Legal · Data protection
Privacy Policy
How Testora ApS processes personal data about private customers, business contacts, website visitors, recipients and people who contact us about products or safety.
Testora ApS
Testora ApS determines the purposes and means of the processing described here unless another role is expressly stated.
B2C and B2B
The policy covers private customers and identifiable people acting for companies, institutions, suppliers or recipients.
Send only what is needed
Do not send patient names, national identification numbers or unnecessary health information by ordinary email.
Data controller and contact
The data controller is Testora ApS, CVR 46447077, Ryparken 74, 1.th, 2100 Copenhagen Ø, Denmark. Privacy requests may be sent to support@testora.eu.
Who and what this policy covers
This policy covers visitors; private customers; account users; representatives, employees and delivery contacts connected with business customers; prospective customers; suppliers and professional contacts; people who contact support; and people connected with a product complaint or incident.
- Identity and contact data, such as name, email, telephone number and addresses.
- Account and organisation data, including login information, role, employer, company and VAT details supplied by the customer.
- Order, payment-status, invoice, delivery, return and support data. Testora does not need to receive full card details from the payment provider.
- Technical data, including IP address, browser/device information, cookie or storage identifiers, page activity, referral and campaign information.
- Product complaint and incident data, including product identifiers, batch or lot, chronology, photographs and consequences described by the reporter.
How data is collected
Data is received directly from you or your organisation through the website, account, checkout, forms, email and customer-service interactions. Technical data is produced when the website is used. Order-related status and delivery information can be received from payment, fulfilment, hosting, email, consent, analytics, transport and other service providers involved in the requested service.
Purposes and legal bases
The applicable basis depends on the purpose and the person concerned.
| Purpose | Typical data | Legal basis |
|---|---|---|
| Enquiries, accounts and purchase steps | Identity, contact, organisation, account and requested-product data | Steps requested before a contract, performance of a consumer contract, or legitimate interests in dealing with an organisation and its representatives |
| Orders, payment status, fulfilment, delivery, returns and support | Order, address, contact, transaction-status and correspondence data | Contract, legitimate interests and legal obligations, depending on the individual and transaction |
| Accounting, tax, fraud prevention and legal claims | Transaction, invoice, account, technical and correspondence data | Legal obligations and legitimate interests in protecting the business and establishing or defending claims |
| Product quality, traceability and safety | Product, order, batch/lot, chronology, reporter and relevant consequence data | Legal obligations and legitimate interests in product safety, quality and traceability |
| Optional analytics or marketing | Device, cookie/storage, page, referral and campaign data | Consent where required; otherwise only another basis that is valid for the exact activity |
Health and other sensitive information
A product complaint or incident can contain health information. Do not send patient names, national identification numbers, complete medical records or unrelated health details by ordinary email. Use a coded reference where possible. If additional sensitive information is genuinely required, Testora will identify an appropriate channel and the applicable legal basis and condition before requesting it.
Testora does not use a screening result or support message to make a solely automated decision that produces legal or similarly significant effects for the individual.
Cookies, local storage and optional measurement
The website uses cookies and similar technologies for language, consent, account, basket and security functions. Google Analytics and limited VisibilityKit AI-referral attribution are loaded only after the visitor selects the analytics category. Google Site Kit remains connected for reporting but does not independently insert its Analytics snippet. No Google or VisibilityKit request is intentionally made before analytics consent, and the trackers are excluded from account, basket and checkout routes. VisibilityKit is additionally excluded from product and product-category pages. See the Cookie Policy for the current inventory and how to reopen cookie settings.
Recipients and service providers
Data is shared only where relevant for the purpose. Recipient categories can include website hosting and maintenance providers, WordPress/WooCommerce and account tools, consent and analytics providers, payment and banking providers, email and form providers, warehouse and fulfilment providers, transport companies, professional advisers, insurers, auditors and public authorities. Each provider receives only the data needed for its role, subject to applicable contractual and legal safeguards.
International transfers
A provider may process data outside the European Economic Area. Where Chapter V of the GDPR applies, Testora must use a valid transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, and supplementary measures where required. Information about safeguards relevant to a particular request can be obtained using the contact details above.
Retention
Personal data is retained only for as long as needed for the relevant purpose and any legal, accounting, tax, product-safety, traceability, limitation or dispute requirement. Account and contact data is reviewed when the relationship ends. Order and accounting records follow statutory retention duties. Complaint and safety records are retained according to the product, role, risk and applicable regulatory obligations. Consent records and suppression information may be retained to demonstrate and respect choices. Data is then deleted or anonymised unless continued retention is required.
Your rights
Subject to the GDPR’s conditions and exceptions, you may request access, correction, deletion, restriction and portability; object to processing based on legitimate interests or direct marketing; and withdraw consent at any time. Withdrawal does not affect processing carried out before withdrawal. Testora may request proportionate information to verify identity and authority.
You may complain to the Danish Data Protection Agency, Datatilsynet, or another competent supervisory authority, including in the EU country where you live or work.
Security, changes and contact
Testora uses organisational and technical safeguards appropriate to the nature and risk of the processing, including access controls, encrypted connections, backups and provider-access restrictions. No internet service can guarantee absolute security. Contact Testora promptly if you suspect unauthorised access.
This policy is updated when material processing, systems or legal requirements change. The update date appears at the top of the page.
Exercise a privacy right
Explain the request and the email address or interaction it concerns. Do not send identity documents unless Testora asks for proportionate verification.