Privacy Policy of the SuperVista (App)

1. Controllers and joint controllership

The joint controllers within the meaning of Art. 26 GDPR for the processing of personal data in the SuperVista App are:

SuperVista AG
Siemensstr. 2, 15711 Königs Wusterhausen
Amtsgericht Cottbus, HRB 11.527
Management Board: Matthias Kamppeter (Chairman), Volker Grahl, Christine Kamppeter, Peter Wieczorek, Carsten Gersdorf
VAT ID: DE 291 219 087
Email: datenschutz@supervista.de

SuperVista Deutschland GmbH (operator of brillen.de)
Siemensstr. 2, 15711 Königs Wusterhausen
Amtsgericht Cottbus, HRB 14.304
VAT ID: DE 324 836 612
Email: datenschutz@supervista.de

Pub&Go UG (haftungsbeschränkt) (operator of Pub&Go)
Siemensstr. 2, 15711 Königs Wusterhausen
Email: datenschutz@supervista.de

The three companies are jointly responsible for the data processing described in this policy. In an arrangement pursuant to Art. 26 GDPR, they have allocated their responsibilities for complying with the obligations under the GDPR, in particular for handling data subject rights and fulfilling the information obligations under Arts. 13 and 14 GDPR. The essence of this arrangement is made available upon request.

Central point of contact for all data protection enquiries is SuperVista AG (datenschutz@supervista.de). However, you may also exercise your rights directly against any of the three controllers. Further information about the companies and the group structure can be found in the legal notice of brillen.de.

2. Data protection officer

You can contact the data protection officer appointed by the controllers at:

Frank Steinbrügger
RT Data & IT Consulting GmbH
Gravenreutherstr. 2, 95445 Bayreuth
Email: datenschutz@rtdata-it.de

3. General information, definitions and scope

We take the protection of your personal data seriously and treat your data confidentially and in accordance with statutory data protection provisions (GDPR, BDSG, TDDDG) and this privacy policy.

“Personal data” means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

This privacy policy applies to the use of the SuperVista App on your mobile device. Use of the brillen.de and supervista.de websites is additionally subject to the privacy policy of brillen.de.

4. Registration and management of your SuperVista account

Registration is required to use the SuperVista App. During registration, we process the following data:

• First and last name
• Email address
• Mobile phone number
• Date of birth (optional, e.g. for age-related offers)
• Postal address (optional, for deliveries)

Sign-in is passwordless: on request, you receive a sign-in link or code by email or SMS. This eliminates the need to store a password.

Legal basis: Art. 6(1)(b) GDPR (performance of the agreement governing use of the app) and Art. 6(1)(f) GDPR (legitimate interest in a user-friendly, secure app).

5. Use of app features

When you use the app, we process data that is technically necessary to provide its features:

• Device information (operating system, app version, device identifier)
• IP address, connection timestamp
• Language and region settings
• Sign-in status and session information

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (functionality and security of the app).

6. Bookings and appointments at brillen.de

Through the app, you can book appointments with partner opticians and at brillen.de stores, and select and order glasses, progressive lenses, sunglasses and contact lenses. In doing so, we process:

• Your basic customer details and contact data
• Requested appointment, branch, partner optician
• Selected products, vision measurements (if provided or determined through an eye test)
• Order and booking history

Eye tests may be carried out through our partner Remote Eyetest GmbH. For this purpose, we transmit the personal data necessary to perform the eye test (in particular name and contact data); after completion, we receive the resulting refraction measurements insofar as these are necessary for further consultation or the manufacture of glasses.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). When processing health data (vision measurements), Art. 9(2)(a) or (h) GDPR additionally applies.

Further details on order processing, factoring and service providers can be found in the privacy policy of brillen.de.

7. Orders and payments at Pub&Go

At Pub&Go locations, you scan a QR code at your table to access the digital menu. In doing so, we process:

• Selected location, table number
• Order data (products, quantities, timestamp)
• Invoice and payment data

Payment processing via Stripe: Payments are processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Irland. When you make a payment, your payment data is forwarded directly to Stripe and processed there (name, billing address, email address, payment amount, payment information such as credit card or bank account details). Stripe is certified under the EU-U.S. Data Privacy Framework. Further information can be found in the Stripe privacy notice and in the privacy policy of brillen.de.

Apple Pay and Google Pay are also supported as payment methods. Apple/Google each process your payment data as independent controllers in accordance with their own privacy notices.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (provision of secure payment processing).

8. Push notifications

If you allow the app to send push notifications, we can send you updates on order status and appointments, as well as promotions and news within the scope of your marketing consent. For this purpose, we process your device push tokens (Apple Push Notification Service, Firebase Cloud Messaging).

You can disable push notifications at any time in your device settings or the app settings.

Legal basis: Art. 6(1)(b) GDPR for contract-related push messages; Art. 6(1)(a) GDPR for marketing push messages.

9. Location data

If you allow it, the app can use your location to show you the nearest brillen.de opticians or Pub&Go locations. There is no continuous location tracking; your location is requested only when you actively use the relevant feature.

You can disable location access at any time in your device settings.

Legal basis: Art. 6(1)(a) GDPR (consent via the operating system's permission prompt).

10. Marketing communications (email, SMS, WhatsApp)

Where you have given consent, we contact you through your selected channels (email, push, SMS, WhatsApp) with offers and news about brillen.de and Pub&Go.

Your consent is confirmed through a double opt-in procedure using a verification code. For details, in particular on content, channels, retention periods and withdrawal, please refer to our information on marketing consent.

Legal basis: Art. 6(1)(a) GDPR and Section 7(2) UWG (German Act Against Unfair Competition).

11. Use of WhatsApp Business and Meta platforms

If you have selected WhatsApp as a marketing channel, we communicate with you through the WhatsApp Business Platform. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland, a company of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA.

When using WhatsApp, the following data in particular is transmitted to WhatsApp/Meta:

• Mobile phone number
• WhatsApp profile data (profile name, profile picture – if shared)
• Message content and metadata (time sent, delivery and read status)
• Device and connection data (e.g. IP address, device ID)

This data may be processed on servers in third countries outside the EU/EEA, particularly in the USA. Meta Platforms is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). For transfers outside the Framework, we use EU standard contractual clauses (Art. 46(2)(c) GDPR).

Please note that WhatsApp/Meta also process the transmitted data for their own purposes. We have no control over this. Details: WhatsApp privacy notice.

Legal basis: Art. 6(1)(a) GDPR (consent).

12. Analytics and diagnostic data in the app

We use analytics tools to improve the app and analyse errors. These collect pseudonymised usage data, such as screens viewed, app crashes, time spent and anonymised device identifiers.

Unless strictly necessary to ensure functionality, this data is collected only with your consent, which you can adjust at any time in the app settings.

Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in reliable functionality).

13. Data disclosure and processing on behalf of controllers

We disclose your data only insofar as this is necessary for the performance of a contract, you have given consent or a legal obligation exists. Recipients include in particular:

• Companies within the SuperVista group (for internal administration and joint provision of services)
• Partner opticians and Pub&Go operators to fulfil your orders and appointments
• IT and hosting service providers, email/SMS/push providers, WhatsApp Business Solution Providers, analytics providers
• Payment service providers (in particular Stripe, Apple Pay, Google Pay)
• Tax advisers, auditors and legal advisers in connection with statutory obligations

Processors are bound by our instructions pursuant to Art. 28 GDPR. A complete overview of the service providers used and further information on factoring and debt collection can be found in the privacy policy of brillen.de.

14. Transfers to third countries

Your data is transferred to countries outside the EU/EEA only where an adequate level of data protection is ensured. This is ensured through:

• Adequacy decisions of the European Commission (Art. 45 GDPR), e.g. the EU-U.S. Data Privacy Framework
• EU standard contractual clauses (Art. 46(2)(c) GDPR)
• Where applicable, your explicit consent (Art. 49(1)(a) GDPR)

15. Retention periods

We store your data only for as long as necessary for the respective purposes:

• Account data: Until your account is deleted
• Order and booking data: Until the statutory retention periods expire (generally 6 or 10 years under HGB/AO, the German Commercial Code and Fiscal Code)
• Marketing consent and evidence data: Until withdrawal; evidence data for up to three years thereafter
• Analytics/diagnostic data: A maximum of 26 months, unless otherwise specified

As also described in the privacy policy of brillen.de, your data is stored in encrypted form on leased data servers in Frankfurt am Main.

16. Data security

We implement technical and organisational measures to protect your data against unauthorised access, loss or manipulation, in particular:

• TLS/SSL-encrypted data transmission
• Encrypted storage
• Access controls with role-based permissions
• Regular security and penetration tests

17. Your rights

You have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) – see Delete your account
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

You may exercise your rights against any of the joint controllers. For this purpose, write to us at datenauskunft@supervista.de (access, rectification, erasure) or widerruf@supervista.de (withdrawal).

18. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

The State Commissioner for Data Protection and the Right of Access to Files in Brandenburg
Dagmar Hartge
Stahnsdorfer Damm 77, 14532 Kleinmachnow
Phone: +49 33203 356-0
Email: poststelle@lda.brandenburg.de
Web: https://www.lda.brandenburg.de

19. Changes to this privacy policy

We update this privacy policy when the legal framework or our processing activities change. We will notify you of material changes in good time in the app or by email.

Last updated: December 2025

Further documents:

• privacy policy of brillen.de
• legal notice of brillen.de
• Information on marketing consent