Privacy policy

Relenser — new lenses in the glasses you already have (a lens replacement service built on the Della Spina optical laboratory)

Website: www.relenser.com
Last updated: 14 October 2026 · Version 1.2

1. Who controls your personal data

The controller of your personal data is:

Relenser d.o.o.
Registered office: Ulica heroja Šaranoviča 23, 2000 Maribor, Slovenia
Registration no.: 9962000000
VAT ID: SI84897724
Phone: +386 51 811 088
Email: info@relenser.com

In this policy, “Relenser”, “we” or “us” means the company named above. “You” means the individual whose personal data we process (a customer or a website visitor).

We have not appointed a data protection officer (DPO), because this is not required by law for the scope of our processing. For any questions about privacy and to exercise your rights, contact us at info@relenser.com.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Personal Data Protection Act (ZVOP-2) and other applicable legislation of the Republic of Slovenia.

2. How the service works (and why we need your data)

Relenser is a lens replacement service: you keep your frames and we fit new lenses (prescription or non-prescription) into them. The process runs as a cycle:

  1. ordering and payment on the website,
  2. submission of your prescription / dioptre values (entering the values or a photo of the prescription),
  3. sending your frames to us (GLS shipping label),
  4. production of the lenses in the laboratory, and
  5. return of the glasses to you.

For each step we need certain personal data. Below we describe exactly which data and why.

3. What personal data we process

3.1 Data you provide to us

  • Identity and contact: first name and surname, email address, phone number.
  • Address: delivery and return address.
  • Order: lens configuration, products ordered, order value and payment details.
  • Prescription / vision (health data): dioptre values for the left and right eye (SPH, CYL, AXIS and, where applicable, ADD), pupillary distance (PD), fitting height (PH), any notes.
  • Photo of the prescription (health data): a photo or scan of your prescription, if you upload one.
  • Communication: the content of messages you send us (e.g. by email).

3.2 Data generated while the service is provided

  • Order status: the stage in the lens replacement process and the order event log.
  • Shipments: tracking numbers (outbound and return shipment), GLS shipping labels.
  • Technical and usage data: session data, cookies, device and browser data, and data on use of the website and the configurator (see section 9).

3.3 Special category of data — health data about your vision

Data about your prescription / dioptre values (including pupillary distance and fitting height) and photos of your prescription are a special category of personal data (health data) under Article 9 GDPR. We process them solely on the basis of your explicit consent and only for the purpose of making and supplying the lenses you ordered.

You give explicit consent by entering or uploading your prescription details during the ordering process and placing the order. These data are necessary solely for making lenses to your prescription; without them the order cannot be carried out. You may withdraw your consent at any time (see sections 6 and 11) — if you withdraw it before production, we cannot complete the order.

We never use these data for advertising, analytics or profiling. Your prescription, dioptre values, pupillary distance, fitting height, photos of your prescription and file names are not sent to analytics and advertising tools (Google, Meta), and we do not disclose them to anyone except processors that are necessary to provide the service (see section 7).

For making the lenses, these data are also received by our partner optical laboratory Della Spina d.o.o., which processes them as our processor and solely for this purpose (see section 7).

4. Purposes and legal bases of processing

  • Concluding and performing the order (lens replacement, delivery, support) — identity, contact, address, order, status, shipments. Legal basis: performance of a contract — Article 6(1)(b) GDPR.
  • Making lenses to your prescription — prescription/dioptre values, photo of the prescription. Legal basis: explicit consent — Article 9(2)(a) GDPR, given by placing the order with the prescription entered/uploaded (in conjunction with Article 6(1)(b)).
  • Payment processing and fraud prevention — payment data, order data. Legal basis: performance of a contract — Article 6(1)(b); legitimate interest — Article 6(1)(f).
  • Issuing and retaining invoices, tax obligations — order and payer data. Legal basis: legal obligation — Article 6(1)(c).
  • Review invitation after delivery (Trustpilot) — name, email address, order number. Legal basis: legitimate interest — Article 6(1)(f). Every customer receives the same invitation regardless of satisfaction, with no reward for a review. You can object at any time via the link in the invitation or at info@relenser.com.
  • Responding to enquiries and support — contact, content of messages. Legal basis: legitimate interest — Article 6(1)(f).
  • Web analytics (Google Analytics 4) — usage data, cookies, device identifiers. Legal basis: consent — Article 6(1)(a).
  • Ad measurement and display (Meta Pixel and Meta Conversions API) — usage and purchase data, device identifiers and possibly (in hashed form) name, email address, phone number and location. Legal basis: consent — Article 6(1)(a).
  • Newsletter and direct marketing (once activated) — email address, name. Legal basis: consent — Article 6(1)(a).
  • Ensuring the security and operation of the website — technical data, session data. Legal basis: legitimate interest — Article 6(1)(f).

Where the legal basis is legitimate interest, we have assessed that our interest (a working, secure, fraud-free service) does not override your rights and freedoms. You may object to such processing (see section 11).

5. Where we obtain data

We obtain personal data directly from you (when you order, submit your prescription and communicate with us) and through our sales platform Shopify, on which you make your purchase and payment. We do not buy data about you and do not obtain it from data brokers.

6. How long we keep data

We keep personal data only for as long as necessary for the purposes for which it was collected:

  • Prescription/dioptre data and photos of the prescription (health data): we keep them for the duration of the business relationship (to enable the order to be carried out, any complaint and a repeat order) and until you withdraw your consent or request erasure. After withdrawal or a request for erasure, we erase them — photos are deleted from storage and the dioptre values are cleared in our records — unless the law exceptionally requires them to be retained (which generally does not apply to the dioptre values themselves).
  • Unfinished configurations (lens and prescription drafts): if you enter or upload a prescription, PD or other data in the lens configurator but do not place an order, we automatically delete the draft, including any uploaded files, after 30 days of inactivity. A draft that belongs to a paid order is kept with that order.
  • Order, delivery and contact data: we keep them for the time needed to carry out the order and a reasonable period for support, complaints and asserting legal claims, and then erase or anonymise them.
  • Invoices and tax documentation: kept in accordance with tax and accounting legislation (generally 10 years under the legislation governing value added tax and tax procedure). This retention cannot be shortened by withdrawing consent.
  • Consents for marketing / analytics: valid until withdrawn; after withdrawal, we stop the processing concerned. Data that analytics and advertising tools have already received is kept by those providers in accordance with their own retention settings.

When the retention period expires, we erase the data or irreversibly anonymise it.

7. Who we disclose data to (processors and other recipients)

We do not sell your data. We disclose it only to trusted processors that help us provide the service, and only to the extent necessary for that purpose. We have concluded data processing agreements (DPAs) with all of them in accordance with Article 28 GDPR.

  • Shopify (Shopify International Ltd., Ireland) — online store, sign-in, cart, orders, payments, cookie banner; identity, contact, address, order, payment. Location: EU/EEA and third countries (SCC).
  • Render (application and database hosting) — storage of order, status, prescription and log data; identity, contact, prescription/dioptre values, status. Location: EU — Frankfurt.
  • Della Spina d.o.o. (optical laboratory) — physical production and fitting of lenses to prescription; prescription/dioptre and order data needed to make the lenses. Location: Slovenia (EU).
  • Cloudflare R2 (file storage) — secure storage of prescription photos and shipping labels; prescription photos, GLS labels (with address). Location: EU — private storage.
  • GLS (delivery service) — delivery and return of frames/glasses; name, address, phone, shipment number. Location: EU.
  • PayPal and the card payment provider via Shopify — payment processing; payment and payer data. Location: EU/EEA and third countries (SCC).
  • Resend (email service provider) — transactional email (prescription submission links, shipping labels, status notifications); email address, name, order data. Location: EU/EEA and third countries (SCC).
  • Čebelca (REFAKTOR d.o.o., Slovenia) — issuing and fiscally confirming invoices; name, address, email address, order items and amount. Location: Slovenia (EU).
  • Trustpilot (Trustpilot A/S, Denmark) — sending review invitations after delivery and publishing your review if you write one; name, email address, order number (never prescription data or order contents). Trustpilot is an independent controller for published reviews. Location: EU (Denmark).
  • Google (Google Ireland Ltd.; Google Analytics 4) — only with your consent to analytics; web analytics; usage data, device identifiers, purchase data. Location: EU/EEA and third countries (DPF/SCC).
  • Meta (Meta Platforms Ireland Ltd.; Meta Pixel and Conversions API) — only with your consent to marketing; ad performance measurement, ad display and conversion matching; usage and purchase data, device identifiers; for conversion matching we may also send Meta your name, email address, phone number and location in hashed form. Location: EU/EEA and third countries (DPF/SCC).

We may also disclose data to competent authorities where the law requires us to do so.

8. Transfers to third countries

We process your data mainly within the EU/European Economic Area. The key storage (the database and the prescription files) is in the EU (Frankfurt or private EU storage).

Some processors and recipients (e.g. Shopify, Cloudflare, PayPal, Resend, Google and Meta) are part of international groups and may also process data outside the EU/EEA. In such cases, the transfer is protected by appropriate safeguards in accordance with the GDPR — generally the European Commission’s standard contractual clauses (SCC) or certification under the EU–US Data Privacy Framework. You may request a copy of the safeguards at info@relenser.com.

9. Cookies and similar technologies

On the website, we use cookies and similar technologies in accordance with the Electronic Communications Act (ZEKom-2) and the GDPR:

  • Necessary cookies — needed for the store to work (session, cart, checkout process, security, storing your cookie choice). They are set without consent because they are necessary for operation.
  • Analytics cookies (Google Analytics 4) — help us understand how the website and the lens configurator are used. They are set only with your consent to analytics.
  • Advertising cookies and pixels (Meta Pixel, Meta Conversions API) — enable ads to be measured and displayed. They are used only with your consent to marketing; without it, Meta does not receive advertising events from us.

On your first visit, we ask for your consent to non-essential cookies through a cookie banner; you can accept, reject or customise your choice by category. Rejecting does not affect your ability to browse or buy. You can change or withdraw your consent at any time through the cookie settings on the website or in your browser settings. After withdrawal, no new events are sent; withdrawal does not affect the lawfulness of processing before withdrawal.

10. Newsletter and direct marketing

If you sign up for our newsletter or consent to receiving offers, we will send you messages about products, offers and news. We do this only on the basis of your consent.

You may withdraw your consent at any time — via the unsubscribe link in every message or by a written request to info@relenser.com. After you unsubscribe, we will no longer send you marketing messages; however, we may continue to send you necessary transactional messages relating to your order (e.g. the prescription submission link, the shipping label, a status notification).

11. Your rights

You have the following rights regarding your personal data:

  • Access — confirmation of whether we process your data, and a copy of that data.
  • Rectification — correction of inaccurate data or completion of incomplete data.
  • Erasure (“right to be forgotten”) — erasure of data where there is no longer a basis for processing.
  • Restriction of processing — in the cases laid down by law.
  • Portability — receiving your data in a structured, machine-readable format or having it transmitted to another controller.
  • Objection — to processing based on legitimate interest and to direct marketing.
  • Withdrawal of consent — at any time, without affecting the lawfulness of processing before withdrawal (applies in particular to health data about your prescription, analytics, advertising and marketing).

You exercise your rights by sending a request to info@relenser.com. To protect your data, we may ask for additional information to confirm your identity. We respond to requests without undue delay and no later than within one month (in more complex cases, the period may be extended in accordance with the GDPR). Exercising your rights is generally free of charge.

If you believe that the processing of your data infringes the regulations, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec)
Dunajska cesta 22, 1000 Ljubljana
Email: gp.ip@ip-rs.si · Phone: +386 (0)1 230 97 30
Website: www.ip-rs.si

12. Data security

We implement appropriate technical and organisational measures to protect your data, including:

  • storing order and prescription data and files within the EU;
  • we keep prescription photos and shipping labels in private storage, accessible only via temporary, signed links — they are not publicly accessible;
  • restricted access to data on a “need-to-know” basis;
  • an encrypted connection (HTTPS) across the entire website;
  • laboratory work orders do not contain the customer’s contact details (data minimisation principle).

Despite careful protection, no transmission or storage of data is completely secure; in the event of a personal data breach, we act in accordance with the GDPR (notification to the supervisory authority and, where required, to the individuals affected).

13. Minors

Our service is intended for adults (aged 18 or over). We do not market directly to minors. An order that includes glasses for a minor (e.g. children’s glasses) may be placed by a parent or legal guardian, who thereby gives consent to the processing of the child’s health data (prescription/dioptre values). If we find that we have obtained a minor’s data without appropriate consent, we erase it.

14. Automated decision-making and profiling

We do not carry out decision-making based solely on automated means that would have legal or similarly significant effects on you with regard to your personal data (Article 22 GDPR). We use your prescription data solely to make lenses, not for evaluation or profiling.

If you consent to marketing cookies, Meta may use data about your use of the website and your purchases to measure ads and to show ads that may interest you (advertising profiling). Health data is not used for this. You may withdraw your consent at any time (see section 9).

15. Changes to this policy

We may update this privacy policy from time to time (e.g. when there are new features, processors or legislative changes). The current version is always published on this page, stating the date of the last update. In the event of material changes, we will notify you in an appropriate way (e.g. by email or with a notice on the website).

16. Contact

For any questions about privacy and the processing of personal data:

Relenser d.o.o.
Ulica heroja Šaranoviča 23, 2000 Maribor, Slovenia
Phone: +386 51 811 088
Email: info@relenser.com