1. General information, controller, data protection officer
1.1 Note on the responsible body
1.3 Scope of the processing of personal data
1.4 Legal basis for the processing of personal data
1.5 Data deletion and storage duration
2.1 Provision of the website, CDN and creation of log files
2.1.4 Cookie consent with the “Cookie Consent Tool”
2.2.11 Availy / Anamnesis / Happy / PROMS
3. Use of offers, own services
3.1 Contact form and e-mail contact
3.1.1 Description and scope of data processing
3.1.2 Legal basis for data processing
3.1.3 Purpose of data processing
3.1.5 Possibility of objection and removal
4.3 Right to restriction of processing
4.4.2 Information to third parties
4.8 Right to revoke the declaration of consent under data protection law
4.9 Automated decision-making in individual cases including profiling
4.10 Right to lodge a complaint with a supervisory authority
5. Data security, third-party websites, changes
5.2 Data protection and third-party websites
5.3 Changes to these data protection provisions
Privacy policy https://www.dental21-freiham.de/
and at the same time informing data subjects in accordance with Article 13 and Article 14 GDPR
1. General information, controller, data protection officer
1.1 Note on the responsible body
Responsible for data processing is:
MVZ Dentalzentrum Schwabing GmbH
Leopoldstraße 33
80802 München
Phone: 089 89054374
Email: info@dental21-freiham.de
1.2 Data protection officer
The institution's data protection officer can be contacted at {mail-address data-protection-officer) and by post
with the reference "Data Protection Officer" at the above address.
1.3 Scope of the processing of personal data
In principle, data relating to health is very sensitive and requires special protection in accordance with Art. 9 of
the EU General Data Protection Regulation (hereinafter "GDPR"). For this reason, data protection is particularly
important to us.
We only process our users' personal data insofar as this is necessary to provide a functional website and our
content and services. The processing of our users' personal data only takes place regularly with the user's
consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the
processing of the data is permitted by law. Health-related data is only processed on the basis of the user's
(patient's) consent or in connection with medical treatment requested by the user (patient).
1.4 Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a GDPR
serves as the legal basis for the processing of personal data. If the processing is necessary to safeguard a
legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the
data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for
the processing.
Insofar as health data within the meaning of Art. 9 para. 1 GDPR are concerned, the legal basis for the
processing of these data arises from Art. 9 para. 2 lit. a GDPR with the consent of the patient. If the purposes
specified in Art. 9 para. 2 lit. h GDPR are affected (including the provision of medical treatment), the legal basis
for processing is Art. 9 para. 3 GDPR in conjunction with Art. 9 para. 2 lit. a GDPR. Art. 9 para. 2 lit. h GDPR.
1.5 Data deletion and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer
applies. Data may also be stored if this is provided for by the European or national legislator in EU regulations,
laws or other provisions to which the controller is subject. The data will also be blocked or erased if a storage
period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data
for the conclusion or fulfillment of a contract.
1.6 Note on data transfer to the USA
Among other things, tools from companies based in the USA are integrated on our website. If these tools are
active, your personal data may be transferred to the US servers of the respective companies. We would like to
point out that the USA is not a safe third country within the meaning of EU data protection law. US companies
are obliged to disclose personal data to security authorities without you as the data subject being able to take
legal action against this. It can therefore not be ruled out that US authorities (e.g. secret services) may process,
evaluate and permanently store your data on US servers for surveillance purposes. We have no influence on
these processing activities. We have concluded valid suitable guarantees with the service providers for the
transfer to these third countries in accordance with Art. 46 para. 2 GDPR.
At no time will health data be transferred to the USA. If you have any further questions, please contact our data
protection officer.
2. Use of our website
2.1 Provision of the website, CDN and creation of log files
2.1.1 Informational use
Description and scope of data processing
It is generally not necessary for you to provide personal data in order to use our website for information purposes
only. Rather, in this case we only collect and use the data that your Internet browser automatically transmits to
us, such as:
● Date and time of access to one of our web pages
● Your browser type
● the browser settings
● the operating system used
● the last page you visited
● the amount of data transferred and the access status (file transferred, file not found, etc.)
● Your IP address.
Purpose of data processing
We collect and use this data during an informational visit exclusively in non-personalized form. This is done to
enable you to use the web pages you have accessed, for statistical purposes and to improve our website.
Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's
computer. For this purpose, the user's IP address must remain stored for the duration of the session.
Legal basis for data processing
The legal basis for the temporary storage of data and log files is Article 6(1)(f) GDPR.
Purpose of data processing
Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's
device. For this purpose, the user's IP address must remain stored for the duration of the session.
Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the
case of the collection of data for the provision of the website, this is the case when the respective session has
ended. If the data is stored in log files, this is the case after fourteen days at the latest. In this case, the IP
addresses of the users are deleted or anonymized so that it is no longer possible to identify the accessing user.
Access to the log data is only possible directly and exclusively for administrators.
Possibility of objection and removal
The collection of data for the provision of services and the storage of data in log files is absolutely necessary for
the operation of the services offered. The user can object to this. Whether the objection is successful must be
determined as part of a weighing of interests.
Further information
In order to use our offer and other services, it may be necessary to provide personal data. Further information on
the use of these services can be found in the section "Use of offers".
2.1.2 Hosting
This website is hosted by an external service provider (hoster). Our service provider is:
Vercel Inc, 440 N Barranca Ave #4133, Covina, CA 91723, USA
The personal data collected on this website is stored on the hoster's servers. This may include IP addresses,
contact requests, meta and communication data, contact details, names, website accesses and other data
generated via a website.
This data is not merged with other data sources. This data is collected on the basis of Art. 6 para. 1 lit. f GDPR.
Our legitimate interest in processing this data is to display our website without errors and to optimize its
functions.
Our hoster will only process your data to the extent necessary to fulfill its performance obligations and follow
our instructions with regard to this data.
In order to guarantee data protection-compliant processing, we have concluded an order processing contract with
our hoster.
The website server is geographically located in the USA.
2.1.3 Use of cookies
Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser
on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating
system. This cookie contains a characteristic string of characters that enables the browser to be uniquely
identified when the website is called up again.
When accessing our website, the user is informed about the use of cookies by a consent banner and his consent
to the processing of the personal data used in this context is obtained and documented in accordance with data
protection regulations. In this context, there is also a reference to this data protection declaration and a reference
to how the storage of cookies can be prevented in the browser settings.
We use cookies on our website that are not technically necessary. Cookies that are not technically necessary are
text files that are not only used for the functionality of the website, but also collect other data.
By setting technically unnecessary cookies, the following data is processed:
● IP address
● Location of Internet users
● Date and time the website was accessed
● Customization of advertisements to the user
● Tracking of surfing behavior
● Linking the website visit with other social media platforms
You can determine yourself whether cookies can be set and retrieved using the settings in your browser. For
example, you can completely deactivate the storage of cookies in your browser, restrict it to certain websites or
configure your browser so that it automatically notifies you as soon as a cookie is to be set and asks you for
feedback. For technical reasons, however, it is necessary to allow the above for the full functionality of our
website.
Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser,
which explains how you can change your cookie settings. You can find these for the respective browsers under
the following links:
Internet Explorer: https:
Firefox: https:
Chrome: https:
Safari: https:
Opera: https:
Please note that if you do not accept cookies, the functionality of our website may be restricted.
Legal basis for data processing
The provisions of the Telecommunications Digital Services Data Protection Act (TDDDG) apply to the storage
of information in the end user's terminal equipment and/or access to information already stored in the end user's
terminal equipment. If the setting and reading of cookies is technically necessary, this is done to ensure the
functionality of our website. In this case, cookies are stored and accessed on your end device on the basis of
Section 25 (2) No. 2 TDDDG. This storage and access to the information in your end device serves to make it
easier for you to use our website and to be able to offer you our services as you have requested. Some functions
of our website do not work without the use of these cookies and could therefore not be offered. The cookies are
generally deleted at the end of the session (e.g. logging out or closing the browser) or after a specified period of
time.
Insofar as cookies are used that are not technically necessary, this is done on the basis of your express consent,
which you can give via the cookie banner. In this case, the basis for storing and accessing information is Section
25 (1) TDDDG in conjunction with Art. 6 para. 1 lit. a), Art. 7 GDPR. You can revoke your consent at any time
with effect for the future or subsequently grant it again by configuring your cookie settings accordingly.
Alternatively you can prevent the storage of cookies by making the appropriate settings in your browser
software. Please note that the browser settings you make only apply to the browser you are using. If personal
data is processed following the storage and access to the information on your end device, the provisions of the
GDPR apply. You can find information on this in the following sections of this privacy policy.
Purpose of data processing
If technically necessary cookies are used:
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions
of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be
recognized even after a page change. We require cookies for the following applications:
● Saving the settings of the cookie notice banner (consent tool)
● Optimization of the functionality and design of our website.
The user data collected by technically necessary cookies is not used to create user profiles.
Cookies that are not technically necessary are used for the purpose of improving the quality of our website, its
content and thus our reach and efficiency. By setting these cookies, we learn how the website is used and can
thus constantly optimize our offer. In particular, these cookies serve the following purposes:
● Objective measurement of user numbers
● Analysis of user data
Duration of storage, objection and removal options
Cookies are stored on the user's computer and transmitted by it to our website. As a user, you therefore have full
control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the
settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also
be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all
functions of the website to their full extent.
You will be informed about the exact storage period in the notes in our consent tool. If consent has also been
given there, you can object to this there.
2.1.4 Cookie consent with the “Cookie Consent Tool”
Our website uses the cookie consent technology of
Usercentrics GmbH Sendlinger Str. 7, 80331 Munich, Germany
to obtain your consent to the storage of certain cookies on your end device and to document this in compliance
with data protection regulations.
Description and scope of data processing
When you enter our website, your consent and other declarations regarding the use of cookies are obtained via
our consent tool. The consent tool then stores a cookie in your browser in order to be able to assign the consents
you have given or revoke them.
Legal basis for data processing
The "Cookie Consent Tool" is used to obtain the legally required consent for the use of cookies. The legal basis
for this is Art. 6 para. 1 sentence 1 lit. c GDPR.
Purpose of data processing
The provision of the "Cookie Consent Tool" serves to comply with overriding legal requirements and to inform
users of the context in which cookies are used on this website.
Possibility of objection and removal
The data collected by the consent tool remains stored until you delete the consent cookie yourself or the purpose
for data storage no longer applies. Mandatory statutory retention obligations remain unaffected.
2.1.5 Cloudflare
This website uses the Cloudflare; service. The provider is Cloudflare Inc, 101 Townsend St., San Francisco,
CA 94107, USA (hereinafter referred to as Cloudflare).
Description and scope of data processing
Cloudflare offers a globally distributed content delivery network with DNS. Technically, the information transfer
between your browser and our website is routed via Cloudflare's network. This enables Cloudflare to analyze the
traffic between your browser and our website and to serve as a filter between our servers and potentially
malicious traffic from the Internet. Cloudflare may also use cookies or other technologies to recognize Internet
users, but these are used solely for the purpose described here.
Legal basis for data processing
The processing of your data by the Meta Pixel is generally based on your consent (Art. 6 para. 1 lit. a GDPR).
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find
details here:
https://www.cloudflare.com/privacypolicy/.
Further information on security and data protection at Cloudflare can be found here:
https://www.cloudflare.com/privacypolicy/.
In order to ensure data protection-compliant processing, we have concluded an order processing contract with
Cloudflare.
2.1.6 Uploadcare
This website uses the "Uploadcare" service. The provider is Uploadcare LLC. with registered office at 18801
Collins Ave 102-120, Sunny Isles Beach, FL 33160, USA (hereinafter "Uploadcare").
Description and scope of data processing
Uploadcare is a Cloud Delivery Network (CDN) for processing and providing image files. For this purpose, all
images/photos and graphics uploaded to this website (by the website owner) are uploaded to Uploadcare's
servers using a plugin, optimized for display there and then delivered back to this server.
Legal basis for data processing
The use of Uploadcare is based on our legitimate interest in providing our website as error-free and secure as
possible (Art. 6 para. 1 lit. f GDPR).
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find
details here: https://uploadcare.com/about/gdpr/.
Further information can be found at: https://uploadcare.com/about/privacy-policy/.
In order to ensure data protection-compliant processing, we have concluded an order processing contract with
Uploadcare.
2.1.7 jsDelivr
To speed up the loading process of our website and optimize performance, we use jsDelivr, a content delivery
network (CDN). jsDelivr is used to provide static files such as JavaScript libraries or stylesheets. By distributing
these files to servers worldwide, the loading time for our users is reduced.
Purpose of data processing
Performance optimization: jsDelivr helps our website to load faster and increase user-friendliness.
Global delivery: By using jsDelivr, we can deliver our content faster worldwide.
Type of data processed
Technical usage data: When you visit our website, your IP address is transmitted to the jsDelivr servers in order
to provide the requested files.
Legal basis for data processing
The processing of your data by jsDelivr is generally based on our legitimate interest in optimizing our website
and improving the user experience (Art. 6 para. 1 lit. f GDPR).
2.2 Plugins and tools
Various tools and plugins may be used on our website to ensure the user-friendliness, functionality and security
of our services. These tools and plugins are carefully selected and may be used, for example, to analyze website
usage, integrate third-party services or optimize technical performance. Personal data may be processed in the
process. If this happens, the processing is carried out exclusively on the basis of the applicable data protection
laws, in particular the GDPR.
The following tools and plugins may be used in individual cases. If you would like to know which tools and
plugins we currently use, you can contact the data protection officer at any time.
2.2.1 Posthog
Scope of the processing of personal data
We use Posthog (https://posthog.com/) from the
PostHog Inc, 2261 Market Street #4008, San Francisco, CA 94114, USA.
PostHog can be used to analyze user behavior on our website for the purpose of improving our online offering.
Your entries are not recorded, so that no name, address or health data are transmitted.
Further information about PostHog can be found at https://posthog.com/faq and in PostHog's privacy policy:
https:
Purpose of data processing
The purpose of processing personal data is to improve our online offering.
Legal basis for the processing of personal data
The legal basis for the processing of users' personal data is generally the consent of the user in accordance with
Art. 6 para. 1 sentence 1 lit. a GDPR.
Duration of storage
Your personal information will be stored for as long as necessary to fulfill the purposes described in this Privacy
Policy or as required by law.
Right of revocation and removal
You have the right to withdraw your declaration of consent under data protection law at any time. The
withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
You can prevent the collection and processing of your personal data by PostHog by preventing the storage of
third-party cookies on your computer, using the "Do Not Track" function of a supporting browser, deactivating
the execution of script code in your browser or installing a script blocker such as NoScript (https://noscript.net/)
or Ghostery (https://www.ghostery.com) in your browser.
For objection and removal requests to PostHog, you can contact . privacy@posthog.com
2.2.2 Sentry
We use Sentry to ensure the stability and performance of our application. Sentry is an error monitoring service
that helps us to detect and resolve technical problems in our application at an early stage. Sentry automatically
collects data about errors that occur, such as stack traces, browser information and, in some cases, anonymized
user IDs. This data is transmitted to Sentry's servers and analyzed there.
Purpose of data processing
Error detection and correction: Sentry helps us to identify and correct errors in our application to ensure an
optimal user experience.
Performance optimization: By analyzing the collected data, we can improve the performance of our application.
Type of data processed:
Type of data processed:
Technical data: stack traces, browser information, operating system, device type.
User data (partially anonymized): User IDs, IP addresses (possibly shortened).
Legal basis for the processing of personal data
The processing of your data by Sentry is based on our legitimate interest in ensuring the functionality and
security of our application (Art. 6 para. 1 lit. f GDPR).
2.2.3 Hubspot
Scope of the processing of personal data
We use Hubspot (https://hubspot.com/) from the
Hubspot INC, 2 Canal Park, Cambridge, MA 02141, USA
We use Hubspot to provide you with health information and offers at certain intervals, e.g. by e-mail. In addition
to clinical data, this also includes further information on your treatment (e.g. the treatment and cost plan),
additional recommendations and valuable preventive tips for your health as well as offers for our medical
products.
If you give your consent, the following data will be processed:
● Names, address and contact details
● Age and gender
● Practitioner and practice data
● Medical history
● Completed treatments
● Date information
● Results of customer satisfaction surveys
Purpose of data processing
The purpose of processing personal data is to improve and individualize patient communication.
Legal basis for the processing of personal data
The legal basis for the processing of users' personal data is generally the consent of the user in accordance with
Art. 6 para. 1 sentence 1 lit. a GDPR. Insofar as health data within the meaning of Art. 9 para. 1 GDPR is in
question, the legal basis for the processing of this data with the consent of the patient results from Art. 9 para. 2
lit. a GDPR. If the purposes specified in Art. 9 para. 2 lit. h GDPR are affected (including the provision of
medical treatment), the legal basis for processing is Art. 9 para. 3 GDPR in conjunction with Art. 9 para. 2 lit. a
GDPR. Art. 9 para. 2 lit. h GDPR.
Duration of storage
Your personal information will be stored for as long as necessary to fulfill the purposes described in this Privacy
Policy or as required by law.
Right of revocation and removal
You have the right to withdraw your declaration of consent under data protection law at any time. The
withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
2.2.4 Google Tag Manager
We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin
4, Ireland.
Google Tag Manager is a tool that enables us to integrate tracking or statistical tools and other technologies on
our website. The Google Tag Manager itself does not create any user profiles, does not store any cookies and
does not carry out any independent analyses. It is only used to manage and display the tools integrated via it.
However, Google Tag Manager records your IP address, which may also be transmitted to Google's parent
company in the United States.
Legal basis for the processing of personal data
The Google Tag Manager is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate
interest in the fast and uncomplicated integration and management of various tools on its website. If a
corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1
lit. a GDPR; the consent can be revoked at any time.
2.2.5 Google Analytics
This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland
Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the
website operator receives various usage data, such as page views, length of visit, operating systems used and
origin of the user. This data may be summarized by Google in a profile that is assigned to the respective user or
their end device.
We can also use Google Analytics to record your mouse and scroll movements and clicks, among other things.
Google Analytics also uses various modeling approaches to supplement the collected data records and uses
machine learning technologies for data analysis.
Google Analytics uses technologies that enable the recognition of the user for the purpose of analyzing user
behavior (e.g. cookies or device fingerprinting). The information collected by Google about the use of this
website is generally transmitted to a Google server in the USA and stored there.
Legal basis for the processing of personal data
The processing of your data by the Meta Pixel is generally based on your consent (Art. 6 para. 1 lit. a GDPR).
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find
details here:
https://privacy.google.com/businesses/controllerterms/mccs/.
We have activated the IP anonymization function on this website. This means that your IP address will be
shortened by Google within member states of the European Union or in other contracting states of the
Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will
the full IP address be transmitted to a Google server in the USA and shortened there. Google will use this
information on behalf of the operator of this website for the purpose of evaluating your use of the website,
compiling reports on website activity and providing other services relating to website activity and internet usage
to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be
merged with other Google data.
You can prevent the collection and processing of your data by Google by downloading and installing the browser
plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
You can find more information on how Google Analytics handles user data in Google's privacy policy:
https://support.google.com/analytics/answer/6004245?hl=de.
We have concluded an order processing contract with Google and fully implement the strict requirements of the
German data protection authorities when using Google Analytics.
2.2.6 Microsoft Advertising
We use Microsoft Advertising to optimize our online advertising and present you with relevant ads. Microsoft
Advertising is an online advertising platform that enables us to display our ads on various websites and in search
engines.
Purpose of data processing
Personalized advertising: By analyzing your user behavior, we can present you with tailored advertisements that
match your interests. Microsoft Advertising enables us to measure and optimize the effectiveness of our
advertising campaigns.
Reach measurement: We can determine how many users have seen our advertising and how often.
Legal basis
The processing of your data by Microsoft Advertising is based on your consent (Art. 6 para. 1 lit. a GDPR).
2.2.7 Meta Pixel
In order to optimize our online advertising and present you with relevant ads on Meta platforms (Facebook,
Instagram, etc.), we use the Meta Pixel. The Meta Pixel is a small piece of code that we have placed on our
website. It enables us to track your behavior on our website and thus better understand your interests.
Purpose of data processing
Personalized advertising: By analyzing your user behavior, we can present you with tailored advertisements that
match your interests.
Reach measurement: We can determine how many users have seen our advertising and how often.
Conversion tracking: We measure the effectiveness of our advertising campaigns by tracking what actions you
take after clicking on one of our ads (e.g. making a purchase).
Legal basis
The processing of your data by the meta pixel is generally based on your consent (Art. 6 para. 1 lit. a GDPR). By
continuing to use our website after being informed of the use of the meta pixel and the option to opt out, you
consent to this data processing.
2.2.8 Contentful
We use the content management platform Contentful (Contentful GmbH, Max-Urich-Straße 3, 13355 Berlin,
Germany) to create and manage our digital content. Contentful processes personal data on our behalf, which we
collect to design our website and provide our services. Further information on data processing by Contentful can
be found in their privacy policy: https://www.contentful.com/legal/privacy-at-contentful/privacy-notice/
Purpose of data processing
The data processed by Contentful is primarily used to manage our digital content and provide you with an
optimal user experience. This includes, for example, the creation and maintenance of page content, the
management of images and media and the personalization of content.
Type of data processed
The data processed by Contentful may vary depending on the scope of use. In general, this can be the following
data:
● Technical usage data (e.g. IP address, browser information)
● Content that you create or upload via our system
● Metadata for this content
Legal basis for the processing of personal data
The processing of your personal data by Contentful is based on our legitimate interest in the efficient creation
and management of our digital content and in the provision of our services (Art. 6 para. 1 lit. f GDPR).
2.2.9 DoubleClick
We use Google DoubleClick, a service provided by Google LLC, to manage and optimize our online advertising.
DoubleClick uses cookies and similar technologies to collect information about your use of our website. This
information is used to present you with relevant ads and to measure the effectiveness of our advertising
campaigns.
Purpose of data processing
Personalized advertising: By analyzing your user behavior, we can present you with tailored advertisements that
match your interests.
Performance measurement: DoubleClick enables us to measure and optimize the effectiveness of our advertising
campaigns.
Reach measurement: We can determine how many users have seen our advertising and how often.
Type of data processed
Technical usage data: This includes, for example, your IP address, browser information and the operating system
of your device.
Usage behavior: Information about which pages you visit, which ads you click on and how long you stay on our
website.
Legal basis for the processing of personal data
The processing of your data by the Meta Pixel is generally based on your consent (Art. 6 para. 1 lit. a GDPR).
2.2.10 reCAPTCHA
To protect our website from misuse, we use Google reCAPTCHA. Google reCAPTCHA is used to check
whether certain entries on our website originate from a human or an automated program (bot).
Purpose of data processing
Spam and abuse protection: reCAPTCHA helps us to prevent spam comments, spam registrations and other
forms of abuse.
Website security: Distinguishing between humans and bots increases the security of our website.
Type of data processed
User interactions: reCAPTCHA analyzes your behavior on our website, such as how you move the mouse
pointer or how quickly you fill out forms.
IP address: Your IP address will be transmitted to Google for verification purposes.
Legal basis for the processing of personal data
The processing of your data by reCAPTCHA is based on our legitimate interest in the security of our website
and the prevention of spam (Art. 6 para. 1 lit. f GDPR).
2.2.11 Availy / Anamnesis / Happy / PROMS
Description, purpose and scope of data processing
On our website, you have the opportunity to make appointments with us, fill out a digital medical history and
take part in a survey after treatment. We use the tools Availy, Ana, PROMS and Happy to book appointments,
take medical histories and conduct patient surveys. The provider in each case is Patient 21 SE, Joachimsthaler
Str. 20, 10719 Berlin, Germany (hereinafter "Patient 21").
To book an appointment, enter the requested data and the desired date in the form provided. The data entered
will be used for the planning, execution and, if necessary, follow-up of the appointment.
To record your medical history, fill in the forms provided. The data will only be made available to treating
physicians and practice staff for the purposes of treatment.
To help us ensure the quality of treatment, you voluntarily complete the PROMS and Happy tool masks provided
after your visit to the practice. You can use PROMS to share your experience of the success of the treatment and
Happy to inform us of your personal satisfaction with the practice. The data is made available to treating doctors
and practice staff to improve our service.
The respective data is stored for us on the servers of Patient 21 SE. Further information about Patient21 can be
found at https://www.patient21.com.
Duration of storage
The data you enter will remain with us until you ask us to delete it, revoke your consent to storage or the purpose
for data storage no longer applies. Mandatory statutory provisions - in particular retention periods - remain
unaffected.
Legal basis for data processing
The legal basis for the processing of appointment and medical history data is Art. 6 para. 1 lit. b GDPR. The
collection is an important pre-contractual measure for the treatment contract you have requested. If health data
within the meaning of Art. 9 para. 1 GDPR is in question, the legal basis for the processing of this data results
from Art. 9 para. 2 lit. a GDPR with the consent of the patient. If the purposes specified in Art. 9 para. 2 lit. h
GDPR are affected (including the provision of medical treatment), the legal basis for processing is Art. 9 para. 3
GDPR in conjunction with Art. 9 para. 2 lit. a GDPR. Art. 9 para. 2 lit. h GDPR.
The legal basis for the processing of data by PROMS, Happy and optional information that is not absolutely
necessary for the treatment is Art. 6 para. 1 lit. f GDPR. The practice has a legitimate interest in individualized
patient care.
Further information
We have concluded an order processing contract with the above-mentioned provider. This is a contract
prescribed by data protection law, which ensures that the provider only processes the personal data of our
website visitors in accordance with our instructions and in compliance with the GDPR.
2.2.12 GRWAPI
We use GRWAPI to simplify and automate interaction with our web services. GRWAPI enables us to make API
requests to external systems and process the data received.
Purpose of data processing
Automation of processes: GRWAPI is used to automate certain tasks, such as retrieving data from external
systems or sending notifications.
Improving user-friendliness: By using GRWAPI, we can simplify and speed up certain functions for our users.
Legal basis
The processing of your data by GRWAPI is generally based on our legitimate interest in the efficient handling of
our business processes and the improvement of our services (Art. 6 para. 1 lit. f GDPR).
Data protection notice for the use of Jameda Elements
2.2.13 Jameda Elements
We use Jameda Elements to optimize our online presence and provide patients with even more comprehensive
information about our services. Jameda Elements is a tool that allows us to customize our Jameda profile and use
additional functions.
Purpose of data processing
Individual profile presentation: Jameda Elements allows us to customize our Jameda profile to the needs of our
patients and, for example, highlight special treatment focuses.
Analysis: The use of Jameda Elements enables us to analyze the use of our profile and thus further optimize our
offer.
Type of data processed
Practice data: In addition to the data already stored on Jameda, Jameda Elements can collect further specific
information about our services and treatment focuses.
User data: When using Jameda Elements, technical usage data such as your IP address, browser information and
the operating system of your device may be collected.
Legal basis
The processing of your data by Jameda Elements is generally based on our legitimate interest in advertising our
services and optimizing our online presence (Art. 6 para. 1 lit. f GDPR).
2.2.14 Social media presence
Our website does not use any social media plugins. The logos of the social networks Facebook, Instagram and
LinkedIn displayed on our website are used exclusively to link to the corresponding profiles of our company.
When you visit our website, no data is transmitted to these social networks when the logos are displayed. Only
when you click on one of the logos will you be redirected to the external website of the respective social
network.
If you visit our profiles on social networks and are logged in there, your activities may be linked to your user
account on the respective network. This applies in particular if you interact with our profile, for example by
commenting, “liking”; or sharing content or reacting in other ways. As a rule, these interactions are also visible to
us.
We receive statistical data about the use of our profiles on the social networks Facebook and Instagram via the
so-called “Insights” function. This function is provided by the social networks and cannot be deactivated. It is
automatically available to all operators of Facebook pages and Instagram business profiles.
The following data is provided to us in anonymized form via Facebook Insights and Instagram Insights:
● Number of page views
● "Like" information (including its origin)
● Page activities
● Post interactions (e.g. comments, shared content)
● Reach of the posts (organic, viral, paid)
● Demographic evaluations (country of origin, gender, age)
This information is provided in aggregated form and does not allow any conclusions to be drawn about
individual persons.
On LinkedIn, we also receive anonymized statistical data on the use of our profile via the “Insights” function.
This data includes information about reach, interactions and demographic evaluations of our followers.
The social networks store your data in the form of pseudonymous user profiles and use them for advertising and
market research purposes. This allows personalized advertisements to be displayed to you within the network
and on third-party websites. Cookies, which are stored on your end device, are generally used to create these user
profiles.
You have the right to object to the creation of such user profiles. To do so, please contact the respective social
network directly. Further information on data processing can be found in the privacy policies of the respective
Providers:
- facebook: https://www.facebook.com/dental21.de/
- instagram: https://www.instagram.com/dental21_de/
- linkedIn: https://www.linkedin.com/company/dental21
3. Use of offers, own services
3.1 Contact form and e-mail contact
3.1.1 Description and scope of data processing
Our website contains our contact details and a contact form that can be used to contact us. It is generally possible
to contact us via the provided e-mail address . In this case, the transmitted personal data (name and request) of
the user will be stored and processed by us for the purpose of processing your request.
If customers or interested parties use the option of sending messages via the contact form, the data entered in the
input mask will be transmitted to us and stored. These data are
● Name
● E-mail address and other contact details
● Website of your practice
The following data is also stored at the time the message is sent:
● The IP address of the user
● Date and time of dispatch
In this context, no data will be passed on to third parties without your consent. The data will be used exclusively
for processing the conversation.
3.1.2 Legal basis for data processing
Contacting us by providing an email address is only possible from the age of 16 or with the consent of a parent
or guardian. By using this function, you confirm that you are over 16 years of age or that you have the consent of
a parent or guardian.
The legal basis for the processing of data transmitted in the course of sending a request is Art. 6 para. 1 lit. a
GDPR. The legitimate interest lies in the efficient and fast processing of user inquiries. If the e-mail contact is
aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.
3.1.3 Purpose of data processing
The processing of the personal data from the input screen or the data transmitted in any other way serves us to
process the establishment of contact, the processing of user inquiries or the processing of appointment requests.
In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.
The other personal data processed during the sending process is used to prevent misuse of the contact form and
to ensure the security of our information technology systems.
3.1.4 Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the
personal data from the input screen of the contact form and those sent by email, this is the case when the
respective conversation with the user has ended. The conversation is ended when it can be inferred from the
circumstances that the matter in question has been conclusively clarified.
3.1.5 Possibility of objection and removal
The user has the option to revoke their consent to the processing of personal data at any time. If the user contacts
us by email, they can object to the storage of their personal data at any time. In such a case, the conversation
cannot be continued. To withdraw your consent, you can contact our data protection officer at any time using the
contact details above.
All personal data stored in the course of contacting us will be deleted in this case.
4. Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the
following rights vis-à-vis the controller:
4.1 Right to information
You can request confirmation from the controller as to whether personal data concerning you is being processed
by us.
If such processing has taken place, you can request the following information from the controller:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data that are processed;
(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be
disclosed;
(4) the planned duration of storage of the personal data concerning you or, if specific information on this is not
possible, criteria for determining the duration of storage;
(5) the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of
processing by the controller or a right to object to such processing;
(6) the existence of a right of appeal to a supervisory authority;
(7) all available information on the origin of the data if the personal data are not collected from the data subject;
(8) the existence of automated decision-making including profiling in accordance with Art. 22 (1) and (4) GDPR
and - at least in these cases - meaningful information on the logic involved and the scope and intended effects of
such processing for the data subject.
You have the right to request information as to whether the personal data concerning you is transferred to a third
country or to an international organization. In this context, you may request to be informed of the appropriate
safeguards pursuant to Art. 46 GDPR in connection with the transfer.
4.2 Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data
concerning you is incorrect or incomplete. The controller must make the correction without delay.
4.3 Right to restriction of processing
Under the following conditions, you may request the restriction of the processing of personal data concerning
you:
(1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify
the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their
use instead;
(3) the controller no longer needs the personal data for the purposes of the processing, but they are required by
you for the establishment, exercise or defense of legal claims, or
(4) if you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet certain whether the
legitimate reasons of the controller outweigh your reasons.
If the processing of personal data concerning you has been restricted, such data may only be processed - apart
from being stored - with your consent or for the establishment, exercise or defense of legal claims or for the
protection of the rights of another natural or legal person or for reasons of important public interest of the Union
or of a Member State.
If the restriction of processing has been restricted in accordance with the above conditions, you will be informed
by the controller before the restriction is lifted.
4.4 Right to erasure
4.4.1 Obligation to delete
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay
and the controller shall have the obligation to erase personal data without undue delay where one of the
following grounds applies:
(1) The personal data concerning you are no longer necessary in relation to the purposes for which they were
collected or otherwise processed.
(2) You revoke your consent on which the processing was based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2
lit. a GDPR and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for
the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
(4) The personal data concerning you has been processed unlawfully.
(5) The deletion of personal data concerning you is necessary to fulfill a legal obligation under Union law or the
law of the Member States to which the controller is subject.
(6) The personal data concerning you were collected in relation to information society services offered in
accordance with Art. 8 para. 1 GDPR.
4.4.2 Information to third parties
If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article
17(1) GDPR, it shall take reasonable steps, including technical measures, taking into account the available
technology and the cost of implementation, to inform controllers which are processing the personal data that you
as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those
personal data.
4.4.3 Exceptions
The right to erasure does not exist if the processing is necessary
(1) to exercise the right to freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the
controller is subject or for the performance of a task carried out in the public interest or in the exercise of official
authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i and Art.
9 para. 3 GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render
impossible or seriously impair the achievement of the objectives of that processing, or
(5) for the assertion, exercise or defense of legal claims.
4.5 Right to information
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the
controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of
this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a
disproportionate effort.
You have the right to be informed about these recipients by the controller.
4.6 Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a
structured, commonly used and machine-readable format. You also have the right to transmit this data to another
controller without hindrance from the controller to which the personal data has been provided, where
(1) the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a
contract pursuant to Art. 6 para. 1 lit. b GDPR and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data concerning you transmitted directly
from one controller to another, where technically feasible. The freedoms and rights of other persons may not be
impaired by this.
The right to data portability does not apply to the processing of personal data necessary for the performance of a
task carried out in the public interest or in the exercise of official authority vested in the controller.
4.7 Right of objection
You have the right to object, on grounds relating to your particular situation, at any time to processing of
personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based
on those provisions.
The controller will no longer process the personal data concerning you unless the controller demonstrates
compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the
establishment, exercise or defense of legal claims.
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the
processing of your personal data for such marketing, which includes profiling to the extent that it is related to
such direct marketing.
If you object to processing for direct marketing purposes, your personal data will no longer be processed for
these purposes.
Notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object in connection with
the use of information society services by means of automated procedures using technical specifications.
4.8 Right to revoke the declaration of consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. The
withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
4.9 Automated decision-making in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling,
which produces legal effects concerning you or similarly significantly affects you. This does not apply if the
decision
(1) is necessary for the conclusion or performance of a contract between you and the controller,
(2) is authorized by Union or Member State law to which the controller is subject and which also lays down
suitable measures to safeguard your rights and freedoms and legitimate interests; or
(3) with your express consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1
GDPR, unless Art. 9 para. 2 lit. a or g GDPR applies and appropriate measures have been taken to protect the
rights and freedoms as well as your legitimate interests.
In the cases referred to in (1) and (3), the data controller shall implement suitable measures to safeguard your
rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the
controller, to express your point of view and to contest the decision.
4.10 Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a
supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the
alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the status
and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
5. Data security, third-party websites, changes
5.1 SSL or TLS encryption
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content,
such as orders or inquiries that you send to us as the site operator. You can recognize an encrypted connection by
the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your
browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
5.2 Data protection and third-party websites
The website may contain hyperlinks to and from third-party websites. If you follow a hyperlink to one of these
websites, please note that we cannot accept any responsibility or guarantee for third-party content or data
protection conditions. Please check the applicable data protection conditions before you transmit personal data to
these websites.
5.3 Changes to these data protection provisions
We reserve the right to amend these data protection provisions at any time with effect for the future. A current
version is always available on the website. Please visit the website regularly and inform yourself about the