Privacy Policy
Last updated: 25 August 2026
OPTIMEGO S.L. (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your personal data when you visit our website replacementlenses.net or purchase our products, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), Spain’s Organic Law 3/2018 on Data Protection and Digital Rights Guarantees (LOPDGDD), and other applicable data protection legislation.
1. Data Controller
| Company | OPTIMEGO S.L. |
| CIF | B19700889 |
| Address | Lavadero de Tablas 11, 18002 Granada, Spain |
| [email protected] | |
| Telephone | +34 610 251 868 |
2. Data Protection Officer (DPO)
OPTIMEGO S.L. is not required to appoint a Data Protection Officer under Article 37 of the GDPR. For any data protection inquiry, you may contact us at: [email protected]
3. Categories of Personal Data We Collect
a) Identification and contact data: name, surname, postal address, email address, telephone number.
b) Transaction and billing data: order details, purchase history, payment information (processed securely by our payment providers; we do not store full card numbers), billing and shipping addresses, VAT/tax identification number where applicable.
c) Account data: username, encrypted password, order history, preferences.
d) Health data (special category): for prescription (Rx) orders, we collect optical prescription data including sphere, cylinder, axis, and pupillary distance (PD). This constitutes health data under GDPR Article 9.
e) Technical and browsing data: IP address, browser type and version, operating system, device identifiers, pages visited, time spent, referring URLs, and other data collected through cookies and similar technologies.
f) Communication data: any information you provide when contacting our customer service.
4. Purposes and Legal Bases
| Purpose | Legal Basis (GDPR) | Details |
|---|---|---|
| Processing and fulfilling orders | Art. 6(1)(b) — performance of a contract | Necessary to process your purchase, arrange shipping, and manage returns. |
| Processing prescription (Rx) orders | Art. 6(1)(b) — contract + Art. 9(2)(a) — explicit consent | Health data (Rx values) is processed to manufacture your prescription lenses. |
| Billing, accounting, and tax obligations | Art. 6(1)(c) — legal obligation | Required under Spanish tax and commercial legislation. |
| Customer service and support | Art. 6(1)(b) — contract / Art. 6(1)(f) — legitimate interest | To respond to your inquiries and provide after-sales support. |
| Sending commercial communications | Art. 6(1)(a) — consent | Only with your prior consent. You may withdraw consent at any time. |
| Sending transactional communications | Art. 6(1)(b) — contract | Order confirmations, shipping notifications, delivery updates. |
| Fraud prevention and security | Art. 6(1)(f) — legitimate interest | To detect and prevent fraudulent transactions. |
| Website analytics and improvement | Art. 6(1)(a) — consent | Statistical analysis of website usage. Cookies placed only after your consent. |
| Advertising and remarketing | Art. 6(1)(a) — consent | To show you relevant advertisements. Only with your consent via cookie preferences. |
| Legal compliance and dispute resolution | Art. 6(1)(c) / Art. 6(1)(f) | To comply with legal obligations and defend legal claims. |
5. Data Processors and Recipients
| Processor | Purpose | Country | Safeguards |
|---|---|---|---|
| Stripe | Payment processing | USA / EU | EU Standard Contractual Clauses (SCC) |
| PayPal | Payment processing | USA / EU | EU Standard Contractual Clauses (SCC) |
| Brevo (Sendinblue) | Email marketing and transactional emails | France / EU | Data processed within the EU/EEA |
| Google LLC (GA4, GTM, Ads) | Analytics, conversion tracking, advertising | USA | EU Standard Contractual Clauses (SCC) |
| SiteGround | Web hosting | EU | Data processed within the EU/EEA |
| Cloudflare | CDN, DDoS protection | USA / EU | EU Standard Contractual Clauses (SCC) |
| Spring GDS | Order shipping | Netherlands (EU) | Data processed within the EU/EEA |
| DHL | Order shipping | Germany (EU) | Data processed within the EU/EEA |
| FedEx | Order shipping | USA | EU Standard Contractual Clauses (SCC) |
| InPost / Mondial Relay | Order shipping | EU | Data processed within the EU/EEA |
We do not sell your personal data to third parties.
Google Customer Reviews
If you choose to take part in the Google Customer Reviews program when you complete your purchase, we share your email address, order number, delivery country and estimated delivery date with Google so that it can send you a survey about your experience. Google processes this data in accordance with its privacy policy.
6. International Data Transfers
Some of our processors are located outside the EEA, primarily in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, in particular EU Standard Contractual Clauses (SCC) adopted by the European Commission. You may request a copy of the applicable safeguards by contacting us at [email protected].
7. Cookies
We use cookies and similar technologies on our website. For detailed information, please refer to our Cookie Policy.
8. Data Retention
| Data category | Retention period |
|---|---|
| Customer account data | Duration of your account + 5 years after deletion. |
| Order and transaction data | 6 years (Spanish Commercial Code, Art. 30; General Tax Law, Art. 70). |
| Prescription (Rx / health) data | Duration of contractual relationship + 5 years. Deleted or anonymized thereafter. |
| Marketing consent records | Until consent is withdrawn. |
| Website analytics data | See Cookie Policy. |
| Customer service communications | 3 years from the last communication. |
9. Your Rights
Under the GDPR (Articles 15 to 21), you have the following rights:
- Right of access (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure (Art. 17)
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20)
- Right to object (Art. 21)
- Right to withdraw consent
10. How to Exercise Your Rights
Contact us at: [email protected] or by post to OPTIMEGO S.L., Lavadero de Tablas 11, 18002 Granada, Spain. Include your full name and a copy of your ID. We will respond within one month.
11. Right to Lodge a Complaint
You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) — www.aepd.es, or your local data protection authority if you are based in another EU/EEA Member State.
12. Minors
Our website is not directed at persons under 16 (or under 14 in Spain). We do not knowingly collect personal data from minors without verifiable parental consent.
13. Automated Decision-Making
We do not use automated decision-making, including profiling, that produces legal effects concerning you.
14. Security Measures
We implement appropriate technical and organizational measures including encryption (TLS/SSL), access controls, regular security assessments, and staff training on data protection.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated revision date.