Privacy policy.
How we process data.

1. Data controller

Cosmodent AB
Company registration no. 556551-9344
Hyllie Boulevard 6E
216 26 Malmö
Sweden
Email: contact@cosmodent.se

Cosmodent is the data controller for processing that concerns our customers (clinics and their contact persons), suppliers, and website visitors.

When a clinic sends us patient-related case material (for example intraoral scans, photographs, bite registrations or work instructions), we generally process that data as a processor on behalf of the clinic. The clinic remains the controller of the patient data. That processing is governed by our agreement with the clinic and follows the clinic’s instructions.

2. Who this policy covers

• Visitors to www.cosmodent.se
• People who submit forms, email us, or contact us by phone or WhatsApp
• People who see or click Cosmodent advertising on dental media, including Dental24
• Contact persons at dental clinics and partners
• Supplier contacts

Our website and services are intended for dental professionals, not for children.

3. Personal data we process

Website and contact

• Name, clinic, role, email, phone number and message content
• Technical data such as IP address, browser, device and timestamp, where generated by use of the site or a form submission
• A record when you accept the privacy policy on a form (timestamp, IP address and page URL)
• A consent log when you agree to WhatsApp or SMS contact (timestamp, IP address and page URL)

Advertising on dental media

• Campaign reports from the publisher (for example impressions, clicks and which banner was shown), usually in aggregated form
• If you click through to www.cosmodent.se: the landing page, campaign parameters in the link, and, only if you have accepted Analytics, that the visit came from that campaign

Customer and case administration

• Clinic contact and delivery details
• Order, case and communication history
• Invoice and payment details

Laboratory cases

• Digital impressions, models, photographs, design files and technical instructions sent by the clinic
• Information that can be linked to a patient to the extent the clinic includes it in the case material

We do not collect more data than we need to respond, produce, deliver, invoice and meet legal requirements.

4. Purposes and legal bases

5. Special category data

Laboratory material may include health-related data. We process such data only when needed to perform the clinic’s assignment, and generally as a processor. We do not use it for marketing.

6. Who we share data with

We do not sell personal data. We disclose data to:

• IT and operations providers, such as web hosting and systems for email and file handling
• Google LLC, if you have consented to Google Analytics
• Dental media publishers we advertise with, including Dental24, for serving and reporting on those ads
• Digital dental workflow and CAD/CAM providers, where required for design and production
• WhatsApp/Meta, if you have consented to communication that way
• Accounting, payment and debt-collection providers when needed to bill or recover a claim
• Public authorities, if we are legally required to do so

Providers that process personal data on our behalf do so under a data processing agreement and our instructions.

The website is hosted by One.com. Personal data you submit via the site is stored in One.com’s environment.

7. Transfers outside the EEA

Our starting point is to process data within the EU/EEA. Some tools, including WhatsApp and Google Analytics (if you consent), may involve processing in a country outside the EEA, including the United States.

Where such a transfer takes place, we use the safeguards required by the GDPR, primarily the European Commission’s standard contractual clauses and any supplementary measures provided by the vendor. You can request more information at contact@cosmodent.se.

8. Retention

• Contact forms and general correspondence: up to 2 years after the dialogue ends, unless a longer period is needed for an active matter.
• WhatsApp consent and related service messages: up to 2 years, or until you withdraw consent and the data is no longer needed to show what was agreed.
• Customer and case history needed for production, complaints and follow-up: for the duration of the customer relationship and up to 2 years thereafter, unless a longer period is required below.
• Invoices and accounting records: 7 years after the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act.
• Patient-related laboratory material: according to the agreement with the clinic and for as long as needed for production, traceability and any complaints.
• Technical logs: only as long as needed for operations and security.
• Google Analytics: according to the retention period set in Analytics, and not longer than 14 months. Withdrawn consent stops further collection; data already sent remains until that period ends.
• Advertising campaign reports: as long as needed to settle and evaluate the campaign, typically up to 2 years.

9. Cookies

The site works without Analytics. Cloudflare Turnstile on forms is a security check, not a marketing cookie, and is treated as necessary for those forms.

A strictly necessary cookie (cosmodent-lang) remembers English, Swedish or Danish. On a first visit we read the country from the CDN edge (Cloudflare) to pick a language: Sweden → Swedish, Denmark → Danish, otherwise English. We do not store your IP for this. You can change language at any time in the header.

Google Analytics 4 (measurement ID G-BYP4NLGZ97) is used only after you click Accept on the cookie bar. It is not loaded if you Reject. You can change the choice at any time via Cookies in the footer. Analytics is used to understand visits, not to serve ads. Google LLC may process the data in the United States under the safeguards described in section 7.

Cookies set after Accept:

We also place banners on dental media such as Dental24. Cookies and tracking used to show and count those ads sit on the publisher’s website, not on www.cosmodent.se. Their cookie notice governs that. If you click a Cosmodent banner and land here, the link may carry a campaign parameter. We do not load extra advertising pixels on this site. If you have accepted Analytics, that visit can be attributed to the campaign; if you have not, the banner still works and we do not measure the visit in Analytics.

10. Security

We apply technical and organisational measures to protect personal data against unauthorised access, loss and unlawful disclosure. Access to case and customer data is limited to staff who need it for their work.

11. Your rights

Where Cosmodent is the controller, you have the right, within the limits of the GDPR, to:

• request access to your data
• request rectification
• request erasure
• request restriction of processing
• object to processing based on legitimate interest
• receive data in a portable format (data portability) where processing is based on contract or consent and is carried out by automated means
• withdraw consent without affecting processing that took place before the withdrawal

Send requests to contact@cosmodent.se. We may need to verify your identity. If the request concerns patient data sent to us by a clinic, we will generally refer you to the clinic, which is the controller of that data.

12. Complaints

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.

13. Changes

We update this policy when our operations, vendors or legal requirements change. The new version is published on this page with an updated date. If a change is material, we inform affected customers in an appropriate way.

14. Contact

Privacy questions: contact@cosmodent.se.