Privacy Policy https://www.dental21-germaniacampus.de/

and at the same time information for data subjects pursuant to Article 13 and Article 14 GDPR

1 General information

1.1 Responsible entity

The controller within the meaning of the General Data Protection Regulation is:

MVZ Dentalzentrum Münster GmbH

Grevener Straße 91

48159 Münster

Phone: 0251 276888

Email: muenster-germaniacampus@dental21.de

1.2 Data Protection Officer

The data protection officer for this institution is:

DataCo GmbH

Sandstraße 33

80335 Munich

Tel.: +49 89 452459 900

Email: datenschutz@dataguard.de

1.3 Scope of the processing of personal data

As a matter of principle, data concerning health requires special protection. For this reason, data protection is of particularly high importance to us.

As a matter of principle, we process personal data only insofar as this is necessary to provide a functional website and our services. Personal data is regularly processed only after the user's consent has been obtained. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.

1.4 Data erasure and storage period

The personal data of the data subject will be erased or blocked as soon as the purpose of storage ceases to apply. Data may also be stored if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data will also be blocked or erased when a storage period prescribed by the aforementioned standards expires, unless there is a need for the continued storage of the data for the conclusion or performance of a contract.

1.5 Notice regarding data transfers to the USA

Among other things, this website integrates tools from companies based in the USA. When these tools are active, your personal data may be transferred to the US servers of the respective companies. The USA is not a safe third country within the meaning of EU data protection law. US companies are obliged to hand over personal data to security authorities without you, as the data subject, being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data located on US servers for surveillance purposes. We have no influence over these processing activities. Appropriate contracts pursuant to Art. 46(2) GDPR have been concluded with the service providers for the transfer to these third countries.

Health data is never transferred to the USA.

2 Use of the website

2.1 Provision of the website, CDN and creation of log files

2.1.1 Informational use

For the purely informational use of this website, it is generally not necessary for you to provide personal data. In order to enable the use of the web pages you access, for statistical purposes and to improve our online offering, the data that your internet browser automatically transmits is used, such as:

• Date and time of access
• Browser type
• Browser settings
• Operating system
• the last page visited
• the amount of data transferred and the access status (file transferred, file not found, etc.)
• IP address.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.

Legal basis

The legal basis for the temporary storage of the data and the log files is our legitimate interest in the technically functional provision of the website (Art. 6(1)(f) GDPR).

The host will only process your data insofar as this is necessary to fulfil its performance obligations. To ensure data protection-compliant processing, a data processing agreement has been concluded with the host. The location of the website's server is geographically in the USA.

2.1.2 Use of cookies

This website uses cookies. Cookies are text files that are stored in or by the internet browser on the user's computer system. Cookies that are not technically necessary — i.e. that do not serve solely the functionality of the website — are also used.

By setting technically unnecessary cookies, the following data is processed:

• IP address
• Location of internet users
• Date and time the website is accessed
• Tailoring of advertisements to the user
• Tracking of browsing behaviour
• Linking of the website visit with other social media platforms

You can determine for yourself whether cookies can be set and retrieved through the settings in your browser. For example, you can completely deactivate the storage of cookies in your browser. As a user, you therefore have full control over the use of cookies.

Purpose of the data processing

If technically necessary cookies are used:

• Storage of the settings of the cookie notice banner (consent tool)
• Optimisation of the functionality and design of the website.

If technically unnecessary cookies are used:

• Objective measurement of user numbers
• Analysis of user data

Legal basis

Where the setting and reading of cookies is technically necessary, this is done on the basis of Section 25(2) No. 2 TDDDG.

Insofar as cookies are used that are not technically necessary, this is done on the basis of your express consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a), Art. 7 GDPR. You can withdraw your consent at any time with effect for the future.

2.1.3 Cookie consent with the „Cookie Consent Tool“

This website uses the cookie consent technology of

Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany

in order to obtain your consent to the storage of certain cookies on your device and to document this in a data protection-compliant manner.

Legal basis

The „Cookie Consent Tool“ is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6(1) sentence 1 (c) GDPR.

Objection and removal options

The data collected by the consent tool remains stored until you delete the consent cookie yourself or the purpose for storing the data ceases to apply. Mandatory statutory retention obligations remain unaffected.

2.1.4 Uploadcare

This website uses the „Uploadcare“ service of

Uploadcare LLC, 18801 Collins Ave 102-120, Sunny Isles Beach, FL 33160, USA

for the processing and provision of media (CDN).

Legal basis

The use is based on our legitimate interest in providing our web offering as error-free and securely as possible (Art. 6(1)(f) GDPR).

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://uploadcare.com/about/gdpr/.

2.2 Plugins and tools

2.2.1 PostHog

This website uses the PostHog service of

PostHog Inc, 2261 Market Street #4008, San Francisco, CA 94114, USA.

PostHog can be used to analyse user behaviour on the website for the purpose of improving the online offering. Your entries are not recorded in the process, so that no name, address or health data is transmitted.

You can find further information about PostHog at https://posthog.com/faq and in their privacy policy: https://posthog.com/privacy

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

2.2.2 HubSpot Analytics and Banner

This website uses services from HubSpot provided by HubSpot Ireland Ltd., One Sir John Rogerson's Quay, Dublin 2, Ireland, to analyse user behaviour and to personalise advertising banners. These services make it possible to understand how visitors interact with the website and to present them with relevant content and offers.

The following personal data is processed within the scope of these services:

• IP address
• Location data
• Information about the browser and device used
• Pages visited and interactions on the website
• Data on clicks on advertising banners

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

2.2.3 Google Tag Manager

This website uses Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that can be used to integrate tracking or statistics tools and other technologies into the website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any independent analyses. It merely serves to manage and deliver the tools integrated via it. However, Google Tag Manager does record your IP address, which may also be transferred to Google's parent company in the United States.

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

2.2.4 Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the site, operating systems used and the origin of the user. Google Analytics also uses various modelling approaches to supplement the collected data sets and uses “machine learning” technologies for data analysis.

Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transferred to a Google server in the USA and stored there.

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

2.2.5 Meta Pixel

Meta Pixel is used to optimise online advertising. Meta Pixel is a small piece of code placed on this website. It makes it possible to track your behaviour on the website and thus to better understand your interests.

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

2.2.6 DoubleClick

This website uses Google DoubleClick, a service provided by Google LLC, to manage and optimise online advertising. DoubleClick uses cookies and similar technologies to collect information about your use of the website.

Type of data processed

Technical usage data: this includes, for example, your IP address, browser information and the operating system of your device.

Usage behaviour: information about which pages you visit, which ads you click on and how long you stay on the website.

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

2.2.7 Appointment organisation and reminders

To organise your treatment appointments, the address and contact data you provide (e.g. email address or mobile number) is used to send you appointment confirmations and reminders. The provider of the appointment organisation tool is Patient21 SE, Kurfürstendamm 33, 10719 Berlin.

Legal basis

Your contact and address data is processed to carry out the treatment relationship on the basis of Art. 6(1)(b) GDPR. Appointment reminders are sent to you following your revocable consent on the basis of Art. 6(1)(a) GDPR.

2.2.8 Online medical history

To carry out your treatment, your medical history data is required, which you can submit online or at the practice on site. The provider of the tool for the online collection of the medical history is Patient21 SE, Kurfürstendamm 33, 10719 Berlin.

Legal basis

The legal basis for the processing of appointment and medical history data is Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(h) GDPR. The collection is an important pre-contractual measure for the treatment contract you have requested.

2.2.9 Happy

To help us ensure the quality of treatment, after your visit to the practice you voluntarily fill in the forms provided by the Happy tool to inform us about your personal satisfaction with the practice. The data is made available to the treating doctors and practice staff for the improvement of the service. The provider of the tool is Patient21 SE, Kurfürstendamm 33, 10719 Berlin.

Legal basis

The legal basis for the processing of your voluntary information is Art. 6(1)(f) GDPR. The practice has a legitimate interest in complying with legal obligations to improve the quality of treatment.

2.2.10 Treatment recommendations

To ensure your optimal care, you receive suitable recommendations by email based on the course of your treatment. The provider of the recommendations tool is Patient21 SE, Kurfürstendamm 33, 10719 Berlin.

Legal basis

Your personal data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Art. 9(2)(a) GDPR.

2.2.11 Patient communication

For email and telephone communication, HubSpot Ireland Ltd., One Sir John Rogerson's Quay, Dublin 2, Ireland and Twilio Ireland Ltd., 70 Sir John Rogerson's Quay, Dublin 2, Ireland are used.

Using HubSpot, health information and offers are sent to you at certain intervals, e.g. by email or SMS. This includes further information about your treatment (e.g. the treatment and cost plan), additional recommendations and valuable preventive care tips for your health, as well as offers for medical products.

If you consent, the following data is processed:

• Name, address and contact data
• Age and gender
• Practitioner and practice data
• Medical history details
• Completed treatments
• Appointment information
• Results of customer satisfaction surveys

Legal basis

The legal basis for the processing of personal data is our legitimate interest in efficient, reliable and documentable communication within the scope of the treatment relationship (Art. 6(1)(f) GDPR).

In the case of offers that are not directly related to your treatment, your personal data is processed on the basis of your revocable consent pursuant to Art. 6(1)(a) GDPR, where applicable in conjunction with Art. 9(2)(a) GDPR.

2.2.12 GRWAPI

This website uses GRWAPI from SKAJ Ventures GmbH, Sonnenlandstraße 4, 14471 Potsdam, to present you with genuine, publicly available reviews of the practice's services. In doing so, your IP address, for example, is transferred to SKAJ.

Legal basis

The processing is based on our legitimate interest in presenting genuine, up-to-date patient reviews as a trust and quality signal (social proof), in informing our patients and strengthening our public image, as well as for patient acquisition and safeguarding our entrepreneurial freedom (Art. 6(1)(f) GDPR).

3 Use of offerings, own services

3.1 Treatment at the dental practice

To carry out your dental treatment, your personal data — in particular health data such as medical histories, diagnoses, findings, treatment proposals or treatment and billing data, X-ray images, 3-D scans, etc. — is processed.

Legal basis

The processing is based on Art. 6(1)(b) GDPR (treatment contract) and Art. 9(2)(h) GDPR (processing of special categories of data in the healthcare sector).

Storage period

The data is stored in accordance with the statutory retention periods, in particular pursuant to Section 630f BGB, generally for 10 years after the completion of treatment, and in special cases for up to 30 years.

3.2 Billing of medical services

To bill for your dental treatment, your personal data — in particular health data such as medical histories, diagnoses, findings, treatment proposals or treatment and billing data, X-ray images, 3-D scans, etc. — is processed.

Legal basis

The processing is based on Art. 6(1)(b) GDPR and Art. 9(2)(h) GDPR. Insofar as we involve statutory health insurance (dental) associations, this is done on a statutory basis or within the scope of processing on our behalf or under a special transmission obligation. Insofar as we involve external billing service providers, this is done on the basis of your consent (Art. 6(1)(a) GDPR).

Debt collection by a debt collection service provider

If you fail to pay a due invoice despite a reminder, the data required for debt collection is transferred to a debt collection service provider. The service provider is

PAIR Finance GmbH, Hardenbergstraße 32, 10623 Berlin,

which acts as an independent controller within the meaning of the GDPR. To process the claim, PAIR Finance uses, among other things, self-developed technologies based on artificial intelligence to manage debtor communication. Only the data required for debt collection is transmitted. Detailed diagnosis or treatment descriptions are not transmitted, unless this is exceptionally strictly necessary to enforce the claim and is specifically requested.

Legal basis for the transmission

The transmission takes place on the basis of Art. 6(1)(f) GDPR and Art. 9(2)(f) GDPR. Within the scope of processing the claim, PAIR Finance may also pass on your data to credit agencies, lawyers as well as courts and authorities. PAIR Finance GmbH will inform you separately about the processing of your data by PAIR Finance; the data protection information is available at https://pairfinance.com/datenschutz-bezahlseite/.

3.3 Handling of applicant data

Description and scope of the data processing

We may offer you the opportunity to apply to us (e.g. by email or by post). For the purpose of carrying out the application process, deciding on the establishment of an employment relationship and carrying out pre-contractual measures, we use:

Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany

Legal basis

The legal basis for the data processing is Section 26 BDSG (new version) under German law (initiation of an employment relationship), Art. 6(1)(b) GDPR (general contract initiation) and — insofar as you have given consent — Art. 6(1)(a) GDPR. Consent can be withdrawn at any time. Your personal data is passed on exclusively to persons involved in processing your application.

Storage period

To fulfil legal obligations or to defend against any claims arising from legal provisions, your data is stored for a period of 6 months beyond the end of the application process.

If, within the scope of the application process, you receive an offer of employment and accept it, the personal data collected during the application process is stored at least for the duration of the employment relationship.

4 Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

4.1 Right of access

You can request confirmation from the controller as to whether personal data concerning you is being processed by us.

If such processing is taking place, you can request information from the controller about the purposes, categories, recipients, storage period, transmission, etc.

4.2 Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

4.3 Right to restriction of processing

Under certain conditions, you can request the restriction of the processing of the personal data concerning you:

• if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of the use of the personal data;
• the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, or
• if you have objected to the processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.

4.4 Right to erasure

4.4.1 Obligation to erase

You can request that the controller erase the personal data concerning you without undue delay, and the controller is obliged to erase this data without undue delay where one of the following grounds applies:

• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
• You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
• The personal data concerning you has been processed unlawfully.
• The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8(1) GDPR.

4.4.2 Exceptions

The right to erasure does not exist insofar as the processing is necessary

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to under section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
• for the establishment, exercise or defence of legal claims.

4.5 Right to data portability

You have the right to receive your personal data in a structured, readable format or to request its transmission to another controller.

4.6 Right to withdraw the data protection consent declaration

You have the right to withdraw your data protection consent declarations at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.

4.7 Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

• is necessary for the conclusion or performance of a contract between you and the controller,
• is authorised by Union or Member State law to which the controller is subject and which lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
• is based on your explicit consent.

4.8 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of the personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint was lodged will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

5 Third-party websites, changes

5.1 Data protection and third-party websites

The website may contain hyperlinks to and from third-party websites. If you follow a hyperlink to any of these websites, please note that we cannot accept any responsibility or liability for third-party content or data protection conditions. Please make sure to check the applicable data protection conditions before submitting personal data to these websites.

5.2 Changes to this privacy policy

We reserve the right to amend this privacy policy at any time with effect for the future. The current version is available on the website.

Ver 3.1