Privacy Policy
Last updated: 24 October 2026
1. Who we are
SmileyWorks is a trading name of JTPD Limited, company no. 11581100, registered office Bryn Road Surgery, Cefn Fforest, Blackwood NP12 3NA.
- JTPD Limited ("SmileyWorks", "we", "us") is the controller of the personal data described in this policy.
- ICO registration number: ZA618423
- How to contact us about privacy:
- the form on our Contact page
- WhatsApp on +44 7549 533823
- by post to JTPD Limited, Bryn Road Surgery, Cefn Fforest, Blackwood NP12 3NA
Our website is for dental professionals. It isn't aimed at patients or children.
2. What this policy covers
This policy covers the personal data we collect when you:
- visit dentallab.co.uk
- fill in one of our forms
- message us on WhatsApp, by email or by phone
- see or respond to our adverts on Meta (Facebook and Instagram)
- make an agreement with us as a customer
- are listed in the business contact data we use to tell dental practices about our services (see section 3A)
Website enquiries and leads are stored in our database (Lovable Cloud, through our Lovable site).
It doesn't cover patient information in prescriptions and case files. We handle that on behalf of the practice that sends us the case.
3. The data we collect and why
| What we collect | Where from | Why we use it | Lawful basis (UK GDPR Art. 6) |
|---|---|---|---|
| Enquiry details: name, practice, email, phone, your message, and your GDC number on our offer-page forms | Our contact form and offer-page forms | To reply to your enquiry and quote for work. We use your GDC number only to check you're a registered clinician | Legitimate interests (answering business enquiries). Steps before a contract if you're about to become a customer. |
| Price-list requests: name, practice name, GDC number, email, phone or WhatsApp number | Our price-list request form | To check from your GDC number that you're a registered clinician, then send you our price list privately | Legitimate interests (making sure trade prices go to clinicians) |
| Email marketing opt-in: whether you ticked the box, the exact wording you saw, and the date and time | The optional, unticked "Email me…" box on our forms | To send the emails you asked for, and to show that you asked | Consent |
| Customer agreements: practice name, address and postcode; your name, role, email, phone, GDC number, notes, signature and acceptance of the agreement | Agreements you make with us, including through our website | To manage and perform the agreement, deliver anything it covers, and keep a record of it | Contract, plus legitimate interests in keeping evidence of it |
| WhatsApp, email and phone messages: your number or email, name, message content, any files you send | When you contact us | To answer you, and to manage cases and orders | Legitimate interests; contract once you're a customer |
| Customer and order records: practice and clinician details, cases, invoices | Your orders | To make and deliver work, invoice you, and meet our legal duties (accounting, and records for custom-made medical devices) | Contract; legal obligation |
| Prospect data: business contact details for dental practices (see section 3A) | A business data supplier | To tell dental practices about our lab services, including by post | Legitimate interests (business-to-business marketing) |
| Device and usage data (strictly necessary): IP address, security cookies, page requests | Our hosting and security providers | To run, secure and protect the site (for example against bots) | Legitimate interests. PECR doesn't require consent because these are strictly necessary. |
Advertising data: cookie IDs (_fbp, _fbc), the ad click ID (fbclid), pages viewed, actions such as "Lead" (form saved) or "Contact" (WhatsApp tapped), IP address and browser details. We never send names, emails, phone numbers, GDC numbers or message text to Meta. Conversions API is disabled. | Meta Pixel, active only after you accept marketing cookies | To measure whether our ads work, show them to relevant dental professionals, and avoid showing them to people who have already enquired | Consent |
| Meta lead-form data: name, email, phone, practice, answers to our questions | Meta Instant Forms (forms you fill in inside Facebook or Instagram) | To contact you about what you asked for | Legitimate interests (you asked us to contact you) |
| Consent record: your cookie choices, the date and time, the policy version, and a random ID | Our cookie banner | To prove and respect your choices | Legal obligation; legitimate interests |
We don't currently use Google Analytics or any other analytics cookies. If we start, we'll only use them if you accept analytics cookies, and we'll update this policy and our Cookie Policy first.
Do you have to give us your details? No. But without them we can't reply to an enquiry, send trade prices or set up an agreement with you. We ask for your GDC number on our price-list and offer forms only to check that you're a registered clinician.
Please don't send patient-identifiable information through our website forms.
We don't make decisions about you solely by automated means that have legal or similarly significant effects.
Marketing emails:
- We send business marketing only where the law allows, and you can opt out at any time with the unsubscribe link or by contacting us.
- If you're a sole trader or a partnership (other than a Scottish partnership, which we treat like a company), we only email you marketing with your consent. The one exception is the "soft opt-in" for existing customers.
- We never use the soft opt-in for contacts from the prospect data in section 3A.
- When you tick our "Email me…" box, we keep a record of the wording you saw and when you ticked it. This is separate from your cookie choices.
3A. Data we didn't collect from you (prospect data)
- What we hold: business contact details. These are the practice name, practice postal address, practice email and phone, town and postcode, and the clinician's name where it's publicly listed.
- Source: a business data supplier, which compiles them from publicly available business listings (for example map listings and practice websites).
- Why: to tell dental practices about our lab services by post and, where the law allows, by email or phone.
- Lawful basis: legitimate interests. We have an interest in telling dental practices about a lab service that's relevant to their work. We use business contact details only, and every time we contact you we give you a simple way to object.
- When we tell you: every mailing we send includes a link to this policy and a simple way to opt out.
- How long: no longer than 24 months after we last contacted you, unless you become a customer. If you object, we keep only a minimal suppression record so we don't contact you again.
- Sharing: we don't upload this data to advertising platforms or share it with anyone else, apart from the service providers that help us send emails.
Your right to object: you can object at any time to our use of your details for marketing, and we'll stop. Contact us (see section 1) or use the unsubscribe link in any email from us.
4. Who we share data with
4.1 Service providers (processors)
These providers act on our instructions.
| Provider | What for | Location and safeguard |
|---|---|---|
| Lovable (Lovable Cloud) | Builds and hosts our website. Stores the leads from our website forms in the Lovable database, along with customer agreement records. | May be outside the UK; safeguards as in section 5 |
| Web3Forms | Receives website form submissions and emails them to us. Its spam checks share your IP address and email with CleanTalk and Akismet. | India, using international cloud infrastructure; safeguards as in section 5 |
| Cloudflare | Content delivery, DNS and security (bot protection) | Global network; safeguards as in section 5 |
| Partner dental laboratories | Making your cases. Prescriptions carry clinician and practice details. | May be outside the UK; safeguards as in section 5 |
| Other service providers | Delivery, accounting, payments and email | As needed for each service |
4.2 Independent and joint controllers
| Organisation | Role |
|---|---|
| Meta Platforms Ireland Ltd | The Meta Pixel is active only after you accept marketing cookies. Meta is a joint controller with us for collecting and sending Pixel data under Meta's Controller Addendum, and an independent controller for its own later use and for lead forms submitted on Facebook or Instagram. Automatic event setup and advanced matching are off. We don't send names, emails, phone numbers, GDC numbers or form-field details to Meta. Conversions API is disabled. You can withdraw consent through Cookie settings in our footer. See Meta's privacy policy. |
| If you message us on WhatsApp, WhatsApp also handles your messages under its own terms and privacy policy. |
We may also share data:
- with our professional advisers
- with regulators where the law requires it
- with a buyer if our business is sold
We do not sell your personal data.
5. International transfers
When personal data is processed outside the UK, we rely on one of these:
- UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework)
- the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment
Contact us for more information about these safeguards.
6. How long we keep data
| Data | Kept for |
|---|---|
| Enquiries and leads that don't become customers (website forms, including first-crown claims and price-list requests, and the GDC numbers given on them) | 24 months from our last contact, then deleted |
| Prospect data (section 3A) | No longer than 24 months after we last contacted you. Suppression records for people who objected are kept for as long as we market. |
| Email marketing opt-in records | For as long as we email you, and for up to 24 months after that, to show you agreed |
| Customer, order and invoice records | 6 years after the end of the financial year they relate to |
| Custom-made device records | As long as the law on custom-made medical devices requires |
| Customer agreements | The length of the agreement, then 6 years |
| Copies of form submissions held by Web3Forms | Up to 3 years, under Web3Forms' own retention |
| Cookie consent records | Up to 24 months |
| Cookies | See our Cookie Policy |
7. Your rights
You have the right to:
- access your data
- have it corrected
- have it erased
- restrict its use
- object to our use of it. Where we rely on legitimate interests you can object at any time, and your right to object to direct marketing is absolute.
- data portability
- withdraw consent at any time. This doesn't affect anything we did before you withdrew it.
You can change your cookie choices at any time with "Cookie settings" in the footer of every page.
To use any of these rights, contact us (see section 1). We'll reply within one month, and there's usually no charge.
8. Complaints
Please contact us first so we can try to put things right. You can also complain to the Information Commissioner's Office (ICO):
- ico.org.uk/make-a-complaint
- 0303 123 1113
- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
9. Security
- We use HTTPS across the site, access controls on our systems, and service providers with appropriate security.
- No internet transmission is completely secure, so please don't send patient data through website forms.
10. Changes
- We'll update this policy when the way we handle data changes. The date at the top shows the latest version.
- If a change affects your cookie choices, we'll ask for them again.