Privacy policy
Introduction
This Privacy and Cookies Policy explains how COLARC S.R.L. a socio unico (“COLARC”, “we”, “us” or “our”), operating the LookerOnline trading name and the websites lookeronline.com and magazine.lookeronline.com and their localised versions, processes personal data in connection with use of the websites, customer accounts, purchases, customer service, marketing communications, cookies and similar technologies.
This Policy is provided for information purposes in accordance with applicable data protection law. It does not form part of the sales contract and does not require acceptance as a contractual term.
Data Controller
The data controller is:
COLARC S.R.L. a socio unico
Piazza Indipendenza 6, 58031 Arcidosso (GR), Italy
REA GR‐84581 – VAT & Tax ID: IT01091330538
Email: [email protected]
PEC: [email protected]
LookerOnline is the trading name and e-commerce website operated by COLARC.
Personal Data We Process
Depending on how you use LookerOnline and the services you request, we may process the following categories of personal data:
- identity and contact data, such as name, billing and delivery address, email address, telephone number and account information;
- order and transaction data, including products ordered, order history, prices, payment status, refunds and related transaction information;
- delivery and logistics data, including delivery address, tracking information, carrier records, Proof of Delivery, delivery scans, recipient information, signatures, photographs and customs-related information where applicable;
- customer service, return, warranty and claim data, including communications with us and any photographs, videos, statements, receipts, shipping documents or other information supplied or generated in connection with a request, return, delivery issue, guarantee claim or dispute;
- technical and usage data, such as IP address, device and browser information, identifiers, website interactions, session information and data collected through cookies and similar technologies;
- marketing and preference data, including newsletter subscriptions, marketing choices, cookie preferences and information relating to marketing communications and their performance;
- prescription and optical data where you order fitted or prescription lenses, including prescriptions, optical parameters, measurements and related information supplied through the website, by upload, by email or otherwise in connection with the order; and
- identification or verification documents and related information where reasonably required for fraud prevention, payment or identity checks, customs, legal compliance or the investigation of a claim.
Payment details required to complete a transaction may be processed directly by the payment service selected at checkout. COLARC may receive payment status, transaction identifiers and other information necessary to administer the order, payment, refund or fraud checks.
How We Collect Personal Data
We collect personal data directly from you when you browse the website, create or use a customer account, place or attempt to place an order, provide a prescription or optical parameters, contact customer service, submit a claim, subscribe to marketing communications, manage cookie preferences or otherwise interact with us.
We may also receive relevant personal data from service providers and other parties involved in the requested service, including ecommerce and payment providers, carriers, security and fraud-prevention providers, and other parties where necessary for the purposes described in this Policy.
Purposes and Legal Bases
We process personal data only where an applicable legal basis exists. Depending on the processing activity, the purposes and legal bases may include the following:
- to create and manage customer accounts, process orders, take payment, provide products and services, arrange delivery, handle returns and refunds, provide customer service and take steps requested before entering into a contract: Article 6(1)(b) GDPR;
- to comply with accounting, tax, consumer-protection, product, customs and other legal or regulatory obligations, and to respond to lawful requests from competent authorities: Article 6(1)(c) GDPR;
- to protect the website, systems, customers and COLARC against fraud, abuse, unauthorised transactions, security incidents and misuse, to conduct reasonable checks, to manage and investigate claims and delivery disputes, and to establish, exercise or defend legal rights: Article 6(1)(f) GDPR, on the basis of COLARC’s legitimate interests in security, fraud prevention, business protection and the defence of legal claims;
- to maintain, administer and improve the technical operation, performance and usability of the website where the processing is not subject to a separate consent requirement: Article 6(1)(f) GDPR, based on our legitimate interest in operating and improving our services;
- to send newsletters, offers and other promotional communications, and to carry out marketing activities where consent is required by applicable law: Article 6(1)(a) GDPR and the applicable rules governing electronic marketing communications; and
- to use non-essential analytics, advertising, conversion-measurement, remarketing or similar tracking technologies where consent is required: Article 6(1)(a) GDPR together with the applicable rules on cookies and electronic communications.
Where a communication concerning an incomplete cart or checkout contains promotional content, discounts, offers or other marketing material, it is treated as a marketing communication and is sent only where permitted by applicable law, including on the basis of consent where required.
Prescription and Optical Data
Prescription and optical information may reveal information concerning an individual’s health and may therefore constitute special-category personal data under the GDPR.
Where such data are necessary to prepare or supply prescription or personalised eyewear requested by the customer, COLARC processes them for the requested service under Article 6(1)(b) GDPR and, where applicable, Article 9(2)(h) and Article 9(3) GDPR. Prescription and optical data used for this purpose are handled within COLARC by a professionally qualified optician subject to applicable confidentiality obligations.
COLARC does not disclose prescription or optical data to external laboratories, opticians or lens suppliers for the manufacture of the lenses. Such data may nevertheless be disclosed where required by law or where strictly necessary for the establishment, exercise or defence of legal claims.
Where a parent or legal guardian places an order for a minor, the personal data relating to the minor that are necessary for the order, including relevant prescription or optical data, may be processed for the same purposes and on the same applicable legal bases.
Provision of Personal Data
Providing personal data is generally voluntary. However, certain information is necessary to create or access an account, process an order, complete payment and delivery, manufacture prescription or personalised products, provide requested assistance, comply with legal requirements or investigate a claim. If information that is necessary for a requested service is not provided, we may be unable to provide that service or complete the relevant transaction.
Fraud Prevention and Automated Tools
COLARC and its ecommerce, payment and security providers may use automated tools, risk indicators or other technical measures to identify transactions or activity that may require additional review for fraud, abuse or security reasons.
Such tools may support COLARC’s assessment, but COLARC does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects on customers within the meaning of Article 22 GDPR.
Recipients of Personal Data
Personal data may be disclosed, only to the extent reasonably necessary for the relevant purpose, to categories of recipients including:
- ecommerce, hosting, cloud, content-delivery, IT infrastructure, security and technical service providers;
- payment processors, payment service providers and providers of checkout, wallet or transaction services;
- email, customer communication, marketing and marketing-automation service providers;
- analytics, advertising, social-media, conversion-measurement and related technology providers, subject to applicable consent requirements;
- carriers, logistics providers, customs intermediaries and competent customs or tax authorities where required for delivery or import/export procedures;
- manufacturers, official distributors, authorised service centres or other qualified parties where reasonably necessary to assess a product, guarantee or conformity claim, without disclosure of prescription or optical data except where lawfully necessary;
- accountants, tax advisers, auditors, lawyers, insurers and other professional advisers where reasonably necessary;
- public authorities, courts, regulators, law-enforcement bodies or other recipients where disclosure is required or permitted by law; and
- other service providers acting on COLARC’s behalf where necessary to operate the website, fulfil an order, provide a requested service or protect COLARC’s rights.
Some third-party services chosen directly by the customer, such as certain payment, wallet, authentication or account services, may also process personal data for their own purposes under their own privacy terms.
Shopify and Ecommerce Services
LookerOnline is operated using Shopify’s ecommerce platform and related services. Shopify processes personal data in connection with the operation of the store and may provide customer account, checkout, payment, security, analytics, cookie-consent and other technical functionality.
Where you choose to use a Shopify service that is provided directly to you, such as Shop or Shop Pay, additional processing may be carried out by Shopify under the terms and privacy information applicable to that service.
More information on Shopify’s privacy practices is available at Shopify Privacy Policy.
International Data Transfers
Some service providers or recipients may process personal data outside the European Economic Area. Where personal data are transferred to a country for which the European Commission has not adopted an applicable adequacy decision, COLARC relies, where required, on an appropriate transfer mechanism under the GDPR, such as Standard Contractual Clauses or another safeguard permitted by applicable law, together with supplementary measures where appropriate.
Information on the safeguards applicable to a relevant transfer may be requested using the contact details provided in this Policy.
Data Retention
COLARC retains personal data for no longer than reasonably necessary for the purposes for which they were collected, taking into account legal and regulatory requirements, the nature of the data, the relationship with the customer and applicable limitation periods.
In particular:
- order, transaction, accounting and tax records are retained for the periods required by applicable law; accounting and tax documentation may generally need to be retained for up to 10 years;
- customer account information is retained while the account or customer relationship remains relevant and thereafter where necessary for legal, administrative, security or claim-related purposes;
- customer service communications and claim, return, delivery, fraud-prevention and warranty records are retained for the time reasonably necessary to handle the matter and, where relevant, to establish, exercise or defend legal claims;
- prescription and optical data are retained only for as long as reasonably necessary in connection with the requested optical service, related customer assistance, applicable legal obligations and the establishment, exercise or defence of claims;
- marketing data are retained while the relevant marketing basis remains valid or until consent is withdrawn or an objection is made, as applicable; limited information may be retained where necessary to document and respect an opt-out or withdrawal; and
- cookie and tracking data are retained according to the purpose and duration of the relevant technology and the choices made through the cookie-preference controls.
Cookies and Similar Technologies
LookerOnline uses cookies and similar technologies, including pixels, tags, local storage and comparable identifiers, to operate the website, remember choices, understand website use, measure performance and, where permitted, support advertising and marketing.
These technologies may fall into the following categories:
- strictly necessary technologies, which are required for functions such as page navigation, security, authentication, shopping-cart operation, checkout, payment and cookie-preference management;
- functional or preference technologies, which remember choices or provide optional website functionality;
- analytics and performance technologies, which help measure website use, traffic and performance; and
- advertising and marketing technologies, which may be used for conversion measurement, audience measurement, remarketing, personalised advertising or similar marketing purposes.
Strictly necessary cookies and equivalent technologies may be used without consent where permitted by applicable law. Analytics technologies are treated as exempt from consent only where the conditions required by applicable law are actually satisfied, including the applicable requirements concerning minimisation, aggregation and restrictions on further use. Other analytics, advertising, profiling and non-essential tracking technologies are used only where permitted by applicable law and, where required, after consent has been obtained.
The website uses a cookie-preference mechanism through which users can accept, decline or manage non-essential categories. Consent may be changed or withdrawn at any time through the cookie-preference controls made available on the website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
The specific technologies and providers used may change as the website and its technical services evolve. Depending on the services active at a given time, providers may include Shopify and third-party analytics, advertising or social-media platforms such as Google and Meta. The relevant technologies remain subject to the consent choices and legal requirements described in this Policy.
Further information about the privacy practices of commonly used platform providers is available at:
You can also use browser or device settings to delete or restrict cookies, although disabling strictly necessary technologies may prevent parts of the website or checkout from functioning correctly.
Marketing Communications
Where required by applicable law, COLARC sends newsletters, offers and other electronic marketing communications only on the basis of a valid marketing consent. Consent may be withdrawn at any time using the unsubscribe mechanism included in the communication or by contacting COLARC.
Withdrawal of marketing consent does not affect service communications that are necessary to administer an order, account, request, delivery, payment, refund, claim or other transaction.
COLARC may use service providers to manage mailing lists, marketing preferences and marketing automation. Such providers process data only to the extent applicable to the services used and subject to the relevant data-protection requirements.
Customer Accounts
Where customer account functionality is available, personal data may be processed to create and authenticate the account, maintain account and contact information, display relevant order information, provide account functionality and protect the account against unauthorised access or misuse.
Customers are responsible for keeping their credentials secure. If you become aware of unauthorised use of an account, please contact us promptly.
Security
COLARC applies appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the processing and the risks involved.
No system or transmission method can be guaranteed to be completely secure. COLARC therefore does not represent that security risks can be eliminated entirely.
Your Data Protection Rights
Subject to the conditions and limitations provided by applicable law, you may have the right to:
- obtain confirmation as to whether COLARC processes your personal data and obtain access to those data;
- request correction of inaccurate or incomplete personal data;
- request erasure of personal data where the applicable legal conditions are met;
- request restriction of processing where the applicable legal conditions are met;
- object to processing based on legitimate interests;
- object at any time to processing of personal data for direct marketing purposes;
- receive personal data in a structured, commonly used and machine-readable format and, where applicable, request transmission to another controller;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; and
- lodge a complaint with the competent supervisory authority.
In Italy, the supervisory authority is the Garante per la protezione dei dati personali. Information is available at www.garanteprivacy.it.
Requests concerning data-protection rights may be sent to [email protected] or by PEC to [email protected]. COLARC may request information reasonably necessary to verify the identity of the person making the request before acting on it.
Children and Minors
LookerOnline is not intended to enable minors to enter into purchase contracts directly. A parent or legal guardian may, however, place an order on behalf of a minor where permitted by applicable law. In that case, COLARC may process the minor’s personal data that are reasonably necessary to fulfil the order, including relevant prescription or optical data where applicable.
COLARC does not knowingly direct marketing communications to children.
Third-Party Websites and Services
The website may contain links to or integrate services provided by third parties. Where a third party processes personal data independently for its own purposes, its processing is governed by its own privacy information and COLARC does not control that independent processing, without prejudice to obligations that remain COLARC’s responsibility under applicable law.
Changes to this Policy
COLARC may update this Privacy and Cookies Policy where necessary to reflect changes in law, regulatory guidance, website functionality, services or processing activities. The current version will be published on the website with the applicable update date. Where applicable law requires additional notice or a new consent for a material change, COLARC will take the measures required by law.
Contact
For questions concerning this Privacy and Cookies Policy or COLARC’s processing of personal data, please contact:
COLARC S.R.L. a socio unico
Piazza Indipendenza 6, 58031 Arcidosso (GR), Italy
Email: [email protected]
PEC: [email protected]
Last updated: September 7, 2026
