Privacy Policy

1. Who is responsible

Data controller: MetaDac FZE, Al Shmookh Business Center, One UAQ, UAQ Free Trade Zone, Umm Al Quwain 566146, United Arab Emirates — privacy@metadac.io

This policy explains how we handle personal data when you visit dacos.dental, buy from our online store, use DACademy or contact us. It covers our website, our Shopify-hosted store and checkout, and our support and technical services. Where our store platform processes data for its own purposes, this is described in Section 4.

2. What we collect, why, and on what basis

We do not knowingly collect data from children. Do not send us patient-identifying information — remove identifiers from case images before submitting.

3. Who we share it with

We do not sell or rent your personal data. We share it only with these categories of recipients, and only as necessary:

• payment service providers — payment and refunds;

• Shopify — our online store is hosted on Shopify, which processes your order and account data on our behalf in order to operate the store and checkout, and which may transfer data to its own service providers in other countries;

• our fulfilment and warehousing partner in Italy — picking, packing, dispatch;

• carriers and customs brokers (including FedEx and Poste Italiane) — delivery and customs clearance; for international shipments this necessarily includes providing your name, address, contact details and importer identification to the destination country's customs authority;

• e-commerce, hosting and IT infrastructure providers — operating the store, our platforms and email delivery;

• analytics and advertising providers — only where you have consented; named in the Cookie Policy;

• professional advisers and authorities — where required by law or to establish, exercise or defend legal claims.

Processors act on our documented instructions under a data processing agreement.

4. Our store platform (Shopify)

Our online store is hosted by Shopify, which collects and processes personal information about your access to and use of the store in order to provide and improve it. Information you submit in the store is transmitted to and shared with Shopify, and with third parties that may be located in countries other than the one you live in.

We also use certain Shopify enhanced features that draw on data about your interactions with our store, with other merchants and with Shopify. For those features Shopify is responsible for the processing of your personal information, including for responding to requests you make about that use. To learn more, see the Shopify Consumer Privacy Policy at privacy.shopify.com/en, where you can also exercise the rights available to you in respect of data processed by Shopify.

Where you reside in a region granting the right to opt out of the sale or sharing of personal information for targeted advertising, you can exercise that right for Shopify-supported personalised advertising through the opt-out link shown in our store and checkout, and for our own advertising as described in Section 10.

5. International transfers

MetaDac FZE is established in the United Arab Emirates, which is not covered by an EU adequacy decision, and personal data is accessed and stored there as well as in the EU.

Where personal data is transferred outside the EEA we rely on the Standard Contractual Clauses adopted by the European Commission, with supplementary measures where required, or on Article 49(1)(b) GDPR where the transfer is necessary to perform your contract — for example sending your address to a carrier or customs authority outside the EEA to deliver your order. A copy of the safeguards is available on request at privacy@metadac.io.

6. Your rights

You have the right to access your data and receive a copy, to rectify inaccurate data, to erase it where no legal retention obligation applies, to restrict processing, to object to processing based on legitimate interests and to direct marketing at any time, to data portability, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. We do not carry out automated decision-making producing legal or similarly significant effects.

Write to privacy@metadac.io. We respond within one month, extendable by two months for complex requests, and we will tell you if that happens. We may ask you to verify your identity.

Complaints. You may lodge a complaint with a supervisory authority in your country of residence, work, or where the alleged infringement occurred. In Italy: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma — garanteprivacy.it.

7. Cookies

Non-essential cookies — including analytics and advertising — are set only with your consent, collected through the cookie banner and changeable at any time via Cookie settings in the site footer. Details are in the DACOS Cookie Policy.

8. Security

We use appropriate technical and organisational measures including encryption in transit, need-to-know access controls and contractual security commitments from our processors. No system can be guaranteed completely secure. Where a breach is likely to result in a high risk to your rights we notify you and the competent supervisory authority as required by Articles 33 and 34 GDPR.

9. Third-party sites

We are not responsible for the privacy practices of sites we link to.

10. Residents of California and other US states

You also have the right to know what personal information we collect and why, to request deletion or correction, and to be free from discrimination for exercising these rights.

We do not sell personal information for money. Our use of advertising and analytics technologies — where you have permitted them — may constitute "sharing" or a "sale" for cross-context behavioural advertising under some US state laws. You can opt out at any time by:

• rejecting marketing cookies via Cookie settings on our website;

• using the opt-out link shown in our store and checkout, for advertising supported by our store platform (Section 4); or

• writing to privacy@metadac.io with the subject "Do Not Sell or Share My Personal Information".

Where you visit our website with the Global Privacy Control preference signal enabled, we treat this as an opt-out request for that device and browser. We do not recognise other "Do Not Track" signals.

We will not discriminate against you for exercising these rights. We may need to verify your identity before acting on a request. You may designate an authorised agent to make a request on your behalf; we will require proof of that authorisation.

11. Changes

We may update this policy to reflect changes in our operations, services or legal obligations. The current version and effective date are always published at dacos.dental.

privacy@metadac.io — MetaDac FZE, Al Shmookh Business Center, One UAQ, UAQ Free Trade Zone, Umm Al Quwain 566146, United Arab Emirates