Compliance · GDPR
Privacy
SutureFinder is sold exclusively to dental professionals in Europe. This page explains what personal data we hold, why, and what you can ask us to do with it. Drafted in line with the EU General Data Protection Regulation (GDPR).
Placeholder. Final legal text is being reviewed by counsel before go-live. The structure below is correct; the wording will tighten.
1 · Data controller
Who decides what happens to your data.
The data controller for SutureFinder is Sensuum Dental, a brand of Eruditio Sensuum, registered in Waterloo, Belgium.
For any privacy question, request, or complaint, write to privacy@sensuum.eu. We aim to respond within 30 days.
2 · What we collect
The data we hold, and where it lives.
- Account email. Stored in our own database, used for sign-in and order notifications. Never used for marketing without your opt-in.
- Clinic name + shipping address. Collected at checkout, written to our order management system (Odoo). Never persisted in our own database.
- Order history. Your orders and their line items, visible at /orders. Backed by Odoo, mirrored for fast reads.
- Cart contents. Anonymous until checkout, then linked to your account. Stored against a session cookie.
- Transactional email. Order confirmations and Sensuum-team replies. Sent through AgentMail; copies retained in their infrastructure per their own retention policy.
3 · Why we collect it
Lawful basis under GDPR Article 6.
Contract
To fulfil orders you place, we need your email, clinic name, and shipping address. Without these we cannot ship sutures to you. (Article 6(1)(b).)
Consent
Marketing emails and any analytics cookies require your opt-in. You can withdraw consent at any time without affecting your orders. (Article 6(1)(a).)
Legitimate interest
We keep basic server logs and a session cookie to prevent fraud and keep the site secure. We balance this against your rights; logs are short-lived. (Article 6(1)(f).)
Legal obligation
Invoices, VAT records, and customs documents are kept as long as tax law requires (typically 6 years in the UK and EU). (Article 6(1)(c).)
4 · Cookies
The cookies we set, and why.
| Category | What this category does | Status |
|---|---|---|
| Strictly necessary | Cart session, sign-in session, and a one-shot flash cookie that powers the "Reorder added" banner. The site doesn't work without these. | Always on |
| Functional | Remembers preferences you set (locale, currency, view density). Optional. | Off until you opt in |
| Analytics | Anonymous usage statistics via Swetrix (self-hosted, EU). No personal data, no cross-site tracking, no fingerprinting. Cookie persists for 30 days. | Off until you opt in |
| Marketing | Ad pixels and re-engagement emails. Off by default; this category is reserved for future retargeting tools. | Off until you opt in |
Manage your choices on the cookie settings page. Includes a one-click "Reject all optional" and a "Withdraw all" link that appears when you've previously opted in. Choices are recorded for one year. We do not run third-party advertising or tracking pixels today.
5 · Third parties
Processors who handle data on our behalf.
- Odoo. Order management, partner records, shipping. Hosted within the EU. Data Processing Agreement in place.
- AgentMail. Transactional email (order confirmations, quote replies). Message content is retained per their policy.
- Better-Auth. Authentication. Passwords are hashed (bcrypt); we never see plaintext.
- Hosting provider. The SutureFinder application is hosted within the EU. Database backups encrypted at rest.
6 · Your rights
What you can ask us to do.
Access
Request a copy of the personal data we hold about you. We provide it within 30 days.
Rectification
Ask us to correct anything wrong. Email, clinic name, and shipping address can be updated on request.
Erasure
Ask us to delete your account. We will, except where tax or legal obligations require us to retain records.
Restriction
Ask us to pause processing while a question about accuracy or lawful basis is resolved.
Portability
Receive your order history in a machine-readable format (CSV or JSON).
Objection + complaint
Object to processing based on legitimate interest. You can also complain to your national data protection authority. For the UK, that's the ICO.
To exercise any of these, email privacy@sensuum.eu from the address on your account.
7 · Retention
How long we keep data.
- Account. Kept while your account is active. Deleted within 30 days of an erasure request.
- Orders + invoices. 6 years from the date of order, per UK / EU tax retention rules.
- Server logs. 30 days, then aggregated or deleted.
- Cart. Anonymous until checkout. Cleared on order placement; abandoned carts expire after 30 days.
8 · Contact
Questions or requests.
Write to privacy@sensuum.eu. We answer within 30 days. For complex requests we may ask for proof of identity to protect your data.
Last updated
26 August 2026
Substantive changes will be listed here with a date and a short note on what changed.