Privacy Policy

House of Branded Lifestyle, Inc. (collectively, “we,” “Personal Information Controller,” or “PIC”) operates the Vision Express and Eye Society stores. We are committed to providing you (the “Data Subject”) with the best eyecare services while implementing safeguards to protect your privacy and keep your personal data safe and secure.

Personal Data Collected

The following Personal Information may be collected:

Purposes of Collected Personal Data

We collect Personal Data for various legitimate purposes.

I. Primary Purpose

1. Service Delivery
   • Healthcare: We collect patient information to provide medical treatment and care, and to provide services or products requested by customers.
   • E-commerce: We collect address and payment information to process and deliver orders, and to communicate with customers regarding their accounts or transactions.
2. Compliance with Legal Obligations
   • We may process personal information to comply with laws and regulations, such as tax reporting, employment laws, or health and safety regulations.
3. User Authentication and Security
   • We may collect personal data to verify the identity of users and secure access to systems and data.

II. Secondary Purpose

1. Marketing and Advertising
   • We use personal information to send promotional materials, newsletters, or targeted advertisements.
2. Analytics and Research
   • We analyze personal information to improve services, understand user behavior, and develop new products.
3. Customer Support and Service Improvement
   • We collect feedback and support requests to enhance customer service and improve products or services.
4. Fraud Prevention and Security Enhancement
   • We monitor data for suspicious activities to prevent fraud and enhance security measures.
5. Internal Reporting and Business Operations
   • We use data for internal reporting, audit, or other administrative purposes.

Data Protection

We shall implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data which we collected:

I. Administrative Controls

• Policies and Procedures: We have developed and enforced comprehensive data protection policies and procedures.
• Employee Training: We regularly train employees (especially those who have access to customer information) on data protection best practices, including recognizing phishing attacks and other social engineering tactics.
• Access Controls: We implement strict access control policies, ensuring that only authorized personnel have access to personal data based on the principle of least privilege.
• Incident Response Plan: We have developed and maintained an incident response plan to address data breaches promptly and effectively.

II. Technical Controls

• Firewalls and Intrusion Detection Systems (IDS): We implemented firewalls and IDS to monitor and control incoming and outgoing network traffic and detect any suspicious activities.
• Regular Software Updates and Patch Management: We ensure all systems and software are up to date with the latest security patches to protect against known vulnerabilities.

III. Physical Controls

• Secure Physical Access: We implement measures such as key cards, biometric access, and security personnel to restrict physical access to facilities where personal data is stored.
• Surveillance: We have installed surveillance cameras and alarm systems to monitor and secure areas where personal data is stored.

IV. Organizational Measures

• Data Minimization: We collect and retain only the minimum amount of personal data necessary for the intended purpose.
• Data Inventory and Classification: We maintain an inventory of personal data and classify it based on sensitivity and risk.
• Third-party Management: We ensure that third-party vendors comply with data protection standards through contractual agreements and regular audits.

V. Monitoring and Auditing

• Regular Audits: The company conducts regular internal security audits and vulnerability assessments to identify and remediate weaknesses in data protection measures.
• Logging and Reporting: We maintain a detailed log of access to personal data and regularly review it for any unauthorized activities.

These security measures shall aim to maintain the availability, integrity, and confidentiality of personal data and are intended for the protection of personal data against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing.

Third Party Transfer

We may disclose and transfer your personal data to our suppliers, service providers, agents, or companies (“Third Parties”) that are acting on our behalf for the following purposes:

• Processing and delivering orders;
• Sending of marketing and promotional offers and discounts;
• Providing IT-related assistance.

Retention

The Personal Information collected is retained only as long as necessary for the purposes it was collected for, or as required by law. We will retain Personal Information for a period of five (5) years for physical storage and ten (10) years for digital storage, counted from your last consultation or completed transaction with us, unless a longer retention period is required under applicable laws or regulations. After the retention period, the personal information will be securely disposed of (shredding for physical documents; deletion from the system for digital records).

Confidentiality

Our employees shall operate and hold personal data under strict confidentiality. They are required to sign non-disclosure agreements and have received training on the company’s privacy and security policies to ensure the confidentiality and security of personal data.

Participation of the Data Subject

You are entitled to the following rights:

1. Be informed on whether your personal information shall be, are being, or have been processed;
2. Be furnished with the information indicated below before the entry of your personal information into the processing system of the personal information controller, or at the next practical opportunity:
   1. Description of the personal information to be entered into the system;
   2. Purposes for which they are being or are to be processed;
   3. Scope and method of the personal information processing;
   4. The recipients or classes of recipients to whom they are or may be disclosed;
   5. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;
   6. The identity and contact details of the personal information controller or its representative;
   7. The period for which the information will be stored; and
   8. The existence of their rights, i.e., to access, correction, as well as the right to lodge a complaint before the Commission.

   Any information supplied or declaration made to you on these matters shall not be amended without prior notification, provided that the notification under subsection (B) shall not apply should the personal information be needed pursuant to a subpoena or when the collection and processing are for obvious purposes.

3. Reasonable access to, upon demand, the following:
   1. Contents of your personal information that were processed;
   2. Sources from which personal information were obtained;
   3. Names and addresses of recipients of the personal information;
   4. Manner by which such data were processed;
   5. Reasons for the disclosure of the personal information to recipients;
   6. Information on automated processes where the data will or is likely to be made as the sole basis for any decision significantly affecting or that will affect you;
   7. Date when your personal information was last accessed and modified; and
   8. The designation, or name or identity and address of the personal information controller.
4. Dispute the inaccuracy or error in the personal information and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable;
5. Suspend, withdraw, or order the blocking, removal, or destruction of your personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary for the purposes for which it was collected;
6. Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information; and
7. Where personal information is processed by electronic means and in a structured and commonly used format, you have the right to obtain from us a copy of data undergoing processing in an electronic or structured format.

Inquiry