Skip to content
Dental Supplier Guide Supplier guide for dental clinics

Type a supplier, a system or a topic.

    Privacy policy

    Page last reviewed

    This policy applies to the US edition of Dental Supplier Guide. It explains how I handle personal data about suppliers in the guide and about you when you visit the site. Who the data controller is and how to contact me is further down.

    Why the GDPR applies

    The guide is run from Norway. The EU General Data Protection Regulation (GDPR) applies to my processing because I am established in Norway (Article 3(1) GDPR), also when the information concerns people or businesses in the United States. I have no establishment in the United States.

    Two purposes

    • Supplier listings: finding, assessing and publishing information about suppliers to dental practices.
    • Operation and security: delivering the pages, see visits to the site.

    Each purpose is assessed separately, with its own legal basis. I do not use information about suppliers to contact them for sales purposes, and I do not share it with others.

    Companies only

    The US edition lists companies only, so that it does not process information about individual people. A business is listed only if it is a corporation (for example Inc., Corp. or Co.), or an LLC, LP or LLP whose name is a brand and not a person’s name. I treat the name of a corporation that reports to the US Securities and Exchange Commission as a brand, even if it contains a founder’s name.

    These are not listed: sole proprietorships, also when they use a trade name (DBA), general partnerships, and LLCs, PCs and PLLCs with a person’s name or a professional degree in their name.

    I read the company form only from the business’s own terms, privacy or footer page, and that is the first and only page I fetch for a new candidate. If the business is not eligible, or the form is not stated there, I fetch nothing more and store only the outcome and a code made from the web address, so that the business is not collected again.

    What I collect about suppliers

    • Business name with its company form, and address, as stated on the business’s own web pages.
    • Website address and a role email address the business has published on its website (such as info@ or orders@). It is used for information and corrections. It is not published and is not a condition for being listed.
    • Information about products, services, prices and delivery terms as stated on the business’s own pages and in public sources. For each fact I keep the web address, the date and a snapshot of the page as evidence.
    • My outcome for the business and a log of notices, objections and corrections.

    I do not collect names of contact persons, owners or staff, or personal email addresses, and I do not fetch team, about, leadership or contact pages. I never collect Social Security numbers, Employer Identification Numbers (EIN), National Provider Identifiers (NPI) or state license numbers. I do not use people-search services, business contact databases, state business registry searches, the NPI registry, state dental board lookups, review sites or LinkedIn, and I do not use information from Google Places. From FDA and SEC records I use company fields only, never information about people.

    What is published

    If a business is included, only this is published: the legal business name with its company form, the address (if the address is a home, only the city and state), the website, and the documented information about products, services and prices, each with its source, its date and a label showing which statements are the business’s own claims. No identification number is published. Nothing else is published.

    If an entry nevertheless turns out to identify a person, I either remove it or inform that person within one month, and earlier if I contact the person or publish the entry before then.

    Legitimate interests

    Supplier listings are based on legitimate interests (Article 6(1)(f) GDPR). The main points of my written assessment are below, and I will send you the full assessment if you ask by email to [email protected].

    • Legitimate interest: dental practice owners’ interest in finding and comparing suppliers on a documented basis, transparency in the market, suppliers’ interest in being described correctly, and my business interest in becoming known as a source and receiving inquiries from dental clinics.
    • Necessity: I collect only the information above and publish only the fields under what is published.
    • Balancing: the information concerns businesses that promote themselves to dental practices on their own websites, and it comes from those websites. It is not health information, not an assessment of anyone as a professional, not a ranking and not a paid placement. Ownership of the guide is stated on the about page, every fact has a source and a date, the business’s own claims are labeled, and errors can be corrected.

    How long information is kept

    • Businesses that are not included are deleted within 30 days of the decision. I keep only a code made from the web address, never from an identification number, so that the business is not collected again.
    • Businesses not yet decided are kept until they are decided.
    • Snapshots of pages that identify a person are kept for as long as a statement in the guide relies on them, at most 24 months. They are deleted if the entry is removed.
    • Other snapshots are kept for as long as the entry is published.
    • The email address from the business’s website is deleted when the business is not included or the entry is removed.
    • The log of notices, objections and corrections is kept for as long as the business or entry is registered, and three years after that.

    Who receives the information

    A published entry is public and can be read by anyone. Beyond that, I share information about suppliers only with my processors. Google Workspace (Gmail and Google Drive) is used for notices and for the evidence log. Notice emails are sent through Resend. The site is delivered by Cloudflare. Google, Cloudflare and Resend are US companies. Transfers to the United States are based on the EU–US Data Privacy Framework and the EU standard contractual clauses in the providers’ data processing agreements.

    Objection and removal from the guide

    I handle requests about an entry through correct a fact or by email to [email protected]. You get a confirmation within two business days and an answer within ten business days.

    • You have the right to object to my processing of information about you on the basis of legitimate interests. I assess such an objection under Article 21(1) GDPR. If I reject an objection, there must be compelling legitimate grounds, and the assessment is made in writing. The company form never decides the outcome on its own.
    • It is my practice, as a voluntary editorial rule, to remove an entry that identifies you as a person from the guide if you ask. I do not claim that the law always gives a right to be removed.
    • If an entry is removed, it disappears from the next edition of the guide, and the snapshots are deleted. I keep only the code that prevents the business from being collected again.
    • I do not use the information for direct marketing. If that ever changes, you have an unconditional right to object to it at any time (Article 21(2) and 21(3) GDPR), without giving reasons.
    • A company that does not identify a person uses the correction route for errors. If the company wants to be removed, I assess that on editorial criteria.

    Visits to the site

    The site is delivered by Cloudflare Pages through Cloudflare’s network. To deliver and protect the pages, Cloudflare processes your IP address and the details of the request itself. The legal basis is a legitimate interest in secure operation (Article 6(1)(f) GDPR). Cloudflare’s own logs follow Cloudflare’s terms, and I do not retrieve them.

    The US pages use no analytics tools and set no cookies. Cloudflare counts page views and visits when it delivers the pages. This happens on the server, without anything being read from or stored in your browser, and I see only totals.

    Automated decisions

    I make no decisions about you based solely on automated processing and create no profiles of you.

    Data controller and your rights

    Data controller: Dental Markedsføring (Ole Tom Pettersen), Norwegian organization number 920 246 540, Hans Nordahls gate 76, 0485 Oslo, Norway. Email: [email protected].

    You can ask for access, correction, deletion or restriction of processing, and you can object as described above. I answer within one month.

    You can complain to the Norwegian Data Protection Authority (Datatilsynet). There is no GDPR supervisory authority in the United States, and I am established in Norway, so Datatilsynet is the authority for your complaint. Its online form is in Norwegian and requires a Norwegian electronic ID, so from the United States you can write to Datatilsynet, P.O. Box 458 Sentrum, 0105 Oslo, Norway.