Privacy policy

Nordic Surgery Lab ApS is the data controller for this website.

This policy covers nordicsurgerylab.com only. Our products (PlastSurgeon, JPBRS, SurgAI and CoSurg) each have their own privacy and cookie policies.

The website is hosted on our own server in the EU (Hetzner Online GmbH, Germany). No personal data from this website is transferred outside the EU.

What we process when you contact us.

If you use the contact form, we receive the details you enter (such as your name, email address and message). We use them only to respond to your enquiry, on the basis of our legitimate interest in answering it (GDPR art. 6(1)(f)), and we keep them no longer than needed for that purpose.

Cookieless usage statistics with Umami, on our own server.

We measure how this website is used with Umami, an open-source analytics tool that we host ourselves on Nordic Surgery Lab's own server in the EU (analytics.nordicsurgerylab.com, hosted by Hetzner Online GmbH, Germany). It is cookieless: nothing is stored on your device (no cookies, no local storage), there is no cross-site tracking, and your IP address is not stored. A visit is identified only by a daily-rotating hash of IP address, browser and website that cannot be reversed.

We record page views and anonymous events such as which product link or contact channel was clicked. These events contain no personal data: no name, email, free text or user ID. The data stays on our server and is not shared with third parties. The legal basis is our legitimate interest in aggregated usage statistics (GDPR art. 6(1)(f)). Because nothing is stored on your device, no cookie consent is required under the Danish cookie rules (ePrivacy §3 / Cookiebekendtgørelsen), but you can object to this processing at any time by contacting us.

Processors: Nordic Surgery Lab ApS operates Umami itself; the server is hosted by Hetzner Online GmbH, Germany.

Access, rectification, erasure and objection.

Under the GDPR you can ask for access to the personal data we hold about you, have it corrected or erased, and object to processing based on our legitimate interests. Use the contact page to reach us. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).