Skip to content
Dental Supplier Guide Supplier guide for dental practices

Type a supplier, a system or a topic.

    Privacy policy

    Page last reviewed

    This policy applies to the UK edition of Dental Supplier Guide. It explains how I handle personal data about suppliers in the guide and about you when you visit the site. Who the data controller is and how to contact me is further down.

    Why the GDPR applies

    The guide is run from Norway. The EU General Data Protection Regulation (GDPR) always applies to my processing, because the guide is run by a business established in Norway, in the European Economic Area. That is also the case when the information concerns businesses in the United Kingdom. I have no office, branch or other establishment in the United Kingdom.

    The UK GDPR

    The United Kingdom has its own data protection law, the UK GDPR and the Data Protection Act 2018. Under Article 3(2) UK GDPR it can apply in addition to the EU GDPR when a controller outside the United Kingdom processes personal data of people in the United Kingdom in connection with offering goods or services to them, or monitoring their behaviour in the United Kingdom.

    The UK edition lists companies only. It offers nothing to the listed suppliers and does not monitor them. The UK pages have no request form and no analytics tools. My current assessment is therefore that the UK GDPR probably does not apply to the UK edition as it works today.

    If I add a request form or analytics to the UK pages, or start selling services to dental practices in the United Kingdom, I will assess this again before the change. Where the UK GDPR then requires it, I will appoint a representative in the United Kingdom in writing (Article 27 UK GDPR), and the representative’s name and address will be given on this page.

    Two purposes

    • Supplier listings: finding, assessing and publishing information about suppliers to dental practices.
    • Operation and security: delivering the pages, see visits to the site.

    Each purpose is assessed separately, with its own legal basis. I do not use information about suppliers to contact them for sales purposes, and I do not share it with others.

    Companies only

    The UK edition lists companies only, so that it does not process information about individual people. A business is listed only if it is a private limited company (Ltd), a public limited company (PLC), a community interest company (CIC) or another company, or a limited liability partnership (LLP) whose name is a brand and not a person’s name. I treat the name of a company that is the brand of a listed group as a brand, even if it contains a founder’s name.

    These are not listed: sole traders, also when they use a trading name, ordinary partnerships, Scottish partnerships, limited partnerships, LLPs with a person’s name in their name, and companies with a person’s full name in their name unless it is the brand of a listed group.

    UK companies must show their company number and registered office on their own website. I read the company form and the company number only from the business’s own terms, privacy or footer page, and that is the first and only page I fetch for a new candidate. If the business is not eligible, or the form and the company number are not stated there, I fetch nothing more and store only the outcome and a code made from the company number or the web address, so that the business is not collected again.

    What I collect about suppliers

    • Business name with its company form, company number and registered office, as stated on the business’s own web pages.
    • Website address and a role email address the business has published on its website (such as info@ or sales@). It is used for information and corrections. It is not published and is not a condition for being listed.
    • Information about products, services, prices and delivery terms as stated on the business’s own pages and in public sources. For each fact I keep the web address, the date and a snapshot of the page as evidence.
    • My outcome for the business and a log of notices, objections, corrections and complaints.

    I do not collect names of contact persons, owners or staff, or personal email addresses, and I do not fetch team, about, leadership or contact pages. I never collect National Insurance numbers, Unique Taxpayer References, NHS numbers or General Dental Council registration numbers, and I do not collect VAT numbers.

    From Companies House I use only the company overview: company name, company number, registered office, status, company type, date of incorporation and SIC codes. I never use its pages or data about officers, persons with significant control, filing history, charges or insolvency, and I do not use its search.

    I do not use these sources, because they show people: websites that copy Companies House data, people-search and phone directory services, The Gazette, the General Dental Council register, Care Quality Commission location and provider pages, NHS «find a dentist» services, the Financial Conduct Authority register of individuals (firm pages only), the HMRC VAT number checker, LinkedIn and business contact databases. In the MHRA register of medical devices I look up only the exact name of a company that is already within scope. I do not use information from Google Places.

    What is published

    If a business is included, only this is published: the legal business name with its company form, the company number, the address (if the registered office is not clearly a business address, only the town or city), the website, and the documented information about products, services and prices, each with its source, its date and a label showing which statements are the business’s own claims. Nothing else is published.

    If an entry nevertheless turns out to identify a person, I either remove it or inform that person within one month, and earlier if I contact the person or publish the entry before then.

    Legitimate interests

    Supplier listings are based on legitimate interests (Article 6(1)(f) GDPR). The main points of my written assessment are below, and I will send you the full assessment if you ask by email to [email protected].

    • Legitimate interest: dental practice owners’ interest in finding and comparing suppliers on a documented basis, transparency in the market, suppliers’ interest in being described correctly, and my business interest in becoming known as a source and receiving enquiries from dental clinics.
    • Necessity: I collect only the information above and publish only the fields under what is published.
    • Balancing: the information concerns businesses that promote themselves to dental practices on their own websites, and it comes from those websites. It is not health information, not an assessment of anyone as a professional, not a ranking and not a paid placement. Ownership of the guide is stated on the about page, every fact has a source and a date, the business’s own claims are labelled, and errors can be corrected.

    How long information is kept

    • Businesses that are not included are deleted within 30 days of the decision. I keep only a code made from the company number or the web address, never from a personal identification number, so that the business is not collected again.
    • Businesses not yet decided are kept until they are decided.
    • Snapshots of pages that identify a person are kept for as long as a statement in the guide relies on them, at most 24 months. They are deleted if the entry is removed.
    • Other snapshots are kept for as long as the entry is published.
    • The email address from the business’s website is deleted when the business is not included or the entry is removed.
    • The log of notices, objections, corrections and complaints is kept for as long as the business or entry is registered, and three years after that.

    Who receives the information

    A published entry is public and can be read by anyone. Beyond that, I share information about suppliers only with my processors. Google Workspace (Gmail and Google Drive) is used for notices and for the evidence log. Notice emails are sent through Resend. The site is delivered by Cloudflare. Google, Cloudflare and Resend are US companies. Transfers to the United States are based on the EU–US Data Privacy Framework and the EU standard contractual clauses in the providers’ data processing agreements.

    Objection and removal from the guide

    I handle requests about an entry through correct a fact or by email to [email protected]. You get a confirmation within two working days and an answer within ten working days.

    • You have the right to object to my processing of information about you on the basis of legitimate interests. I assess such an objection under Article 21(1) GDPR. If I reject an objection, there must be compelling legitimate grounds, and the assessment is made in writing. The company form never decides the outcome on its own.
    • It is my practice, as a voluntary editorial rule, to remove an entry that identifies you as a person from the guide if you ask. I do not claim that the law always gives a right to be removed.
    • If an entry is removed, it disappears from the next edition of the guide, and the snapshots are deleted. I keep only the code that prevents the business from being collected again.
    • I do not use the information for direct marketing. If that ever changes, you have an unconditional right to object to it at any time (Article 21(2) and 21(3) GDPR), without giving reasons.
    • A company that does not identify a person uses the correction route for errors. If the company wants to be removed, I assess that on editorial criteria.

    If you think the UK GDPR applies to you, you can also send me a complaint about how I handle your personal data, by email to [email protected] or by post to the address below. I handle it within the same time limits.

    Visits to the site

    The site is delivered by Cloudflare Pages through Cloudflare’s network. To deliver and protect the pages, Cloudflare processes your IP address and the details of the request itself. The legal basis is a legitimate interest in secure operation (Article 6(1)(f) GDPR). Cloudflare’s own logs follow Cloudflare’s terms, and I do not retrieve them.

    The UK pages use no analytics tools, set no cookies and have no request form. Cloudflare counts page views and visits when it delivers the pages. This happens on the server, without anything being read from or stored in your browser, and I see only totals.

    Automated decisions

    I make no decisions about you based solely on automated processing and create no profiles of you.

    Data controller and your rights

    Data controller: Dental Markedsføring (Ole Tom Pettersen), Norwegian organisation number 920 246 540, Hans Nordahls gate 76, 0485 Oslo, Norway. Email: [email protected].

    You can ask for access, correction, deletion or restriction of processing, and you can object as described above. I answer within one month.

    You can complain to the Norwegian Data Protection Authority (Datatilsynet). I am established in Norway, so under the EU GDPR Datatilsynet is the authority for your complaint; since Brexit, the United Kingdom has no supervisory authority under the EU GDPR. Datatilsynet’s online form is in Norwegian and requires a Norwegian electronic ID, so from the United Kingdom you can write to Datatilsynet, P.O. Box 458 Sentrum, 0105 Oslo, Norway.

    If you think the UK GDPR also applies, you can contact the Information Commissioner’s Office (ICO), telephone 0303 123 1113. The ICO asks people to raise a concern with the organisation first in most cases, so please contact me first.