Politique de confidentialité

STAAR SURGICAL PRIVACY POLICY

Last Updated: October 22, 2026

To submit a data subject request, you may visit our portal at https://staar-privacy.relyance....

Your privacy is important to STAAR Surgical Company and our global subsidiaries and affiliates (collectively, “STAAR,” “we,” “us,” and “our”). Responsibility for Personal Information processing lies with STAAR US (25510 Commercentre Drive, Ste. 200, Lake Forest, California 92630 U.S.A.) and/or one of its subsidiaries listed in Annex I attached to the end of this Policy. The responsible entity depends on which of the STAAR entities listed in Annex I processes your Personal Information as a controller.

This Privacy Policy (“Policy”) sets forth how we collect, use, disclose, and otherwise process the Personal Information we collect as a data controller in the course of providing our products and services (the “Services”) which includes when you visit our websites, including www.staar.com, https://investors.staar.com/, www.evo.staar.com, www.discovericl.com, www.staaruniversity.com, our mobile applications, or any other digital properties that post this Policy (collectively, the “Sites”), or otherwise interact with us directly or indirectly such as in person, by telephone, at a trade show or training, or via your healthcare provider.

Please be sure to read this entire Policy before using our Services or submitting information to your healthcare provider for purposes of ordering STAAR products on your behalf.

INFORMATION COLLECTION

Personal Information Collection Overview

“Personal Information” or “personal data” refers to any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual. The Personal Information we collect about you depends on your relationship with us.

We may collect Personal Information directly from you, from third parties that provide your information with your authorization or otherwise on your behalf, or from other sources such as social media advertising partners or public databases. The Personal Information we collect includes the following:

• Contact details such as name, email address, phone number, and address
• Date of birth
• IP address, device ID, social media ID
• Professional information such as employer, job title, NPI, business contact information, about business partners and/or healthcare professionals or institutional healthcare providers (collectively, “Providers”)
• Commercial information such as products or services purchased, obtained, or considered
• Payment and billing information
• Health information such as information about your refractive disorder (e.g., nearsightedness), vision, and eye measurements
• Inferences drawn from any of the information listed above to create a profile about you reflecting your preferences, characteristics, behavior, and attitudes

While we may receive individual vision-related health information from Providers, such information is limited to the information needed to provide our Services and STAAR strongly discourages Providers from providing patient names.

By submitting or otherwise providing us with any Personal Information about another individual, you represent and warrant that you have provided all notices and obtained all permissions, consents, and authorizations necessary under applicable law to disclose that individual’s Personal Information to us and to permit our collection, use, and disclosure of such information as described in this Policy.

Additional Personal Information Collection Details

Website Tracking. We collect Personal Information automatically using various tracking technologies on our Sites. The information collected by these tracking technologies may include IP address and geolocation information as well as information about your device, web browser, browsing history, and browsing activity. See further information in the section below called “Cookies & Tracking Technologies.”

Interactive Services. If you choose to participate in our questionnaires and surveys and other interactive services, we will collect Personal Information that you disclose, to help us better understand how STAAR products are used and the results achieved by patients. The information you provide through interactive services may be combined (subject to all applicable laws) with the Personal Information provided elsewhere in or through the Services.

If you submit sensitive Personal Information (e.g., identifiable health-related information) through the Services to participate in a clinical trial, referral program or otherwise, we may use such sensitive Personal Information to assess whether you qualify for enrollment or participation, to contact you about potential participation, and to provide you with additional information.

Testimonials. We post customer testimonials on our websites which may contain Personal Information. We obtain the customer’s consent prior to posting the testimonial to post their name along with their testimonial. If you wish to request that your testimonial be removed, you may do so by emailing us at privacyoffice@staar.com.

Public Forums. Our Sites may offer publicly accessible blogs or community forums. You should be aware that any information you provide in these areas may be read, collected, and used by others who access them. To request removal of your Personal Information from our blog or community forum, contact us at privacyoffice@staar.com. In some cases, we may not be able to remove your Personal Information, in which case we will let you know if we are unable to do so and why.

Medical Education and Webinars. For those Providers who share their Personal Information as part of a medical education program, STAAR will use that information solely for such educational purposes unless you provide express consent to receive marketing information. STAAR will share your information with third parties for the purposes of attending webinars and/or making travel and accommodation arrangements.

COOKIES & TRACKING TECHNOLOGIES

We—along with our third party partners and service providers (such as analytics and advertising networks)—use first-party and third-party cookies and similar tracking technologies such as tracking pixels, web beacons, and software development kits (referred to collectively herein as “cookies” or “tracking technologies”) to collect information about your use of the Sites and how you interact with emails we send. The information collected by these tracking technologies may include IP address, geolocation data, browser and device characteristics, operating system, language preferences, referring URLs, information about how and when you use the Sites, and other technical details.

Types of Cookies

We may use some or all of the following types of cookies:

• Strictly Necessary cookies. These are cookies that are required for the operation of the Sites. They cannot be turned off in our systems.
• Functional cookies. These cookies provide enhanced functionality and personalization. If you do not allow these cookies, some features of the Sites may not function properly.
• Performance and analytics cookies. These cookies may be set by us or by third party partners to allow us to count visits and traffic sources so we can measure and improve the performance of our Sites. They help us to know which pages are the most and least popular and see how visitors arrive at and move around the Sites. They may be used by third parties to build a profile of your interests.
• Targeting and advertising cookies. These cookies may be set by us or by our third party advertising partners. They are used to track your online activity and deliver personalized advertisements. They may be used by third parties to build a profile of your interests and show you relevant ads on other sites. They may make advertising more relevant to you, limit how often you see an ad, and help measure the effectiveness of advertising campaigns, including across devices and over time.

We may track your activities over time and across third-party websites, apps or other online services to display advertisements on third-party websites. See further information in the “Information Disclosure” > “Disclosures to Analytics and Advertising Partners” section below.

Your Choices

You can adjust your cookie preferences in your browser settings. You can also adjust your cookie and tracking technology settings via the cookie preference center located on our Sites. You will be asked to customize your preference the first time you use a Site, and may update those preferences anytime thereafter by clicking the cookie widget at the bottom of the screen.

Some internet browsers have “Do Not Track” or “DNT” features which, when turned on, send a signal to the website that the individual visiting the website does not wish to be tracked. Our Sites do not honor DNT signals.

Examples of Tracking Technologies Used

We use Google Analytics, among other third parties, to collect information such as the number of visitors to a Site, the webpage that referred visitors to a Site, and the pages visitors view within a Site. You can opt-out of Google Analytics by downloading Google’s Opt-Out Browser Add-on.

We also use Google Ads, including remarketing and conversion tracking features, to advertise our products and services across the internet. When you visit our Sites, Google may place cookies or read existing cookies on your browser to collect information about your browsing activity. You may opt out of personalized advertising by Google by visiting Google’s Ads Settings at https://adssettings.google.com. On mobile devices, you may adjust your device’s advertising identifier settings to limit ad tracking.

We may also use pixels on our Sites to track visits to and interactions with the Sites and to analyze the content a user has viewed when visiting the Sites (e.g., EVO Visian ICL® videos on discovericl.com) in order to measure, optimize, and improve the content of the Sites, as well as for advertising purposes. For example, the Meta and TikTok Pixels record information about a Facebook or TikTok user’s session on our Sites, which it sends to the parent companies. For further information about these pixels please see: https://en-gb.facebook.com/bus... and https://ads.tiktok.com/help/ar....

Taboola and Criteo Pixels report what actions you have taken on our Sites. These pixel tags are used in combination with cookies to generate analytics on the actions of visitors on our Sites. The following data may be processed: events on our Sites, including initial and subsequent page visits, transaction data, the user’s gender (if provided) and information about the user’s browser read from the user agent, include operating system, browser type, browser version and associated IP address. More information on how these vendors manage user information, and what you can do to opt out/disable pixels, can be found on Taboola’s and Criteo’s respective privacy policies.

Social Media Plugins

If you are logged into a social media account while using the Sites, the social media plugins (e.g., Facebook, Instagram, YouTube) (collectively, “Social Media Plugins”) on our Sites allow that social media operator to receive information regarding your access and use of the Sites. The Social Media Plugins also allow the social media operator to share information about your activities on the Sites with other social media users. For example, Facebook Social Media Plugins allow Facebook to show your “likes” and “comments” on our pages to your Facebook friends. Facebook Social Media Plugins also allow you to see your friends’ Facebook activity on the Sites. STAAR does not control the functionality of the Social Media Plugins. For more information about Social Media Plugins, please refer to the privacy policies and other legal notices of the social media platform.

INFORMATION USE

You are not required to provide us with your Personal Information, however, if you choose not to provide us with your Personal Information, you may not be able to fully utilize our Services. We use your Personal Information as necessary to perform a contract (e.g., to respond to your enquiries, to register you for an account with us, to provide you and your Provider with our Services), to comply with a legal obligation (e.g., for fraud and security monitoring purposes and regulatory compliance), for reasons of public interest in the area of public health (e.g., for our medical device vigilance obligations) or for our legitimate business interests unless consent is a legal requirement (e.g., to operate and improve our Sites, develop and improve our products, to send you messages, and for other purposes described in this Policy or disclosed to you on our Sites or in connection with our Services). For example, depending on how you interact with us and the Services, we may use your Personal Information to do the following.

• Provide and Improve Products and Services. Provide, activate, operate, maintain, develop, enhance, improve, and manage our Services, monitor and analyze trends, usage, and activities, and perform services requested by you. This includes evaluating whether you qualify for enrollment or participation in a clinical trial, referral program or otherwise.
• Respond to You. Provide technical, product, and other support and respond to your requests, inquiries, comments, concerns, and provide customer support. We may record and process communications for training, quality assurance, and administrative purposes.
• Service Communications. Notify you about changes, updates and other announcements related to our Services and send you technical notices, invoices, updates, security alerts, support messages, and other transactional or relationship messages.
• Personalize Your Experience. Customize our product offerings and present you with tailored content, and otherwise personalize your experience while using our Services.
• Advertising and Marketing. Provide you with advertising, promotional messages, and other information about products and services offered by STAAR and our selected partners.
• Research and Development. Conduct research and development, compile analytics, conduct industry and market research, develop and improve products and services, and other purposes consistent with our legitimate business needs.

We may also use your Personal Information:

• to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities or engage in adverse event reporting or other regulatory reporting obligations;
• to protect our, your, or others’ rights, privacy, safety or property, including by making and defending legal claims;
• to prevent potentially prohibited or illegal activities;
• to audit our internal processes for compliance with legal and contractual requirements and internal policies;
• to complete a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy;
• to enforce the terms and conditions that govern the Sites;
• to prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft;
• as otherwise described to you at the point of collection; or
• otherwise with your consent.

We may also combine or aggregate Personal Information or anonymize it in such a way that you may not reasonably be re-identified and may use such anonymized information for any purpose permitted by law. In such case, we commit not to attempt to re-identify the information.

INFORMATION DISCLOSURE

We may share your Personal Information with third parties as described below.

• Disclosures to our Vendors and Service Providers. To assist us in providing our Services, we may share Personal Information with vendors or service providers so that they can perform the functions for which we engage them. These may include communications platforms supporting STAAR Apps; administrative cloud services (e.g., Office365); and service providers providing data analysis, system design and maintenance, customer service, cybersecurity, order fulfillment and billing, and marketing and promotions functions.
• Disclosures to Analytics and Advertising Partners. We do not “sell” Personal Information as that term is traditionally defined, but our use of certain third party analytics and advertising partners may constitute a “sale” or “sharing of Personal Information for cross-context behavioral advertising” or “targeted advertising” as those terms are defined under certain privacy laws. The Personal Information disclosed in this manner may include, for example, device identifiers, IP address, and browsing and purchase history. These partners use this information to provide us with analytics and digital advertising services and may also use it for their own purposes, subject to their own privacy policies and terms. See additional information about this information disclosure activity in the sections of this Policy titled “Cookies & Tracking Technologies” and “Privacy Rights Based on Residency.”
• Disclosures to Affiliates. We may share Personal Information with affiliated companies.
• Business Transfers. If we are involved in a merger, acquisition, or other corporate transaction, we may share your Personal Information during the diligence process with counterparties and others assisting with the transaction, as well as with a successor as part of such a transaction. We may also share your Personal Information pursuant to a financing arrangement or event of bankruptcy.
• Legal Requirements. We may also share Personal Information if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to cooperate with law enforcement or regulatory reporting, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users or the public, or (v) protect against legal liability.
• Consent. We may also share your Personal Information with other third parties pursuant to your consent to do so. These parties may include healthcare providers or clinic staff.

DATA SECURITY

We take reasonable security measures designed to protect your Personal Information to prevent loss, misuse, unauthorized access, disclosure, alteration, and destruction. Please be aware, however, that despite our efforts, no security measures are impenetrable.

Additionally, if you use a password or other access credentials on our Sites, you are responsible for keeping them confidential. If you believe your account credentials have been misused, please advise us immediately. Any access to the Services through your credentials will be treated as authorized by you.

DATA RETENTION

We retain Personal Information as long as it is necessary and relevant for our operations. In addition, we retain Personal Information to comply with applicable laws, support regulatory obligations, prevent fraud, resolve disputes, troubleshoot problems, assist with any investigation, enforce our contracts, and other actions. When we no longer need your Personal Information for our business or legal retention purposes, we de-identify or dispose of it. The criteria used to determine retention periods includes: (i) how long the Personal Information is needed to provide the Services and operate the business; (ii) the type of Personal Information collected; and (iii) whether we are subject to legal, contractual, or similar obligations to retain the Personal Information (e.g., mandatory data retention laws, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation or disputes). In lieu of Personal Information deletion, we reserve the right to de-identify and retain information for security analytics, research, development or other legitimate purposes where permitted by law.

INTERNATIONAL USERS

By using the Services, you acknowledge and agree that your Personal Information may be transferred, stored, and/or processed by us or our service providers in a country other than your country of residence, including but not limited to the United States, where laws regarding processing of Personal Information may be less stringent than the laws of your country of residence. Additional information about international data transfers out of the EU, UK, and Switzerland to the US is provided below.

CHILDREN’S PRIVACY

Our Services are not intended for children under 18 years of age. We do not knowingly collect any Personal Information from or about children under the age of 18 without parental permission, nor do we knowingly disclose Personal Information of children under 18 to third parties for valuable consideration or for cross-context behavioral advertising. If we learn we have collected or received Personal Information from a child under 18, we will make reasonable efforts to delete that information. If you believe we might have any information from or about a child under 18 and you would like us to delete it, please contact us.

LINKS TO OTHER WEBSITES

This Policy only addresses the use and disclosure of information by STAAR. We may provide links to outside websites or advertisements for third parties that have their own privacy policies and data collection, use, and disclosure practices. Our business partners have their own privacy policies, too. We encourage you to familiarize yourself with the privacy policies provided by all third parties prior to providing them with information or taking advantage of an offer or promotion.

EMAIL COMMUNICATION PREFERENCES

You may opt-out of receiving promotional or marketing emails from us at any time by using the “unsubscribe” link in the email you receive or otherwise contacting us using the contact information listed below. Please note we may continue to send you other non-marketing communications related to your relationship with us.

PRIVACY RIGHTS BASED ON RESIDENCY

Depending on your jurisdiction of residence (e.g., Alabama, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, Virginia, or an applicable international jurisdiction) and your relationship with us, you may have some or all of the privacy rights listed below with respect to the Personal Information we maintain about you. Please note that these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

• Right to Confirm / Access / Know. You may have the right to request access to and obtain copies of Personal Information that we hold about you, including details relating to the ways in which we collect, use, and share your information. You may also have the right to obtain a list of the categories of third parties to which we have disclosed or sold Personal Information. Residents of California have the right to know the categories of Personal Information we have collected about them, the categories of sources from which the Personal Information is collected, the categories of Personal Information sold, shared, or disclosed, the business or commercial purpose for selling, sharing, or disclosing the Personal Information, and the categories of third parties to whom we have sold, shared, or disclosed their Personal Information. California’s “Shine the Light” law also permits users of our Sites that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes.
• Right of Portability. You may have the right to receive a copy of the Personal Information we hold about you in a portable format and to request that we transfer it to a third party.
• Right to Delete. You may have the right to request that we delete Personal Information we maintain about you.
• Right to Correct. You may have the right to request that we correct inaccurate Personal Information we maintain about you.
• Right to Withdraw Consent. You may have the right to withdraw your consent to the processing of your Personal Information. Note that withdrawal of consent shall not affect the lawfulness of processing based on consent prior to withdrawal.
• Right to Opt-Out. You may have the right to opt-out of certain uses of your Personal Information such as for (i) targeted advertising, (ii) “sale” or “sharing” for cross-context behavioral advertising, or (iii) profiling or automated decision-making activities that result in a legal or similarly significant effect on you. We do not engage in (iii), but you can opt-out of uses (i) and (ii) by adjusting your cookie settings to reject analytics and advertising cookies in our cookie preference center. Additionally, if you visit our Sites with the Global Privacy Control opt-out preference signal enabled, where required by law, that signal will be treated as a request to opt-out of “sale,” “sharing,” and targeted advertising. Please note your request may apply only to the browser from which you submit the request unless we are able to identify you across devices. Learn more about the Global Privacy Control signal here.
• Right to Appeal. You may have the right to appeal our decision if we decline to process your request in part or in full. You can do so by replying directly to our denial. If you are not satisfied with our response to your appeal, you may contact your state Attorney General or applicable supervisory authority.

Requests to exercise these rights may be made by submitting a request at https://staar-privacy.relyance.ai/, calling us at 888-909-0123, contacting us at the contact information listed at the end of this Policy, or as otherwise set forth in this section. Only you, or as permitted by law, a person that you authorize to act on your behalf, may make a request related to your Personal Information. For certain requests, we must verify your request before we can fulfill it. Verifying your request will require you to provide sufficient information for us to reasonably verify that you are the person about whom we collected Personal Information or that the requestor is authorized to act on your behalf. STAAR will inform you of the specific information it requires, if any, to verify your identity after it receives your request. Once we are able to validate your identity, as applicable, we will respond to your request in a timely manner (as set forth in applicable legal requirements). Please note that these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law. We will not discriminate against you for exercising your privacy rights.

ADDITIONAL DISCLOSURES FOR CALIFORNIA RESIDENTS

Table 1 below provides additional disclosures for residents of California, as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”). Please remember that the information we collect varies based on our relationship with you.

Table 1
Category of Personal Information STAAR has collected in preceding 12 months	Category of source from which Personal Information was collected	Business/commercial purpose for which Personal Information was collected	Categories of service providers (and other authorized recipients) to whom STAAR discloses Personal Information	Categories of third parties to whom STAAR sells or shares Personal Information*
Identifiers (e.g., name, online identifier, email address, date of birth, zip code, payment card or financial account information, and similar identifiers)	CA Consumers; Site users; STAAR’s customers, suppliers and distributors	For STAAR’s provision of customer service and EVO Advisor assistance; EVO ICL Consultation app; order fulfillment; billing and payment purposes; marketing purposes; handling of complaints; STAAR’s compliance with applicable regulations; verifying or maintaining the quality and safety of STAAR’s products	Existing vendors/service providers, including cloud and communication platform providers; customer service support vendors; STAAR’s customers (Providers), suppliers and distributors; regulatory agencies; cybersecurity partners	Analytics and advertising partners such as Google, Facebook, TikTok, etc.
Sensitive Personal Information - Health information (e.g., vision data) NOTE: We do not use sensitive Personal Information to infer characteristics about consumers.	CA Consumers; Site users; STAAR’s customers; research collaborators	For handling of complaints; STAAR’s compliance with applicable regulations; auditing purposes; STAAR’s provision of customer service and EVO Advisor support; order fulfillment; verifying or maintaining the quality and safety of STAAR’s products	Existing customer support providers; regulatory agencies; STAAR’s customers; auditors; cybersecurity partners	Information regarding your interest in our Services may be sold or shared with analytics and advertising partners such as Google, Facebook, TikTok, etc., but specific details regarding your health and/or vision will not be sold or shared.
Commercial information (e.g., account/payment information, products/services purchased)	CA Consumers; Site users; STAAR’s customers and suppliers	For STAAR’s provision of customer service; marketing purposes; billing purposes; financial and accounting purposes	Existing vendors/service providers; STAAR’s customers and suppliers	Analytics and advertising partners such as Google, Facebook, TikTok, etc.
Internet or other electronic network activity information (e.g., search history, information concerning a consumer’s interaction with website)	CA Consumers; Site users	To optimize and maintain STAAR’s websites and systems; to detect security incidents and protect website security; for data analysis, marketing and advertising purposes; provision of customer service	Existing vendors/service providers	Analytics and advertising partners such as Google, Facebook, TikTok, etc.
Geolocation Data	Location data inferred from Site users’ device or IP address; sensitive personal information such as precise geolocation data	To provide the Sites and to conduct analytics and advertising activities	Existing vendors/service providers	Analytics and advertising partners such as Google, Facebook, TikTok, etc.
Inferences used to create a profile reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, or attitudes.	CA Consumers; Site users	To provide the Services and to conduct analytics and advertising activities	Existing vendors/service providers	Analytics and advertising partners such as Google, Facebook, TikTok, etc.
Employment-related information (e.g., name, contact information, background check information, employment history, education information, disability identification)	CA Consumers; Site users; STAAR’s employees; job applicants	To fulfill STAAR’s legal obligations; for STAAR’s legitimate interests and business purposes; financial purposes	Existing vendors/service providers; auditors	Not sold or shared

*Under the CCPA, a “sale” of Personal Information does not necessarily involve an exchange of money. Instead, a sale also includes disclosures of Personal Information to third parties who may use the information for their own purposes, such as analytics and advertising partners. Similarly, under California law, “sharing” Personal Information refers to disclosing Personal Information to third parties for cross-context behavioral advertising. Per these definitions, we may sell and share the certain categories of Personal Information to third party analytics and advertising partners.

California Residents, please refer to the “Privacy Rights Based on Residency” section above for information regarding the rights you have with respect to your Personal Information and how to exercise them.

ADDITIONAL DISCLOSURES FOR RESIDENTS OF THE EUROPEAN UNION, EUROPEAN ECONOMIC AREA (EU/EEA), UNITED KINGDOM (UK), AND SWITZERLAND (CH)

Privacy Rights

Individuals in the EU, UK, and Switzerland have certain data subject rights which may be subject to limitations and/or restrictions. These rights include the: (i) right to request access to and rectification or erasure of their Personal Information; (ii) right to request restriction of processing or to object to processing of their Personal Information; (iii) right to ask for a copy of their Personal Information to be provided to them, or a third party, in a digital format (data portability); and (iv) right to file a complaint with a data protection authority. Individuals also have the right to withdraw consent for the processing of their Personal Information at any time; however, such withdrawal will not affect the lawfulness of processing of Personal Information that (a) occurred prior to the consent being withdrawn; or (b) is processed under a different legal basis (e.g., legal or contractual compliance). Please note, however, that we reserve the right to enforce statutory restrictions on our part, for example if we are obliged to retain or process certain data, have an overriding interest (insofar as we may invoke such interests) or need the data for asserting claims. If exercising certain rights will incur costs to you, we will notify you thereof in advance. Please further note that the exercise of these rights may conflict with contractual obligations and this may result in consequences such as premature contract termination or involve costs. If this is the case, we will inform you in advance unless it has already been contractually agreed upon.

If individuals want to exercise any of their rights, they can contact us at privacyoffice@staar.com or the local data representatives as provided in the “Identity of Controller” subsection below. In general, exercising these rights requires that you can prove your identity (e.g., providing a copy of identification documents where your identity is not evident otherwise or cannot be verified in another way). Individuals also have the right to enforce their rights in court or to lodge a complaint about the processing of their Personal Information with their local data protection authority.

International Transfers

Your Personal Information may be accessed or transferred by the STAAR entity you interact with to our entities in the US or Switzerland, or our sub-processors in the US or other countries, for the purposes outlined in this Policy. By providing us with your Personal Information, you consent to this transfer. Data transfers from the EEA, UK, and Switzerland to bodies in jurisdictions outside of the EEA, UK, or Switzerland take place pursuant to a valid transfer mechanism requiring that appropriate safeguards are implemented to provide an adequate level of data protection such as (i) standard contractual clauses approved by the European Commission which can be accessed here, (ii) an adequacy decision such as the Data Privacy Framework discussed below, and/or (iii) a derogation such as informed explicit consent or transfers required for establishment, exercise, or defense of legal claims.

Data Privacy Framework

STAAR adheres to the EU-U.S. Data Privacy Framework (“DPF”) and the UK Extension to the DPF with regard to personal data transferred from the European Union and the United Kingdom to the US, and the Swiss-U.S. Data Privacy Framework with regard to personal data transferred from Switzerland to the US. For more information, see STAAR’s Data Privacy Framework Addendum and the Data Privacy Framework website. In keeping with the DPF principles, we take reasonable measures to protect the privacy and security of your Personal Information as expressed in this Policy, regardless of where it is processed or stored.

Identity of Controller

For purposes of EU/EEA, UK, and Swiss data protection laws, the data controller (i.e., the organization that determines the purposes and means of processing) for the Personal Information that you submit to us is STAAR Surgical AG (“STAAR CH”). For purposes of U.S. privacy laws, the data controller is STAAR Surgical Company (“STAAR US”). Please see the Contact Information below for the details for the data protection representative for each entity.

CHANGES TO THIS POLICY

We may update this Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. If we make updates, we will post the updated version on this page and indicate the date the Policy was last updated. We encourage you to review this page from time to time to check for updates. By using the Services after changes to the Policy have occurred, you are deemed to have accepted such changes.

CONTACT INFORMATION

If you have questions or concerns regarding this Policy or wish to exercise your privacy rights, please contact the appropriate party below:

STAAR US and STAAR CH have appointed STAAR Surgical AG Niederlassung Germany (“STAAR DE”), Harksheider Str. 3, 22399 Hamburg, Germany, Email: DPRepresentative@staar.com, as the data protection representative in Europe. The data protection officer for STAAR DE is IITR Datenschutz GmbH, Marienplatz 2, 80331 München, Email: email@iitr.de.

STAAR US and STAAR CH have appointed STAAR Surgical UK, Ltd. (STAAR UK), Suite 2, The Granary, 50 Barton Road, Worsley, Manchester, United Kingdom M28 2EB, Email: privacyoffice@staar.com, as the data protection representative in the UK.

STAAR US has appointed STAAR Surgical AG, Hauptstrasse 104, CH – 2560 Nidau, Switzerland (“STAAR AG”), Email: DPRepresentative@staar.com, Phone: +41 32 332 88 88, as the data protection representative in Switzerland. The data protection officer for STAAR Surgical AG is IITR Datenschutz GmbH, Marienplatz 2, 80331 München, Email: email@iitr.de.

The Chief Privacy Officer for STAAR US is Kathleen Determann, 25510 Commercentre Drive, Ste. 200, Lake Forest, CA 92630, Phone: 1.626.303.7902, Email: PrivacyOffice@staar.com.

If you feel your inquiry has not been adequately addressed, you may submit a complaint through STAAR’s independent recourse provider at ADR Services’ DPF independent recourse mechanism.

In locations other than the EU, UK and Switzerland, where operations are conducted by a local STAAR subsidiary (see below), contact DPRepresentative@staar.com for assistance. In some countries, you will need to contact the local distributor (as data controller) to exercise your privacy rights as STAAR discourages distributors from sharing Personal Information except the minimum necessary required to perform our Services. Contact information for all distributors and subsidiaries is available at www.staar.com/distributors-list.

ANNEX I: LIST OF RELEVANT STAAR ENTITIES

1. STAAR Surgical Company (Delaware, United States)
2. STAAR Surgical UK, Ltd. (Manchester, England)
3. STAAR India Pvt. Ltd (Delhi, India)
4. STAAR Surgical AG (Nidau, Switzerland)
5. STAAR Surgical AG Niederlassung Deutschland (Hamburg, Germany)
6. STAAR Surgical AG Sucursal España (Barcelona, Spain)
7. STAAR Surgical Japan (Tokyo, Japan)
8. STAAR Surgical Pte. Ltd. (Singapore)

ANNEX II: JOB APPLICANT AND EMPLOYEE DATA

In addition to the applicable disclosures throughout the Policy, this Annex II provides additional notices related to STAAR’s collection of Personal Information about workforce members.

Job Applicants 

If you have applied for employment with STAAR, the Personal Information submitted during the application process will be used to process and consider your candidacy and where in our legitimate interest, for business management purposes. Such information may include contact details, information about your education and employment history, and demographic and/or citizenship status information. STAAR will not sell the information on your application to unaffiliated third parties for their marketing purposes. We may share the information on your applications with recruiters, consultants, attorneys, background services and our affiliates. The information on your application may also be used for certain regulatory, compliance, and legal purposes, consistent with this Policy. Should we enter into an employment contract with you, we will provide further notification to you about the processing of your Personal Information as an employee. If you have questions or requests concerning our use of your Personal Information, please provide a detailed request to privacyoffice@staar.com. In most cases, your Personal Information provided to a third party recruiting platform will also be subject to that vendor’s privacy policy available on their site.

Employees 

Employee privacy notices are made available to STAAR employees upon hire, and copies can be found in your training documentation and on the STAAR intranet (Corporate Policies). Any questions should be directed to your Human Resources partner.