OPTI-VUE Network Privacy Policy

Version effective from 1st July 2025

The protection of your personal data is a priority for the companies and shops that are members of the OPTI-VUE network (hereinafter the “Network” or “we”). During their activities, these entities undertake to ensure the lawful, fair, transparent and secure processing of your data, in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR).

The Network processes your personal data for the following purposes:

• Provision, management and improvement of optical and hearing products and services (glasses, contact lenses, eye tests, hearing aids, specialist advice, )
• Customer follow-up, after-sales service, processing of orders and invoices
• Compliance with legal obligations relating to accounting, tax, social security or professional matters
• Recruitment, human resources management and supplier management
• Sending of commercial information, satisfaction surveys and loyalty schemes (where permitted)
• Litigation management, fraud prevention and facility security

This processing is based, depending on the circumstances, on the performance of a contract, compliance with legal obligations, the Network’s legitimate interests or your explicit consent.

Depending on your relationship with the Network (customer, employee, supplier, applicant), we may process the following information, amongst other things:

Customers:

• Identity, contact details, date of birth, National Insurance number
• Health data provided by your doctor or collected with your consent
• Purchase history, prescriptions, billing data
• Photographs for professional or promotional use

Employees and candidates:

• Identification data, personal and banking details
• Qualifications, certifications, employment contract, remuneration, working hours
• Career-related data, absences, leave, performance review

Suppliers:

• Identity, business contact details
• Financial and contractual data
• History of services and invoices

Website users:

• IP address, browser type, pages visited, cookies, web beacons
• Data from log files and online usage

Data may be transferred to service providers acting on behalf of the Network (hosting, IT support, management tools, security), in strict compliance with contractual confidentiality and security requirements.

It may also be disclosed to third parties in the following cases:

• Where required by law or by the authorities (e.g. CNPD, CNS)
• To protect the Network’s rights or security
• For debt recovery or dispute resolution

In the event of a transfer to a third country, the Network ensures that the transfer is based on a recognised legal basis (adequacy decision, standard contractual clauses, etc.) and guarantees an adequate level of protection.

The Network implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of data, including:

• Access management and authorisation
• Protection of workstations, networks and servers (antivirus, firewalls, encryption)
• Secure backups
• Physical protection of premises
• Staff training on data security

Data is retained for the periods strictly necessary, depending on the purpose of the processing and legal obligations, as a guide:

• 10 years for the Network’s accounting and commercial documents
• 10 years for clients’ health data
• 3 to 10 years for internal HR documents within the Network (1 month for unsuccessful applications)
• Unlimited retention for certain company documents, in accordance with regulatory requirements

In accordance with the GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification, erasure, restriction or objection (subject to conditions)
• Right to withdraw your consent (where applicable)

Right to lodge a complaint with the National Commission for Data Protection (CNPD)

National Commission for Data Protection (CNPD)

15, Boulevard du Jazz – L-4370 Belvaux, (+352) 26 10 60 –1, info@cnpd.lu

Each member store is responsible for processing the data it collects from its own customers. For processing carried out at a centralised level (Network administration), responsibility lies with the coordinating entity.

For any requests or queries regarding your personal data, you may contact our Data Protection Officer:

Opti-Vue Administration – Data Protection
10, route de Luxembourg – L-7759 Roost (+352) 26 80 42 20
rgpd@opti-vue.lu

See the following pages for a list of shops and the head office forming part of the Opti-Vue “Network”.