Skip to content
Eyefriends
Back to home

Legal notice

Privacy Policy

Information on the processing of personal data on eyefriends.de in accordance with the GDPR.

Last updated August 3, 2026

1. Information on the collection of personal data and contact details of the controller

1.1 Thank you for visiting our website. Below we inform you about how we handle your personal data when you use our website. Personal data is, in principle, any data that can be used to identify you personally.

1.2 The controller responsible for data processing on our website within the meaning of the General Data Protection Regulation (GDPR) is:

Eyefriends GmbH
Blütenstraße 15
c/o BASE Coworking
80799 Munich
Germany

Phone: +49 176 9311 3153
Email: info@eyefriends.de

1.3 To protect the security of your data during transmission, we use encryption methods that reflect the current state of the art (e.g. SSL or TLS) via HTTPS.

2. Data collection when visiting our website

Each time our website is accessed, our system automatically collects data and information transmitted by your browser to our server (so-called "server log files"). The following data, which is technically necessary for us, is collected:

  • The website visited
  • Date and time of access
  • Amount of data sent, in bytes
  • Source/referrer from which you accessed the page
  • Operating system used
  • Browser used
  • IP address used (anonymized where applicable)

The legal basis for this processing is Art. 6(1)(f) GDPR, based on our legitimate interest in improving the stability and functionality of our website. Data is not passed on or otherwise used. Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's device. For this purpose, the user's IP address must remain stored for the duration of the session.

We reserve the right to review the server log files retrospectively should there be concrete indications of unlawful use. Data is deleted once it is no longer required for the purpose for which it was collected. In the case of data collected to provide the website, this is the case once the respective session has ended.

Where data is stored in log files, this is the case after seven days at the latest. Further storage is possible; in that case, users' IP addresses are deleted or anonymized so that the accessing client can no longer be identified. Collection of the data to provide the website and its storage in log files is strictly necessary for operation of the website. Accordingly, users have no right to object to this processing.

We use the Ecwid shop system, operated by Ecwid, Inc. (144 West D Street, Suite 103, Encinitas, California 92024, USA), headquartered in the USA. Further information on data protection at Ecwid: ecwid.com/eu-privacy-policy

3. Cookies

Our website uses cookies. In addition, on the pages of our consultation questionnaire (Section 5, served on the start. subdomain of our website) we use cookies and similar technologies in connection with third-party services — specifically Microsoft Clarity (Section 10) and the Meta Pixel (Section 9) — which are only set and loaded after your express consent. As long as you have not consented, the corresponding scripts are not loaded and no data is transmitted to the respective providers. Details can be found in the relevant sections of this privacy policy and in our cookie banner, where you can give and withdraw your consent at any time, separately for analytics and marketing.

Cookies are text files stored on the user's device. When a user visits a website, a cookie may be stored on the user's operating system. Some features of our website cannot be offered without the use of cookies. For this, it is necessary that the browser is recognized even after a page change. User data collected through technically necessary cookies is not used to create user profiles. Our legitimate interest in the processing of personal data for the purposes described above also lies in Art. 6(1)(f) GDPR.

In addition, our website may use cookies that enable analysis of users' browsing behavior (so-called third-party cookies). Further information on the scope, purpose, legal basis, and rights to object is provided in the relevant sections of this privacy policy.

As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable, restrict, or delete the transmission of cookies. If you disable cookies for our website, you may no longer be able to use all functions of the website to their full extent.

Help with browser settings can be found in the respective help menus:

Some of the cookies used here are deleted after you close your browser (so-called session cookies). Other cookies remain on your device and allow us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies). Where cookies are set, they collect and process, to varying degrees, certain user information such as browser and location data as well as IP address values. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie.

4. Contacting us

If you contact us via our contact form, the data entered in the input mask is transmitted to us and stored. The data collected can be seen from the respective input mask. If you contact us by email, only the data you provide in that email is transmitted to us.

The data is used exclusively for processing the conversation and your enquiry. The legal basis for processing the data is Art. 6(1)(a) GDPR, provided the user has given consent. The legal basis for processing data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. The data is deleted once it is no longer required to achieve the purpose for which it was collected and provided no statutory retention obligations apply.

5. Lead capture via our consultation questionnaire ("funnel") and use of Close CRM

5.1 On our website we offer a multi-step consultation questionnaire (the "funnel") that lets you find out, without obligation, whether orthokeratology ("night lenses") might be suitable for you. As part of this questionnaire, we collect the information you enter, including contact details (e.g. name, email address, and, where provided, phone number), an indication of your vision (see Section 5.3), and an optional free-text field in which you can provide us with additional, freely worded information about your enquiry. For the vision question, the questionnaire offers a choice of three predefined answer options:

  • "Between –8.5 and +3.0 diopters"
  • "I don't know"
  • "Outside of this range"

5.2 The legal basis for processing your contact details and other, non-health-related information is your consent pursuant to Art. 6(1)(a) GDPR.

5.3 Health data (special category of personal data). The indication of your vision (Section 5.1) constitutes health data within the meaning of Art. 9(1) GDPR. This applies regardless of which of the three answer options you select: the question itself is designed to elicit health-related information, so that even the answer "I don't know" is treated as part of this health-related enquiry. The same applies where you voluntarily provide further health-related information in the optional free-text field (Section 5.1) — for example about your vision, pre-existing conditions, or prior treatment; such information is likewise treated as health data within the meaning of Art. 9(1) GDPR. We process this information solely on the basis of your explicit, separate consent pursuant to Art. 9(2)(a) GDPR. This consent is obtained separately from the general consent under Section 5.2 above and is not given automatically together with it. Without this separate consent, we do not collect, transmit, or otherwise process your vision-related answer or corresponding free-text entries.

5.4 Disclosure to Close. Provided you have given consent, we transmit the data collected via the questionnaire to our processor Close (Elastic Inc., dba Close, PO Box 7775 #69574, San Francisco, CA 94120, USA; data protection officer reachable at privacy@close.com or dpo@close.com), a cloud-based sales and communication system (CRM). We use Close to follow up on your enquiry, to send you further information about our products, and to select the follow-up communication relevant to you (e.g. which automated email sequence you receive) based on the information you provide — including your vision-related answer and any free-text entries. We do not transmit your information to advertising platforms (e.g. Meta, TikTok) for audience-targeting purposes.

5.5 Transfer to the USA. Close processes data (also) outside the EU/EEA. We base this transfer on the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor) pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021, under a data processing agreement concluded with Close pursuant to Art. 46(2)(c) GDPR.

5.6 Interaction with tracking. On the questionnaire pages we use the services described in Sections 9 and 10 (Meta Pixel, Microsoft Clarity). These are only activated after you have given the consent required for them in the cookie banner; no such tracking takes place before you have given consent. The information you enter in the questionnaire — in particular your vision-related answer and any free-text entries (Section 5.3) — is not transmitted to these services and is not combined with tracking data; input into form fields is masked in Microsoft Clarity's session recordings (Section 10).

5.7 Retention period. After the contractual relationship between Eyefriends and Close ends, Close makes the data available for export for 90 days and then irreversibly deletes it (per the data processing agreement concluded with Close).

5.8 Your rights — in particular the right to withdraw your consent(s) at any time with effect for the future — are set out in Section 11 of this policy.

6. Data processing when opening a customer account and for contract performance

If you wish to place an order in our online shop, it is necessary for the conclusion of the contract that you provide the personal data we need to process your order. We process the data you provide in order to process your order.

In some cases, we work with external service providers to process your order. For this purpose, we must disclose the personal data required for this. Where we engage transport companies to deliver your goods, we pass on the data required for delivery to the relevant transport company. For payment processing, we pass on your data, to the extent necessary, to the credit institution engaged. The legal basis for disclosing your data is Art. 6(1)(b) GDPR.

We use the Ecwid shop system, operated by Ecwid, Inc. (144 West D Street, Suite 103, Encinitas, California 92024, USA), headquartered in the USA. Further information on data protection at Ecwid: ecwid.com/eu-privacy-policy

7. Newsletter

Our website offers the option to subscribe to a free newsletter. When you sign up for the newsletter, the data from the input mask is transmitted to us. The only mandatory field is your email address. If you provide additional, voluntary information, this is used only for personal address purposes.

The legal basis for processing your data after signing up for the newsletter is Art. 6(1)(a) GDPR, provided the user has given consent. We obtain this consent by sending you a confirmation email after signing up for the newsletter, containing a confirmation link. By clicking this link, you simultaneously give your consent to receive the newsletter.

When the newsletter sign-up is submitted, we store your IP address as well as the date and time of sign-up. This storage serves to enable us to trace any possible misuse of your email address.

You may cancel your newsletter subscription at any time. A corresponding link is provided in every newsletter for this purpose. This also allows you to withdraw your consent to the storage of the personal data collected during the sign-up process.

8. Data processing for order fulfillment

8.1 If you wish to place an order in our online shop, it is necessary for the conclusion of the contract that you provide the personal data we need to process your order.

PayPal

If you select PayPal, credit card via PayPal, direct debit via PayPal, or — where offered — "purchase on account" or "installment payment" via PayPal as the payment method, payment processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

We disclose your personal data to PayPal in accordance with Art. 6(1)(b) GDPR, to the extent necessary. For the payment methods credit card, direct debit, or — where offered — "purchase on account" or "installment payment", PayPal reserves the right to carry out a credit check.

Further details on the data collected by PayPal can be found in its privacy policy: paypal.com/de/webapps/mpp/ua/privacy-full

You may object to this processing of your data by PayPal at any time by notifying PayPal. However, PayPal may remain entitled to process your personal data where this is necessary to carry out payment processing under the contract.

9. Online marketing

Meta Pixel (Facebook Pixel)

On the pages of our consultation questionnaire (Section 5, served on the start. subdomain of our website) we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). We do not use the Meta Pixel on the other pages of our website. The Meta Pixel lets us measure the effectiveness of our advertising on Meta's platforms (in particular Facebook and Instagram): it allows Meta to recognise that you visited the questionnaire after clicking one of our ads.

Scope of processing. We use the pixel exclusively to measure page views (the standard "PageView" event). No further conversion or event measurement (e.g. purchase, lead, add-to-cart) takes place, and we do not use server-side transmission via the Meta Conversions API. We also do not transmit any data from our consultation questionnaire (Section 5) to Meta. On a page view, Meta processes in particular your IP address, information about your browser and device, the page accessed, and the _fbp cookie identifier.

Legal basis and withdrawal. This use is based exclusively on your consent pursuant to Art. 6(1)(a) GDPR. Without your consent to the "Marketing" category, the Meta Pixel is neither loaded nor initialised and no data is transmitted to Meta. You can withdraw your consent at any time via the cookie settings. After withdrawal we pause the pixel using Meta's consent function (fbq('consent', 'revoke')) and delete the cookies within our reach (_fbp, _fbc); the fr cookie, which is set on a Meta domain, cannot be deleted by us — you can remove it via your browser settings.

Joint controllership and third-country transfer. We are a joint controller with Meta for the collection and transmission of data by means of the pixel (Art. 26 GDPR); Meta's further processing takes place under its own responsibility. Meta also processes data in the USA and bases this transfer on the EU-US Data Privacy Framework and on the European Commission's Standard Contractual Clauses.

Further information: facebook.com/privacy/policy, facebook.com/legal/terms/businesstools

10. Web analytics services

Microsoft Clarity

On the pages of our consultation questionnaire (Section 5, served on the start. subdomain of our website) we use the analytics service Microsoft Clarity of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland ("Microsoft"). We do not use Clarity on the other pages of our website.

Purpose and scope of processing. Clarity records your interactions with the questionnaire — in particular the pages accessed, clicks, mouse and scroll movements, screen and window size, browser and device type, referrer, and your IP address — and evaluates them in the form of session recordings and heatmaps. The course of your visit is therefore recorded and can be replayed by us afterwards. We use this solely to understand which content is found and which is overlooked, and to improve navigation. Input into form fields is masked by Clarity by default and is not recorded in clear text.

Cookies. For this purpose Clarity sets cookies on our domain (_clck, _clsk) as well as cookies on Microsoft domains (CLID, ANONCHK, MR, MUID, SM) in order to recognise returning visits and connected sessions. Microsoft also uses the MUID cookie for advertising purposes. An overview including retention periods can be found in our cookie banner.

Legal basis and withdrawal. This use is based exclusively on your consent pursuant to Art. 6(1)(a) GDPR. Without your consent to the "Analytics" category, Clarity is not loaded, no data is transmitted to Microsoft, and no Clarity cookies are set. You can withdraw your consent at any time via the cookie settings. After withdrawal we communicate the withdrawal to Microsoft via Clarity's consent API; Clarity then ends the session, sets no further cookies, and deletes the cookies it has set. We additionally delete the cookies on our own domain (_clck, _clsk) ourselves.

Third-country transfer. Microsoft also processes the data in the USA. We base this transfer on the EU-US Data Privacy Framework, under which Microsoft Corporation is certified, and additionally on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Microsoft processes the data collected via Clarity on our behalf on the basis of the data protection terms of the Microsoft Clarity Terms of Use.

Further information: learn.microsoft.com/en-us/clarity, privacy.microsoft.com/en-us/privacystatement

11. Data subject rights

11.1 Applicable data protection law grants you comprehensive rights (rights of access and intervention) against the controller regarding the processing of your personal data:

  • Right of access pursuant to Art. 15 GDPR — confirmation of the processing of your personal data, and information on the purpose, categories, recipients, and planned storage period.
  • Right to rectification pursuant to Art. 16 GDPR — prompt correction of inaccurate data or completion of incomplete data.
  • Right to restriction of processing pursuant to Art. 18 GDPR — while disputed data is being verified or an objection is being reviewed.
  • Right to erasure pursuant to Art. 17 GDPR — where the requirements are met and no exceptions apply (e.g. statutory retention obligations).
  • Right to notification pursuant to Art. 19 GDPR — regarding rectification, erasure, or restriction, vis-à-vis all recipients of your data.
  • Right to data portability pursuant to Art. 20 GDPR — to receive the data you have provided in a structured, commonly used, and machine-readable format.
  • Right to withdraw consent pursuant to Art. 7(3) GDPR — at any time, with effect for the future.
  • Right to lodge a complaint pursuant to Art. 77 GDPR — with a supervisory authority, in particular at your place of residence, place of work, or the place of the alleged infringement.

11.2 Right to object. You have the right to object at any time, with effect for the future, to the processing of your data where we process it on the basis of an overriding legitimate interest following a balancing of interests. If you exercise this right to object, we will stop processing your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or the processing is necessary for the establishment, exercise, or defense of legal claims.

12. Duration of storage of personal data

The duration of storage of personal data depends on the applicable statutory retention periods in each case. Once these periods expire, we routinely delete the data, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continued storage.