Privacy Policy

Privacy Policy

Last updated: 25 August 2026

OPTIMEGO S.L. (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your personal data when you visit our website replacementlenses.net or purchase our products, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), Spain’s Organic Law 3/2018 on Data Protection and Digital Rights Guarantees (LOPDGDD), and other applicable data protection legislation.

1. Data Controller

Company	OPTIMEGO S.L.
CIF	B19700889
Address	Lavadero de Tablas 11, 18002 Granada, Spain
Email	[email protected]
Telephone	+34 610 251 868

2. Data Protection Officer (DPO)

OPTIMEGO S.L. is not required to appoint a Data Protection Officer under Article 37 of the GDPR. For any data protection enquiry, you may contact us at: [email protected]

3. Categories of Personal Data We Collect

a) Identification and contact data: name, surname, postal address, email address, telephone number.

b) Transaction and billing data: order details, purchase history, payment information (processed securely by our payment providers; we do not store full card numbers), billing and shipping addresses, VAT/tax identification number where applicable.

c) Account data: username, encrypted password, order history, preferences.

d) Health data (special category): for prescription (Rx) orders, we collect optical prescription data including sphere, cylinder, axis, and pupillary distance (PD). This constitutes health data under GDPR Article 9.

e) Technical and browsing data: IP address, browser type and version, operating system, device identifiers, pages visited, time spent, referring URLs, and other data collected through cookies and similar technologies.

f) Communication data: any information you provide when contacting our customer service.

4. Purposes and Legal Bases

Purpose	Legal Basis (GDPR)	Details
Processing and fulfilling orders	Art. 6(1)(b) — performance of a contract	Necessary to process your purchase, arrange shipping, and manage returns.
Processing prescription (Rx) orders	Art. 6(1)(b) — contract + Art. 9(2)(a) — explicit consent	Health data (Rx values) is processed to manufacture your prescription lenses.
Billing, accounting, and tax obligations	Art. 6(1)(c) — legal obligation	Required under Spanish tax and commercial legislation.
Customer service and support	Art. 6(1)(b) — contract / Art. 6(1)(f) — legitimate interest	To respond to your enquiries and provide after-sales support.
Sending commercial communications	Art. 6(1)(a) — consent	Only with your prior consent. You may withdraw consent at any time.
Sending transactional communications	Art. 6(1)(b) — contract	Order confirmations, shipping notifications, delivery updates.
Fraud prevention and security	Art. 6(1)(f) — legitimate interest	To detect and prevent fraudulent transactions.
Website analytics and improvement	Art. 6(1)(a) — consent	Statistical analysis of website usage. Cookies placed only after your consent.
Advertising and remarketing	Art. 6(1)(a) — consent	To show you relevant advertisements. Only with your consent via cookie preferences.
Legal compliance and dispute resolution	Art. 6(1)(c) / Art. 6(1)(f)	To comply with legal obligations and defend legal claims.

5. Data Processors and Recipients

Processor	Purpose	Country	Safeguards
Stripe	Payment processing	USA / EU	EU Standard Contractual Clauses (SCC)
PayPal	Payment processing	USA / EU	EU Standard Contractual Clauses (SCC)
Brevo (Sendinblue)	Email marketing and transactional emails	France / EU	Data processed within the EU/EEA
Google LLC (GA4, GTM, Ads)	Analytics, conversion tracking, advertising	USA	EU Standard Contractual Clauses (SCC)
SiteGround	Web hosting	EU	Data processed within the EU/EEA
Cloudflare	CDN, DDoS protection	USA / EU	EU Standard Contractual Clauses (SCC)
Spring GDS	Order shipping	Netherlands (EU)	Data processed within the EU/EEA
DHL	Order shipping	Germany (EU)	Data processed within the EU/EEA
FedEx	Order shipping	USA	EU Standard Contractual Clauses (SCC)
InPost / Mondial Relay	Order shipping	EU	Data processed within the EU/EEA

We do not sell your personal data to third parties.

6. International Data Transfers

Some of our processors are located outside the EEA, primarily in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, in particular EU Standard Contractual Clauses (SCC) adopted by the European Commission. You may request a copy of the applicable safeguards by contacting us at [email protected].

7. Cookies

We use cookies and similar technologies on our website. For detailed information, please refer to our Cookie Policy.

8. Data Retention

Data category	Retention period
Customer account data	Duration of your account + 5 years after deletion.
Order and transaction data	6 years (Spanish Commercial Code, Art. 30; General Tax Law, Art. 70).
Prescription (Rx / health) data	Duration of contractual relationship + 5 years. Deleted or anonymised thereafter.
Marketing consent records	Until consent is withdrawn.
Website analytics data	See Cookie Policy.
Customer service communications	3 years from the last communication.

9. Your Rights

Under the GDPR (Articles 15 to 21), you have the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent

10. How to Exercise Your Rights

Contact us at: [email protected] or by post to OPTIMEGO S.L., Lavadero de Tablas 11, 18002 Granada, Spain. Include your full name and a copy of your ID. We will respond within one month.

11. Right to Lodge a Complaint

You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) — www.aepd.es, or your local data protection authority if you are based in another EU/EEA Member State.

12. Minors

Our website is not directed at persons under 16 (or under 14 in Spain). We do not knowingly collect personal data from minors without verifiable parental consent.

13. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you.

14. Security Measures

We implement appropriate technical and organisational measures including encryption (TLS/SSL), access controls, regular security assessments, and staff training on data protection.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated revision date.