Data Protection Information for Consumers – Alcon Consumer Universe programme


With this Privacy Notice, Alcon would like to tell you about the personal data (any information that is capable of identifying you) we collect and use as well as how we ensure we respect your rights. Please note that we will not knowingly collect, use or disclose personal data from a minor under the age of 16 without obtaining prior consent from a parent or legal guardian. As per our legal Terms and Conditions, only persons aged 16 or older can participate.

For which purposes do we need your personal data and how is this justified?

We need to collect, use and share your personal data for the following purposes:

- Manage your participation in our Consumer Engagement programme in order to provide you proactively with tailored information about our products, services and related offers (or to answer specific questions or requests you may have);

We will only process your personal data for these purposes if we have a proper justification foreseen in the law (“legal basis”). Therefore, we will only process your personal data if:

We have obtained your prior explicit consent;

The processing is necessary to perform our contractual obligations towards you or to take pre-contractual steps at your request;

The processing is necessary to comply with our legal or regulatory obligations;

We may also process your personal data for the following additional purposes:

  • - for pharmacovigilance purposes (tracking of side effects);
  • - to ensure the quality of our products and services;
  • - as well as any other purposes imposed by law.

How do we ensure we respect your rights and the law?

We make sure we follow these Privacy Principles when we collect and use your personal data:

  • - Security: We keep your personal data safe and secure from misuse or unauthorized alteration, loss, or access by using appropriate technical, physical, and organizational measures (such as multifactor password authentication, encryption, access restriction, etc.).

  • - Limited Purpose: We collect and use your personal data only as necessary for the purpose.

  • - Limited Data: We only collect the personal data that we need.

  • - Data Quality: We keep your personal data up to date and ensure that it is accurate.

  • - Limited Access: We only give access to your personal data on a strict need to know basis.

  • - Limited Retention: We only keep your personal data as long as necessary for the purpose.

  • - Lawful Use: We make sure we have a valid and lawful reason to collect and use your personal data

What personal data are we collecting, sharing and using on you?

When you sign up to the Alcon Consumer Universe programme via one of our campaigns, you will be asked to provide us with all or only some of the following information (as strictly necessary for the campaign):

  • - General identification information and contact information (first and last name, email address, postal address, phone number(s)));

  • - Contact lens data;

  • - Contact method preferences

Additional Information you may provide to us voluntarily:

  • - Birthdate

  • - Survey answers from surveys you choose to participate in

  • - The products you use and purchase and related eye health conditions such as eyesight, dryness of eyes etc.

  • - As per your choices when you visit a specific Alcon website, we may collect further information on you which we then combine with the data we already hold on you in the Alcon Consumer Universe programme (for example the content you browsed, day and time of visit, time spent). For more information, please refer to our website and cookie policies.

Information we collect or infer on you:

  • - Content and interest preferences

  • - Communication style and communication timing preferences

  • - Day and time you open a communication from us

Information from other third party sources we may combine with your personal data in the Alcon Consumer Universe programme:

  • - Statistics on average size of household and income in your area

Automated Decision Making and Profiling

We do not use any automated decision making. We will use automated processing to profile your interest and preferences in order to provide most relevant content and offers to you.

Who do we share your personal data with?

If required your personal data can be shared by Alcon with:

  • Other companies in the worldwide Alcon Group, wherever located;

  • Third party consultants, service providers, partner companies contracted by or on behalf of Alcon or its affiliates, wherever located;

  • Healthcare professional boards, authorities, government agencies, regulators wherever located.

Where is your personal data used or stored?

We transfer your personal data to other countries outside of the country of residence where you provided your personal data to Alcon, as follows:

We transfer your personal data:

  1. To Switzerland and Japan: Switzerland and Japan are considered as providing adequate data protection standards.

  2. Within the worldwide Alcon group of companies including to the United States: We rely on approved legal methods for such international transfers including Standard Contractual Clauses (an approved European Union legal method) or other country approved transfer contracts for non-European Union countries, for these transfers.

  3. To service providers located in countries where data protection standards may not have been determined to be adequate by the European Union (if you are located in a European Union country): these countries include the United States and India. In these cases, we will ensure that any recipients of your personal data are bound by contract to meet applicable data protection standards.

You can reach out to our Data Protection Officer for further information. Alternatively for persons based in the European Union, you can find further details on these protections on the European Commission’s webpage on international transfers (see for example: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/rules-international-data-transfers_en)

How long are we keeping your personal data?

We will only store your personal data as long as legally permitted and at maximum until you request the deletion of your account. We will only retain your personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.

We keep data collected through the use of cookies for a maximum of 12 months.

What are your rights?

Depending on your country of residence and on where your personal data is used, you may have a number of rights.

The availability of some of these rights depends on the lawful basis for processing your personal data and your rights may also be subject to certain other legal conditions and restrictions.

You may have the right:

  • to obtain access to your personal data together with information about how and on what basis that personal data is processed;

  • to rectify inaccurate personal data (including the right to have incomplete personal data completed);

  • to erase your personal data in limited circumstances where it is no longer necessary in relation to the purposes for which it was collected or processed or where you object to or withdraw your consent. This right may also apply where the processing was unlawful;

  • to restrict processing of your personal data where:

    • the accuracy of the personal data is contested;
    • the processing may be non-compliant but you do not wish at this stage to request erasure of the personal data;

  • to challenge processing where it is justified on the basis of a legitimate interest;

  • to obtain a portable copy of your personal data, or to have a copy transferred to a third party controller;

  • to obtain more information as to safeguards under which your personal data is transferred outside of the EEA (if relevant); or,

  • to withdraw your consent

  • to lodge a complaint with the data protection/supervisory authority noted below.

We may ask you for additional information to confirm your identity and for security purposes before processing your request.

How will you be informed of changes to this Privacy Notice?

Any future changes or additions to the processing of your personal data as described in this Privacy Notice will be notified to you in advance through an individual notice using the usual communication channels (e.g. by email) as well as through the website (via banners, pop-ups or other notification mechanisms).

Who can you contact regarding your rights?

Any future changes or additions to the processing of your personal data as described in this Privacy Notice will be notified to you in advance through an individual notice using the usual communication channels (e.g. by email) as well as through the website (via banners, pop-ups or other notification mechanisms).

Data Controller: The entity that determines why and how your personal data is processed is called a Data Controller.

The Data Controller for the processing of your personal data is:
Alcon Eye Care UK Limited and Affiliates,privacy@alcon.com

Data Protection Officer Alcon:privacy@alcon.com

Data Protection Authority/Supervisory Authority: The Data Protection Authority/Supervisory Authority for the processing of your personal data is the authority located in the country where you live or work. More information about how to contact these authorities can be found here: https://edpb.europa.eu/about-edpb/board/members_en.