Online Privacy Statement
THORLABS, INC. DATA PRIVACY FRAMEWORK STATEMENT (“PRIVACY STATEMENT”)(Last Updated: April 16, 2024)(Effective Date: May 24, 2018)
Introduction

1.

Thorlabs, Inc., which operates the Internet sites Thorlabs.com, Thorlabs.de, Thorlabs.us, Thorlabs.hk,
Thorlabschina.cn, and Thorlabs.co.jp (the “Sites”), and its subsidiaries in the United States, Thorlabs
Imaging Research Group, LLC, Thorlabs Quantum Electronics, Inc., Thorlabs Measurement Systems
Inc., and Thorlabs Lens Systems, Inc. (such subsidiaries are the “Other Covered Entities”, andtogether with Thorlabs, Inc., “Thorlabs”, “we” or “our”), are committed to protecting the privacy of usersof the Sites in accordance with applicable law. Thorlabs intends to give users as much control as
possible over information that identifies users, referred to as Personally Identifiable Information,
including registration data. This Privacy Statement applies to each of the Sites and describes theinformation Thorlabs collects about users and how that information may be used.
Thorlabs reserves the right to update and change this Privacy Statement from time to time. If Thorlabs
makes material changes to its privacy practices, a prominent notice will be posted on this web page.
Each time a user uses the Sites, the current version of the Privacy Statement applies. Accordingly, auser should check the date on which this Privacy Statement was last updated (which appears at the top)
and review for any changes since the last version. If a user does not agree to the Privacy Statement,
the user should not use the Sites.
Thorlabs is the data controller for the purposes of this Privacy Statement. Thorlabs complies with theUnited States (“US”)/European Union (“EU”) Data Privacy Framework (“EU-US DPF”) and the United
Kingdom (“UK”) Extension to the EU-US DPF (“UK Extension to the EU-US DPF”) as set forth by the
U.S. Department of Commerce. Thorlabs has certified to the US Department of Commerce that it
adheres to the EU-US Data Privacy Framework Principles (“EU-US DPF Principles”) with regard to theprocessing of personal data received from the EU in reliance on the EU-US DPF and from the United
Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-US DPF. If there is any conflict
between the terms in this Privacy Statement and the EU-US DPF Principles, the EU-US DPF Principles
shall govern. For more information on our compliance with the EU-US DPF and the UK Extension to the
EU-US DPF, please see Section 6 of this Privacy Statement below. To learn more about the Data
Privacy Framework (DPF) program, and to view our certification, please visit
https://www.dataprivacyframework.gov/.
What information Thorlabs uses

2.

Thorlabs collects two types of information from users of Sites:i.

"Personally Identifiable Information" this is any information from which you can be personallyidentified (such as name, email address, postal address, telephone, birth date); andii.

"Aggregate Information" which is non-personally identifiable/anonymous information about
users of the Sites (such as frequency of visits to Sites, IP address, Site pages most frequently
accessed, browser type). Aggregate Information is used in a collective manner and no single
person can be identified by that compiled information.

2.1

Information that you provide to us

On the Sites, users may order products or services, and register to receive materials. During this processusers may provide us with Personally Identifiable Information, including community forum content,
diaries, profiles, photographs, name, unique identifiers (e.g., passwords), contact and billing information(e.g., email address, postal address, telephone, fax), and transaction information.

Rev 1.0

1|P a g e

In order to tailor Thorlabs’ subsequent communications to users and continuously improve the Sites’
products and services, Thorlabs may also ask users to provide information regarding their interests,
demographics, experience with its products, and detailed contact preferences.
2.2

Information that we collect

During your use of the Sites, we may collect information from you about the way you use and interact
with the Sites. This will include the use of cookies and log files.
CookiesThorlabs uses secure cookies on the Sites that clear when deleted by the user. A cookie is a uniquetext file that may be used for data analysis and enables a web site to tailor information presented to auser based on a user’s browsing program. Thorlabs may use cookies to personalize a user’s pages at
a Site, to remember a user when the user registers for products or services, or to track visits to a Site.
If a user does not want Thorlabs to deploy cookies in the user’s browser, the user may set the browser
to reject cookies or to notify the user when a web site tries to place cookies in the browser program.
Rejecting cookies may affect a user’s ability to use some of the products, features, functions, or services
on a Site. Cookies do not contain Personally Identifiable Information.
Log files
Thorlabs web servers may automatically log information, such as a user’s IP address, domain name,browser type, date and time of access, and other log file data. This information may be used to analyze
trends or administer the Sites.
Third party providers
With respect to Thorlabs.com, Thorlabs contracts with third party mirror providers, who deliver integrated
communications services, including Internet access services, to deploy mirrors of downloads in order tomake file downloading via Thorlabs.com faster and more convenient. Thorlabs has no control over theprivacy or logging policies of mirror providers, or the implementation thereof, and such policies may
differ from this Privacy Statement.
Use of Google Analytics
This website uses functions of the web analytics service Google Analytics. Service provider is Google
Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses so-called"cookies". These are text files that are stored on your computer and that allow an analysis of the use of
the website by you. The information generated by the cookie about your use of this website is usuallytransmitted to a Google server in the USA and stored there. Google Analytics cookies are stored on thebasis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analyzing user
behavior in order to optimize both its website and its advertising.
IP anonymization
We have activated the function IP anonymization on this website. As a result, your IP address will betruncated by Google. On behalf of the operator of this website, Google will use this information toevaluate your use of the website, to compile reports on website activity and to provide other services
related to website activity and internet usage to the website operator. The IP address provided by
Google Analytics as part of Google Analytics will not be merged with other Google data.
Browser Plugin
You can prevent the storage of cookies by a corresponding setting of your browser software. In addition,
you may prevent the collection by Google of the data generated by the cookie and related to your useof the website (including your IP address) as well as the processing of this data by Google bydownloading the browser plug-in available under the following link and install:https://tools.google.com/dlpage/gaoptout?hl=en. Please note that if you prevent the storage of
cookies and do not use the browser plugin, you will not be able to take advantage of the essential
features of the Thorlabs website. For example, you will not be able to purchase products on our site or

Rev 1.02|P a g euse the Live Chat feature. If you want to benefit from the Thorlabs’ comprehensive product offering
without using cookies, our technical support and customer service teams are able to assist you overthe phone. Please contact them at https://www.thorlabs.com/locations.cfm.
Third party processing:
We've entered into an agreement with Google for data processing and fully implement the strict
requirements of the German data protection authorities when using Google Analytics.
How Thorlabs uses the information collected3.

Thorlabs will use the Personally Identifiable Information a user submits for any purposes related toThorlabs’s business, including, but not limited to:i.

To understand a user’s needs and create content that is relevant to the user;ii.

To generate statistical studies;iii.

To conduct market research and planning by sending user surveys;

iv.

To notify user referrals of Thorlabs services, information, or products when a user requests that
Thorlabs send such information to referrals;v.

To improve services, information, and products;vi.

To help a user complete a transaction, or provide services or customer support;vii.

To communicate back to the user;viii.

To update the user on services, information, and products;ix.

To personalize a Site for the user;x.

To notify the user of any changes with a Site which may affect the user;xi.

To enforce terms of use on a Site; andxii.

To allow the user to purchase products, access services, or otherwise engage in activities theuser selects.

Sharing Information with third parties
Thorlabs may share information with third parties in order to perform any of the action specified above.
Any sharing of user information will be in accordance with this privacy statement (as more clearlyspecified under paragraph 5 below).
Public posting of information
User names, identifications (“IDs”), and email addresses (as well as any additional information that auser may choose to post) may be publicly available on a Site when users voluntarily and publicly disclose
Personally Identifiable Information, such as when a user posts Personally Identifiable Information in
conjunction with content subject to an Open Source license, or as part of a message posted to a publicforum or a publicly-released software application. Users may not be able to change or remove public
postings once posted. Such Personally Identifiable Information may be used by visitors of these pages
to send unsolicited messages. Thorlabs is not responsible for any consequences which may occur fromthe use of Personally Identifiable Information that a user chooses to submit to public pages.
Surveys

Rev 1.0

3|P a g e

With respect to surveys, in the event that responses are publicly disclosed, users will be notified at thetime they take the survey. Thorlabs will disclose only Aggregate Information, which as stated earlier isanonymous information that does not identify any specific individual. Circumstances under which
Thorlabs would publicly disclose such Aggregate Information include, but are not limited to, sharing
survey results with the site population, providing data to Thorlabs advertisers on user preferences and/or
demographics, and publicizing overall usage data in press communications.
Where surveys allow users to submit written comments, and where Thorlabs advises users of thepossibility of such disclosure at the time they take the survey, Thorlabs reserves the right to disclose
any information provided by users, provided that no personal information identifying a specific user isdisclosed. Participation in surveys is at a user's option; Thorlabs does not conduct mandatory surveys.
CHOICE/OPT IN

4.

A user makes the decision whether to proceed with any activity that requests Personally Identifiable
Information. If a user does not provide requested information, the user may not be able to complete
certain transactions.
Users who use the Personally Identifiable Information of other users agree to use such information onlyfor:i.

Using services offered through a Site;

ii.

Site transaction-related purposes and not for unsolicited commercial messages; oriii.

Other purposes that the other user expressly chooses.

Users are not licensed to add other users to a Site, even users who entered into transactions with them,or to their mail lists without consent.
Thorlabs encourages users to evaluate privacy and security policies of any of the Sites’ transaction
partners before entering into transactions or choosing to disclose Personally Identifiable Information.
4.1

Direct Marketing

If a user no longer wishes to receive direct marketing materials, Thorlabs will provide instructions ineach of its emails on how to be removed from any lists.
4.2

Profile or User ID Display

A user’s Personally Identifiable Information may be publicly available through a user's profile or user ID
display. In such cases, users have the option and discretion to opt out of publicly displaying their real
names at any time by changing their display name under the Sites’ user preferences. Profile or user ID
display may allow other users to see a user’s activities, including purchase and sales content, ratings,
and comments.
4.3

Email Display

Users may have the opportunity to use a service to send electronic mail to another user or email list. In
such cases, a user's valid email address and real name will be included with such messages. In orderto prevent abuse, users may not opt out of such a display, but may choose to refrain from using suchservice to transmit an email message.
4.4

Photographs

Users may have the opportunity to submit photographs to the Sites for product promotions, contests,
and other purposes to be disclosed at the time of request. In these circumstances, the Sites are designed
to allow the public to view, download, save, and otherwise access the photographs posted. By submitting

Rev 1.0

4|P a g e

a photograph, users waive any privacy expectations users have with respect to the security of suchphotographs, and Thorlabs’s use or exploitation of users’ likeness. All photographs submitted toThorlabs become the property of Thorlabs and will not be returned.
5.

ONWARD TRANSFER

5.1

With whom may Thorlabs share information?

Thorlabs will not sell, rent, or lease a user’s Personally Identifiable Information to others, except as
described in this Privacy Statement. Unless Thorlabs has a user’s permission or as required by law,
Thorlabs will only share the Personally Identifiable Information a user provides online with other entities
that are part of the Thorlabs corporate family and/or outside service providers who may be used to ship
products, process credit cards, provide technical support, handle order processing, or otherwise act on
Thorlabs’s behalf. These third parties are prohibited from using users’ information for any other purpose,including their own marketing.
When Thorlabs uses third parties to assist in processing a Site’s user Personally Identifiable Information,
Thorlabs requests that they comply with Thorlabs privacy practices, and other appropriate confidentiality
and security measures.
When users choose to provide Thorlabs with Personally Identifiable Information, users consent to thetransfer and storage of such information by Thorlabs servers in the United States.
Compliance with Law
Please be advised that in certain instances, it may be necessary for Thorlabs to disclose a user’s
Personally Identifiable Information without a user’s permission to government officials or otherwise as
required by legal obligations, including to meet national security or law enforcement requirements.
Thorlabs may disclose such Personally Identifiable Information when responding to subpoenas, court
orders, or legal process, or to establish or exercise legal rights or defend against claims, including fraud
or infringement investigations.
Data collected online may be combined with information a user provides through other means ofcommunication, such as postal mail or third parties to further carry out the purposes described above
under paragraph 3.
Service Orders
To purchase services, users may be asked to be directed to a third party site, such as PayPal, to pay
for their purchases. If applicable, the third party site may collect payment information directly to facilitatea transaction. None of this information will be captured or stored by Thorlabs.
Links to third party web sites
Links to third party web sites on the Sites are provided solely as a convenience to the user. When auser uses these links, the user leaves the Sites. Thorlabs has not reviewed all of these third party sites,
does not control, and is not responsible for, any of the third party sites, their content or privacy practices.
Thorlabs does not endorse or make any representations about the third party sites, or any information,
services, or products found on the sites. If a user decides to access any of the linked sites, Thorlabs
encourages the user to read their privacy statements. The user accesses such sites at user’s own risk.
Bankruptcy or Sale of businessThorlabs reserves the right to share or transfer Personally Identifiable Information and Aggregate
Information to a third party should Thorlabs ever file for bankruptcy or in the event of a sale, merger or
acquisition of Thorlabs, provided such third party agrees to adhere to the terms of this Privacy Statement
Aggregate Information

Rev 1.0

5|P a g eThorlabs reserves the right to share Aggregate Information collected from users of the Sites, without
prior notice, with entities that are part of the Thorlabs corporate family and unrelated third parties. As
stated earlier, Aggregate Information is used in a collective manner and no single person can be
identified by such compiled information.
6.

DATA PRIVACY FRAMEWORK

6.1

Thorlabs has certified that it adheres to the EU-US DPF Principles of: (1) Notice; (2) Choice; (3)Accountability for Onward Transfer; (4) Security; (5) Data Integrity and Purpose Limitation; (6)Access; and (7) Recourse, Enforcement and Liability in respect of any personal information
received from the EU in reliance on the EU-US DPF and from the UK (and Gibraltar) in relianceon the UK Extension to the EU-US DPF.

6.2

The US Federal Trade Commission has jurisdiction over Thorlabs’ compliance with the EU-US
DPF and the UK Extension to the EU-US DPF.

6.3

Thorlabs is responsible for the processing of personal data it receives under the EU-US DPF
and the UK Extension to the EU-US DPF and subsequently transfers to a third party acting asan agent on its behalf. Thorlabs complies with the EU-US DPF Principles for all onward transfersof personal data from the EU and UK, including the onward transfer liability provisions.

7.

DATA INTEGRITY AND ACCESS

Access to and correction of information
Should a user find inaccuracies in such user’s information, or desire to close an account or view the
Personally Identifiable Information Thorlabs may have regarding the user, the user may contact Thorlabs
through the communication methods described under paragraph 11 below, or when technically feasible,
directly on a Site.
Thorlabs will make commercially reasonable efforts to respond to requests for access within thirty (30)days of receiving requests. Thorlabs may decline to process users’ access or update requests to their
Personally Identifiable Information if the requests require disproportionate technical effort, jeopardize
the privacy of other users, or are impractical (for instance, requests concerning information residing on
backup tapes).
Storage of your information
If you close your account with us, then we'll delete your account immediately and depersonalize accountinformation within 14 business days (including any Personal Information). For business continuity
purposes, we may maintain records of Aggregate Information for a period consistent with our dataretention policies. This Aggregate Information will be stored in our archival system and shall only beaccessible to a limited number of Thorlabs administrators in our worldwide organization.
If you close your account, we may retain your Personal Information but only for the purposes of
preventing fraud or future abuse, enforcing our rights, protecting against harm to the rights and propertyof Thorlabs and its users, and if required or permitted by law. All retained information will continue to be
subject to the terms of this privacy statement.
8.

SECURITY

To prevent unauthorized access or disclosure, maintain data accuracy, and ensure the appropriate useof information, Thorlabs implements physical, electronic, and managerial procedures to safeguard andsecure the information Thorlabs collects. Thorlabs uses encryption when collecting or transferring
sensitive Personally Identifiable Information. However, Thorlabs does not guarantee that unauthorizedthird parties will never defeat measures taken to prevent improper use of Personally Identifiable
Information.

Rev 1.0

6|P a g eInternal Thorlabs access to users’ non-public Personally Identifiable Information is restricted toThorlabs’s administrators and individuals on a need-to-know basis. These individuals are bound by
confidentiality agreements.
User passwords are keys to accounts. Use unique numbers, letters, and special characters forpasswords and do not disclose passwords to other people in order to prevent loss of account control.
Users are responsible for all actions taken in their accounts. Notify Thorlabs of any password
compromises, and change passwords periodically to maintain account protection.
9.

Children

Users represent they are of legal age to create binding and financial obligations for any liability users
may incur as a result of their use of the Sites. The Sites are not directed to children under the age of 13,
and Thorlabs will never request Personally Identifiable Information from anyone whom it knows to beunder the age of 13 without verifiable parental or guardian consent. Thorlabs does not knowingly collect,
or wish to obtain, Personally Identifiable Information from children. If Thorlabs becomes aware that auser is under the age of 13 and has provided Personally Identifiable Information without prior verifiable
parental or guardian consent, it will remove user’s Personally Identifiable Information from its files.
10.

Complaints

In compliance with the EU-US DPF and the UK Extension to the EU-US DPF, Thorlabs commits toresolve DPF Principles-related complaints about our collection and use of your Personally Identifiable
Information. EU and UK individuals with inquiries or complaints regarding our handling of personal data
received in reliance on the EU-US DPF and the UK Extension to the EU-US DPF should first contact
Thorlabs at:
Email: privacy@thorlabs.com
Telephone: 973-300-3000
Postal Mail:
Attn: Information Security Officer
Thorlabs, Inc.
43 Sparta Avenue
Newton, NJ 07860
Thorlabs will respond to individuals within 45 days of receiving a complaint.
Thorlabs has further committed to refer unresolved complaints concerning our handling of personal data
received in reliance on the EU-US DPF and the UK Extension to the EU-US DPF to the International
Centre for Dispute Resolution (the international division of the American Arbitration Association), an
alternative dispute resolution provider located in the United States. If you do not receive timely
acknowledgment of your EU-US DPF Principles-related complaint from us, or if we have not addressed
your EU-US DPF Principles-related complaint, please visit the International Centre for Dispute
Resolution for more information or to file a complaint: https://go.adr.org/dpf_irm.html. The services of
the International Centre for Dispute Resolution are provided at no cost to you.
Further, Thorlabs commits to cooperate and comply with the advice of the panel established by the EUdata protection authorities (DPAs), the UK Information Commissioner’s Office (ICO) and the Gibraltar
Regulatory Authority (GRA) with regard to unresolved complaints concerning our handling of personal
data received in reliance on the EU-US DPF and the UK Extension to the EU-US DPF.
For complaints regarding DPF compliance not resolved by any of the other DPF mechanisms, you havethe possibility, under certain conditions, to invoke binding arbitration. Further information can be found
on
the
U.S.
Department
ofCommerce’s
Data
Privacy
Frameworkwebsite:https://www.dataprivacyframework.gov/.

Rev 1.0

7|P a g e

11.

ENFORCEMENT

In the event Thorlabs becomes aware that the security of a Site has been compromised or user’s
Personally Identifiable Information has been disclosed to unrelated third parties as a result of external
activity, including but not limited to security attacks or fraud, Thorlabs reserves the right to takereasonable appropriate measures, including but not limited to, investigation and reporting, andnotification to and cooperation with law enforcement authorities.
If Thorlabs becomes aware that a user's Personally Identifiable Information has been disclosed in amanner not permitted by this Privacy Statement, Thorlabs will make reasonable efforts to notify theaffected user, as soon as reasonably possible and as permitted by law, of what information has been
disclosed, to the extent that Thorlabs knows this information.
12.

Contact us

If a user has comments or questions about Thorlabs.com's Privacy Statement, please contact:
Email: privacy@thorlabs.com
Telephone: 973-300-3000
Postal Mail:
Attn: Information Security Officer
Thorlabs, Inc.
43 Sparta Avenue
Newton, NJ 07860

Rev 1.0

8|P a g e