Privacy policy

Last updated: August 4, 2026

1. ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how Moretti International Ltd., trading as Elliot Vaughn (“Elliot Vaughn,” “we,” “us,” or “our”), collects, uses, stores, discloses, and protects personal information when you:

• visit or use elliotvaughn.com;
• create or use an account;
• purchase or return a product;
• submit prescription or optical information;
• communicate with our customer-support team;
• call or receive a call from our telephone support service;
• interact with our AI-powered telephone agent;
• subscribe to marketing communications;
• engage with our advertisements or social-media pages; or
• otherwise use our products, website, or related services.

For the purposes of applicable data-protection law, Moretti International Ltd. is generally the controller or business responsible for deciding how and why your personal information is processed.

Our contact details are:

Moretti International Ltd.
Trading as Elliot Vaughn
BRN: 76829260

50 Stanley Street
World Trust Tower, Suite C, Level 7
Central, Hong Kong

Email: support@elliotvaughn.com
Telephone: + 1 424 4453259

This Privacy Policy should be read together with our Terms of Service, Refund Policy, Shipping Policy, and any collection notice presented when you submit sensitive information.

This Privacy Policy is a notice of our practices. It is not intended to obtain consent where applicable law requires separate, express, or affirmative consent. Where such consent is required, we will request it separately.

2. PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with us.

Contact and identification information

We may collect:

• your name;
• email address;
• telephone number;
• billing address;
• shipping address;
• country or region;
• account identifier;
• customer number; and
• other information used to identify or contact you.

Account information

Where customer accounts are available, we may collect:

• account login details;
• encrypted or hashed passwords;
• account preferences;
• saved addresses;
• order history;
• wish-list information; and
• account-security information.

Order and transaction information

We may collect:

• products viewed or ordered;
• selected variants;
• quantities;
• order numbers;
• order dates;
• discounts and promotional codes;
• purchase values;
• payment status;
• billing and delivery information;
• tracking details;
• return and refund information;
• customer-support history; and
• fraud-prevention or transaction-verification information.

Payment information

Payments are processed through third-party payment providers, which may include Shopify Payments, credit and debit card networks, PayPal, Apple Pay, Google Pay, or other providers presented at checkout.

We generally do not directly receive or store complete payment-card numbers, card security codes, or complete payment credentials.

We may receive limited payment-related information, such as:

• payment status;
• payment method type;
• card brand;
• the final digits of a payment card;
• transaction identifiers;
• billing address;
• fraud-screening results; and
• refund or chargeback information.

Shopping and website activity

We may collect:

• products and pages viewed;
• searches;
• items added to a cart or wish list;
• checkout activity;
• referral source;
• interactions with website features;
• advertising interactions;
• email opens and clicks;
• device identifiers;
• browser type;
• operating system;
• IP address;
• approximate location derived from an IP address;
• session identifiers; and
• cookie and tracking information.

Communications and customer-support information

We collect information contained in communications with us, including:

• emails;
• contact-form submissions;
• chat messages;
• social-media messages;
• return requests;
• complaints;
• reviews;
• photographs;
• videos;
• support tickets; and
• telephone calls.

Please do not send unnecessary sensitive or confidential information through ordinary email, social-media messages, or other unencrypted communication channels.

Reviews and user-generated content

If you submit a product review, photograph, video, comment, or other user-generated content, we may collect:

• your name or chosen display name;
• review content;
• rating;
• images or videos;
• product and order information;
• submission date; and
• information used to verify that the review relates to a genuine customer experience.

Content submitted for publication may become publicly accessible.

Marketing information

We may collect:

• email and SMS subscription status;
• marketing preferences;
• campaign interactions;
• referral information;
• promotional-code use;
• customer-segment information; and
• information used to measure or personalize advertising.

Inferences

We may create limited inferences from information such as purchase history, website activity, product interests, customer-support interactions, and advertising activity.

We do not use prescription or health information to create advertising profiles or infer medical conditions.

3. PRESCRIPTION AND OPTICAL INFORMATION

Where we offer prescription eyewear, prescription lenses, optical customization, or related services, we may collect information that is considered sensitive personal information, health information, medical information, or consumer health data under applicable law.

Prescription information we may collect

This may include:

• an uploaded image, scan, PDF, or photograph of an optical prescription;
• sphere, cylinder, axis, prism, and add-power values;
• pupillary distance;
• fitting height or other optical measurements;
• lens type and lens options;
• prescription date and expiration date;
• prescriber name and contact information;
• confirmation that a prescription is valid;
• information necessary to verify or clarify the prescription;
• the name and age category of the person for whom the eyewear is intended; and
• communications relating to prescription accuracy, lens manufacture, fitting, remake, or quality concerns.

We do not request general medical records, unrelated diagnoses, insurance records, genetic information, or health history unless specifically required by law or genuinely necessary to fulfil a request.

Why we process prescription information

We use prescription and optical information only as reasonably necessary to:

• confirm that a prescription order can be manufactured;
• interpret and validate submitted lens specifications;
• manufacture and fit prescription lenses;
• perform optical and quality-control checks;
• communicate about unclear, incomplete, expired, or inconsistent information;
• fulfil and deliver the order;
• process a remake, correction, complaint, warranty claim, or return;
• maintain legally required product, safety, and transaction records;
• prevent fraud or unauthorized prescription use; and
• comply with applicable legal obligations.

We do not use prescription or optical information for:

• behavioral advertising;
• targeted advertising;
• unrelated profiling;
• determining insurance eligibility;
• employment decisions;
• credit decisions;
• data-broker activities; or
• training general-purpose artificial-intelligence models.

Consent

Where applicable law requires express consent to collect, process, disclose, or transfer prescription or health information, we will request that consent separately before the information is submitted or processed.

You may withdraw consent where the processing is based on consent. Withdrawal will not affect processing that lawfully occurred before withdrawal.

If processing the information remains necessary to manufacture or fulfil a requested prescription order, withdrawing consent may mean that we cannot complete the order.

Secure submission of prescription information

Prescription documents should be submitted only through the secure upload, checkout, customer-account, or prescription-submission method designated by us.

Customers should not submit prescriptions through:

• ordinary unencrypted email;
• SMS;
• social-media messages;
• public comments;
• unencrypted file-sharing links; or
• a recorded telephone call.

Where prescription information is accidentally submitted through an inappropriate channel, we may:

• move it to an approved secure system;
• request that it be resubmitted securely;
• restrict access to it;
• redact it from customer-support records; or
• delete the original communication where reasonably possible and legally permitted.

Safe transmission to suppliers and factories

Prescription and optical information may be securely transmitted to selected:

• optical laboratories;
• lens manufacturers;
• frame manufacturers;
• factories;
• quality-control providers;
• fulfilment partners; and
• technical service providers.

These providers may be located outside your country, including in Hong Kong, China, the United States, Europe, or other jurisdictions in which our manufacturing or fulfilment providers operate.

We limit prescription information disclosed to a supplier or factory to what is reasonably necessary to manufacture, verify, fulfil, or correct the relevant order.

Where reasonably practicable:

• the supplier receives an order or production identifier rather than unnecessary customer-account information;
• prescription documents and parameters are transmitted through encrypted systems or secure access-controlled portals;
• access is limited to authorized personnel with a genuine manufacturing, fulfilment, quality, or support need;
• prescription information is kept separate from advertising and marketing systems;
• factories and suppliers are subject to contractual confidentiality, security, restricted-use, retention, deletion, and incident-notification obligations;
• prescription information is not used by the supplier for its own marketing;
• prescription information is not sold or licensed;
• prescription information is not used to train general-purpose AI systems; and
• suppliers are required to delete or return prescription information when it is no longer reasonably required for the authorized purpose.

A factory may need to associate prescription parameters with a customer order, lens blank, frame, production record, quality-control record, or shipment to manufacture the correct product. This processing is limited to order fulfilment and related legal or quality-control purposes.

Prescription-data retention

We retain prescription information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Unless a longer period is required by law or reasonably necessary because of a complaint, remake, safety matter, warranty claim, legal dispute, or customer request:

• uploaded prescription documents are normally deleted or de-identified within 12 months after the relevant order is completed; and
• essential prescription parameters associated with the transaction may be retained for a longer period where needed for order records, quality verification, safety, warranty, dispute resolution, or legal compliance.

We require suppliers and factories to retain prescription information only for the manufacturing, quality-control, fulfilment, or legally required period applicable to them.

A customer may request deletion of prescription information, subject to legal, safety, fraud-prevention, warranty, accounting, and dispute-related exceptions.

4. CONSUMER HEALTH DATA PRIVACY NOTICE

This section applies where prescription or optical information is treated as consumer health data under applicable law, including certain United States state laws.

Categories of consumer health data

The consumer health data we may collect includes:

• optical prescriptions;
• prescription lens values;
• pupillary distance;
• fitting measurements;
• prescription validity information;
• lens and vision-correction requirements;
• information concerning a prescription eyewear order;
• communications relating to visual correction or prescription accuracy; and
• inferences necessarily derived from these details to manufacture the requested lenses.

Sources of consumer health data

We may obtain consumer health data:

• directly from you;
• from a parent or guardian ordering for a minor;
• from a person authorized to order on your behalf;
• from a prescriber or optical professional where you direct or authorize the disclosure;
• from an optical laboratory or manufacturing partner;
• from order and customer-support records; or
• from measurements or information you submit through an approved service.

Purposes

We collect and use consumer health data to:

• provide the prescription product requested;
• verify and interpret prescription information;
• manufacture, fit, inspect, and deliver prescription lenses;
• provide customer service;
• process remakes, complaints, returns, and warranty matters;
• maintain product quality and safety;
• prevent fraud; and
• meet legal obligations.

Parties with whom consumer health data may be shared

We may disclose consumer health data to:

• selected optical laboratories;
• lens and frame manufacturers;
• factories;
• quality-control providers;
• secure cloud, storage, and technology providers;
• fulfilment and shipping providers where necessary;
• professional advisers;
• regulators, courts, law enforcement, or authorities where legally required; and
• a successor entity in a corporate transaction, subject to applicable law and appropriate safeguards.

We do not sell consumer health data.

We do not share consumer health data for cross-context behavioral advertising or targeted advertising.

We do not permit suppliers, factories, or advertising partners to use consumer health data for their own marketing.

Consumer health data rights

Depending on where you live, you may have the right to:

• confirm whether we collect, use, or disclose your consumer health data;
• access your consumer health data;
• obtain a list of categories of recipients;
• correct inaccurate data;
• withdraw consent;
• request deletion from our systems;
• request deletion from processors and other recipients;
• appeal a refusal of a request; and
• obtain a copy of certain data.

Requests may be submitted to support@elliotvaughn.com.

We may need to verify your identity before completing a request. We will not discriminate against you for exercising a privacy right.

5. AI PHONE AGENT AND RECORDED CALLS

We use CallFlows, an AI-powered telephone service provided by Call Flows Ltd., to assist with certain incoming and outgoing customer telephone calls.

A caller may interact with an artificial-intelligence system rather than a human representative.

Call notice and consent

Where a call is recorded, transcribed, or analyzed, we will provide a notice at or near the beginning of the call stating that:

• the caller is interacting with an AI-powered phone agent;
• the call may be recorded and transcribed;
• the purposes include customer service, quality assurance, security, and dispute resolution; and
• the caller may use an alternative support channel if they do not wish to be recorded.

Where applicable law requires affirmative or all-party consent, recording should not begin until the required notice and consent have been provided.

Where the law permits consent through continued participation after clear notice, continuing with the call may constitute consent to the recording and processing described in the notice.

If you do not wish to participate in a recorded call, you may end the call and contact us at support@elliotvaughn.com.

Where reasonably available, you may also request transfer to an alternative support method. We cannot guarantee that a live, unrecorded telephone representative will always be available.

Information processed during calls

CallFlows may collect, generate, access, or process:

• the caller’s telephone number;
• a voice recording;
• a written transcript;
• caller name and contact information;
• order or customer identifiers;
• call date, time, and duration;
• call-routing and transfer information;
• call outcome and end reason;
• AI-generated summaries;
• sentiment or interaction-analysis signals;
• products discussed or presented;
• shipping or tracking information;
• order status;
• customer-support requests;
• products purchased or considered;
• sales-attribution information; and
• information voluntarily stated during the call.

Where necessary to respond to a request, the AI phone agent may access relevant information from our Shopify store, such as:

• customer name;
• contact information;
• shipping or billing address;
• order history;
• ordered products;
• order value;
• fulfilment status;
• shipment status;
• store policies; and
• product information.

Access is intended to be limited to information reasonably needed to answer the caller’s request or complete an authorized action.

Purposes of call recording and AI processing

We may use recorded calls, transcripts, summaries, and call metadata to:

• respond to customer questions;
• identify an order;
• provide product information;
• provide shipping and delivery information;
• assist with returns or complaints;
• document requests and commitments;
• detect fraud, abuse, or security incidents;
• investigate disputes;
• monitor service quality;
• train and supervise our customer-support processes;
• improve the AI phone agent’s performance for Elliot Vaughn;
• identify recurring customer-service issues;
• generate operational analytics; and
• comply with legal obligations.

We do not use call recordings or transcripts to make decisions concerning credit, employment, insurance, medical eligibility, or other similarly significant matters.

CallFlows’ role

When CallFlows processes customer call information and connected Shopify information on our instructions, Call Flows Ltd. generally acts as our data processor or service provider.

We remain responsible for determining the purposes for which customer call data is processed and for providing legally required notices and obtaining legally required consent.

CallFlows may use authorized subprocessors to provide:

• cloud hosting;
• speech-to-text transcription;
• natural-language understanding;
• AI response generation;
• sentiment analysis;
• telecommunications services;
• email notifications;
• security;
• analytics; and
• shipment or carrier lookups.

CallFlows may process data in the European Union, United States, Canada, and other countries used by its authorized subprocessors.

We instruct CallFlows to process identifiable customer call data only for the provision, security, support, maintenance, and authorized improvement of our service.

We do not authorize CallFlows or its AI-model providers to use identifiable Elliot Vaughn customer call data to train or improve their general-purpose artificial-intelligence models.

CallFlows may use aggregated or de-identified information that no longer reasonably identifies a caller to maintain or improve its services, subject to applicable law and our agreement with it.

Call recording security

Call recordings and transcripts are maintained within access-controlled systems.

CallFlows states that its service uses security measures including encryption in transit and at rest, role-based access controls, administrative multi-factor authentication, logging, and cloud-security controls.

Only personnel or service providers with a legitimate customer-service, technical, security, legal, or quality-assurance need should be permitted to access identifiable recordings or transcripts.

Caller numbers included in automated CallFlows email notifications may be partially masked. Complete caller details may remain available through the secure CallFlows dashboard or authorized integration.

Sensitive information during calls

Do not provide the following during a recorded call:

• complete payment-card numbers;
• card security codes;
• online banking credentials;
• account passwords;
• government identification numbers;
• prescription documents;
• complete optical prescription values; or
• unrelated medical information.

Our AI phone agent should direct customers to an approved secure checkout, upload, account, or customer-support process for sensitive information.

If sensitive information is voluntarily disclosed during a recorded call, it may be captured in the recording or transcript. Where reasonably possible and legally permitted, we may restrict access, redact, or delete that portion of the record.

Call recording retention

We normally retain identifiable call recordings, transcripts, and AI-generated call summaries for up to 90 days after the call.

We may retain a record for longer where reasonably necessary to:

• resolve an active complaint or dispute;
• investigate fraud or abuse;
• protect legal rights;
• comply with a legal preservation obligation;
• address a product-safety issue; or
• establish or defend a legal claim.

Operational information extracted from a call and added to an order or customer-support record may be retained for the period applicable to that order or support record.

Aggregated or de-identified call analytics that no longer reasonably identify a person may be retained for longer.

6. HOW WE COLLECT PERSONAL INFORMATION

We collect personal information:

Directly from you

This includes information submitted when you:

• browse or purchase through the website;
• create an account;
• contact customer service;
• upload a prescription;
• make a telephone call;
• subscribe to marketing;
• enter a promotion;
• submit a review; or
• request a return, refund, or warranty remedy.

Automatically

We may automatically collect information through:

• cookies;
• pixels;
• tags;
• software development kits;
• local storage;
• analytics tools;
• advertising technologies;
• server logs;
• fraud-prevention systems; and
• similar technologies.

From service providers and third parties

We may receive information from:

• Shopify;
• payment providers;
• fraud-prevention providers;
• shipping carriers;
• fulfilment partners;
• optical laboratories;
• suppliers and factories;
• CallFlows;
• customer-support providers;
• analytics providers;
• advertising and social-media partners;
• review providers;
• referral partners; and
• publicly available sources.

7. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

Provide products and services

This includes:

• processing and accepting orders;
• processing payments;
• manufacturing prescription products;
• fulfilling and shipping orders;
• sending order notifications;
• providing tracking information;
• processing returns and refunds;
• administering accounts;
• responding to questions;
• providing customer support; and
• operating website features.

Communicate with you

We may send:

• order confirmations;
• dispatch notices;
• delivery updates;
• return and refund communications;
• customer-support responses;
• product-safety or recall notices;
• account and security notices; and
• other service-related communications.

Improve products and services

We may use information to:

• understand how customers use our website;
• evaluate product interest;
• improve website functionality;
• identify common support issues;
• improve fulfilment and shipping;
• assess product quality;
• develop new products;
• test customer-service processes; and
• improve our AI phone agent for Elliot Vaughn.

Marketing and advertising

Subject to applicable law and your choices, we may use non-health personal information to:

• send promotional email or SMS messages;
• personalize website content;
• measure advertising performance;
• create advertising audiences;
• display advertisements;
• conduct referral programs; and
• understand campaign effectiveness.

Prescription information, consumer health data, complete payment information, call recordings, and call transcripts are not used for targeted advertising.

Security, fraud prevention, and enforcement

We may use information to:

• authenticate transactions;
• prevent payment fraud;
• protect customer accounts;
• detect malicious activity;
• investigate misuse;
• protect our website and systems;
• enforce our Terms of Service; and
• establish, exercise, or defend legal claims.

Legal compliance

We may use and preserve information to comply with:

• tax and accounting requirements;
• product-safety requirements;
• consumer-protection obligations;
• privacy and data-protection requirements;
• court orders;
• subpoenas;
• regulatory requests;
• sanctions and trade restrictions; and
• other applicable laws.

8. LEGAL BASES FOR PROCESSING

Where applicable law requires us to identify a legal basis, we may rely on:

Performance of a contract

We process information where necessary to:

• accept and fulfil an order;
• manufacture a requested product;
• provide customer support;
• process a return or refund;
• operate an account; or
• provide another requested service.

Consent

We may rely on consent for:

• processing sensitive prescription or health information where required;
• certain cookies and tracking technologies;
• email or SMS marketing;
• recorded calls where consent is required;
• optional disclosures; and
• other processing for which applicable law requires consent.

Legitimate interests

We may process information where necessary for legitimate interests such as:

• operating and improving our business;
• providing customer service;
• maintaining security;
• preventing fraud;
• improving our website;
• measuring service quality;
• maintaining appropriate business records; and
• establishing or defending legal claims.

We consider the impact on individual privacy before relying on legitimate interests.

Legal obligations

We may process information where required to comply with laws, regulations, legal proceedings, tax obligations, product-safety requirements, or lawful authority requests.

Vital or public interests

In limited circumstances, we may process information to protect a person’s safety or comply with a matter of substantial public interest where applicable law permits.

9. COOKIES AND TRACKING TECHNOLOGIES

We and our providers may use cookies and similar technologies to:

• operate the website;
• remember preferences;
• maintain a shopping cart;
• secure accounts and checkout;
• prevent fraud;
• understand website performance;
• conduct analytics;
• personalize content;
• measure advertising;
• provide relevant advertisements; and
• attribute purchases to marketing campaigns.

Cookies may be categorized as:

• strictly necessary;
• functional;
• analytics or performance; and
• advertising or targeting cookies.

Where required, non-essential cookies will be used only after appropriate consent.

You may manage cookies through our cookie banner or privacy-preference tools, where available, and through your browser settings.

Blocking cookies may affect website functionality.

10. TARGETED ADVERTISING, SALE, AND SHARING

We do not sell personal information in exchange for money.

However, our use of advertising pixels, cookies, audience tools, and similar technologies may be considered a “sale,” “sharing,” or use for targeted advertising under certain United States state privacy laws.

The categories of information that may be disclosed to advertising or analytics partners include:

• identifiers such as cookie or device identifiers;
• internet and electronic-network activity;
• approximate location derived from IP address;
• commercial information;
• website interactions;
• advertising interactions; and
• inferences concerning product interests.

We do not sell or share for targeted advertising:

• prescription information;
• consumer health data;
• complete payment information;
• account passwords;
• call recordings;
• call transcripts;
• government identifiers; or
• information submitted solely for a customer-support complaint.

Where required by law, you may opt out through our cookie or privacy-preference mechanism or through a “Your Privacy Choices” or similar link made available on the website.

Where legally required and technically supported, we recognize valid Global Privacy Control signals as an opt-out request.

11. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to:

Shopify and ecommerce providers

Shopify provides the ecommerce platform used to operate our store, checkout, accounts, and related functionality.

Payment providers

Payment processors, banks, card networks, digital-wallet providers, and fraud-prevention providers process transaction and payment information.

Suppliers, optical laboratories, and factories

Selected manufacturers and suppliers may receive information necessary to manufacture, inspect, correct, package, or fulfil an order.

Prescription information is subject to the restrictions described in this Privacy Policy.

Fulfilment, logistics, and shipping providers

We disclose relevant recipient, address, contact, order, customs, and delivery information to fulfilment providers and shipping carriers.

CallFlows and customer-support providers

CallFlows and other support providers may process customer, order, communication, call, recording, transcript, and support information on our behalf.

Technology, hosting, and security providers

Providers may assist with:

• website hosting;
• cloud storage;
• data security;
• email delivery;
• account authentication;
• analytics;
• database management;
• customer-support systems; and
• business continuity.

Marketing and advertising partners

Subject to applicable law and your privacy choices, we may disclose limited website and advertising information to advertising, social-media, analytics, and campaign-measurement partners.

Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary.

Authorities and legal recipients

We may disclose information where we reasonably believe it is necessary to:

• comply with law;
• respond to lawful legal process;
• protect customers or the public;
• investigate fraud;
• enforce agreements;
• protect our rights; or
• address a security or safety issue.

Corporate transactions

Information may be disclosed or transferred in connection with a merger, acquisition, financing, restructuring, insolvency, sale of assets, or similar transaction.

Any successor will remain subject to applicable privacy obligations concerning personal information received through the transaction.

With your direction or consent

We may disclose information where you direct us to do so or provide valid consent.

12. INTERNATIONAL DATA TRANSFERS

We operate from Hong Kong and use international service providers, suppliers, manufacturers, factories, fulfilment partners, and technology systems.

Your personal information may therefore be processed in countries other than your country of residence, including:

• Hong Kong;
• China;
• the United States;
• Canada;
• Australia;
• Switzerland;
• countries within the European Economic Area; and
• other locations used by our service providers.

Privacy and government-access laws may differ between countries.

Where required by applicable law, we use appropriate safeguards for international transfers, which may include:

• data-processing agreements;
• contractual confidentiality obligations;
• standard contractual clauses;
• approved transfer addenda;
• adequacy decisions;
• recognized certification frameworks;
• transfer-risk assessments;
• access restrictions;
• encryption;
• data minimization; and
• another legally recognized transfer mechanism.

We require processors handling personal information on our behalf to process it only according to authorized instructions and applicable contractual obligations.

13. DATA SECURITY

We use reasonable administrative, technical, contractual, and organizational measures designed to protect personal information against:

• unauthorized access;
• unauthorized disclosure;
• unlawful use;
• alteration;
• accidental loss;
• destruction; and
• misuse.

Measures may include:

• encryption in transit;
• encryption at rest where appropriate;
• access-controlled systems;
• role-based access;
• multi-factor authentication;
• password and credential controls;
• logging and monitoring;
• secure cloud infrastructure;
• vendor-security review;
• confidentiality obligations;
• staff access restrictions;
• data-minimization procedures;
• backup and recovery controls; and
• incident-response procedures.

Prescription information is subject to enhanced access, disclosure, purpose, and retention restrictions.

No internet transmission, storage system, or security process is completely secure. We cannot guarantee absolute security.

Customers are responsible for protecting account credentials and should contact us promptly if they suspect unauthorized account access.

14. PERSONAL DATA INCIDENTS

We maintain processes for identifying, investigating, containing, documenting, and responding to security incidents.

Where an incident involving personal information triggers a legal notification obligation, we will notify affected individuals, regulators, authorities, or other required parties in accordance with applicable law.

Our processors and suppliers are required, where appropriate, to notify us of relevant security incidents and cooperate with our response.

15. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate legal, accounting, safety, fraud-prevention, dispute, and operational requirements.

Retention periods depend on:

• the type and sensitivity of information;
• the reason it was collected;
• whether an account or order remains active;
• product-safety and warranty requirements;
• tax and accounting obligations;
• applicable limitation periods;
• fraud and security risks;
• legal preservation obligations; and
• whether a dispute is active or reasonably anticipated.

Generally:

• order, transaction, tax, and accounting records are retained for legally required business-record periods;
• customer-support records are retained for the period reasonably necessary to resolve the request and protect legal rights;
• call recordings and transcripts are normally retained for up to 90 days;
• uploaded prescription documents are normally deleted or de-identified within 12 months after order completion;
• marketing information is retained until consent is withdrawn, the information is no longer useful, or continued retention is no longer lawful;
• inactive account information may be deleted or de-identified after a reasonable period; and
• security logs may be retained for fraud prevention, investigation, and system protection.

Information may be retained for longer where required by law or reasonably necessary for an active complaint, chargeback, warranty matter, safety matter, investigation, or legal claim.

Aggregated or de-identified information that no longer reasonably identifies an individual may be retained for longer.

16. YOUR PRIVACY RIGHTS

Depending on where you live and the law that applies, you may have the right to:

• know whether we process your personal information;
• request access to personal information;
• obtain information about categories, sources, purposes, and recipients;
• receive a copy of certain information;
• correct inaccurate information;
• request deletion;
• restrict certain processing;
• object to certain processing;
• withdraw consent;
• opt out of targeted advertising;
• opt out of sale or sharing;
• limit use of sensitive personal information;
• obtain data portability;
• appeal a refused request;
• complain to a privacy regulator; and
• avoid discriminatory treatment for exercising privacy rights.

Rights are not absolute. We may retain or continue processing information where permitted or required for:

• completing a requested transaction;
• security;
• fraud prevention;
• legal compliance;
• accounting;
• product safety;
• warranty matters;
• dispute resolution;
• freedom of expression;
• legal claims; or
• another lawful exception.

Submitting a request

Privacy requests may be submitted to:

Email: support@elliotvaughn.com
Telephone: + 1 424 4453259

Please state that your request concerns privacy or personal information.

We may need to verify your identity before completing a request. Verification may require confirming information already associated with your account or order.

We will use verification information only for processing the request.

An authorized agent may submit a request where permitted by law. We may require proof of authorization and direct verification from the individual.

We will respond within the period required by applicable law.

17. UNITED STATES PRIVACY NOTICE

This section applies to residents of United States states with applicable comprehensive privacy or consumer health-data laws.

Categories collected

During the preceding 12 months, we may have collected:

• identifiers;
• customer-record information;
• commercial information;
• internet or electronic-network activity;
• approximate geolocation;
• audio and electronic information;
• customer-support communications;
• payment and transaction information;
• sensitive personal information;
• prescription and consumer health data; and
• inferences.

Business purposes

We use these categories for:

• order processing;
• fulfilment;
• payments;
• prescription manufacturing;
• customer support;
• security;
• fraud prevention;
• analytics;
• marketing;
• legal compliance; and
• the other purposes described in this Privacy Policy.

California residents

Where the California Consumer Privacy Act applies, California residents may have rights to:

• know;
• access;
• delete;
• correct;
• opt out of sale or sharing;
• limit certain uses of sensitive personal information; and
• receive equal treatment.

We do not use prescription or health information for purposes outside those reasonably necessary to provide the requested product, maintain safety, comply with law, prevent fraud, or protect legal rights.

Other state privacy rights

Residents of other states may have similar rights, including rights concerning targeted advertising, profiling, sensitive information, consumer health data, appeals, and authorized agents.

A refusal of a request may be appealed by replying to our response and stating that you wish to appeal the privacy decision.

18. CANADIAN PRIVACY RIGHTS

Where Canadian privacy law applies, we handle personal information in accordance with applicable federal and provincial privacy requirements.

We seek meaningful consent where required and limit collection to information reasonably necessary for identified purposes.

Canadian customers may have rights to:

• request access;
• request correction;
• withdraw consent, subject to legal or contractual restrictions;
• ask questions about cross-border processing;
• challenge compliance; and
• complain to the Office of the Privacy Commissioner of Canada or an applicable provincial regulator.

Telephone calls will not be recorded without providing notice of the recording and its purposes. Where required, we will obtain consent and provide a reasonable alternative for callers who do not consent.

Personal information may be processed outside Canada and may be accessible to courts, law-enforcement agencies, and authorities under the laws of the country in which it is processed.

19. AUSTRALIAN PRIVACY RIGHTS

Where the Australian Privacy Act and Australian Privacy Principles apply, Australian customers may request access to or correction of personal information we hold.

Prescription and health information may constitute sensitive information and will be collected with consent where required and only where reasonably necessary for our functions or activities.

Australian customers may submit a privacy complaint to support@elliotvaughn.com.

We will investigate and respond within a reasonable period.

If you are not satisfied with our response, you may have the right to complain to the Office of the Australian Information Commissioner.

Nothing in this Privacy Policy limits a right that cannot lawfully be excluded under Australian law.

20. SWISS PRIVACY RIGHTS

Where the Swiss Federal Act on Data Protection applies, Swiss customers may have rights to:

• receive information about processing;
• access personal data;
• correct inaccurate personal data;
• request deletion or destruction;
• object to certain processing;
• withdraw consent;
• receive certain data in a portable format; and
• complain to the Federal Data Protection and Information Commissioner.

Prescription information and health information may constitute sensitive personal data.

Where express consent is legally required for sensitive personal data, we will request express consent.

International transfers from Switzerland will be subject to appropriate safeguards where the destination does not provide a recognized adequate level of protection.

21. EUROPEAN UNION AND EUROPEAN ECONOMIC AREA

Where the General Data Protection Regulation applies, Moretti International Ltd. is generally the controller of personal information processed through Elliot Vaughn.

EU and EEA residents may have rights to:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability;
• withdrawal of consent; and
• lodge a complaint with a competent supervisory authority.

Prescription and health information may be treated as special-category personal data.

Where required, we rely on explicit consent to process prescription information. We may also process information where another lawful exception applies.

Withdrawing consent will not affect earlier lawful processing, but it may prevent us from manufacturing or completing a prescription order.

Where information is transferred outside the EEA, we use an appropriate transfer mechanism where required, such as standard contractual clauses, an adequacy decision, or another recognized safeguard.

Where processing is based on legitimate interests, you may request information about the relevant balancing assessment.

You may object at any time to processing for direct marketing.

22. CHILDREN AND PRESCRIPTION ORDERS FOR MINORS

Our website and general services are not directed to children under 16, and children should not create accounts, subscribe to marketing, or submit personal information without appropriate parental or guardian involvement.

A parent or legal guardian may purchase prescription eyewear for a minor and submit the minor’s prescription information where legally authorized to do so.

In that situation, we may process:

• the minor’s name;
• age category;
• prescription;
• optical measurements; and
• other information necessary to manufacture the requested eyewear.

The parent or guardian represents that they have authority to provide the information and authorize the order.

We do not knowingly sell or share the personal information of individuals under 16 for targeted advertising.

If a parent or guardian believes that a child submitted information without appropriate authorization, they may contact support@elliotvaughn.com.

23. MARKETING COMMUNICATIONS

You may unsubscribe from promotional email by using the unsubscribe link in the message.

You may opt out of SMS marketing by replying STOP where supported.

Consent to marketing is not a condition of purchase.

Even after a marketing opt-out, we may send non-promotional messages concerning:

• an order;
• account security;
• customer support;
• product safety;
• recalls;
• legal notices; or
• another service-related matter.

24. THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to or integrations with third-party websites, applications, payment services, social-media services, virtual try-on tools, and other platforms.

Their privacy practices are governed by their own policies.

We are not responsible for the independent privacy practices of a third party, except to the extent applicable law makes us responsible.

25. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in:

• our products;
• our prescription services;
• our phone-support services;
• our providers;
• our technology;
• our legal obligations; or
• our data practices.

We will post the updated Privacy Policy and revise the “Last updated” date.

Where required by law, we will provide additional notice or obtain new consent before materially changing how previously collected sensitive information is used.

26. CONTACT AND COMPLAINTS

Questions, complaints, requests, and concerns regarding privacy or personal information may be directed to:

Moretti International Ltd.
Trading as Elliot Vaughn
BRN: 76829260

50 Stanley Street
World Trust Tower, Suite C, Level 7
Central, Hong Kong

Email: support@elliotvaughn.com
Telephone: + 1 424 4453259

Please include “Privacy Request” or “Privacy Complaint” in the email subject line where possible.

We will review privacy complaints and respond within the period required by applicable law.