Privacy and Cookie Statement Ordentic B.V.

1. Company details

1. Ordentic B.V.
   Postbus 69
   3850AB Ermelo
   The Netherlands

2. Chamber of Commerce number: 98641913

3. VAT number: NL868581264B01

4. Email address: support@ordentic.com

5. Website: https://ordentic.com

6. Data controller: Ordentic B.V.

2. Personal data we process

We process personal data of:

1. Suppliers

2. Users

3. Website visitors

This includes, among other things:

1. Identification and contact details: name, company name, registration number, address, email, telephone number, Chamber of Commerce number, VAT number

2. Financial data: bank account number, payment information via Stripe Payments

3. Technical data: IP address, browser data, device ID, login data

4. Communication data: messages via email, contact form or chat

5. Communication preferences and cookie data

We collect this data directly from you or through your use of our website and services.

Our services are intended solely for business users and adults. We do not process personal data of persons under the age of 18.

3. Purposes of processing

1. Performance of agreements (accounts, orders, payments)

2. Customer service and support

3. Legal obligations (tax administration, bookkeeping)

4. Marketing and communication (with consent)

5. Security, fraud prevention and platform management

6. Analysis and improvement of our services

4. Lawful basis for processing

Ordentic processes personal data only where a valid lawful basis exists as referred to in article 6 of the General Data Protection Regulation (GDPR). We base our processing on the following grounds:

1. Performance of a contract (art. 6(1)(b) GDPR)

   Insofar as this is necessary for the performance of agreements in which Ordentic acts as a platform, including creating and managing accounts, processing orders, communication about our services and invoicing.

2. Legal obligation (art. 6(1)(c) GDPR)

   Where Ordentic is required by laws and regulations to process personal data, for instance for tax and administrative obligations.

3. Consent (art. 6(1)(a) GDPR)

   For specific processing that requires consent, such as sending newsletters and placing marketing and tracking cookies. Consent can be withdrawn at any time.

4. Legitimate interest (art. 6(1)(f) GDPR)

   Where processing is necessary for the legitimate interests of Ordentic, such as improving and securing the platform, performing analyses and statistics, fraud prevention and limiting abuse. In each case a careful balancing of interests is made, taking the privacy of data subjects into account.

5. Sharing data with third parties

We share personal data with third parties only where this is necessary for the performance of our services or for legal obligations.

For specific parts of our services we use third parties such as Stripe Payments (payments), Intercom (customer support), Featurebase (feedback) and analytics providers.

We have concluded data processing agreements with all of these parties that comply with the GDPR.

Where data is processed outside the EU/EEA, we ensure that this takes place on the basis of standard contractual clauses or an equivalent level of protection.

6. Retention periods

1. Account data: as long as the account is active + 2 years

2. Invoice data: 7 years (statutory tax period)

3. Communication: 2 years

4. Cookie and analytics data: at most 14 months

5. Newsletter data: until unsubscribed

7. Processing of uploaded purchase invoices

Through our platform, and through campaigns in which we ask for invoices, you can upload purchase invoices from dental suppliers. This section explains what we do with them.

Purposes. We use uploaded purchase invoices to:

1. improve our matching model, so that products on an invoice are recognised more accurately;

2. spot gaps in our assortment;

3. compare prices.

Means of processing. An uploaded invoice is parsed automatically, including by AI. Ordentic staff also review the invoice and the result of that parsing. For the parsing we use an external AI service provider, with which a data processing agreement is in place. We do not take automated decisions that have legal effects for you.

Lawful basis. We process uploaded purchase invoices on the basis of your consent (art. 6(1)(a) GDPR). You give that consent when you upload, and you can withdraw it at any time via support@ordentic.com. Withdrawal applies to future use and does not affect the lawfulness of processing carried out before it.

Retention. Invoices we reject, or that are never linked to an account, are deleted within 90 days, including the uploaded file itself. Invoices that are approved and linked become part of the purchase history of your account and follow the retention periods in section 6.

Data categories. This concerns business data (practice or company name, address, email address, invoice number and invoice date) and supplier data (the supplier, the product lines, quantities and prices). We do not ask for special categories of personal data or for patient data, and we do not process them in this context. Please do not upload documents containing such data.

8. Security of personal data

Ordentic takes appropriate technical and organisational measures, including SSL encryption, secured servers and limited access to personal data.

Our staff are bound by a duty of confidentiality and are given access only to data that is necessary for their role.

9. Your rights

You have the right of access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

Contact us at support@ordentic.com. You will receive a response no later than one month after we receive your request. Where necessary, this period can be extended by two months.

You can also lodge a complaint with the Dutch Data Protection Authority or the Data Protection Authority (BE).

You can object at any time to the use of your data for direct marketing. After your objection we will no longer process your data for that purpose.

10. Cookies

Ordentic uses functional cookies and privacy-friendly analytics cookies. These cookies are necessary for the correct functioning and improvement of the platform.

Functional cookies are used for, among others:

1. user authentication and session management

2. account security

3. remembering user settings

We also use analytics services such as Google Analytics and Vercel Analytics to understand how our platform is used. These analytics cookies are deployed in a privacy-friendly way and have no, or only a minor, impact on the privacy of users.

No data is used for advertising purposes and IP addresses are anonymised.

Third parties such as Stripe Payments, Intercom and Featurebase may place functional cookies that are necessary for payment processing, customer support and user feedback respectively.

11. Changes to this statement

We reserve the right to amend this statement.

The current version can always be found at https://ordentic.com/legal/privacy-policy.

12. Contact

For questions about this statement:

1. Email: support@ordentic.com

2. Address: Postbus 69, 3850AB Ermelo, The Netherlands