Privacy Notice

EssilorLuxottica and your Personal Data

Understanding why and how EssilorLuxottica Processes your Personal Data

Last update: 30 July2026

At EssilorLuxottica, we are committed to protecting the Personal Data of our stakeholders. Upholding this commitment is essential to our success and reputation, and ultimately our ability to fulfil our mission of helping people see more and be more.

1. INTRODUCTION

1.1 Who are we?

Luxottica Group S.p.A., with registered office at Piazzale Cadorna no. 3 – 20123 Milan, Italy, inscribed in the Milan Trade Registry under the number 00891030272, VAT no. 10182640150, a company which is part of the EssilorLuxottica Group ("Luxottica")

is the party that determines the Purposes and the means of the Processing, so being the Data Controller over your Personal Data.

Further in this Privacy Policy, when we speak about "Alain Mikli" or "we" or "our" or "us" we refer to Luxottica.

1.2 What is the purpose of this Privacy Policy?

EssilorLuxottica, its Affiliates and its Brands attach particular importance to the Processing, confidentiality and security of your Personal Data.

The purpose of this Privacy Policy is to inform you in a clear, simple and complete manner of the Processing carried out on the Personal Data that we collect from and about you, their possible transfer to third parties as well as your rights and the options you have to control your Personal Data and to protect your privacy, in accordance with the applicable legislation.

This Website is a purely showcase website (non-transactional): there are no data collection forms, e-commerce functionality or account registration. Accordingly, the only individuals whose Personal Data is processed in connection with the Website are Web Users, as defined in section 1.3 below and the only Personal Data Processed derives from technical browsing activity.

We may update this Privacy Policy at any time but if we do so, we will make an updated copy of this Privacy Policy available to you.

Where and if our Website includes links to websites and/or applications operated and maintained by third parties, please note that we have no control over the privacy practices of such websites or applications as we do not own them. Alain Mikli encourages you to always review the privacy policies of those third parties before connecting.

1.3 What is this Privacy Policy about? Key definitions

Term	Definition
Affiliates	Means subsidiaries of EssilorLuxottica Group, its ultimate holding company and its subsidiaries, or companies that it controls, are controlled by or under common control, and its service providers/vendors and strategic business partners.
Brands	The brands owned by the companies belonging to EssilorLuxottica Group.
Data Controller	Means the natural or legal person, department or organization, alone or jointly with others, that determines the Purposes and means of the Processing of Personal Data.
Data Processor	Means a natural or legal person, department or other body which Processes Personal Data on behalf of and on the instructions of the Data Controller.
Data Subject(s)	The physical person(s) whose Personal Data is Processed.
EssilorLuxottica Group (or, simply, EssilorLuxottica or Group)	EssilorLuxottica as global organization, i.e. jointly EssilorLuxottica (as ultimate holding company) and all its Affiliates.
GDPR	Regulation (EU) 2016/679 (General Data Protection Regulation).
Personal Data (or simply Data)	Any information about an individual (the Data Subject) from which that person can be identified (name, contact details, identification number, etc.). The categories of Personal Data that we may Process are enumerated in this Privacy Policy.
Processing (of Personal Data)	Any action conducted concerning your Personal Data such as the collection, recording, organization, storage, modification, transfer, deletion, access, consultation, etc. of such data.
Purpose	Refers to the Purpose of the Processing. In other words, the reasons for which the Personal Data is collected.
Recipients (of the Personal Data)	A natural or legal person, public authority, agency or another body, to which the Personal Data are disclosed, whether a third party or not.
Website	The Alain Mikli website (www.alainmikli.com/) in its purely showcase (non-transactional) version, without e-commerce or data collection form functionality.

Likewise, this Privacy Policy will apply to the following Data Subjects:

Data Subject	Description
Web Users	Users who access the Website.

2. WHERE ARE THE PERSONAL DATA COLLECTED FROM?

The Personal Data we collect depends on the point of contact through which you interact with us and are limited to those which are relevant and appropriate for this interaction.

We collect and obtain information through the following means only:

• By using Cookies – We use only technical cookies to allow proper navigation on our Website. For more information on the data collected through cookies, please refer to our Cookie Policy available on the Website.

• From technical service providers – We may receive technical browsing data from analytics, infrastructure and IT security providers operating on our behalf.

3. WHAT PERSONAL DATA MAY WE PROCESS ABOUT YOU?

The Personal Data we collect depends on the point of contact through which you interact with us and are limited to those which are relevant and appropriate for this interaction.

Category of Daya	Types of Data	Data Subject
Device information	Including such as the IP address or other unique code of your device (computer, mobile or other devices), technical information that may include the URL from where you originate, time zone setting and location, browser information and language.	Web Users
Navigation information	Including such as information regarding your interactions with our Website and statistical data relating to these interactions.	Web Users

4. WHY DO WE PROCESS YOUR PERSONAL DATA?

We are required to use your data for Purposes defined according to the nature of our Website. As this Website is purely showcase and non-transactional, the only Purposes pursued are those set out in the table below.

Purpose

Processing activities

Legal basis

Legal obligations compliance

· Comply with the requirements of the laws, regulations, protocols and national and EU legislation.

· Implement the decisions of Public Authorities.

· Manage the requests to exercise your rights.

· Data retention with regard to legal obligations.

Legal obligation

Legitimate interests' pursuit

· Exercise or defend legal claims in court proceedings or in administrative or out-of-court procedures relating to our rights, of our group companies and/or of our representatives, shareholders, officers and directors.

· Enable the technical management of the Website and its operational functions, including solving any technical problems, to perform tests, updates and upgrades that cannot be performed through non-personal data.

· Prevent or identify fraudulent activities or misuses of the Website or against the EssilorLuxottica Group and/or the Web Users.

· Complete a potential merger, sale of assets, transfer of all or a material part of its business, or financing transaction by disclosing and transferring the Personal Data to the third party or parties involved in the transaction as part of the transaction.

· Anonymize Personal Data such as in order to perform statistical analysis, for R&D purposes, to train AI models, etc.

Legitimate interest

5. HOW DO WE PROCESS YOUR PERSONAL DATA?

5.1 What modalities do we use to Process your Personal Data?

The Processing of your Personal Data is carried out, by electronic and manual means, only within the limits necessary to pursue the Purposes outlined in Section 4 above.

We undertake to protect your Personal Data. Your Personal Data will be processed by our staff, contractors and agents bound by confidentiality and privacy obligations and based on specific authorizations and instructions from us. We implement appropriate technical and organizational measures to ensure the security and confidentiality of your Personal Data. For further information, please refer to Section 6 below.

5.2 We disclose your Personal Data to other Affiliates of the Group

EssilorLuxottica is a global organization, and your Personal Data may be shared or accessed and processed by other Affiliates of the Group as part of our centralized systems and services. In particular, most Processing activities are carried out through the shared platform and services operated at Group level, including by Essilor International and Luxottica Group S.p.A. Such access is limited to what is lawful and necessary for the relevant Purposes and is subject to internal data protection policies and appropriate safeguard

5.3 Is your Personal Data transferred to third parties?

Your Personal Data may be shared with external parties, who may act either as a Data Processor or as an independent Data Controller depending on the circumstances. More information about such third parties is available on request pursuant to Section 8 of this Privacy Policy.

Service providers/Vendors

We may disclose your Personal Data with our third-party service providers that support us in the provision of our Product and services, including, for example, IT, accounting, administrative, legal, insurance, marketing, payment, and customer service, Data Subjects requests management, Data analysis matters.

Each service provider may act, depending on the case and on the specific nature of our relationship, as:

· Data Processors, on behalf of and in accordance with the instructions received from us, by virtue of a specific agreement in place per Article 28 of the GDPR, which sets out specific obligations and guarantees of implementation of appropriate technical and organizational measures;

· independent Data Controllers, where they determine purposes and means of the processing (such as payment providers or wallet providers, as the case may be).

Please note that we require that any such third-party providers are subject to strict control and implement appropriate guarantees of security and confidentiality of your Personal Data.

Other disclosure scenarios

We may also disclose your Personal Data in the following circumstances:

· Corporate transactions. In the event of a merger, acquisition, sale of assets or similar transaction, your Personal Data may be disclosed to the relevant counterparties as part of the operation.

· Legal and regulatory obligations. We may disclose your Personal Data to public authorities, courts, regulators or other authorized third parties where required by applicable law or necessary to protect our rights.

· With your consent. Where required, we may share your Personal Data with additional third parties based on your explicit consent.

Please note that we do not sell, rent, or lease your Personal Data to any third parties.

5.4 Is your Personal Data transferred across the border?

Given the presence of the EssilorLuxottica Group in many countries around the world and in order to provide you with personalized services worldwide, some of your Personal Data may be transferred to, made accessible from and/or stored outside the European Economic Area (EEA), including in countries which do not have data protection laws equivalent to those existing within the EEA.

In such cases, Alain Mikli ensures that, at all times, appropriate safeguards are implemented to ensure that your Personal Data is processed under an adequate level of protection, including

· intragroup dedicated transfer agreement and internal data protection policies;

· adequacy decisions (including the EU–US Data Privacy Framework, where applicable), Standard Contractual Clauses (and equivalent UK transfer tools), and supplementary measures identified through a Transfer Impact Assessment, where necessary.

For more information on international Personal Data transfers, you can contact us as set out at Section 8 of this Privacy Policy.

5.5 For how long do we retain your Personal Data?

We retain all or part of your Personal Data for the time strictly necessary:

· to meet applicable statutory requirements for data retention;

· to meet and comply with our legal and/or contractual obligations;

· for as long as necessary to carry out each of the Purposes mentioned in this Privacy Policy, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for Personal Data, we consider jointly the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the Purposes for which we Process your Personal Data and whether we can achieve those Purposes through other means, and the applicable legal requirements.

In any case, please note that, as a general rule, within EssilorLuxottica Group, retention and archiving of Personal Data will not exceed 10 (ten) years overall calculated as of the first record and/or any other relevant interaction, exception made for further legal hold obligations.

In some circumstances we may anonymize your Personal Data so that it can no longer be associated with you, in which case we may use such information without further notice to you, such as for statistical analysis, R&D purposes, training AI models, etc.

For any additional information on the retention of your Personal Data, you can contact us at the email address set out in Section 8 of this Privacy Policy.

6. HOW DO WE PROTECT YOUR PERSONAL DATA?

We regard the protection of Personal Data as an essential priority.

We are aware that we have the responsibility for the security and accuracy of the Personal Data that we process and also for keeping your Data up to date.

We have also implemented appropriate technical and organizational measures and safeguards to protect the Personal Data we process, in accordance with Article 32 GDPR. This is reflected in the EssilorLuxottica Group Data Protection Policy, and related guidelines, policies and procedures, as well as in the Information Security policies, procedures and measures implemented throughout the Group.

Namely, we put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. The security measures in place range from technical security measures that protect IT systems, to the physical security measures employed at EssilorLuxottica Group’s sites and offices.

We have also implemented a policy to deal with any suspected Personal Data Breach, and we undertake to notify you and any applicable regulator of such a breach where we are legally required to do so.

Furthermore, we limit the access to your Personal Data to those of our employees, agents, contractors and third parties which have a business need to know it. They will process your Personal Data only based on our instructions and they are subject to a strict confidentiality duty.

We also require our staff to participate in data protection and information security training.

More details on the security measures implemented within the EssilorLuxottica Group may be required by contacting us at the contact details set out in Section 8 of this Privacy Policy.

7. YOUR RIGHTS

You can exercise any of the following rights, subject to verification of your identity where necessary:

• Right of Information and Access: you may request the confirmation of the existence of your Personal Data and to be informed of its content and source and obtain a copy of those Personal Data which our databases currently contain.

• Right to Rectification: you may request to rectify what Personal Data our databases currently contain. We may not accommodate a request to change Personal Data if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

• Right to Restriction of the Processing: when applicable, you may restrict the Processing of your Personal Data. If such restrictions are not possible, we will inform you accordingly.

• Right to Object to the Processing: when applicable, you have the right to object to the Processing of your Personal Data on grounds relating to your particular situation, if the Processing is based on our legitimate interest. If such objections are not possible, we will inform you accordingly.

• Right to Erasure: if you should wish to have your Personal Data deleted, then you may submit a request. Upon receipt of such a request for erasure, we will confirm receipt and confirm once your Personal Data has been deleted. If complete deletion is not possible, we will inform you accordingly.

• Right to Data Portability: upon request and when possible and where applicable by local laws, we can provide you with copies of your Personal Data in a structured, commonly used and machine-readable format. If such a request cannot be honoured, we will inform you accordingly.

• Right to Withdraw your Consent: where Processing is based on consent, you may withdraw your consent at any time to the Processing of your Personal Data. Upon receipt of such a withdrawal of consent, we will confirm receipt and proceed to stop Processing your Personal Data.

• Right to lodge a complaint with the relevant data protection supervisory authority: If you are not satisfied with the way we Process your Personal Data and/or respond to a request to exercise the rights you have exercised, you can lodge a complaint with the relevant data protection competent supervisory authority.

In order to exercise your rights, you may contact us at privacy@luxottica.com.

8. HOW CAN YOU CONTACT US?

8.1 Contact of the Data Controller

The Data Controller over the Processing of your Personal Data is set out in Section 1.1 of this Privacy Policy.

Should you have questions or comments on this Privacy Policy or on any data Processing carried out by us, we may be contacted at the postal address set out in Section 1.1 above and/or at the email address specified in the preceding Section 7.

8.2 Contact of the Data Protection Officer

Luxottica has appointed a Data Protection Officer which can be contacted at the following email address: dpo@luxottica.com or by sending a mail at the address set out at Section 1.1 of this Privacy Policy.

9. HOW CAN YOU KEEP TRACK OF CHANGES TO THIS PRIVACY POLICY?

For legal and/or organizational reasons, this Privacy Policy may undergo changes. We suggest, therefore, checking this Privacy Policy regularly and referring to the latest version of it; we will post the date it was last updated at the top of this Privacy Policy.

In any case, an updated version of this Privacy Policy will be always available on the Website, and we will provide additional notice to you if we make any changes that materially affect your privacy rights.