FillerDepot is the controller of the personal data described in this policy. That means we decide why and how your data is used, and we are responsible for protecting it.

This policy explains what personal data we collect when you visit fillerdepot.com, create an account, place an order, contact us or subscribe to our newsletter — why we use it, who we share it with, how long we keep it, and what rights you have.

We sell exclusively to licensed healthcare professionals and clinics, so most of the data we hold relates to you in a professional capacity.

How we use cookies is covered separately in our Cookie Policy.

Data you give us

• Identity and contact details — name, email address, phone number, professional position.
• Company details — company name, address, VAT number, company registration number.
• Business identifier — for customers in Sweden, your company registration number (organisationsnummer); where you trade as a sole trader (enskild firma) this is the same as your personal identity number (personnummer). For customers elsewhere in the EU we collect your VAT number, and for customers outside the EU your official company registration number.
• Professional documentation — licences, certificates and registration details used to verify that you are qualified to purchase our products.
• Order and payment information — the products you order, delivery address, invoice details and payment method. We do not store full card numbers.
• Correspondence — messages you send us by email, chat or phone.

Data we collect automatically

• Technical data — IP address, browser and device type, and how you use the site.

Data we receive from others

• Credit information about your business — from Creditsafe, which we access through our accounting system Fortnox, where you apply to pay by invoice.
• Company and VAT verification — from the EU VIES system and official company registers.

We only use your personal data where the law gives us a basis to do so.

• To process and deliver your order — necessary to perform our contract with you.
• To create and manage your account — necessary to perform our contract with you.
• To verify your professional qualifications — our legitimate interest in ensuring that professional-use products are supplied only to appropriate professional purchasers, and where applicable to comply with legal and regulatory requirements governing the sale and distribution of our products.
• To assess creditworthiness where you ask to pay by invoice — steps prior to entering a contract, and our legitimate interest in avoiding payment losses.
• To provide customer support — to perform our contract, and our legitimate interest in answering enquiries.
• To keep accounting records — a legal obligation under the Swedish Bookkeeping Act.
• To send marketing emails — your consent, which you may withdraw at any time.
• To measure and improve the website using statistics and marketing cookies — your consent.
• To identify and diagnose technical errors — our legitimate interest in maintaining the security, reliability and proper functioning of our website.
• To prevent fraud and keep the site secure — our legitimate interest in protecting our business and our customers.

Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You can ask us for a summary of that assessment.

Credit assessment for invoice payment

If you apply to pay by invoice, we obtain credit information about your business from Creditsafe, which we access through our accounting system Fortnox. The decision is always made by a member of our team, not automatically by a system. If invoice payment is not offered to you, you can pay by card instead, and you are welcome to contact us to discuss it.

Some of the information we ask for is necessary for us to do business with you. We need it to create your account, to verify that you are eligible to buy products intended for professional use, to process and deliver your orders, to assess an application to pay by invoice, and to meet our legal obligations.

If you choose not to provide that information, we may not be able to open an account for you, accept your order, offer invoice payment, or provide some of our services. Where information is optional, we say so at the point we ask for it.

We do not sell your personal data. We share it only with the following recipients, and only as far as they need it:

• Nets — to process card payments (Visa and Mastercard).
• Creditsafe — to provide credit information when you apply to pay by invoice.
• Fortnox — our accounting and invoicing system.
• Companies that purchase or finance our invoices — where an invoice is transferred, you will be told who to pay before any payment is due.
• PostNord and DHL — to deliver your order.
• Omnisend — our email marketing platform.
• Google — website statistics and advertising measurement, where you have consented.
• Sentry — technical error monitoring.
• Cloudflare — site security and content delivery.
• Our hosting and IT providers — who keep the website and our systems running.
• Our external accountants and auditors — for bookkeeping and statutory reporting.
• Public authorities — where we are legally required to disclose information.

Where a supplier processes personal data on our behalf as a processor, we have a written data processing agreement in place requiring it to protect the data and process it only in accordance with our instructions. Some recipients may instead process personal data as independent controllers for their own legally defined purposes.

Some of our suppliers — including Google, Omnisend and Sentry — may process personal data outside the EU/EEA. Where that happens, we rely on one of the safeguards permitted by the GDPR: where the recipient is eligible, the European Commission’s adequacy decision for organisations participating in the EU–US Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission, together with any additional measures required for the transfer.

You can ask us which safeguard applies to a specific transfer, and we will tell you.

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

• Order and accounting records — until the end of the seventh year following the calendar year in which the relevant financial year ended, as required by the Swedish Bookkeeping Act (bokföringslagen, 7 kap. 2 §).
• Account data — while your account is active, then 12 months after you close it or after your last order.
• Professional verification records — while your account is active and afterwards for as long as reasonably necessary to document compliance with applicable product and professional-use requirements. Where your licence can be confirmed against an official register, we record the result of that check and delete the uploaded document.
• Customer support correspondence — 24 months after the matter is closed.
• Marketing data — until you withdraw your consent or unsubscribe.
• Cookie data — for the periods set out in our Cookie Policy.

Under the GDPR you have the following rights. They are generally free to exercise. We will normally respond within one month, although the GDPR allows us to extend this period in certain cases.

• Access — to be told whether we hold data about you, and to receive a copy of it.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have your data deleted, where we have no continuing legal reason to keep it. Accounting records are one such reason.
• Restriction — to have us pause our use of your data while a dispute about it is resolved.
• Portability — to receive the data you gave us in a machine-readable format, or have it sent to another provider.
• Objection — to object to processing we base on legitimate interests. You may object to direct marketing at any time, and we will stop.
• Withdrawal of consent — at any time, without affecting processing carried out beforehand.

To exercise any of these, email [email protected]. We may need to verify your identity first.

If you think we are handling your personal data incorrectly, please contact us first — we would rather fix it. You also have the right to complain to the Swedish supervisory authority at any time:

We update this policy when our processing changes or the law does. The date at the top of the page shows when it was last revised. If we make a significant change, we will tell you directly where we can.

For any question about this policy or your personal data:

Cookies are small text files stored on your device when you visit our website. Similar technologies such as pixels and local storage work in comparable ways, and we refer to all of them as “cookies” throughout this policy.

Cookies that are strictly necessary to deliver the service you have requested are placed without your consent, as permitted by Chapter 9, Section 28 of the Swedish Electronic Communications Act (lag (2022:482) om elektronisk kommunikation).

All other cookies are placed only after you have given your consent. Where those cookies involve the processing of personal data, our legal basis is your consent.

Required for the website to work, and cannot be switched off. They keep you logged in, secure your session, remember the contents of your shopping cart, and protect the site against automated abuse. Set by WordPress, WooCommerce and Cloudflare, and lasting from the end of your browsing session up to one year.

Two cookies control which currency prices are shown in. One stores the currency you have selected, and the other stores country information used to choose a default currency. Both expire at the end of your session.

Preference cookies are not strictly necessary, so they are placed only after you have given your consent to preference cookies.

We use Google Analytics to understand how visitors use the site so we can improve it. Its cookies distinguish visitors from one another and maintain session state, lasting between 24 hours and two years. They process personal data including your IP address and a device identifier, and are set only if you consent to statistics cookies.

We use Omnisend for email marketing and Google for advertising measurement. Their cookies identify your session, attribute orders to campaigns and measure advertising performance, lasting between 30 minutes and 90 days. They are set only if you consent to marketing cookies.

We use Sentry to monitor technical errors on the website. It does not set cookies, but it records technical information including your IP address when an error occurs, so that we can keep the site working correctly.

Google, Omnisend and Sentry may process data outside the EU/EEA. Where they do, we rely on the safeguards permitted by the GDPR: where the recipient is eligible, the European Commission’s adequacy decision for organisations participating in the EU–US Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission, together with any additional measures required for the transfer. Contact us if you would like details of the safeguard applied to a specific transfer.

You can change or withdraw your cookie consent at any time, and it is as easy to withdraw as it was to give. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

You can also delete cookies already stored through your browser settings at any time, though this may affect how the website works.

For any question about our use of cookies:

How we handle personal data more generally is set out in our Privacy Policy.