EssilorLuxottica and your personal data
Understand why and how EssilorLuxottica processes your personal data
Last updated: 11 March 2026
At EssilorLuxottica, we are committed to protecting our customers‘ personal data.
Upholding this commitment is vital to our success and reputation, and ultimately to our ability to fulfil our mission of helping people see more, be more and live life to the full.
EssilorLuxottica, a public limited company under French law with its registered office at 1-6 rue Paul Cézanne, 75008 Paris, France, registered in the Créteil Trade and Companies Register under number 712 049 618;
Essilor International, a public limited company under French law with its registered office at 1147 rue de Paris, 94220 Charenton-le-Pont, FRANCE, registered in the Créteil Trade and Companies Register under number 439 769 654, as part of the EssilorLuxottica Group;
Luxottica Group S.p.A., a public limited company under Italian law, with its registered office at Piazzale Cadorna No. 3 – 20123 Milan, Italy, as part of the EssilorLuxottica Group;
And
Rupp + Hubrach Optik GmbH, Von-Ketteler-Str. 1, 96050 Bamberg, Germany, as part of the EssilorLuxottica Group.
Hereinafter collectively referred to as „we„, „us“ or „EssilorLuxottica“.
We are „Joint Controllers“ for the purposes described below. This means that we are jointly responsible for deciding how we and the global organisation, together with its subsidiaries and brands worldwide, store and use personal data about you.
We are bound by data protection legislation and this Privacy Notice.
We, our affiliates and our brands attach particular importance to the processing, confidentiality and security of your personal data.
The purpose of this Privacy Notice is to inform you in a clear, simple and comprehensive manner about the processing of the personal data you provide to us or that any of our subsidiaries/brands may collect during the various interactions you have with us (e.g. in-store, customer service, websites, services, events, social media, etc.), about its possible disclosure to third parties, and about your rights and the options available to you to control your data and protect your privacy, in accordance with applicable legislation.
We may update this Privacy Notice at any time, but if we do so, we will provide you with an updated version of this notice as soon as possible.
We provide you with different or additional Privacy Notices in connection with specific activities, programmes and offers.
We may also provide additional „just-in-time“ notices that supplement or clarify our privacy practices, or offer you further choices regarding your personal data.
Our websites contain links to websites and/or applications operated and maintained by third parties. Please note that we have no control over the privacy practices of websites or applications that we do not own. EssilorLuxottica recommends that you read the Privacy Notices of these third parties (see section 5.3.c.d).
For the purposes of this Privacy Notice, the following terms and expressions, the first letter of which appears in capital letters, shall have the meanings assigned to them below:
| Personal Data//Personal Information | Any information relating to an individual (the data subject) that enables that individual to be identified, either directly or indirectly (name, contact details, identification number, etc.). The categories of personal data that we may process are listed in this Privacy Notice. |
| Applicable legislation | Refers to all laws, regulations, directives and decrees at local, national or supranational level relating to data protection or others that have a direct or indirect impact on the processing of personal data. |
| Processing of personal data | Any operation carried out in relation to your personal data, such as the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of such data. |
| Recipients of the data | A natural or legal person, public authority, agency or other body to whom personal data is disclosed, regardless of whether they are a third party or not. |
| Purpose | Refers to the purpose of the processing. In other words: the reasons for which the personal data is collected. |
| Data controller | Refers to the natural or legal person, department or organisation that, alone or jointly with others, determines the purposes and means of the processing of personal data. |
| Joint controllers | Refers to two or more controllers who jointly determine the purposes and means of processing. |
| Data processor | Means a natural or legal person, public authority, agency or other body which processes personal data on behalf of and on the instructions of the controller. |
| Subsidiaries | Refers to subsidiaries of the Essilor-Luxottica Group, its ultimate holding company and its subsidiaries or companies that it controls, are controlled by it or are under common control, as well as its service providers and strategic business partners. |
The personal data we collect depends on the point of contact through which you engage with us, as well as the purposes of that interaction as described in this Privacy Notice, and is limited to that which is relevant and appropriate to that interaction.
We use various methods and sources to collect data from and about you. We collect and receive information:
a) Provided directly by you
During the registration process, when creating an account on the website and/or services, or when you place an order or take part in our engagement programmes, competitions and events, and when you contact us with an enquiry, feedback or complaint. Under certain circumstances, we also record customer service calls and keep transcripts of chats for quality assurance and quality management purposes.
b) Use of automatic tracking systems
We may use certain technologies (e.g. cookies and automated tracking systems) that automatically collect certain information about how you use the websites and services. For further information on the use of personal data collected by automated tracking systems, please read our Cookie Policy carefully, which you can find at here.
c) Through in-store visits and other offline technologies
When you visit our shops, information may be collected during the purchasing process, the creation of an unrealised quote, the customisation of purchased products, and visual checks that may be carried out in the shops. We also use video surveillance in our shops for security, fraud, loss prevention and operational purposes.
d) From social media profiles
If you choose to log in to the websites and/or services via social media applications, or to link your account to your public social media profiles, and to share your actions on the website and/or services via the relevant plug-ins (e.g. Facebook Connect, Like, Share, etc.) on these channels. Use of the aforementioned plug-in results in the relevant actions and information being shared on the relevant social networks (see point 5.3.c.d).
e) From you, when you apply for a job
The application data received for the purpose of processing the application procedure, which may be submitted in various ways. If an employment contract is concluded with an applicant, the data submitted will be processed for the purpose of managing the employment relationship. If no employment contract is concluded with the applicant, the application documents will be deleted in accordance with section 5.5 of this Privacy Notice.
Unless it has been individually agreed with the applicant to retain the data for a longer period in order to be able to contact them regarding future job vacancies.
f) From other sources
We may obtain information about you from other sources, such as data analytics providers, marketing or advertising service providers, fraud prevention service providers, providers who perform services on our behalf, or from publicly available sources. We also generate information based on our analysis of the information we have collected from you.
The personal data we collect depends on the point of contact through which you engage with us, as well as the purposes of that interaction, as described below in this Privacy Notice, and is limited to that which is relevant and appropriate to that interaction.
| DATA CATEGORY | TYPES OF DATA |
|---|---|
| Identification information | Including first name, surname, email address, gender, date of birth, country of residence, postal address and telephone numbers |
| Payment information | This includes data relating to your credit card for the purchase of products via the websites and services (payments are processed via a secure platform, supplemented by control measures, including the encryption of contact details), as well as details of products you have purchased from us. |
| Profile and commercial data | This includes your account name, password, personal data you have shared on social media, billing and delivery addresses, details of products and services you have purchased from us (in-store or online, including your order, tracking information and invoices, the amount and type of purchase), as well as your interests, preferences, feedback and responses to surveys. |
| Marketing and communication data | This includes your preferences regarding receiving marketing materials from us, your communication preferences, and information contained in correspondence or enquiries you send to us, or which we request from you when issues with the websites, services or purchased products are reported. |
| Health and medical data | This includes optician’s prescriptions, eye examinations, measurements (optical correction, pupillary distance, etc.), fittings, information affecting your visual health, as well as eye tests that may be carried out in our shops, and information regarding hearing ability and the condition of your ears. |
| Device information | This includes, for example, the IP address or other unique identifier of your device (computer, mobile phone or other devices), whether you are identified as a registered user or not (login details), technical information such as the URL you came from, time zone setting and location, browser information and language. |
| Navigation information | This includes information about your interactions with our websites, our services, emails, products or advertising, as well as statistical data relating to these interactions. |
| Application data | This includes data relating to the processing of the application process, such as CV/professional background, photograph, date of birth and contact details. |
| Personal data of our business partners | This includes the contact details of the contact persons at our business partners. |
Certain categories of personal data that we process for the purposes set out below are classified as „sensitive“ personal data. This applies in particular to health and medical data and data relating to your care, as described above, which we may process.
However, we only process sensitive data:
However, if you do not give your explicit consent to the processing of your health and medical data, as well as your care-related data, you will not be able to use the services described above in our shops and via our websites and services.
We are obliged to use your data for purposes arising from the nature of our relationship. Depending on the context in which your data is collected, it may be used for one or more of the following purposes:
| PURPOSES | DETAILS | LEGAL BASIS |
|---|---|---|
| Tracking and fulfilling your online orders, as well as managing customer service |
|
CONTRACT CONCLUSION |
| Managing transactions and potentially unpaid invoices |
|
CONTRACT CONCLUSION |
| Creation and management of accounts and registrations |
|
CONSENT |
| Communication between us |
|
CONSENT |
| Conducting eye tests |
|
CONSENT |
| Analytical purposes |
|
CONSENT |
| Compliance with legal obligations |
|
LEGAL OBLIGATIONS |
| Pursuit of legitimate interests |
|
LEGITIMATE INTEREST |
Your personal data is processed both electronically and manually only to the extent necessary to achieve the purposes set out above.
We are committed to protecting your personal data.
Please note that your password is one of the account’s security measures. You are therefore advised to use a password that is sufficiently secure and to keep it in a safe place, restricting access to your own computers and browsers, and logging out after visiting the websites and/or services.
All personal data you provide is stored on secure servers, with appropriate security measures in place to protect the personal data from unauthorised access, ensure the accuracy of the personal data, and guarantee the proper use of the information.
In addition, a secure system is used to authorise credit card payments and detect fraudulent activity. We use the SSL (Secure Sockets Layer) standard to protect the confidentiality of your personal data.
EssilorLuxottica is a global company with offices and operations around the world. Most of your personal data is stored and processed in a range of global applications used by EssilorLuxottica’s subsidiaries worldwide. The majority of the processing of your personal data is carried out by the centralised services of two companies: Essilor International and Luxottica Group S.p.A.
We may share your personal data with certain affiliates or brands within the EssilorLuxottica Group, based on your preferences and interests regarding those affiliates or brands, for the purposes set out in this Privacy Notice, in each case within or outside your country, to the extent permitted and required by applicable law and/or in other circumstances with your consent.
We may also share your data for our internal business, technical or marketing purposes (e.g. to offer you similar products or services).
a) Service providers
We may share your personal data with our third-party service providers who are entrusted with processing activities and who provide us with services or support and advice, in particular – but not exclusively – in relation to technology, accounting, administration, legal matters, insurance, IT, marketing and data analysis.
Each service provider acts as a data processor on our behalf and in accordance with the instructions we provide, pursuant to a specific agreement under Article 28 of the GDPR, which sets out their obligations and guarantees the implementation of appropriate technical and organisational measures to comply with applicable legislation and protect your rights.
We require that such third-party providers be subject to strict oversight and provide adequate safeguards for the security and confidentiality of your personal data.
b) Business partners (e.g. contact lens manufacturers and brands)
Where your order is dispatched directly by the manufacturers, we will transfer your data to our distribution partners.
In such cases, however, the scope of the data transferred is limited to the minimum necessary.
Our partners have been carefully selected by us and are obliged to us, in accordance with legal provisions, to handle your data with the utmost care and to comply with our own data protection standards. In particular, our partners are not permitted to pass on our customers‘ data to third parties for advertising purposes.
c) Sale or merger
We may also disclose your personal data:
We may share all data we have collected in connection with a major corporate transaction, such as the sale of a website, a merger, a consolidation, the sale of assets or, in the unlikely event of bankruptcy.
d) Third-party social network providers
If you choose to log in to the websites and/or services via social networking applications or link your account to your public social networking profiles and share your actions on the website and/or services via the relevant plug-ins (e.g. Facebook Connect, I like, fb share, etc.) on these channels, these third-party services may collect information about you, including information about your activities on the websites and/or services, and they may inform their third-party services of your connections through your use of the websites and/or services. The use of your personal data by these services is not governed by this Privacy Notice, but by their own privacy policies.
e) Legal proceedings
We are entitled to disclose your personal data to public authorities, courts, administrative bodies or other authorised third parties (including, without limitation, lawyers) where the disclosure of personal data is required by law, regulation or court order, or where such disclosure is necessary to protect and defend our rights.
f) Other instances
We may ask you whether you wish to share your data with other third parties not described elsewhere in this Privacy Notice. Furthermore, we do not sell, rent or lease your personal data to third parties.
Depending on the circumstances, the recipients mentioned above will process your personal data as data controllers, data processors or agents.
A full list of data processors is available on request from us via the contact details provided in this Privacy Notice.
Given EssilorLuxottica’s presence in many countries around the world and in order to provide you with a personalised service globally, some of your data may be collected, accessed or stored outside your country of residence.
Consequently, your personal data may be accessed and/or transferred to countries that do not have data protection laws equivalent to those applicable in the European Economic Area (EEA).
In such cases, EssilorLuxottica ensures that appropriate safeguards are in place at all times to ensure that your personal data is processed in accordance with applicable legislation. Where your personal data is processed by another EssilorLuxottica entity, the safeguards are based on commitments entered into on the basis of (i) a specific transfer agreement under the , which is binding on the EssilorLuxottica entity involved in the processing, and (ii) a set of common rules applicable across the EssilorLuxottica Group’s data protection policy.
Where your data is processed by EssilorLuxottica entities or third parties outside the European Economic Area, EssilorLuxottica ensures that specific contractual safeguards are implemented to ensure that this requirement is met in accordance with applicable legislation under Articles 44 et seq. of the GDPR.
For further information on the appropriate or suitable safeguards and the means by which you can obtain a copy of them, please contact us using the contact details provided in this Privacy Notice.
We retain your personal data, in whole or in part, for as long as is strictly necessary for the following reasons:
When determining the appropriate retention period for personal data, we take into account the volume, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes by other means, as well as the applicable legal provisions.
| Data used to demonstrate fulfilment of the contract | 10 years |
| Customer data for marketing activities | 10 years – from the last interaction with us |
| Data from prospective customers for marketing activities | 3 years – from the date of your last interaction with us |
| Evidence regarding the exercise of your rights in accordance with point 7 | 3 years |
| Application data | 6 months – Exception: Section 2 – e |
In certain circumstances, we may anonymise your personal data so that it can no longer be linked to you; in this case, we may use this information without further notice to you.
We are responsible for the security and accuracy of the personal data we process about you and must keep the data up to date. We have taken measures to avoid duplicate copies of data and to facilitate the updating of data that may change over time.
We regard the protection of personal data as a key priority.
In this regard, we have put in place appropriate measures and safeguards to protect the personal data we process.
This is reflected in EssilorLuxottica’s procedures, as described in the EssilorLuxottica Group’s privacy programme, policies and principles, as well as in the specific measures implemented within the Group.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed without authorisation, altered or disclosed. Furthermore, we restrict access to your personal data to those employees, agents, contractors and other third parties who need to know that information for business purposes. They will process your personal data only on our instructions and are bound by a duty of confidentiality. These measures range from technical security measures to protect IT systems to physical security measures at EssilorLuxottica’s premises. EssilorLuxottica also requires its employees to undertake training on information security and data protection. Details of these measures can be obtained from the Group’s Information Security Department.
We have established procedures for dealing with suspected data security breaches and will notify you and the relevant supervisory authorities of a breach where we are legally obliged to do so.
You may exercise any of the following rights, subject to verification of your identity where necessary:
a) Right to information and access
You may request confirmation of the existence of your personal data and be informed of its content, the purposes of processing, the categories of recipients, the duration of storage and the source, and receive a copy of the personal data currently stored in our databases.
b) Right to rectification
You may request that the personal data stored in our databases be rectified. We may not comply with a request to amend personal data if we believe that the amendment would contravene a law or statutory provision or result in the information being incorrect.
c) Right to restrict processing
Where applicable, you may restrict the processing of your personal data. If such a restriction is not possible, we will inform you accordingly. You may then exercise all other rights under this Privacy Notice, including the right to withdraw your consent to the processing of your personal data.
d) Right to object to processing
Where applicable, you have the right to object to the processing of your personal data on grounds relating to your particular situation, where the processing is based on our legitimate interests. Furthermore, you have the right to object to the processing at any time where personal data is processed for direct marketing purposes, including profiling insofar as it is related to such direct marketing.
If such objections are not possible, we will inform you accordingly. You will then have the option to exercise another right under this Privacy Notice, e.g. to withdraw your consent to the processing of your personal data.
e) Right to erasure
Under certain conditions, you have the right to have your personal data erased. Upon receipt of such a request for erasure, we will confirm receipt, review your request, make a decision and notify you of it.
f) Right to data portability
Upon request, we may provide you with copies of your personal data in a structured, commonly used and machine-readable format, where this is possible and provided for by local laws. If such a request cannot be met, we will inform you accordingly. You will then have the option to exercise any other rights under this notice, including withdrawing your consent. Where applicable, we will ensure that such changes are communicated to trusted third parties.
g) Right to withdraw consent
Where processing is based on consent, you may withdraw your consent to the processing of your personal data at any time. Upon receipt of such a withdrawal of consent, we will confirm receipt and cease processing your personal data.
h) Right to lodge a complaint with the competent data protection supervisory authority
If you are not satisfied with the way we process your personal data and/or with our response to a request to exercise your rights, you may lodge a complaint with the relevant data protection supervisory authority.
To exercise your right, please contact:
Bavarian State Office for Data Protection (BayLDA),
Promenade 18, 91522 Ansbach,
Tel.: +49 (0) 981 180093-0, Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de Website: www.lda.bayern.de
We also provide you with tools to update and amend your personal data. In fact, every registered user can access and update their own information (e.g. via their user account).
You can also change and update your preferences regarding how you wish to receive emails or other communications from us. You can also request that your account information be deleted.
Information on how to withdraw your consent to cookies can be found in the Cookie Notice (Cookie Policy). [Link to be added]
The data controller responsible for the processing of your personal data is Rupp + Hubrach Optik GmbH, Von-Ketteler-Str. 1, 96050 Bamberg, Germany
If you have any questions or comments regarding this Privacy Notice or the processing of data by Rupp + Hubrach GmbH, please contact our Data Protection Officer:
Data Protection Department
Rupp + Hubrach Optik GmbH, Von-Ketteler-Str. 1, 96050 Bamberg, Germany, Email: datenschutz@rh-brillenglas.de
Rupp + Hubrach Optik GmbH has appointed a Data Protection Officer who can be contacted at the following email address: datenschutz@rh-brillenglas.de or at the address provided in the section „HOW CAN YOU CONTACT US?“ of this Privacy Notice.
For legal and/or organisational reasons, this Privacy Notice may be subject to change. We therefore recommend that you review this Privacy Notice regularly and refer to the latest version. The date of the last update can be found at the beginning of this Privacy Notice.
In any case, an updated version of the Privacy Notice will always be available on the websites and services, and we will also inform you if we make changes that significantly affect your data protection rights.
Any reference in this privacy policy to e-commerce, own shops or business activities directed directly at end consumers is irrelevant to Rupp + Hubrach, as R+H does not operate its own shops.