Privacy policy website www.dentalspecialists.de

I. Introduction and terms

1. GENERAL

In operating our website with the URL www.dentalspecialists.de (hereinafter referred to as "website"), we process personal data. These will be treated confidentially by us and processed in accordance with the applicable laws - in particular, the General Data Protection Regulation (GDPR), the Bundesdatenschutzgesetzes (BDSG) [Federal Data Protection Act] and the Telekommunikation-Telemedien-Datenschutzgesetz (TTDSG) [Telecommunications Telemedia Data Protection Act]. The purpose of this Privacy Policy is to inform you about what personal data we collect from you, for what purposes and on what legal basis we use it and, if applicable, to whom we disclose it. In addition, we will explain the rights you have to protect and enforce your data privacy.

2. TERMS

Our Privacy Policy contains technical terms that are in the GDPR and the BDSG. For your better understanding we want to explain these terms in simple language in advance:

2.1 Personal data
"Personal data" refers to any information related to an identified or identifiable individual (Article 4(1) GDPR). Information about an identified person can be, for example, their name or email address. However, personal data is also data for which the identity is not immediately apparent but can be determined by combining one's own or third-party information and thereby ascertaining who the data subject is. A person becomes identifiable, for example, through the provision of their address or bank details, their date of birth or username, their IP addresses and/or location data. Relevant here is all information that in any way allows a conclusion to be drawn about a person.

2.2 Processing
According to Article 4(2) of the GDPR, the term "processing" encompasses any operation performed on personal data. This applies in particular to the collection, recording, organisation, ordering, storage, adaptation or modification, reading, querying, use, disclosure, transmission, dissemination or any other form of provision, comparison or linking, restriction, deletion or destruction of personal data.

2.3 Health data
The term "health data" is defined in Article 4(15) of the GDPR as personal data related to the physical or mental health of an individual, including the provision of healthcare services, which reveals information about that individual's health status.

II. Person responsible and data protection officer

3. RESPONSIBLE

The party responsible for data processing is:

Responsible person_ DENTAL SPECIALISTS MVZ GmbH ("we")
Legal representative: Dr. med. dent. Martin Jörgens, Martin Springfeld
Address: Kaiserswerther Markt 25-27 | D-40489 Düsseldorf
Phone: +49 211.4790079
Fax: +49 211.4790009
E-mail: info@dentalspecialists.de

4. DATA PROTECTION OFFICER

We have appointed an external data protection officer for our company. You can reach him at:

Klaus Weinhoefer
Practice Dental Specialists (owner Dr. med. dent. Martin Jörgens)
Kaiserswerther Markt 25-27
40489 Düsseldorf
Germany
Phone: +49 211 479 0079
E-mail: dsb@the-expert.eu

III Processing framework

5. PROCESSING FRAMEWORK: WEBSITE

Within the framework of the website, we process the personal data from you listed in detail below in section IV. We only process data from you which you actively provide on the website (e.g. by filling out forms) or which you automatically provide when using our offer.

Your data will be processed exclusively by us and will not be sold, lent or passed on to third parties. If we use the help of external service providers to process your personal data, this is done within the framework of so-called commissioned processing, in which we as the client are authorised to issue instructions to our contractors. To operate our website, we use external service providers for hosting. We host our website with the external provider Amazon Web Services AWS (Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA) in the data centre location in Germany. If further external service providers are used for individual processing operations listed in Section IV, they will be named there.

We do not transfer data to third countries and do not plan to do so. We will inform about exceptions to this principle in the processing operations presented below. Any data transfer to third countries then takes place on the basis of the so-called EU standard contractual clauses.

IV. The processing in detail

6. PROVISION OF THE WEBSITE AND SERVER LOGFILES

6. Processing description
Each time you visit our website, we automatically collect information that your browser transmits to our server. This involves the following data:

• IP address
• Browser software used, as well as its version and language
• Operating system
• The website from which visitors have reached the website (so-called referrer)
• The subpages accessed on the website
• The date and time of the call of the website

These are also stored in the so-called logfiles of our system. The temporary storage of your IP address by the system is necessary to deliver our website to a user's terminal device. For this purpose, the user's IP address must remain stored for the duration of the session. The IP address is recorded in the log files only shortened by the last three digits.

6.2 Purpose
The processing is carried out to enable the website to be accessed and to ensure its stability and security. Furthermore, the processing serves the statistical evaluation and improvement of our online offer.

6.3 Legal basis
Processing is necessary to protect the overriding legitimate interests of the responsible party (Article 6(1)(f) of the GDPR). Our legitimate interest lies in the purpose named in section 6.2.

6.4 Storage duration
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. The logfiles are deleted after 7 days.

7. COOKIES

7.1 Processing description
Our website uses cookies. Cookies are small text files that are stored on the user's terminal device when a website is visited. Cookies contain information that enables the recognition of a terminal device and possibly certain functions of a website. We distinguish between our own cookies and external, so-called third-party cookies. So-called "session cookies" and "persistent cookies" are used on our site. "Session cookies" are automatically deleted when you end your internet session and close the browser. Persistent cookies remain stored on your terminal device for a longer period of time. If cookies are technically necessary for the operation of our site, this does not require your consent. All other cookies that are not technically necessary are only set after you have actively consented to the use of cookies via our consent tool. We use a self-programmed application to obtain and document consent. The consent tool itself stores your selection in a cookie on your terminal. This means that you do not need to make a decision about cookies again on a subsequent visit to our website.

You can find out which cookies are used on our website and for what purpose, how long they are stored on your end device and what consent you may have already given in the settings of the consent tool [...] settings.

7.2 Purpose
We use cookies to make our website more user-friendly and to offer the functions described in section 7.1.

7.3 Legal basis
The processing is necessary with regard to technically required cookies, as well as the use of the consent tool to protect the overriding legitimate interests of the responsible party (Article 6(1)(f) GDPR in conjunction with § 25 para. 2 TTDSG). Our legitimate interest lies in the purpose named in section 7.2. In the case of processing with regard to all other - i.e. non-technically necessary - cookies, the legal basis is consent (Article 6(1)(a) GDPR in conjunction with Section 25 para. 1 of the TTDSG). Such consent is voluntary.

7.4 Storage period, revocation of consent
Cookies are automatically deleted at the end of a session or when the specified storage period expires. Since cookies are stored on your terminal device, you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transfer of cookies. Cookies that have already been saved can be deleted. This can also be done automatically. If cookies are deactivated, deleted or restricted for our website, it may be that individual functions of our website cannot be used or can only be used to a limited extent. You can revoke any consent you may have given for the use of cookies at any time in the settings of the [...] consent tool with effect for the future.

7.5 Recipient
When third-party cookies are used, data may be transmitted to the corresponding providers of these third-party services. Under certain circumstances, data may also be transferred to third countries outside the European Union or the European Economic Area. We provide information about the recipients of data and the transfer of data to third countries in the settings of the consent tool or in the corresponding section on the third-party service in this Privacy Policy.

8. CONTACT FORM AND CONTACT BY EMAIL

8. Processing description
We have provided a contact form on our website for contacting us. In this form you will be asked to enter your email address, name and a message to us. When you click the "Submit" button, the data is transmitted to us using SSL encryption (see item 12.). The contact form can only be transmitted if you confirm that you have taken note of this Privacy Policy by clicking on the corresponding checkbox. You can also contact us via the email addresses provided on the website. In this case, the personal data transmitted with the email will be processed by us.

8.2 Purpose
By providing a contact form on our website, we want to offer you a convenient way to get in touch with us. The data transmitted with and in the contact form or your email will be used exclusively for the purpose of processing and responding to your request.

8.3 Legal basis
The processing is necessary to protect the overriding legitimate interests of the responsible party (Article 6(1)(f) of the GDPR). Our legitimate interest lies in the purpose named in section 8.2. If the email contact is intended for the conclusion or fulfilment of a contract, the data processing is carried out to fulfil the contract (Article 6(1)(b) GDPR).

8.4 Storage period
We delete the data as soon as they are no longer required to achieve the purpose for which they were collected. This is usually the case when the respective communication with you has ended. The communication is terminated when it is clear from the circumstances that your concern has been conclusively clarified. If statutory retention periods prevent deletion, the data will be deleted immediately after expiry of the statutory retention period.

9. GOOGLE ANALYTICS

9.1 Description of the processing

Our website uses "Google Analytics", a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google Analytics uses cookies (see item 7.), which enable an analysis of your use of our offer.  The information generated by the cookies is usually transferred to a Google server in the USA and stored there. However, we use Google Analytics exclusively with IP anonymisation. This means that your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics is not merged with other data from Google. The statistics generated by Google Analytics record in particular how many users visit our website, from which country or location the access takes place, which subpages are accessed, and via which links or search terms visitors reach our website. The Google Analytics Terms of Use can be found at marketingplatform.google.com/about/analytics/terms/us/ An overview of data protection at Google Analytics is available at marketingplatform.google.com/intl/en_uk/about/. Google's privacy policy can be viewed at policies.google.com/privacy

9.2 Purpose
The processing takes place in order for us to be able to evaluate the use of our website. The information obtained in this way is used to improve our online presence and to design it in line with requirements.

9.3 Legal basis
Processing is carried out based on consent in accordance with Article 6(1)(a) of the GDPR. This is obtained by us via the consent tool (see section 7.1). Such consent is voluntary.

9.4 Storage period and right to object, revocation of consent
We have explained the storage period and your control and setting options for cookies in section 7.4. You can revoke the consent you have given with regard to Google Analytics at any time in the settings of the consent tool with effect for the future. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on offered by Google at tools.google.com/dlpage/gaoptout?hl=en. The analysis data processed and stored with Google Analytics is automatically deleted by us after 14 months.

9.5 Recipients and transfer to third countries
According to the German data protection supervisory authorities (Data Protection Conference), Google Analytics is jointly responsible for data processing on our behalf. With this in mind, we have also entered into the "Google Measurement Controller-Controller Data Protection Terms" with Google. Google also processes your personal data in the USA.

10. GOOGLE REMARKETING

10.1 Description of the processing
Our website uses the advertising service "Google Ads Conversion", which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google"). With the help of Google Ads Conversions, we can place advertisements on external websites to draw your attention to our offers. The service also enables us to determine the reach and success of individual advertising measures. Our advertisements are delivered by Google via so-called "ad servers". For this purpose, Google uses so-called "ad server" cookies, which are used to measure certain parameters for measuring success, such as the display of adverts or clicks by users. If you access our website via a Google ad, Google Ads will store a cookie on your device (see section 7). According to Google, these cookies are not intended to identify you personally. The unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values for this cookie. The cookies enable Google to recognise your internet browser. If you visit the website of a Google Ads customer and the cookie stored on your device has not yet expired, both Google and the customer can identify that you clicked on the ad and were redirected to our website. A different cookie is assigned to each Google Ads customer. Cookies can therefore not be tracked via the websites of Google Ads customers. We ourselves do not process any personal data with our Google Adwords advertising measures. Google only provides us with statistical evaluations. Based on these evaluations, we can determine which of the advertising measures are particularly effective. We do not receive any additional data from the use of the advertising media; specifically, we cannot identify users based on this information. When you visit our website, a connection to Google’s servers is therefore established. We have no control over the extent and further use of the data collected by Google through the use of Google Ads Conversion. Therefore, we inform you according to our current knowledge: By integrating Google Ads Conversion, Google obtains information about which specific page of our website you have visited or which of our ads you have clicked on. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that Google will find out your IP address and store it.
Our website uses the "Google Remarketing" advertising service, which is also operated by Google. With Google Remarketing, we can target you with advertisements for our offers on other websites within the Google advertising network after you have visited our site. Google also uses cookies for this purpose, which are stored in your browser. These cookies track and evaluate your usage behaviour as you visit various websites. This allows Google to identify your previous visit to our website and display advertisements for our offers on other websites you visit. According to its own statements, Google does not combine the data collected through remarketing with your personal data that may be stored by Google. In particular, Google states that pseudonymisation is employed for remarketing.

Further information on data protection at Google can be found here: policies.google.com/privacy.

10.2 Purpose
The processing is conducted to enable targeted online advertising for our own offers and to evaluate their effectiveness and reach.

10.3 Legal basis
Processing is based on consent pursuant to Article 6(1)(a) of the GDPR. This is obtained by us via the consent tool [...] (see section 7.1). Such consent is voluntary.

10.4 Storage period and right to object, revocation of consent
We have explained the storage period and your control and setting options for cookies in section 7. You can object to data processing by Google Remarketing at any time via the following website: www.google.com/ads/preferences. You can revoke the consent you have given regarding data collection by Google Remarketing at any time in the settings of the consent tool, with effect for the future.

10.5 Recipients and transfer to third countries
By integrating Google Remarketing, personal data may be transmitted to Google. Google also processes your personal data in the USA.

11. GOOGLE TAG MANAGER

Our website uses the "Google Tag Manager", a service of the company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). No personal data is collected via the Google Tag Manager and no cookies are set. This service only allows us to include and manage tags on our website. Tags are small pieces of code on our website that are helpful to build upon with other tools to, for example, measure traffic and visitor behaviour, track the impact of online advertising and social channels, use remarketing and audience targeting, test and optimise the website. For more information about Google Tag Manager, visit www.google.com/intl/de/tagmanager/use-policy.html.

12. ONLINE APPOINTMENT BOOKING

12.1 Processing description

Appointments can be booked conveniently online via our website. For online appointment booking, we have integrated the "Dr. Flex" booking system, operated by Dr. Flex® GmbH, located at Stresemannstraße 21, 10963 Berlin, on our website. In this booking system, you will be asked to provide your surname, first name, and insurance status (e.g., self-payer, statutory, etc.), appointment type (e.g., consultation, check-up, private consultation, etc.), selected doctor/practitioner, booked appointments, cancellations of booked appointments, location data, mobile phone number, and any other information you choose to share voluntarily with the doctor (e.g., medical history, health-related questions, etc.). When you click the "Submit" button, the data is transmitted to us using SSL encryption (see item 13.). Your data can only be transmitted if you confirm that you have acknowledged the data protection provisions by clicking the corresponding checkbox. You will then receive a text message from Dr. Flex to confirm your appointment. Dr. Flex transmits the data you enter to us. Further information on data protection at Dr. Flex can be found at dr-flex.de/info/data-protection.

12.2 Purpose
By providing the booking system on our website, we aim to offer you a convenient way to schedule appointments online. The data transmitted with and in the booking system is used exclusively for the purpose of making appointments.

12.3 Legal basis
The processing is based on consent in accordance with Article 6(1)(a) of the GDPR. Such consent is voluntary. The aforementioned data processing may also include special categories of personal data as defined by Article 9 of the GDPR, such as health data. Your consent also expressly refers to this data.

12.4 Storage duration
We delete the data as soon as they are no longer required to achieve the purpose for which they were collected. If statutory retention periods prevent deletion, the data will be deleted immediately after expiry of the statutory retention period.

13. Processing of applicant data

13.1 Processing description

We process the data you provide in connection with your application in order to assess your suitability for the position (or other open positions in our company, if applicable) and to carry out the application process. This includes general information about you (such as your name, address and contact details), information about your professional qualifications and academic education, information about professional training, knowledge and skills, and other information that you disclose to us in connection with your application. This is usually done by means of letters of application, resume, references, correspondence, telephone or verbal information from you.

We would like to evaluate all applicants only on the basis of their qualifications and therefore ask you to refrain from providing "special categories of personal data" in accordance with Art. 9 of the General Data Protection Regulation in your application (e.g. a photo that reveals your ethnic origin, information about severe disabilities, etc.). If your application contains such information, please send us a corresponding declaration of consent, otherwise your application cannot be considered.

If your application is successful, we will transfer your data to your personnel file and use it to manage and conclude your employment.

If we are currently unable to offer you employment, we will continue to process your data after sending the rejection in order to defend ourselves against any legal claims, in particular due to alleged discrimination in the application process.

If you are not selected for the vacant position, we will transfer your data to our applicant pool - provided we have your consent to do so.

13.2 Purpose

Processing is carried out in order to conduct the application process, to decide on the establishment of an employment relationship with us and to document compliance with legal requirements in the application process.

13.3 Legal basis

Data processing in connection with the application procedure has its legal basis in Section 26 (1) sentence 1 BDSG and Article 6 (1) (1) b of the GDPR. If your application is successful, further data processing will be conducted in accordance with Article 6(1)(b) GDPR, Article 88(1) GDPR, and Section 26(1) BDSG, for the purpose of establishing, implementing, and terminating the employment relationship. If you have given your consent, such as for including your data in our applicant pool, the data processing is based on Article 6(1)(1)(a) GDPR. The legal basis for data processing after a cancellation is Article 6(1)(1)(f) GDPR. Our legitimate interest is the defence against legal claims.

13.4 Storage period

If your application is successful, your data will be transferred to your personnel file and deleted in accordance with the regulations applicable to personnel files. If we are currently unable to offer you employment, we will continue to process your data for up to six months after sending the rejection letter. If we transfer your data to our applicant pool after completion of the application process, we will delete it from the applicant pool in the event of a subsequent establishment of an employment relationship or otherwise two years after inclusion.

13.5 Recipients of your data, transfer of data to third parties and transfer to third countries

After we have received your application, your applicant data will be viewed by the Human Resources department and by the personnel service provider zahneins GmbH commissioned by us (zahneins GmbH, Legal Representative: Daniel Wichels (Managing Director), Mühlenkamp 6c, 22303 Hamburg; phone:040 33 46 12 90. Suitable applications are then forwarded internally to the department managers for the respective open position. Then the further procedure is coordinated. In principle, only those persons in the company have access to your data who need it for the proper course of our application procedure. For the processing of personnel administration, the program Recruitee of Recruitee B.V., Keizersgracht 313,1016 EE Amsterdam, Netherlands is used within the framework of order processing.  Data is not transferred to third countries.

14. Open Streetmap

14.1 Description of the processing

Our website uses the "JavaScript leaflet" to provide map data on our website. We use the service e.g. Open Streetmap which is provided by the Openstreetmap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS United Kingdom) (hereinafter referred to as "Open Streetmap") as a map. We use Open Streetmap by embedding a map with our business address on our website. For the use and function of Open Streetmap it is necessary to store your IP address. Your IP address is transmitted to Open Streetmap in connection with the address of our website. However, we have no influence on this data transmission. You have the option to deactivate the service of Open Streetmap and thus prevent the data transfer to Open Streetmap by deactivating JavaScript in your browser. However, we would like to point out that in this case you will not be able to use the map display on our pages, or only to a limited extent. Further information on data protection at Open Streetmap can be found at: wiki.osmfoundation.org/wiki/Privacy_Policy. Further information on "JavaScript Leaflet" can be found at: leafletjs.com.

14.2 Purpose

The processing is carried out in order to be able to show you an interactive map on our website.

14.3 Legal basis

The processing is necessary to protect the overriding legitimate interests of the responsible party (Article 6(1)(f) GDPR). Our legitimate interest lies in the purpose named in section 14.2.

14.4 Recipients and transfer to third countries

Open Streetmap also processes your personal data in England.

V. Security measures

15. Security measures

 To protect your personal data from unauthorised access, we have equipped our website with an SSL or TLS certificate. SSL stands for "Secure Sockets Layer" and TLS for "Transport Layer Security" and encrypts the communication of data between a website and the user's terminal device. You can recognise active SSL or TLS encryption by a small lock logo that appears on the far left of the browser's address bar.

VI Your rights

16. Data subject rights

With regard to the data processing by our company described above, you are entitled to the following data subject rights:

16.1 Information (Article 15 GDPR)
You have the right to request confirmation from us as to whether we are processing personal data relating to you. If this is the case, they have the right to information about this personal data and to the details listed in Article 15 GDPR, under the conditions specified in Article 15 GDPR.

16.2 Rectification (Article 16 GDPR)
You have the right to demand that we immediately correct any inaccurate personal data concerning you and, if necessary, complete any incomplete personal data.

16.3 Deletion (Article 17 GDPR)
You have the right to demand that we delete personal data concerning you without delay, provided that one of the reasons listed in detail in Article 17 GDPR applies, e.g. if your data is no longer required for the purposes pursued by us.

16.4 Restriction of data processing (Article 18 GDPR)
You have the right to request us to restrict processing if one of the conditions listed in Article 18 GDPR is met, e.g. if you dispute the accuracy of your personal data, data processing will be restricted for the period of time that allows us to verify the accuracy of your data.

16.5 Data portability (Article 20 GDPR)
You have the right, under the conditions set out in Article 20 GDPR, to request the return of the data concerning you in a structured, common and machine-readable format.

16.6 Revocation of consent (Article 7 paragraph 3 GDPR)
You have the right to withdraw your consent at any time in the case of processing based on consent. The revocation is valid from the time of its assertion. In other words, it functions for the future. The processing therefore does not become retroactively unlawful by the revocation of consent.

16.7 Complaint (Article 77 GDPR)
If you believe that the processing of personal data concerning you violates the GDPR, you have the right to lodge a complaint with a supervisory authority. You may exercise this right by contacting a supervisory authority in the EU Member State where you are located, where you work or where the alleged infringement took place.

16.8 Prohibition of automated decisions/profiling (Article 22 GDPR)
Decisions that have legal consequences for you or significantly affect you must not be based solely on automated processing of personal data - including profiling. We inform you that we do not use automated decision-making including profiling with regard to your personal data.

16.9 Right of objection (Article 21 GDPR)
If we process personal data from you on the basis of Article 6 (1) f GDPR (for the protection of overriding legitimate interests), you have the right to object to this under the conditions listed in Article 21 GDPR. However, this only applies if there are reasons arising from your particular situation. After an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms. We also do not have to stop processing if it serves the assertion, exercise or defence of legal claims. In any event - also irrespective of a specific situation - you have the right to object at any time to the processing of your personal data for direct marketing purposes.

Last updated: April 2022