Privacy policy

This policy explains how we process personal data on this website, which is the business-to-business site for the STEINER Vision partner programme for opticians in the United Kingdom. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications Regulations (PECR).

The controller is:
Specsfactory Ltd
Bridge House, Old Grantham Road, Whatton, Nottingham NG13 9FG
Companies House no. 09754623
Email: partner@steiner-vision-b2b.co.uk

This is a trade site. We do not collect patient records, prescriptions or any other health data through it.

When you submit the partner enquiry form we collect the business and contact details you enter — practice or company name, contact name, email address, telephone number, practice address and postcode, plus anything you write in the free-text fields — together with the campaign source that brought you to the form and the status of your application as we process it.

We use this to assess your application, check district availability, contact you, arrange a demonstration and, if we work together, set up your partner account. Lawful bases: taking steps at your request prior to entering into a contract (Art. 6(1)(b)) and our legitimate interests in operating and administering the partner programme (Art. 6(1)(f)).

Applications are stored in our hosted database (Supabase, in the partner_applications table) and are visible only to authorised STEINER Vision staff.

The region check takes the outward part of a postcode (for example "SW12") to tell you whether that district is still available. If you ask to be added to the waiting list for a district, we store the outward code together with the contact details you give us so we can notify you when it becomes free. Lawful basis: steps prior to a contract and our legitimate interests in managing district exclusivity.

We record a very small amount of usage data: the campaign or referral source (for example a UTM parameter) and the path of the page on which an action occurred. These records are sent to our own endpoint at /api/track and stored in our track_events table. They let us see which campaigns generate partner interest.

We do not use Google Analytics, advertising networks, tracking pixels or social media plugins on this site, and we do not build profiles about you. Lawful basis: our legitimate interests in understanding how our own campaigns perform.

If you become a partner, or if you are a member of staff, we create an account for you. We process your email address, name, sign-in credentials handled by our authentication provider, your role, and records of your sign-ins and activity in the partner cockpit or admin area. Lawful bases: performance of our contract with you and our legitimate interests in securing the platform.

We send transactional and account emails — application confirmations, notifications, invitations, sign-in links, password resets and email-change confirmations. Every marketing-style message includes an unsubscribe link. If you unsubscribe, or if an address bounces or is reported as spam, we add the address to a suppression list (the suppressed_emails table) so that we do not email it again. Lawful bases: performance of our contract, and our legitimate interests in business-to-business communication and in honouring opt-outs, in line with PECR.

When a demonstration is arranged, the appointment — including your name, business, and the contact details needed to attend — is written to the calendar of the relevant STEINER Vision staff member using the Google Calendar API. Google acts as our processor for this. Lawful basis: steps prior to a contract, and our legitimate interests in scheduling.

We do not use advertising, analytics or third-party cookies on this site. The only items we place on your device are the following, all of which are strictly necessary or functional:

You can clear or block these through your browser settings, but the site will not keep you signed in and will show the cookie notice again on every visit.

We share personal data only with service providers acting on our instructions: our hosting and database provider (Supabase), our email delivery provider, and Google (Calendar) as described above. We also share it with professional advisers or authorities where the law requires it. We do not sell personal data.

Some of our providers process data outside the United Kingdom. Where that happens, transfers are covered by UK adequacy regulations or by the International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses, with appropriate safeguards in place.

Applications that do not lead to a partnership are kept for up to 24 months and then deleted or anonymised. Partner account and contract records are kept for the life of the relationship and for six years afterwards to meet our legal and tax obligations. Measurement records are kept for up to 24 months. Suppression-list entries are kept indefinitely, because that is the only way to honour your opt-out.

You have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing (including processing based on legitimate interests), and to receive certain data in a portable format. Where we rely on consent, you may withdraw it at any time. To exercise any of these rights, email partner@steiner-vision-b2b.co.uk. We will respond within one month.

If you are unhappy with how we have handled your personal data, please contact us first at partner@steiner-vision-b2b.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113, or at ico.org.uk/make-a-complaint.

We may update this policy from time to time. The version published on this page is always the current one.