Privacy Policy and GDPR

1. Who processes your data

Depending on the service requested, the relevant controller is the Axa Optic® entity providing that service. For medical and ophthalmology activities, processing is carried out by Axa Mob SRL. For optical services, commercial optometry and product sales, processing is carried out by Media Class SRL. Where a request involves integrated services, only the data necessary may be shared between the two entities for appointments, continuity of service, invoicing and compliance with legal obligations.

For privacy enquiries, contact office@axaoptic.ro.

2. What data we may process

• Identity and contact details: first and last names, phone number and email address.
• Appointment details: location, service requested, preferred date and time range.
• Information needed for optometry and optical services: prescription, measurements, lens and frame parameters and order history.
• Health data, only when needed for medical care or an ophthalmic examination.
• Contractual, tax and payment data, as needed for invoicing and statutory records.
• Technical website data, such as IP address, device type, security logs and cookie preferences, within the limits of the law.

3. Legal grounds for processing

Depending on the circumstances, data are processed under Article 6 of Regulation (EU) 2016/679: performance of a contract or steps prior to entering into one, compliance with a legal obligation, the controller’s legitimate interests, or consent where required.

We do not rely on consent where processing is necessary to provide a requested service or meet a legal obligation. Where processing relies on consent, you may withdraw it at any time for the future.

4. Health information

Medical information is a special category of personal data. It is processed only where a valid basis under Article 9 GDPR applies, including where necessary for medical diagnosis, healthcare or treatment, or the management of health services, by or under the responsibility of a professional bound by confidentiality.

Medical data are not used for behavioural advertising and are not disclosed to third parties for commercial purposes.

5. Who may receive the data

Access is restricted to people who need the data for their duties and, where applicable, contracted suppliers of IT, hosting, maintenance, accounting, payment, courier or professional services. Providers acting as processors are contractually required to respect confidentiality and GDPR requirements.

Data may be disclosed to authorities or other recipients where required by law or pursuant to a legally valid request.

6. How long data are retained

Data are retained only for as long as needed for the purpose for which they were collected and for periods required by medical, tax, accounting or archiving law, or to establish, exercise or defend legal claims. Appointment requests that do not lead to a service are retained only for the period needed to handle the request and any associated recordkeeping or security obligations.

7. Data subject rights

Subject to the GDPR conditions, you may request access, rectification of inaccurate data, erasure, restriction of processing and data portability, and object to certain processing. You may also withdraw consent where it forms the legal basis, and have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, in the cases provided by law.

Send requests to office@axaoptic.ro. To protect your data, we may ask for reasonable information to verify your identity. We respond within the time limits prescribed by Article 12 GDPR.

You may also lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), without prejudice to other administrative or judicial remedies.

8. Data security

We apply technical and organisational measures appropriate to the risks, including access controls, authentication, backups, security updates, logging and restricted data access. In the event of a personal data breach, the assessment, documentation and notification procedures under Articles 33–34 GDPR apply where the legal conditions are met.

9. Contact for data protection matters

For rights requests or data protection enquiries: office@axaoptic.ro. For appointments, you may also use the phone numbers listed for each location on our Contact page.

10. Relevant GDPR legislation

• Regulation (EU) 2016/679 (GDPR), including Article 5 principles, Article 6 legal bases, Article 9 special categories, Articles 12–14 transparency, Articles 15–22 rights, Article 32 security and Articles 33–34 breaches.
• Romanian Law No. 190/2018 on measures to implement Regulation (EU) 2016/679.
• Directive 2002/58/EC on privacy and electronic communications, together with the applicable national rules on cookies and electronic communications.

This policy describes processing through the website and Axa Optic® activities. Medical records, consent forms and notices relating to specific medical procedures may provide additional information appropriate to the circumstances.