GLOBAL PRIVACY POLICY

1. OBJECT

The oakley.com website (hereinafter "Website") is managed by Luxottica Group S.p.A. and Oakley Inc., in its quality of Data Controller (hereinafter “Luxottica”) and the applicable security and privacy measures on this website have been defined and developed to guarantee that personal information is processed correctly in compliance with local and international safety and privacy regulations.

This policy illustrates how Luxottica, directly or through its subsidiaries, process personal information of the users (hereinafter, “user”, “users” or “you”) according to art. 13 the Italian Legislative Decree no. 196/2003 (hereinafter “Italian Privacy Code”) and art. 13 EU General Data Protection Regulation (hereinafter, the “GDPR”) and how this information is used, shared and how may be accessed, changed or deleted. As proof of its commitment towards privacy, Luxottica has defined this policy within the wider scope of a global management model on privacy, to ensure total compliance with privacy as the foundation of Luxottica’s company culture. All personal information supplied by you through this Website is used exclusively for the objectives described below.

2. SOURCE AND TYPE OF PERSONAL INFORMATION

Luxottica processes different types of information on the user collected from different sources, such as:

• information provided directly by the user;
• information obtained from automatic tracking systems when using the Website and its services.

More specifically, Luxottica may process the following identification personal data of the user:

• Information provided by the user during the registration process or when completing the order (e.g. name and surname; e-mail address; password; gender; country (nation); postal address and phone numbers for deliveries, credit card and financial information) and other information contained in any correspondence or requests sent by the user. Luxottica may also ask the user to provide some information if problems with our service on the Website are reported;
• Information relating to the use of the Website by the user. For security purposes we process the log files related to each session when the user logins into his/her account, as well as information on payment transactions that will be processed through our provider;
• Navigation information. When the user surfs the Website, Luxottica uses some technologies (cookies, see below for more information) that automatically collect certain items of information relating to the way in which the user uses our products and services, such as the IP address or other unique code of the device (computer, mobile or other devices) employed by the user to browse the Website, identification as registered user or not, technical information that may include the URL from where a user originates, browser information, language. This information helps us to continuously improve the browsing experience and the mechanisms of purchase of our products and services, and to monitor the correct operations of the Website. This information only includes statistical data relating to the actions performed by the user, and is not intended to be associated with the user’s identifying data. However, Navigation data may identify you, only when matched with your identification personal information.
• Image provided by the user (both registered and unregistered users), if he/she takes part in the Virtual Try-On experience and he/she authorizes the storage of his/her image in Luxottica’s servers.

All the identification data abovementioned are hereinafter jointly defined “information”.

3. PURPOSES OF THE PROCESSING

3.1 Contractual purposes

The information collected by Luxottica are used for the following contractual purposes without prior users’ consent according to art. 24 Italian Privacy Code and art. 6 GDPR:

• to allow users’ to register to the Website;
• to provide the services available through the Website (e.g. management of the registration process and access to the account, account management);
• to manage online orders, to supply products and services, to process payments and e-payments, to transmit orders, products, services;
• for the technical management of the Website and its operational functions (including logistics), including solving any technical problems, statistical analysis, tests and research;
• to prevent or uncover fraudulent activities or misuse that is damaging to our website or threatening the security of the transactions;
• to comply with the requirements of the laws, regulations, protocols and national and EU legislation;
• for the implementation of decisions of public Authorities;
• to protect the safety of an individual;
• for Luxottica’s defence in court, for example, in case of violations by the web-users, or in order to protect the rights and the property of Luxottica;
• to fulfill the user’s requests (e.g. management of requests for information);
• to send to users operational communications related to the supply of the service or products, sales and after sales assistance.

3.2 Marketing purposes

The information collected by Luxottica are used for the following marketing purposes with users’ prior consent according to Article 23 Italian Privacy Code and art. 7 GDPR:

• to participate in and manage promotions and contests as available from time to time on the Website, if any;
• • to send commercial and promotional communications and periodical updates (e.g. via e-mail, phone, SMS/MMS, postal service, social network and newsletter) related to Luxottica's products, services, initiatives and events organised by, or in collaboration with, Luxottica;
• for the purpose of conducting, by post, telephone or e-mail, statistical analyses, surveys and market research relating to Luxottica’s products and services.

Furthermore, according to art. 130, c. 4 Italian Privacy Code, if the user is already our customer, Luxottica may send him/her commercial emails on similar products, events, fairs and services already provided by Luxottica. The users may opt out at any time.

4. Processing modalities

The processing of users’ information is made only if necessary and is carried out by means of operations indicated in Article 4 Italian Privacy Code and 4 GDPR and namely: collection, registration, organization, storage, consulting, processing, modification, selection, extraction, comparison, use, interconnection, access and communication, blocking, erasure and destruction of the data. Users’ data is processed electronically through the Website and the servers in which it is stored.

5. Categories of persons who can access information

Any personal information given or collected by connecting to the Website will be processed by Luxottica as Data Controller. Personal information will be processed by the Luxottica staff deputed to the processing of the personal information being collected:

• employees and consultants authorized to manage the Website and supply the related services (e.g. customer services, management of Luxottica Computer Systems, management of IT systems, storage of images in case the users take part in the Virtual Try-On experience, etc.), in their quality of persons in charge of the processing and/or systems administrators and/or internal data processors;
• employees and consultants in the marketing, finance, administration, accounting and other relevant department of Luxottica, in their quality of persons in charge of the processing and/or internal data processors.

In addition, Luxottica may request its service providers to carry out some processing operations on its behalf, according to the instructions provided by Luxottica and in line with this Privacy Policy. These providers will process personal information in their quality as external data processors based on adequate contractual commitments and o/r letter of appointments, and they include, for instance:

• suppliers of services to manage the Computer Systems and the Website (e.g. hosting providers, market and analyst service providers, database management and maintenance services);
• suppliers of online payment services, who may access; credit card information and other user’s financial information;
• suppliers of order entry related services, shipping of products and/or other services available through this Website;

Finally, Information may be accessed by the companies of Luxottica Group, in their quality of external data processors, for management of intra-group services (e.g. commercial communications) and the fulfillment of the contractual purposes set forth above, including dispatching the products, managing any claim, analyzing data, supplying marketing assistance. In carrying out the activities provided by the subjects above, Luxottica gives operating instructions and rules of conduct on processing personal information in compliance with this Privacy Policy.

6. Third parties to which information can be communicated

In addition, user’s information may be communicated to third parties for the following reasons:

• to permit to third companies a merger, acquisition or sale of all or part of Luxottica’s assets;
• to fulfill the obligation provided by the law, regulations, protocols and national and EU legislation;
• to implement laws required by public Authorities;
• to allow Luxottica’s defense in court, for example, in case of violations by the web-users.

The said parties shall process the information in their quality of autonomous Data Controllers. Therefore, the use of data by the said third parties is not regulated by this Privacy Policy.

7. Data transfer outside the EU

Luxottica may transfer the information to external data processors listed above and located outside of the European Union (for instance, companies of the Luxottica group or third parties) to allow the activities listed in this Privacy Policy to be carried out (e.g. hosting services). If the personal information will be transferred to countries that do not provide the same level of protection, or in any case an adequate level of protection (e.g. the United States of America), of personal information, we ensure that each service provider enters into specific contractual obligations according to the applicable data protection legislations (including the execution of the Standard Contractual Clauses as approved by the European Commission) unless Luxottica can rely on any other legal basis for transferring personal information.

8. Nature of providing personal information and the consequences of the refusal

Providing information for the contractual purposes is voluntary and optional. Users’ may freely decide not to provide information for the contractual purposes, as well as they may subsequently revoke their consent to process information already provided: this may prevent users from the use of the Website and from the provision of the services listed at section 3.1. of this Privacy Policy.

Providing information for the marketing purposes is voluntary and optional. Users’ may freely decide not to provide information for the marketing purposes, as well as they may subsequently revoke their consent to process information already provided: in this case users’ will not receive Luxottica commercial communications listed at section 3.2. If he/she has provided information for the contractual purposes, the user will continue to be provided with the contractual services mentioned in section 3.1 of this Privacy Policy.

9. Safety

Luxottica undertakes to protect users’ information. Luxottica advises that the password is one of the protection mechanisms of the account, therefore users are invited to use a password sufficiently secure and stored in a safe place, limiting access to it on their own computers and browsers, disconnecting it after having visited the site. Luxottica undertakes to protect the information received from users. All personal information supplied is kept on secure servers and within its internal systems. Luxottica uses adequate safety measures to protect information from non-authorized access or non-authorized changes, and from the circulation or distribution of data. To prevent non-authorized access, to maintain the accuracy of the data and guarantee the proper use of information, Luxottica uses adequate physical, electronic and managerial procedures to safeguard and protect the information and data stored in our system.

Information on purchase transactions (e.g. credit card number) is handled securely through selected suppliers that guarantee that they have adopted the most adequate security measures. Furthermore, a secure system for authorizing credit card payments and identifying fraudulent activities is used. Luxottica uses the standard SSL (Secure Sockets Layer) to protect the confidentiality of your personal information. Although no computer system is completely secure, Luxottica believes that the measures it has implemented reduce the possibility of security problems to an appropriate level for the type of data involved.

10. Storage and deletion of information

Luxottica accesses, uses, processes, files and stores personal information collected only for the purposes described in this Privacy Policy and in accordance with the consent expressed by the user, if necessary. Specifically, Luxottica collects personal information consistent with:

• the purposes for which they were collected;
• the consent received from the user;
• local and international regulations.

Personal information is kept and deleted in accordance with Luxottica security policy for the time necessary to achieve the purposes for which data were collected and further processed, including any retention period required under the applicable legislation (e.g. retention of accounting documentation). Luxottica will process users’ information for contractual purposes (section 3.1 a-d) for 10 years after the termination of the contract; for Virtual Try-On experience (section 3.1. e) for 14 days from the storage of the image, in case of unregistered user, or for a maximum of 24 months from the storage of the image in case of registered users; for 24 months for marketing purposes from the collection of the said information. Users’ information is processed at the premises of Luxottica and in the places where the servers are located. In case of EU citizens, the servers are based in EU, while of the other users servers are based in their relevant country of residence. For further information, contact Luxottica to the details below.

11. Use of cookies

To improve browsing on the Website, Luxottica uses “cookies”. A cookie is a small file, generally made up of letters and numbers, which is downloaded onto a computer when the user logs onto specific websites. Cookies permit a website to recognize the user’s computer, to trace its browsing through several pages of a website and to identify those users who return to a website. Cookies do not contain information that personally identifies the user, but the personal information that Luxottica records on the user may be linked to information retained in the cookies and taken from them.

Cookies can be technical, analytics and profiling:

• Technical cookies are used to carry out and to facilitate your browsing, to provide you and to allow you to use the services of the Website. The Cookies allow you, during a second access, for example, not having to re-enter data such as the username for the login.
• Analytic cookies are used to analyze and to monitor the way you use the Website (e.g. number of accesses and page viewed), in order to enable us to make constructive amendments to the Website in the functioning and browsing.
• Profiling cookies are used to track your browsing on the Website and to create profiles about your tastes, habits, choices, etc. These cookies can be used to send you advertising messages in line with the preferences that you have already shown in the online browsing.

Luxottica does not use profiling cookies.

11.1 Third party analytical cookies

Luxottica uses the following analytics cookies:

• Google Analytics
  This Website uses Google Analytics, a web analysis service of Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files which are stored on users’ computer and enable an analysis of their usage of the Website. The information about the use of this Website generated by the cookie is generally transferred to a Google server in the USA and stored there. If IP anonymization is activated on this Website, then users’ IP address will first be shortened by Google, however, within the member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the complete IP address be transmitted to a Google server in the USA and shortened there. Google uses this information on behalf of the operator of this Website to evaluate users’ Website usage, to compile reports on the Website activities, and to provide additional services connected with the Website and Internet usage to the Website operator. The IP address transmitted from users’ browser as part of Google Analytics will not be combined with other Google data. Users’ can authorize the use of Google analytics cookies, continuing the browsing on the website after having read the banner on the site. However, users’ can prevent the storage of cookies by a corresponding setting of the browser software, however, in this case, users’ may not be able to fully use all of the functions of this Website. Users’ can also prevent Google from recording the data generated by the cookie and those referring to users’ usage of the Website (including IP address) and from processing these data by downloading and installing the browser plug-in provided under the following link http://tools.google.com/dlpage/gaoptout?hl=itde).
  Users can prevent data-recording by Google Analytics by clicking the following link. An Opt-Out-Cookie is set which prevents the future recording of your data when you visit this website.
  Then click here: Deactivate Google Analytics
  More detailed information on the conditions of use and data protection can be found at http://www.google.com/analytics/terms/it.html or at https://www.google.de/intl/it/policies/.
• Adobe Site Catalyst
  This Website uses Adobe Site Catalyst, a web analysis service of Adobe. (“Adobe”).
  The information about the use of this Website generated by the cookie is generally transferred to an Adobe server in the USA and stored there.
  More detailed information on the conditions of use and data protection can be found at https://www.adobe.com/privacy/optout.html#4
• Google Maps
  Luxottica receives no information on the content of the data transmitted and its usage by Google. For this reason, please refer to the Google data-protection clarification for further information: http://www.google.it/intl/it/policies/privacy/

Furthermore, the Website could use the following third party analytical cookies:

• Google AdWords;
• Monetate;
• ShopZilla;
• PriceGrabber;
• Commission Junction;
• Criteo;
• Tealium;
• BazaarVoice;
• Affiliate Window;
• Rakuten;
• Verza;

11.4 Use of the Web beacon

Luxottica’s website may have digital images that are recognized as web beacons (sometimes also defined as GIF or pixel tag), also tied to the use of cookies, for the purpose of collecting information on how the website is used. Web beacons may furnish some types of information found on the user’s computer, such as the time and date when the page was visited, the description of the page where the web beacon is found, or the same cookies. These web beacons may also be found in promotional e-mail messages and inside newsletters, for the purpose of confirming that the message was opened and read. Luxottica may use third party web beacons to facilitate gathering grouped statistics on the effectiveness of its advertising campaigns or on other aspects concerning the running of its websites.

11.5 Enabling or disabling cookies and web beacons

Users can authorize Luxottica to use cookies and web beacons, continuing the browsing on the Website after having read the banner on the Website. If users do not desire this, they should set their browser to refuse the acceptance of cookies.

Please note that refusing/disabling cookies may limit the usability and the easy navigation of the website.

12. Underage users’ data

This Website is not intended for minors of 18 years and Luxottica does not intentionally collect personal information from them.

If any information about minors is unintentionally recorded, Luxottica will provide to cancel it in a timely manner upon request of the users.

13. Data subject’s rights in relation to personal information

According to art. 7 Italian Privacy Code, the users have the right to obtain from Luxottica the confirmation about the existence of personal data referring to them and their communication in an intelligible form; users can also ask to know the source of data; the purposes and modalities of the processing; users can also obtain an update, correction or integration of data. Moreover, users may, at any time, revoke their consent, requesting the interruption of the processing, the deletion, anonymization or the block of the information being processed. Users may refuse, fully or partially, the processing: a) for legitimate reasons on the processing data concerning them; b) for the purpose of sending advertising material or for carrying out market researches or commercial communications.

Users have also the rights referred to in articles 16-21 GDPR (right of confirmation, right to be forgotten, right of processing limitation, right of data portability, right to object) and the right to complain to the Supervisor Authority.

Furthermore, Luxottica offers tools to users to update and amend the personal information given. Indeed, every registered user may access his/her own information and update it (e.g. through user account). Besides, it is also possible for users to modify and update their preferences on how they wish to receive e-mails or other communications from Luxottica. Users may also request that their information on their account is deleted.

In order to exercise the rights above and to request information , users may write to the following e-mail address customercare@oakley.com. Luxottica will respond within a reasonable time frame, after verifying users’ identity.

14. Contact information

The Data Controller of the processing of users’ data is Luxottica S.p.A., with office in Piazzale Luigi Cadorna, 3, 20123 Milan, Italy. The updated list of the data processors and of the persons in charge of the processing is kept at the premise of the Data Controller. Should the user have questions or comments on this Privacy Policy, Luxottica may be contacted at the following e-mail address: customercare@oakley.com.

15. Changes to the Privacy Policy

For legal and/or organizational reasons, this Privacy Policy may undergo changes; we suggest, therefore, to check this Privacy Policy regularly and to refer to the latest version of it. If Luxottica makes any changes that the company believes to be important, users will be advised through the Website.

16. Links to third party websites

While browsing, contents may be seen that link to third party websites. Luxottica cannot access or control the cookies or the other functions used by third party's websites, and the procedures of those outside sites are not regulated by our Privacy Policy. Consequently, you should contact and/or directly consult those third parties for additional information on their privacy protection procedures.

RADAR PACE

Effective Date: 9/28/2016

This Privacy Policy describes how Oakley, Inc., 1 Icon, Foothill Ranch, California 92610, U.S.A. (“Oakley,” “we,” or “us”) will collect, use, and share the information that you provide to us as a result of your use of the Radar Pace wearable device, the Radar Pace application, and any website that links to this Privacy Policy (collectively, “Radar Pace” or our “Properties”). This Privacy Policy does not apply to any of Oakley’s applications or websites that are not associated with Radar Pace.

NOTHING IN THIS PRIVACY POLICY SHALL BE CONSTRUED TO IMPAIR OR RESTRICT ANY OF YOUR STATUTORY RIGHTS UNDER ANY APPLICABLE LOCAL LAW.

Collection of Information

Personal Information

We may collect personal information about you when you voluntarily provide us with such information. We collect this information when you use our products, communicate with us, create or update your account information, participate in surveys or otherwise interact with Radar Pace. We may also receive personal information about you from third parties, such as any partners, affiliates, service providers, and subsidiaries we may have, and we may combine this information with any information that you provide to us. If we do not collect this personal information from you, we may not be able to provide you with the services you have requested.

The personal information that we collect may include your name, your contact information (such as your email address), your date of birth, your weight, and your gender. This may be combined with other information collected through your use of Radar Pace, such as:

• The precise location of your Radar Pace wearable device and/or the device on which the application is installed (see below for more information); and
• Activity and workout information, including the date, time, and duration of your workout, information about your heart rate, average speed, distance traveled, elevation change, calories burned, and information about the route you took during your workout; and
• Information from and about any sensors that you pair with Radar Pace, including a heart rate monitor, foot pod, power meter, cadence sensor, and speed sensor.

Non-Personal Information

We may collect non-personal information about you through our Properties. Such information may include your device identifier, your browser type and version, your operating system type and version, the time and date of your visit to our website or application, your activities when using the Radar Pace Properties, and your preference settings. We may collect such information through various technologies, such as cookies eTags, web beacons, or log files.

Location Information

We may also collect precise geolocation data pertaining to your wearable device and/or mobile device and associate it with the personal information that you provide and other information that we collect. We may collect this information in the background even if you are not using Radar Pace. For example, we may collect precise latitude/longitude coordinates from your device over time, or location data from other sources such as Wi-Fi or cell tower signals. We use this information to provide our services to you such as to calculate your distance traveled, measure speed or pace, map your route, and provide coaching feedback. If you do not want to provide your mobile device location to us, please use the settings available on your mobile device to limit this sharing. If you do not want to provide your wearable device’s location to us, please turn off the device. If you choose to limit our ability to collect information about your precise location, certain of Radar Pace’s features may not work.

Voice Recognition

Radar Pace is designed to allow users to operate certain device functions using voice commands. While the device is turned on, users can activate these functions by saying an activation command followed by directing Radar Pace to perform the desired function. For this functionality to work, Radar Pace must listen for the activation command while it is in use. If you want to turn off this functionality, you can say “stop listening” or you can turn Radar Pace off. This will work until you say “Ok Radar” again, and isn’t applicable from session to session, so if you reopen the application or turn the device off and on again, then the device will be listening and collecting data. We will collect your voice interactions with Radar Pace over time in order to provide and improve Radar Pace. We may also collect audio information in the background even when you are not actively using Radar Pace.

Third-Party Services

We may use analytics services provided by third parties, which use various technologies to collect information about your activities on Radar Pace, and across other sites over time, for non-advertising purposes.

Use of Information

We may use both personal and non-personal information that we collect from you for purposes including:

• To operate the product, including providing you with Radar Pace’s coaching features and to respond to your directions;
• To operate, maintain, and improve Radar Pace;
• To communicate with you, including responding to your communications with us and sending you communications about Radar Pace;
• For our own marketing purposes;
• For our research, recordkeeping, and reporting purposes, including for product development;
• To personalize and improve your experience of our Properties;
• To monitor our Properties for compliance with our Terms of Service; and
• To prevent fraud and to protect Oakley, other individuals, and the integrity of our system.

Sharing of Information

We may share both personal and non-personal information as follows:

• With service providers that help us operate, maintain, and improve Radar Pace and other Oakley products or services ;
• With our parent and affiliate companies,
• With government entities as needed to provide our services and where required by law;
• As part of a sale or merger of all or part of Oakley, including at bankruptcy;
• Pursuant to a subpoena, court order, or other legal process;
• To investigate, respond to or resolve problems or inquiries (including law enforcement requests) or protect, enforce, or defend our rights, assets, and/or interests;
• To prevent or respond to a violation of any law, regulation, or our Terms of Service; or
• With your consent or as otherwise disclosed at the time of collection, or as otherwise required or authorized by applicable law.

Some of these recipients may be located in countries including the United States, where our servers are located.

We may also share aggregate information or de-identified information with third parties in our discretion.

Radar Pace may include social media plug-ins that link to and share information with third-party social media websites. If you use these tools to share information about your use of our Properties or otherwise interact with any social media features on our website, those social media companies may collect information about you and may use and disclose that information in accordance with their own privacy policies and your account settings. We encourage you to carefully review the privacy policy of any social media company before using any social media plug-ins to understand the practices that will apply to any information that you provide to these companies.

Updating Personal Information or Account Deactivation

If you would like to access or update the personal information that we maintain about you or you would like to deactivate your account, you may do so by calling customer service. If you deactivate your account, we may retain certain personal information about you for record keeping purposes for the time provided in the relevant applicable law.

Third Party Websites

Our Properties may contain links to third-party websites or mobile applications. Please note that this Privacy Policy does not apply to any such third-party websites or applications. We do not control how the owners of these websites and applications collect, use, or disclosure your information. If you click on any of these links, we encourage you to read the privacy policy of the website or application that you visit before you provide any information to the owner of that website or application.

How We Protect Your Information

We have implemented reasonable administrative, technical, and physical safeguards to protect the confidentiality, security, and integrity of the personal information that we collect through Radar Pace.

Changes to Our Privacy Policy

We reserve the right to modify or revise this Privacy Policy at any time and in our sole discretion. If we revise this Privacy Policy, we will make the revised Privacy Policy available through our Properties, and we will update the effective date identified above. We encourage you to visit this Privacy Policy regularly to stay informed about our practices with respect to your information and to learn of any changes to those practices.

Contact Us

If you have questions or comments about this Privacy Policy, or you have a problem or complaint about our handling of your personal information, please contact us at privacyoffice@oakley.com. For complaints, we will respond within a reasonable time. If you are not satisfied with our response, you may contact the relevant regulator.