Privacy Policy

This Privacy Policy explains how Coral Eyewear Ltd collects, uses, shares, and protects personal data — whether you buy from our website as a consumer, hold a trade account as an optician or retailer, work with us on a private label or licensing programme, order corporate gifting, visit our website, subscribe to our marketing, or simply get in touch.

We take data protection seriously. This policy is written to meet the requirements of the UK General Data Protection Regulation and the Data Protection Act 2018, and to explain things in plain language.

If you buy prescription eyewear from us, we handle health data about your eyes. This is "special category" data under UK GDPR and receives additional protection. Section 4 explains exactly what we do with it and the lawful basis we rely on.

1. Who We Are & How to Contact Us

Coral Eyewear Ltd is the controller of the personal data described in this policy.

Coral Eyewear Ltd Registered office: Unit 21 Woolton Farm, Bekesbourne, Canterbury, Kent, England, CT4 5EA Registered in England & Wales — company number 12033074 VAT number 333009049 Telephone: 020 3105 6627 Email: info@coraleyewear.com

For data protection enquiries, write to us at the registered office marked for the attention of "Data Protection", or email info@coraleyewear.com with "Data protection" in the subject line.

We have not appointed a Data Protection Officer, as we are not required to do so under UK GDPR. The contact above handles all data protection matters.

2. The Personal Data We Collect

What we collect depends on how you interact with us.

Consumer customers

• Identity and contact — name, email address, telephone number, delivery and billing addresses.

• Order and payment — products ordered, prices paid, payment method, and the last four digits of your card. We do not store full card details. See section 7.

• Prescription data, if you order prescription eyewear — sphere, cylinder, axis, addition, pupillary distance, any notes on your prescription, and the name and practice of the optician who issued it.

• Account details, if you create an account — login details, order history, saved addresses, and preferences.

• Correspondence — records of emails, live chat, call notes, and any reviews you share with us.

• Marketing preferences — whether you have subscribed to our newsletter and how you interact with our marketing emails.

• Website use — see section 3.

Trade and distribution customers

• Business information — trading name, company number, VAT number, registered and trading addresses, and (for opticians) General Optical Council registration.

• Account contacts — name, role, email address, and telephone number of the people in your organisation who hold or use the trade account.

• Credit and trading — credit reference checks, orders placed, invoices raised, and payment history.

Private label, licensing, and corporate gifting clients

• Contact details — name, role, employer, and business contact information for the people we work with on your side.

• Project records — briefs, design approvals, meeting notes, call recordings where you have consented, emails, and project artefacts.

• Commercial records — orders, invoices, royalty statements where applicable, and payment history.

Website visitors and prospective clients

• IP address, device and browser information, pages visited, referring source, interaction with our marketing, and the content of any form you submit.

3. Cookies & Website Tracking

Our website uses cookies and similar technologies. When you first visit, you are shown a cookie banner that lets you choose which categories to accept, in line with the Privacy and Electronic Communications Regulations and UK GDPR.

The categories are:

• Strictly necessary — needed for the website to function, including the shopping basket, checkout, and security. These are set without consent, as the regulations permit.

• Analytics — tell us how the site is being used so we can improve it.

• Marketing — allow us and our advertising partners to show you relevant advertising and measure its effectiveness.

You can change your preferences at any time using the "Manage cookies" link in our website footer. Blocking some cookies may affect how parts of the site work.

4. Why We Use Your Data & Our Lawful Basis

UK GDPR requires us to tell you the lawful basis we rely on for each purpose.

Fulfilling your order — payment, dispatch, delivery, and customer service. Lawful basis: performance of a contract with you.

Verifying prescription details and producing prescription spectacles. Lawful basis: performance of a contract. For the handling of your prescription (health) data specifically, our basis under Article 9 UK GDPR is your explicit consent, which you give when you submit a prescription order and confirm the prescription declarations.

Managing your trade account — credit checks, invoicing, and credit control. Lawful basis: performance of a contract, and our legitimate interests in running the business efficiently and controlling credit risk.

Delivering private label, licensing, and corporate gifting programmes — design development, approvals, production management, and account management. Lawful basis: performance of a contract, and our legitimate interests in delivering the projects we are engaged on.

Administering royalty arrangements and reporting to licensors. Lawful basis: performance of a contract, and compliance with our legal and contractual obligations.

Fraud prevention, identity verification, and keeping our website and customers safe. Lawful basis: our legitimate interests in preventing fraud and protecting our customers and our business.

Complying with legal obligations — tax, accounting, consumer law, and product safety record-keeping. Lawful basis: legal obligation.

Consumer marketing — sending our newsletter and promotional emails. Lawful basis: your consent. You opt in, and you can unsubscribe at any time using the link in every email.

B2B marketing — contacting opticians, retailers, and prospective private label, licensing, and gifting clients. Lawful basis: our legitimate interests, and the "soft opt-in" permitted by the Privacy and Electronic Communications Regulations for existing customers. We obtain consent where required.

Analysing how our website is used and improving our products and experience. Lawful basis: our legitimate interests in improving what we offer, and — where cookies are involved — your consent through the cookie banner.

5. Who We Share Your Data With

We share personal data with trusted third parties only where necessary, and always under appropriate contracts. The main categories are:

• Shopify — our ecommerce platform provider, which hosts our website and processes orders.

• Payment providers — Klarna, Shop Pay, Apple Pay, Google Pay, and card processors. They receive only the data needed to process your payment. Where you choose Klarna, Klarna's own privacy policy governs the payment arrangement.

• Delivery partners — Royal Mail, DHL, DPD, FedEx, and other carriers. They receive the information needed to deliver your order.

• Email and marketing platforms — for order confirmations, dispatch notifications, and, if you have subscribed, marketing emails.

• Analytics and advertising platforms — for website analytics and digital advertising, where enabled by your cookie choices.

• Customer service tools — including our help desk and live chat platforms, to handle your enquiries.

• Our CRM — to manage trade accounts, private label and licensing clients, gifting clients, and prospects.

• Manufacturing partners — for private label and licensing programmes, we share the design and specification information needed to produce the goods. We do not share your commercial terms or pricing with manufacturers.

• Licensors — where we hold a licence for a brand or property, we share the sales and royalty reporting data our licence requires. This is aggregated commercial data and does not include consumer personal data.

• Credit reference agencies — for business credit checks on trade account applications.

• Accountants, auditors, and professional advisers — where necessary, and bound by confidentiality.

• Law enforcement and regulators — where we are legally required to share.

• A purchaser of our business — if we sell or restructure the business, personal data may be transferred as part of that process.

We do not sell your personal data. We do not share your prescription data with any third party other than the opticians and technicians who make up your lenses, the delivery partner bringing your spectacles to you, and where we are legally required to.

6. International Transfers

Some of our service providers are based outside the UK. Where that is the case, we rely on appropriate safeguards to make sure your data remains protected to UK standards:

• Where the UK Government has made an adequacy decision for the recipient country, including the EU and EEA, we rely on that decision.

• For transfers to the United States and other countries, we use the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, supported by appropriate technical and organisational measures.

• For transfers to US providers certified under the UK extension to the EU-US Data Privacy Framework, we rely on that framework.

• Our manufacturing partners are located in Asia and Europe. Transfers of design and specification data to them are made under contractual safeguards and are limited to what is needed to produce the goods.

You can request details of the specific safeguards in place for a particular transfer by contacting us.

7. Payment Data

We never see or store your full card details. Card payments are processed securely by our payment provider. We receive only confirmation of payment and the last four digits of the card, for reconciliation.

8. How Long We Keep Your Data

We keep personal data only for as long as we need it for the purpose it was collected, or as the law requires. In general:

• Order records and related financial information — six years from the end of the relevant tax year, to meet HMRC requirements.

• Prescription data — six years from the date of the order, so we can respond to any product issue and meet our record-keeping obligations. Held securely and, where practicable, separately from other data.

• Account data — for as long as your account is active, plus a reasonable period afterwards to deal with post-closure queries.

• Marketing data — for as long as you remain subscribed, plus a short period after you unsubscribe so that we can honour your preference.

• Private label, licensing, and gifting project records — for the duration of the programme and six years afterwards, reflecting product liability and contractual limitation periods.

• Trade and client CRM records — for as long as the relationship is active, and for a reasonable period afterwards consistent with the nature of the relationship.

• Website analytics data — typically no longer than 26 months.

9. Your Rights

Under UK GDPR you have the following rights in relation to your personal data.

• Access — ask for a copy of the personal data we hold about you.

• Rectification — ask us to correct data that is inaccurate.

• Erasure — ask us to delete your data. This is not an absolute right and does not apply where we have a legal obligation to retain it.

• Restriction — ask us to pause processing in certain circumstances.

• Portability — ask for your data in a structured, machine-readable format, where we rely on consent or contract as our lawful basis.

• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.

• Withdraw consent — where we rely on consent, including for marketing emails and for special category prescription data, you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it.

• Automated decision-making — you have the right not to be subject to decisions based solely on automated processing which have legal or similarly significant effects. We do not currently carry out such automated decision-making.

To exercise any of these rights, email info@coraleyewear.com. We will normally respond within one month.

You also have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk

• Helpline: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always prefer to resolve a concern with you directly first, but we fully respect your right to raise it with the ICO at any time.

10. Marketing

10.1 We send marketing emails to consumers who have given us consent, for example by subscribing to our newsletter, and to existing consumer customers under the "soft opt-in" permitted by the Privacy and Electronic Communications Regulations for products similar to those they have already bought, unless they have opted out.

10.2 Every marketing email includes an unsubscribe link. You can also update your preferences by contacting us.

10.3 For B2B marketing — to opticians, retailers, and prospective private label, licensing, and gifting clients — we rely on our legitimate interests where the regulations permit, and on consent where it is required.

11. Children

Our website is not directed at children. We require customers purchasing prescription eyewear to confirm that they are at least 16 years old. If you believe a child has provided personal data to us, please contact us and we will take steps to remove it.

12. Security

We use appropriate technical and organisational measures to protect personal data, including secure hosting, encrypted transmission of data across our website, access controls on internal systems, and data protection training for our team.

No system can be guaranteed completely secure. Where a personal data breach is likely to result in a high risk to individuals' rights and freedoms, we will notify those affected and the Information Commissioner's Office as the law requires.

13. Changes to This Policy

We may update this policy from time to time. The current version and its effective date are shown at the top of this page. Where a change is material, we will notify those affected, for example by email or by a prominent notice on our website.

Company Details

Coral Eyewear Ltd Registered office: Unit 21 Woolton Farm, Bekesbourne, Canterbury, Kent, England, CT4 5EA Registered in England & Wales — company number 12033074 VAT number 333009049

Telephone: 020 3105 6627 Email: info@coraleyewear.com