Privacy Policy

1. Data Controller

2. What Data We Collect

We collect the following categories of personal data:

• Personal information — Name, email address, phone number, and delivery address.
• Prescription data — Contact lens prescription details including sphere, cylinder, axis, base curve, and diameter for each eye.
• Payment information — Payment method details processed securely through Stripe. We do not store full card numbers on our servers.
• Usage data — Information about how you interact with our website, including pages visited, features used, and device information.
• Communication data — Records of your communications with our support team, including support tickets and emails.

3. How We Use Your Data

• Processing and fulfilling your orders, including delivery of contact lenses.
• Managing your subscription, including renewals, pausing, and cancellations.
• Communicating with you about your orders, subscription status, and customer support inquiries.
• Improving our services, website functionality, and customer experience.
• Complying with legal obligations, including tax and accounting requirements.

4. Legal Basis for Processing

• Contract performance — Processing necessary to fulfill our contract with you (e.g., delivering orders, managing subscriptions).
• Consent — Marketing communications and non-essential cookies are only used with your explicit consent.
• Legitimate interest — Improving our services, fraud prevention, and website security.
• Legal obligation — Retaining financial records as required by Norwegian law.

5. Data Sharing

We share your personal data only with trusted third parties as necessary to provide our services:

• Payment processor (Stripe) — To securely process your payments. Stripe acts as a data processor on our behalf.
• Shipping providers — Your name and delivery address are shared with our logistics partners to deliver your orders.
• Partner opticians — Prescription data may be shared with verified opticians for prescription verification purposes.
• Analytics providers — Anonymized usage data may be shared with analytics services to help us improve our website.

6. Cookies

We use cookies and similar technologies on our website. You can manage your cookie preferences at any time.

7. Data Retention

• Account data is retained for as long as your account is active, and deleted within 30 days of account deletion.
• Order and transaction data is retained for 5 years to comply with Norwegian accounting regulations (Bokforingsloven).
• Prescription data is retained for the duration of prescription validity plus 1 year.
• Marketing consent records are retained for 3 years or until consent is withdrawn.

8. Your Rights Under GDPR

As a data subject, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access — You can request a copy of all personal data we hold about you.
• Right to rectification — You can request correction of inaccurate or incomplete personal data.
• Right to erasure — You can request deletion of your personal data, subject to legal retention requirements.
• Right to data portability — You can request your data in a structured, machine-readable format.
• Right to object — You can object to processing based on legitimate interest or for direct marketing purposes.
• Right to restriction — You can request that we limit the processing of your personal data in certain circumstances.

To exercise any of these rights, use the Data Management section in your account settings, or get in touch through the contact form.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit and at rest, regular security audits, access controls, and secure development practices.

10. Contact Us

If you have questions about this privacy policy or how we handle your personal data, please contact our Data Protection team:

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.