Version 1.0 · Published 31 October 2026

Data processing agreement

Contractual terms for Eyewear Ltd to process personal information on a business customer's documented instructions.

1. Parties, scope and duration

The processor is Eyewear Ltd, company number 14918400, registered in England and Wales, with its registered office at Unit 03b, 1 Riverbank Business Park, Dye House Lane, London E3 2TB. The controller is the customer business identified in the written acceptance and processing scope. Each party's authorised contact is recorded with that acceptance.

This agreement applies to personal information Eyewear processes on that customer's behalf in connection with the agreed Lens Portal and laboratory services. It applies from the agreed effective date for the duration of that processing and continues for retained copies until they have been lawfully returned or deleted.

The UK GDPR, the Data Protection Act 2018 and other applicable data protection law govern the parties' responsibilities. The terms controller, processor, personal information, processing and personal data breach have their meanings under that law.

Where Eyewear independently controls business account, billing or legal records, the privacy notice describes that processing. A label in this agreement does not change the role that follows from the actual activity. Where the customer itself acts as processor, it must identify its controller and authority, and the parties must agree the corresponding chain and instructions in writing.

2. Purpose and documented instructions

Eyewear will process the information only on the customer's documented instructions, including instructions concerning international transfers, unless applicable UK law requires otherwise. If law requires other processing, Eyewear will inform the customer before processing unless that law prohibits disclosure on important public interest grounds.

The agreed services, processing schedule, lawful orders and subsequent written instructions together document the instructions. An instruction can be given through the portal or by another agreed written channel and must be capable of being retained.

Eyewear will promptly inform the customer if, in its opinion, an instruction infringes applicable data protection law. The parties will resolve the issue before carrying out the affected instruction. Eyewear will not use patient information for independent advertising, the development of its own AI training datasets or another purpose outside the instructions.

3. Customer rights and responsibilities

The customer determines the purposes, relevant patient information and lawful instructions. It will provide the required privacy information, identify the applicable Article 6 basis and Article 9 condition for health information, and meet its other controller obligations. This agreement does not require consent where another valid condition applies.

The customer may issue lawful instructions, request information about compliance, seek assistance, object to proposed subprocessors as set out below, and require return or deletion in accordance with this agreement. It will provide accurate authorised contact details and promptly communicate relevant restrictions or corrections. These obligations do not remove Eyewear's own statutory or contractual responsibilities.

4. Confidentiality

Eyewear will ensure that people authorised to process the customer's information are bound by an appropriate confidentiality commitment or an applicable statutory duty. Access will be limited to those who need it for their authorised work, and those people will receive instructions appropriate to their responsibilities.

5. Security

Eyewear will implement and maintain technical and organisational measures appropriate to the risk under Article 32, taking account of the health information involved, the nature of the service, the state of the art and implementation cost. The obligations in Schedule 2 form part of this agreement. Eyewear will assess the effectiveness of the measures and address identified deficiencies according to their risk.

This is a contractual obligation to maintain appropriate measures. It is not a statement that the portal has obtained a security certification or passed a completed independent audit.

6. Subprocessors and other recipients

Eyewear may appoint a subprocessor only with the customer's prior specific or general written authorisation and after establishing a written agreement imposing, in substance, the same data protection obligations for the relevant processing. Eyewear remains responsible to the customer for that subprocessor's performance of those obligations.

The parties must identify the authorised initial subprocessors and agreed processing scope in the acceptance record, by reference to a dated provider schedule or a separately agreed list. The public provider information identifies services in the current setup and verification gaps. It is not itself confirmation that every listed entity has completed contractual onboarding.

Where the customer gives general written authorisation, Eyewear will proactively notify its recorded contact of a proposed addition or replacement before that provider processes the customer's information and give a reasonable opportunity to object on data protection grounds. The notice will explain the provider, purpose, location information and proposed start date. A website change alone will not substitute for this notification.

Eyewear will consider an objection in good faith and seek an appropriate alternative. It will not begin the disputed new processing until the objection has been resolved or a lawful alternative arrangement has been agreed. If an urgent security or legal issue makes the planned arrangement unsuitable, Eyewear will explain the affected restriction and options promptly.

Where a customer instructs transmission to a laboratory acting as an independent controller, the parties will identify that role and the necessary arrangements for that disclosure. Naming a supplier does not automatically make it a subprocessor.

7. International transfers

Eyewear will make a restricted transfer only on documented instructions and with an applicable UK transfer mechanism. Where appropriate safeguards are relied on, the required contract and assessment must be in place. Permission to use a provider is not, by itself, explicit patient consent or a transfer safeguard.

Eyewear will give the customer relevant information about international processing and the available safeguards. A published provider agreement is not treated as evidence that it applies to an account unless that applicability has been established. The current confirmation items are set out in the provider information and must be resolved for the agreed processing.

8. Assistance with individuals' rights

Taking account of the nature of the processing, Eyewear will use appropriate technical and organisational measures, insofar as possible, to help the customer respond to requests under Chapter III of the UK GDPR. This includes locating information and helping with access, correction, deletion, restriction, portability and objections within the applicable responsibilities.

Eyewear will pass a relevant request received directly to the customer without undue delay and provide enough information for the customer to act. It will not make an unauthorised substantive response on the customer's behalf, unless required by law. It will respond to any separate part for which it is itself controller.

9. Assistance with security, breaches and assessments

Taking account of the nature of the processing and the information available to it, Eyewear will assist the customer with its obligations under Articles 32 to 36, including security, breach notification, communicating qualifying breaches to individuals, data protection impact assessments and prior consultation with the ICO where required.

Eyewear will notify the customer's recorded contact without undue delay after becoming aware of a personal data breach affecting the customer's information. It will provide available details of the nature of the breach, affected categories and approximate numbers where known, the contact for further information, likely consequences and measures taken or proposed. Missing details may be supplied in stages without undue further delay.

Eyewear will take appropriate containment and remedial steps, preserve relevant evidence and cooperate with the customer. Notification will not be delayed until every fact is known. This agreement does not make customer approval a condition for either party to meet its own mandatory reporting duties.

10. Return and deletion

At the customer's choice, after the end of the processing service Eyewear will return or securely delete the customer's personal information and delete existing copies, unless UK law requires retention. Eyewear will identify any legal retention requirement and restrict retained information to that purpose.

The parties will record the return format, scope and practical completion steps. Where information in a backup cannot be immediately erased, Eyewear will keep it beyond ordinary use, restrict access, apply the agreed or confirmed deletion cycle, and ensure a restoration does not silently reinstate information that should be deleted. Eyewear will explain the relevant timing and confirm completion of the required actions.

During the service, Eyewear will give effect to lawful documented retention and deletion instructions. It will explain any dependency or legal restriction promptly. A completed job status, archived screen or deleted scan does not by itself mean every related copy has been erased.

11. Information, audits and inspections

Eyewear will make available information needed to demonstrate compliance with Article 28 and allow and contribute to audits and inspections by the customer or its appointed auditor. The parties will arrange reasonable scope, timing and confidentiality safeguards to protect other customers and service security. Those arrangements will not frustrate an applicable legal right or prevent urgent or regulator required inspection.

Eyewear will maintain the records required of it, cooperate with the competent supervisory authority and inform the customer about material matters affecting its ability to meet this agreement. No additional fee for assistance or audit is created by this document. Any additional commercial arrangement must be separately agreed and must not prevent mandatory compliance.

12. Relationship with other terms

This agreement takes precedence over conflicting general portal terms for the processing it covers, while any applicable mandatory transfer clauses retain their required priority. It does not replace a separately negotiated agreement unless the parties expressly agree that replacement.

It adds no commercial liability cap or indemnity. Mandatory statutory liabilities and individuals' rights remain unaffected. Existing agreed governing law and dispute arrangements continue to apply, or otherwise the law and courts of England and Wales apply, subject to mandatory law.

Schedule 1. Processing details

Subject matter

Processing patient and related contact information to provide the customer's agreed lens ordering and laboratory services.

Duration

The duration of the agreed service, with continued protection while any information remains pending lawful return or deletion. The acceptance record identifies the effective date and any specific duration or retention instructions.

Nature and purpose

Receiving and recording instructions, storing documents and job information, validating and preparing the order, manufacturing or sourcing authorised products, communicating with nominated suppliers, recording progress, arranging fulfilment and providing relevant support. AI extraction and assistant functions are currently paused. Future AI processing is included only if separately identified in the agreed scope after the required provider permissions and safeguards are confirmed.

People whose information may be involved

The customer's patients, who may include children, authorised carers or representatives where relevant, and business or delivery contacts included in the customer's instructions.

Information

Patient or order references, names where supplied, prescriptions and related visual measurements, fitting and frame measurements, lens specifications, relevant notes, uploaded scans and files, job and supplier status, and necessary delivery or contact information. Health information is a special category of personal information. Unnecessary medical history and unrelated special category information are outside the intended scope.

Frequency

Ongoing receipt and processing as the customer places and manages jobs, subject to the agreed service scope.

Customer obligations and rights

Those in clause 3 and applicable law, together with any additional written instructions recorded with acceptance.

Subprocessors and transfers

The dated, verified schedule agreed at acceptance, with later changes managed under clauses 6 and 7. The public inventory alone does not fill an unresolved entry.

Schedule 2. Security obligations

Eyewear will maintain measures proportionate to the risks of the agreed processing. These include:

1. Named authorised access, appropriate role restrictions, prompt changes when staff responsibilities change and protection of authentication credentials.
2. Controls that restrict customer information and files to the appropriate customer and authorised laboratory staff, with suitable restrictions on administrative access.
3. Appropriate protection for data transfers, stored files, supplier credentials and infrastructure secrets, including encryption or equivalent risk appropriate safeguards where necessary.
4. Documented confidentiality expectations, instructions for staff handling health information, and steps to minimise unnecessary patient identifiers in notes, exports and communications.
5. Measures for system availability, recoverability and backup handling appropriate to the service, with recovery and deletion dependencies documented.
6. Relevant activity and incident records, an escalation process, and timely assessment and response to suspected unauthorised access, loss or disclosure.
7. A process to assess changes and regularly review the effectiveness of measures, including permissions, software maintenance, supplier arrangements and significant processing changes.
8. Controlled return, deletion and disposal, including restrictions on information retained solely to meet an identified legal obligation.

Evidence of the measures and identified limitations is available through the compliance information and audit process. The schedule states obligations, not a claim that an independent assurance review has already been completed.

Acceptance and contact

The customer may request onboarding or record its proposed acceptance through the account option where available or by emailing lab@itseyewear.com. Identify the customer's full legal name and address, the representative's name and role, the version accepted, the proposed processing scope and any existing agreement.

Eyewear will confirm the agreed scope, applicable provider schedule, effective date and completion of the prerequisites in writing. Both parties should retain that record with this document. A customer tick or email does not retrospectively cure a missing provider agreement or authorise processing that a provider's terms prohibit.