1.Introduction and scope
This Privacy Policy explains how Hansco Lens Pvt. Ltd. (“Hansco Lens”, “we”, “us”) collects, uses, stores, shares and protects personal data when you visit hanscolens.com, contact us, open a trade account, or place an order for ophthalmic lenses and related services.
We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and other applicable Indian law.
For most personal data described below, Hansco Lens is the Data Fiduciary (the entity that decides why and how the data is processed). When an optician, clinic or eyewear brand sends us their own customers’ prescription details to manufacture lenses, that business is the Data Fiduciary for its customers and we act as its Data Processor, handling the data only on its instructions.
2.Personal data we collect
Depending on how you interact with us, we may collect:
Contact and enquiry data
- Name, business name, designation, email address and phone number.
- The content of messages, quote requests and support tickets you send us.
Order, delivery and billing data
- Shipping and billing addresses, order history and delivery instructions.
- GST number, PAN (where required for invoicing or TDS), and invoice details.
- Payment status and transaction references. We do not store full card, UPI PIN or net-banking credentials; these are handled by our payment processors.
Prescription and optical data (sensitive)
- Spherical, cylindrical, axis, addition, prism, pupillary distance, fitting height and similar measurements needed to make lenses.
- Frame and lens selections, wearer name or reference code, and related notes. This information relates to a person’s physical health and is treated by us as sensitive personal data with additional safeguards.
B2B account data
- Business registration details, authorised signatories, credit and trade references, pricing tier and account-user credentials.
Technical and usage data
- IP address, device and browser type, pages viewed, referring pages and approximate location, collected through cookies and similar technologies (see Cookies and analytics).
3.Why we use your data and our legal basis
Under the DPDP Act we process personal data either with your consent or for the “certain legitimate uses” the Act recognises (for example, where you voluntarily provide data for a specified purpose and have not indicated otherwise, or to comply with law). Where we rely on consent, it is free, specific, informed and unambiguous, and you may withdraw it at any time.
| Purpose | Data used | Basis |
|---|---|---|
| Respond to enquiries and quote requests | Contact data, message content | Consent / voluntary provision |
| Process, manufacture, ship and invoice orders | Order, billing, prescription data | Consent; performance of the order you requested |
| Create and manage B2B trade accounts | B2B account data, contact data | Consent; contract with your business |
| Customer support, remakes and warranty claims | Order, prescription, contact data | Consent; legitimate use |
| Tax, accounting and regulatory compliance | Billing and order data | Compliance with law |
| Site security, fraud prevention, analytics | Technical and usage data | Consent (analytics cookies); legitimate use (security) |
| Product updates and trade offers | Contact data | Consent (opt-out at any time) |
We do not sell personal data, and we do not use prescription data for marketing or profiling.
5.International transfers
Some of our service providers (for example cloud hosting or email tools) may store or process data outside India. We transfer personal data outside India only to countries and recipients not restricted by the Central Government under the DPDP Act, and we use contractual safeguards to require a comparable standard of protection. Prescription data is processed within India unless you instruct otherwise.
6.How long we keep data
We retain personal data only for as long as needed for the purpose it was collected, or as the law requires:
- Enquiries: up to 24 months after the last interaction.
- Order and prescription records: up to 3 years from the order date to support remakes, warranty claims and disputes, unless you ask us to erase them earlier.
- Invoices and tax records: for the period required under GST and income-tax law (generally 6 to 8 years).
- B2B account data: for the life of the account and 24 months afterwards.
- Analytics data: typically up to 14 months.
When retention periods end, data is erased or irreversibly anonymised.
7.How we protect your data
We apply reasonable security safeguards appropriate to the sensitivity of the data, including encryption in transit (HTTPS/TLS), access controls based on role, secure credential storage, separation of prescription data from marketing systems, staff confidentiality obligations and periodic reviews of our processors.
No system is completely secure. In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act. Please keep your account credentials confidential and tell us promptly at privacy@hanscolens.com if you suspect unauthorised access.
8.Your rights
As a Data Principal under the DPDP Act, you have the right to:
- Access a summary of the personal data we process about you and the identities of those we have shared it with.
- Correction and completion of inaccurate or incomplete data, and updating it.
- Erasure of data that is no longer necessary for its purpose, unless we must retain it by law.
- Withdraw consent at any time. Withdrawal does not affect processing already carried out, but we may be unable to continue some services.
- Grievance redressal through the process in the next section.
- Nominate another individual to exercise your rights in the event of your death or incapacity.
To exercise any right, email privacy@hanscolens.com from the address linked to your account or order. We may ask you to verify your identity. We aim to respond within 30 days. As Data Principal you also have duties under the Act, including not providing false information or impersonating another person.
9.Grievance Officer
In accordance with the DPDP Act and the Information Technology Act, 2000, you may contact our Grievance Officer with any complaint about how your personal data is handled:
Grievance Officer
Hansco Lens Pvt. Ltd.
Unit 12, Optics Park, Sector 18, Gurugram, Haryana 122015, India
Email: privacy@hanscolens.com
Phone: +91 98765 43210 (Mon – Sat, 9:30 AM – 6:30 PM IST)
We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operational and the applicable procedure is notified.
11.Children
Our website and trade services are intended for adults and registered businesses. We do not knowingly collect personal data of children (under 18) except prescription details of a minor wearer supplied by a parent, guardian or the optician or clinic serving them. We process such data only with verifiable parental or guardian consent, do not track or monitor children’s behaviour, and do not target advertising at them. If you believe a child has given us data directly, contact us and we will delete it.
12.Third-party links
Our site may link to third-party websites such as courier tracking pages or social networks. We are not responsible for their privacy practices and encourage you to read their policies.
13.Changes to this policy
We may update this policy to reflect changes in our practices or the law. The “Last updated” date at the top shows when it was last revised. For material changes we will give reasonable notice, by email or a prominent notice on the site, and seek fresh consent where required.