Promotion Privacy Notice

This notice explains how personal data is used in connection with the Lenstore Monthly Contact Lens Giveaway (the “Promotion”). It should be read together with Lenstore’s main Privacy Policy available at www.lenstore.co.uk/privacy. In matters not specifically addressed in this Promotion Privacy Notice, the general Lenstore Privacy Policy shall apply, including in particular procedures relating to the exercise of data subject rights.

1. Data Controller

The Promotion is operated by LGL Ltd, trading as Lenstore.co.uk, a company registered in Guernsey under company number 51990 with its registered office at Fourth Floor Plaza House, Admiral Park, St Peter Port and Anson Court, St Martin, GY1 3UQ, Guernsey. For the purposes of applicable data protection laws, LGL Ltd acts as the data controller for personal data processed in connection with this Promotion.

Questions relating to the processing of personal data may be directed to: dpo@luxottica.com.

2. Personal Data We Collect

In order to administer the Promotion, the Promoter may process the following personal data:

• name
• email address
• Lenstore account details
• newsletter subscription status
• Auto Reorder subscription status
• country of residence
• confirmation of age eligibility (18+)
• promotion participation records
• communications relating to winner notification

This information is obtained directly from Lenstore account records, newsletter subscription records, or Auto Reorder subscription details.

3. How Personal Data Is Used

Personal data is processed for the following purposes:

• verifying eligibility for the Promotion;
• administering the monthly prize draw;
• compiling the pool of eligible entrants;
• selecting and contacting the winner;
• preventing fraudulent or abusive participation; and
• managing promotion-related advertising, including preventing individuals who have already entered the Promotion from seeing further advertisements promoting the same Promotion.

4. Advertising Audience Management

In order to avoid displaying promotion advertisements to individuals who have already entered the Promotion, the Promoter may share a hashed version of participants’ email addresses with advertising platforms such as Meta (Facebook and Instagram).

Before sharing, the email address is converted into a cryptographic hash using the SHA-256 hashing method. The hashed identifier is then uploaded to Meta’s Custom Audiences service.

Meta compares the hashed identifier against its own hashed user database in order to identify accounts that should be excluded from seeing advertisements promoting the same Promotion.

Although the email address is hashed before sharing, the resulting identifier may still constitute personal data under applicable data protection law where it can be matched with an individual by the receiving platform.

The hashed data is shared solely for the purpose of suppressing promotion advertisements for individuals who have already entered the Promotion.

Meta may process the data it receives as an independent data controller in accordance with its own privacy policies.

5. Legal Basis for Processing

Personal data is processed on the following legal bases under applicable data protection law:

• processing necessary for the administration of the Promotion, including verifying eligibility and conducting the prize draw;
• the Promoter’s legitimate interests in operating the Promotion fairly and efficiently, preventing fraud or abuse, and managing advertising campaigns effectively, including suppressing advertisements for individuals who have already entered the Promotion;
• consent, where an individual has separately subscribed to receive marketing communications from Lenstore.

Newsletter marketing communications may be withdrawn at any time using the unsubscribe link included in marketing emails.

6. Data Sharing

Personal data will not be shared with third parties for their own marketing purposes.

For the limited purpose described in section 4, hashed email identifiers may be shared with Meta Platforms Ireland Ltd in order to create advertising suppression audiences that prevent promotion advertisements from being shown to individuals who have already entered the Promotion.

7. International Transfers

Some advertising platforms used by the Promoter may process personal data outside the United Kingdom. Where this occurs, appropriate safeguards are implemented in accordance with applicable data protection laws, including reliance on recognised international transfer mechanisms.

8. Data Retention

Personal data relating to the Promotion will be retained only for as long as necessary to administer the Promotion and comply with applicable legal or regulatory requirements.

Typically, promotion participation records may be retained for up to 12 months following the relevant monthly draw. Suppression audiences used for advertising purposes will generally be retained only for the duration of the associated advertising campaign.

9. Data Subject Rights

Individuals have rights under applicable data protection laws, including the right to request access to their personal data, request correction of inaccurate information, request deletion of personal data where appropriate, object to certain types of processing, and request restriction of processing.

Requests relating to these rights may be submitted to dpo@luxottica.com.

Further information about these rights and how to exercise them is available in the Lenstore Privacy Policy.