luxottica.com

  Additionally, we provide tools for updating and modifying your personal data. Each registered user can access and update their information (e.g., via their user account).

  You may also modify and update your preferences regarding how you wish to receive emails or other communications from us. You may also request the deletion of information related to your account.

  Top

  How to contact us?

  • CONTACT THE DATA CONTROLLER

    The data controllers responsible for processing your personal data are listed in section 1.1 of this Privacy Notice.

    If you have any questions or comments about this Privacy Policy or any data processing we have carried out, you can contact us at the postal address indicated in section 1.1 above and/or at the email address provided in section 7 above.

    CONTACT THE DATA PROTECTION OFFICER

    We have appointed a Data Protection Officer, who can be contacted at the following email address: dpo@luxottica.com, or using the contact methods provided above in section 8.1.

  Top

  How are cookies managed by Sunglass Hut?

  • When you visit our website, cookies may be placed on your device. Their placement and storage are carried out in compliance with applicable regulations. You can accept or reject cookies at any time using the mechanism integrated into the banner available on the first page of our site or under the conditions specified below.

    What is a cookie?

    A cookie is a text file saved by a website on your device, phone, or other device to collect information about your browsing. They are managed by your web browser.

    For what purposes are cookies used on this website?

    Data collected through cookies may relate to you, your preferences, or your device, and are mainly used to ensure that the e-commerce site functions correctly. The information generally does not allow you to be directly identified but may enable a personalized web experience.

    Strictly necessary cookies

    These cookies are essential for the operation of the e-commerce site and cannot be disabled in our systems. They are generally set in response to actions you have taken that constitute a service request, such as setting your privacy preferences, logging in, or filling out forms. You can configure your browser to block or be notified of these cookies, but some parts of the e-commerce site may be affected. These cookies do not store any personally identifiable information.

    Functionality cookies

    These cookies help improve and personalize the functionality of the e-commerce site. They may be activated by our teams or by third parties whose services are used on our e-commerce pages. If you do not accept these cookies, some or all of these services may not function properly.

    Performance cookies

    These cookies help determine the number of visits and traffic sources to measure and improve the performance of our e-commerce site. They also help identify the most or least visited pages and assess visitor browsing habits. All information collected by these cookies is aggregated and therefore anonymized. It may be transferred cross-border outside the EU via Google Analytics technology. If you do not accept these cookies, we will not be informed of your visit to our site.

    Social media cookies

    These cookies are activated by services offered on social media that we have added to the e-commerce site to allow you to share our content with your network and contacts. They also allow us to track your browsing on other websites and build a profile of your interests. This may affect the content and messages displayed on other websites you visit. If you do not allow these cookies, you may not be able to use or view these sharing tools. Social media cookies are managed by the social network provider. Users are encouraged to review the cookie management policies of social networks on the relevant sites.

    Cookies for targeted advertising

    These cookies may be placed on our e-commerce site by our advertising partners. They may be used by these companies to build a profile of your interests and offer you relevant advertisements on other websites. They do not directly store personal data but are based on the unique identification of your browser and internet device. If you do not allow these cookies, your advertising will be less targeted.

    For what purposes are cookies NOT used on this website?

    We do not store sensitive personal information such as your address, password, credit card data, etc., in the cookies we use.

    Cookie users

    Information stored in cookies on our website is processed exclusively by us, except for cookies placed by third parties (e.g., advertising networks or partners). The issuance and use of cookies by third parties are subject to the privacy policies of these third parties in addition to the provisions of this policy. Consequently, users are encouraged to visit these third-party websites for more information on the cookies they store and how users can manage them.

    Disabling cookies

    You can choose to disable these cookies at any time, taking into account the limitations mentioned above within your browser.

    Using Internet Explorer?

    • In Internet Explorer, click the Tools button, then Internet Options.
    • Under the General tab, under Browsing History, click Settings.
    • Click the View Files button.
    • Click the Name column header to sort all files alphabetically, then browse the list until you see files starting with “Cookie.” (All cookies have this prefix and usually contain the name of the e-commerce site that created the cookie).
    • Close the window containing the list of files, then click OK twice to return to Internet Explorer.

     

    Using Firefox?

    • Go to the “Tools” tab in the browser and select the “Options” menu.
    • In the window that appears, choose “Privacy” and click on “Show Cookies.”
    • Locate the files that contain the site’s name. Select them and delete them. Using Safari?
    • In your browser, choose the Edit menu > Preferences.
    • Click on Security.
    • Click on Show Cookies.
    • Select the cookies that contain the site’s name and click Delete or Delete All.
    • After deleting the cookies, click Done.

     

    Using Google Chrome?

    • Click on the Tools menu icon.
    • Select “Options.”
    • Click on the Advanced Options tab and go to the “Privacy” section.
    • Click the Show Cookies button.
    • Locate the files that contain the site’s name. Select them and delete them.
    • Click “Close” to return to your browser. For more information on cookies and how to manage them, visit http://www.cnil.fr/vos-droits/vos-traces/les-cookies/ or click the “Help” option in your browser’s menu.

     

  Top

  How can you track changes to this Privacy Policy?

  • For legal and/or organizational reasons, this Privacy Policy may be subject to changes. We therefore recommend that you regularly review this Privacy Policy, and to refer to its latest version, we will display the date of its last update at the top of this Privacy Policy.