JavaScript seems to be disabled in your browser. For the best experience on our site, be sure to turn on Javascript in your browser.
Myymälämme isoimmissa kaupungeissa:
Katso kaikki myymälät
Hyvä tietää näkemisestä
Silmien terveys
Varaa aika
Piilarien uusintatilaus
Instru Optiikka Oy (“Instru Optiikka”, “Company”, “we”, “our” or “us”) is a pioneer in the optical industry in Finland and Estonia. In Finland, Instru Optiikka operates under Instrumentarium, Nissen, and Keops retail brands. This Privacy Notice is applicable to all our stores, opticians and ophthalmologists employed or operating under the referred retail brands in Finland.
Instru Optiikka is part of EssilorLuxottica, a global leader in the design, manufacture and distribution of ophthalmic lenses, frames and sunglasses.
Instru Optiikka Oy
Business ID 1789727-2
Linnoitustie 3
02600 Espoo
Instru Optiikka has appointed a Data Protection Officer who can be contacted by email at tietosuoja@instru.fi or by using the postal address mentioned above.
Should you have any questions regarding the processing of your Personal Data or if you wish to use your data protection rights, please contact us by email at tietosuoja@instru.fi.
The purpose of this Privacy Notice is to inform you in a clear, simple, and complete manner about the processing of your Personal Data provided by you or collected by us from various interactions you may have with us e.g., in-store, customer care, websites, services, events, etc., possible data transfer to third parties, as well as, your rights and the options to control your information and protect your privacy, in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (2016/679, “GDPR”) and local laws and regulations supplementing the GDPR, such as the Act on the Status and Rights of Patients and the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare (“Applicable Legislation”).
We may update or amend this Privacy Notice at any time. You will be adequately notified of any changes to this Privacy Notice unless such changes are non-material or insignificant.
The Personal Data we collect depends on the point of contact through which you interact with us, as well as the purposes of the interaction, as described in this Privacy Notice. The collected Personal Data is limited to information that is relevant and appropriate for this interaction.
We use different methods and various sources to collect data from and about you. We collect and obtain information:
(a) Provided directly by you
When you visit our stores, optician, or ophthalmologist, information may be collected during your eyesight checks, the purchase process, and adjustment of purchased products.
We also collect information when you use our websites. For example, during the registration process, the creation of a customer account on the website, or when completing a purchase order or joining our engagement programs, participating in prize competitions and events, and when you contact us for request, feedback, or complaint. Under certain conditions, we also keep records of customer service calls and maintain a transcript of chats for quality assurance and management.
(b) Cookies
We use certain technologies (e.g., cookies and automatic tracking systems) that automatically collect specific information related to your use of our websites and online services. For further information on the use of Personal Data collected through automatic tracking systems, please carefully read our Cookie Policy available on the following website: https://nissen.fi/evasteet.
(c) From other sources
We may obtain information about you from other sources, such as Digital and Population Data Services Agency, for the purpose of verifying any uncertainties related to patient information or updating address information.
For underage customers, information is also collected from the guardian or other legal representatives.
The Personal Data we collect depends on the point of contact through which you interact with us, as well as the purposes of this interaction as described hereafter in this Privacy Notice. The collected Personal Data is limited to information that is relevant and necessary for this interaction.
Category of Data:
Basic Data
Henkilötietotyyppi:
Including such as name and surname, e-mail address, gender, date of birth, country of residence, postal address and phone numbers.
For an underage, the name and contact details of their guardians or other legal representatives, as well as, if applicable, the name and contact details of any legally appointed representative for an adult individual.
Identification data
Types of data:
Government issued documents or information including national identification card, passport, and national identity number.
Payment data
Including customer number, bills, billing addresses, billing amount, payment information, payments, credit worthiness and details about products which you have purchased from us.
Delivery Data
Including customer number, delivery addresses, delivery method, place of delivery, details about purchased products and services, order information, tracking number, amount and type of purchase.
Customer data
Types of Data:
Customer data Including customer number, delivery addresses, details about purchased products and services, place of purchase (in store or online), order information, amount, and type of purchase, returns, complaints and your interests, preferences, feedback, and survey responses.
Customer account data
Including your account name and password, details about products and services which you have purchased from us.
Marketing data
Including your contact details, preferences for receiving marketing communications from us, such as any prohibitions or consents you have provided, and information contained in any correspondence.
Communications Data
Including any correspondence or requests sent by you to us, or requested by us from you, particularly if problems with the website, services, or purchased products are reported.
Patient data (Sensitive data)
Including eye examinations, measurements (optical correction, pupillary distance, etc.), information having an impact on your visual health and eyesight checks that can be carried out in our stores, and log data related to patient data (name and position of person, date and time of entry).
Device information
Including such as the IP address or other unique code of your device (computer, mobile or other devices), identification as registered user or not (login data), technical information that may include the URL from where you originate, time zone setting and location, browser information and language.
Navigation information
Including information regarding your interactions with our websites, our services, emails, products or advertisements and statistical data relating to these interactions.
We are required to use your data for purposes defined according to the nature of our relationship. Thus, depending on the context in which your data is collected, it may be used for one or more of the following purposes:
Purposes:
Patient care and management of the patient relationship
Description:
Legal basis:
Legal obligation and consent
Management of individual purchases and deliveries
We process your Basic data and Delivery data to deliver the ordered products.
The data is also processed when you order a single product without logging into our services or creating a customer account.
Execution of a contract
Purpose:
Customer management in-store and online and the after-sales services management
Management of payments and potential unpaid invoices
Account creation and management
Consent
Digital advertising and direct marketing
Communication with us
Legal obligations
Legal proceedings and complaints
Legimitate interest: Processing of sensitive data is based on Art. 9(2)(f) of GDPR.
Corporate acquisitions
Legimitate interest
Information security and Website maintenance
Legitimate interest
Cookies and analytics
Instru Optiikka is part of the international EssilorLuxottica Group. EssilorLuxottica is a global leader in the design, manufacture and distribution of ophthalmic lenses, frames and sunglasses.
Instru Optiikka (all our stores under our retail brands) uses group-wide IT systems, for example customer management system. Your Personal Data is stored and processed in these global IT systems and applications that are used globally by the Affiliates of EssilorLuxottica. The group-wide processing of your personal data is carried out through the concentrated services of two entities: Essilor International and Luxottica Group S.p.A.
(a) Service providers
We may disclose your Personal Data with our third-party service providers entrusted with processing activities that provide services or assistance and advice to us, with special – but not exclusive – reference to technology, accounting, administrative, legal, insurance, IT, marketing, data analysis matters.
Most of our service providers will act as data processors, on behalf of and in accordance with the instructions received from us, by virtue of a specific agreement in place per Article 28 of the GDPR, which sets out its obligations and guarantees the implementation of appropriate technical and organizational measures to respect the Applicable Legislation and the protection of your rights. Some service providers, such as attorneys and accountants, act as independent data controllers and are independently responsible for their processing.
We require that any such third-party service provider is subject to strict control and implements appropriate guarantees of security and confidentiality of your Personal Data.
(b) Franchise Partners
Some of our stores are operated by independent traders, who are authorized to exploit the commercial concept of Instru Optiikka’s retail brands Instrumentarium and Keops and our trademarks, within the framework of a franchise agreement (“Franchise Partner”).
Our retail network, including stores operated by our Franchising Partners, uses our IT systems (incl. customer management system and patient information system), where your Customer and Patient data is stored. To ensure that our service is as seamless as possible, it is important for the professionals serving you to have access to your customer and patient information. For example, if you visit two different stores or have appointments with two different ophthalmologists, we want the details of your previous visits to be accessible to our other professionals so that they can provide you with appropriate patient care based on your state of health and prior visits and serve you in the best possible way. Subject to your consent, your Customer data and Patient data can be accessed by professionals in all our stores, as necessary for your treatment.
(c) Self-employed ophthalmologists
Some of the ophthalmologists who provide their services in our stores act as independent medical practitioners. This means that they are not employed by us. We have a contractual relationship with them, and they are allowed to use our patient information system. These ophthalmologists act as independent data controllers and are responsible to you under applicable data protection legislation. Subject to your consent, your patient data can be accessed by professionals (incl. independent practitioners) in all our stores, as necessary for your treatment.
(d) Sale or merger
We may also disclose your Personal Data if we sell, buy, merge with, are acquired by, or partner with other companies or businesses, or sell some or all of our assets. In such transactions, your Personal Data may be among the transferred assets.
We may share necessary information we collect in connection with a substantial corporate transaction, such as the sale of a website, a merger, consolidation, asset sales, or in the unlikely event of bankruptcy. Prior to such an event, we will inform you separately about the details of sharing your data and will obtain your consent where legally necessary.
(e) Legal obligations and legal proceedings
We may disclose your Personal Data to any authority, court, administrative body, or other authorised third party (including, without limitation, counsel), where the disclosure of Personal Data is required by law, regulation or court order or where such disclosure is necessary for the protection and defense of our rights. For example, we can disclose your Personal Data relating to products (e.g. frames and ophthalmic lenses) to third parties in accordance with applicable legislation on medical devices.
(f) Digital advertising
We may disclose your Personal Data to our third-party service providers, such as Sanoma and Schibsted for digital targeted marketing. If you have an account with the service provider, the service provider can connect the contact details you provide to us (typically your e-mail address) and to them. When the data is combined, the data is used to send you digital advertising that reflects your interests. The processing is based on your consent. The service providers are not allowed to use the data for other purposes.
As a main rule, Instru Optiikka processes Personal Data within the European Economic Area (“EEA”).
Instru Optiikka is part of EssilorLuxottica Group and the group-wide IT systems as well as third parties engaged by EssilorLuxottica Group operate globally and therefore may process Personal Data outside the EEA.
Further, when we order customized products (e.g. lens) from our foreign suppliers, your Personal Data may be accessed and/or transferred to countries outside the EEA.
In such cases, Instru Optiikka and EssilorLuxottica ensure that, at all times, appropriate safeguards are implemented to ensure that your Personal Data is processed in accordance with Applicable Legislation. In this respect, where your Personal Data is processed by another EssilorLuxottica entity, the safeguards are based on the commitments taken on the basis of (ii) a dedicated transfer agreement binding upon the EssilorLuxottica entity involved in the processing and (ii) a set of common rules applicable through the EssilorLuxottica Group Data Protection Policy.
Where your Personal Data is processed by EssilorLuxottica entities or third parties located outside the EEA, we and EssilorLuxottica shall ensure that that one of the following safeguards is in place (i) the European Commission has issued a decision on an adequate level of protection for personal data in the country of destination, (ii) Standard Contractual Clauses approved by the European Commission have been put in place or (iii) other appropriate transfer mechanism is applicable to the transfer of personal data outside the EEA in accordance with Applicable Legislation.
For further information with regard to the appropriate or suitable safeguards and the means by which to obtain a copy of them, you can contact us with the modalities as per this Privacy Notice.
As a main rule, Personal Data will be retained for the duration of the customer relationship between Instru Optiikka and you and for as long as it is necessary to fulfil the purpose of processing. We retain all or part of your Personal Data for the time strictly necessary for the following reasons:
(a) To meet applicable statutory requirements for data retention;
(b) To meet and comply with our legal and/or contractual obligations;
(c) For as long as necessary to carry out each of the purposes mentioned in this Privacy Notice, including for the purposes of customer management, product delivery and marketing.
The main retention periods are listed below:
Retention period or criteria to determine the period:
Patient data is retained in accordance with the Decree of the Ministry of Social Affairs and Health on Patient Documents (94/2022). As a rule, the retention period of Patient data is 12 years from the date of death. Log data relating to Patient data is retained for a minimum of 12 years from the creation.
Post-market surveillance and quality management relating to medical devices
Customer data relating to medical devices is retained in accordance with medical device regulation and supplementing laws. As a rule, the necessary data must be retained for the lifecycle of the product.
Delivery data is retained until your ordered products are delivered in accordance with agreed terms.
Customer management and after-sales service management
Customer data is retained as long as necessary for the purpose of customer relationship and product warranty.
As a rule, Customer data is retained until five years have elapsed since your last visit or contact related to the customer relationship. With your consent, Customer data may be retained for an additional three years.
Management of customer account
Customer account is retained until you withdraw your consent or five years have elapsed since your last interaction with us. With your consent, the Customer account and Customer data may be retained for an additional three years.
Payment data is retained in accordance with applicable accounting and tax laws, for a minimum of six years after the end of the year during which the financial year ended.
Direct marketing and digital advertising
Marketing data is retained until your consent is withdrawn or five years have elapsed since your last contact/activity with us.
Communications with us
Data related to your requests and other communication is retained until five years have elapsed since your communication with us. Surveys, opinion polls, and market research data is retained only for the duration of the survey/poll/research and the data is anonymised thereafter.
Information security and website maintenance (incl. cookies)
Reports and statistics (i.e. non-personal data) are retained until further notice. Regarding user data collected using cookies, please visit our Cookie Notice for more information about retention times.
Personal data is retained during the period necessary to establish, exercise and defend the legal claim and manage complaint, within statute of limitations.
We regard the protection of Personal Data as an essential priority. The processing of your Personal Data is carried out, electronically and manually, only within the limits necessary to pursue the purposes outlined above.
In this respect, we have implemented appropriate measures and safeguards to protect the Personal Data we process.
This is reflected in EssilorLuxottica’s procedures described in the EssilorLuxottica Group Data Protection Program, guidelines and policies and in the actual measures implemented throughout the Group.
We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality. These measures range from technical security measures that protect IT systems to the physical security measures employed at EssilorLuxottica sites. EssilorLuxottica also requires its staff to participate in information security and Data Protection trainings. Details of these measures may be obtained from the Group Information Security Department.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We advise that the password is one of the protection mechanisms of the customer account. Therefore, you are invited to use a password sufficiently secure and stored in a safe place, limiting access to it on your own computers and browsers, disconnecting it after having visited the websites and/or the services.
All Personal Data provided by you is kept on secure servers, adopting adequate security measures to protect Personal Data from non-authorized access, to maintain the accuracy of Personal Data and guarantee the proper use of information.
Furthermore, a secure system for authorizing credit card payments and identifying fraudulent activities is used. We use the standard SSL (Secure Sockets Layer) to protect the confidentiality of your Personal Data.
You can exercise any of the following rights, subject to verification of your identity where necessary:
(a) Right of Information and Access
You may request that the existence of your personal data be confirmed and that you be informed of its content, the purposes of processing, categories of recipients, storage period and source, and receive a copy of the personal data currently stored in our databases.
(b) Right to Rectification
You may request the correction of inaccurate data and, subject to the nature of the collection and use, the completion of incomplete data. We may not accommodate a request to change Personal Data if we believe the change would violate any law or legal requirement or cause the information to be incorrect.
(c) Right to Restriction of the Processing
When applicable, you may restrict the processing of your Personal Data. When such restrictions are not possible, we will advise you accordingly. You can then choose to exercise any other rights under this Privacy Notice, including withdrawing your consent to the processing of your Personal Data.
(d) Right to Object to the Processing
When applicable, you have the right to object to the processing of your Personal Data on grounds relating to your particular situation, if the processing is based on our legitimate interest. In addition, you have the right to object at any time to the processing where Personal Data are processed for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing as well as to object to the disclosure of your patient data.
When such objections are not possible, we will advise you accordingly. You can then choose to exercise another right under this Privacy Notice, like withdrawing your consent to the processing of your Personal Data.
(e) Right to Erasure
Under certain conditions, you have the right to have your Personal Data deleted. The right to erasure does not apply to Patient data that must be retained by us under patient legislation or other data we are obligated to retain under mandatory legislation. Upon receipt of such a request for erasure, we will confirm receipt, consider your request, take a decision and communicate it to you.
(f) Right to data Portability
Upon request and when possible and where applicable by local laws, we can provide to you with copies of your Personal Data in a structured, common framework and machine-readable format. When such a request cannot be honoured, we will advise you accordingly. You can then choose to exercise any other rights under this Privacy Notice, including withdrawing your consent. Where applicable, we will ensure such changes are shared with any trusted third parties.
(g) Right to Withdraw your Consent
Where processing is based on consent, you may withdraw your consent at any time. Upon receipt of such a withdrawal of consent, we will confirm receipt and proceed to stop processing your Personal Data. Such withdrawal will not affect the lawfulness of the processing prior to withdrawal.
(h) Right to lodge a complaint with the relevant data protection supervisory authority
If you are not satisfied with the way we process your Personal Data and/or our response to a request to exercise your rights, you can lodge a complaint with the competent data protection supervisory authority. The supervisory authority in Finland is the Data Protection Ombudsman (www.tietosuoja.fi).
In order to exercise your rights, please contact us at:
tietosuoja@instru.fi
Furthermore, we offer tools to you to update and amend your Personal Data. Indeed, every registered User may access his/her own information and update it (e.g. through user account).
Besides, it is also possible for you to modify and update your preferences on how you wish to receive e-mails or other communications from us. You may also request that your information on your account is deleted.
For information on how to withdraw your consent for cookies, please refer to the Cookies Notice available on the following websites: https://nissen.fi/evasteet.
