The protection of your personal data is important to us. In collecting, processing and using data, we strictly adhere to the regulations and legal bases of the Federal Data Protection Act (refer also to https://www.gesetze-im-internet.de/bdsg_1990/) and to the Telemedia Act (refer also to https://www.gesetze-im-internet.de/tmg/). By using our website you permit us to collect particular data about you. Below is some information about the type of data which is collected when you visit our homepage and how this data is used.
As a user of the website http://www.neurodontics.com/ you can, in principle, see the full contents of the webpage without entering any personal data. Provided that you as a user, (hereinafter called "person concerned") would like to take advantage of certain services (e.g. appointment or contact forms) via our website, it may, however, become necessary to process personal data (see also Section 4. Collection of data and information).
When processing personal data (e.g. name, date of birth, address, email address or phone number) of a person concerned, we always adhere to the General Data Protection Regulation (see also https://dsgvo-gesetz.de), as well as the professional code applicable to us and the country-specific data protection regulations. Our intention in issuing this data policy is to inform persons concerned about the type, scope and purpose of the personal data collected and processed by us. Furthermore, we inform all users of our website about their rights in connection with the data processing carried out by our company.
In addition, we as the entity responsible for data processing consider it our obligation, with the assistance of several technical and organisational measures, to ensure that the user of the website http://www.neurodontics.com/ is guaranteed protection which is as complete as possible with regard to the personal data processed through this website. In principle, internet-based data transmissions can have security gaps any time, and this means that we cannot guarantee absolute protection. For this reason it is up to each user concerned to transmit personal data to us via alternative means also, for example by telephone.
1. Definition of terms
We intend to make our data policy easy to read and to understand, both for the public and for our Patients. To ensure this, and to explain to you in advance the terminology used below, we refer you at this point to the original wordings of the law and definitions of the General Data Protection Regulation available at https://dsgvo-gesetz.de/art-4-dsgvo/ andhttps://dsgvo-gesetz.de/bdsg-neu/46-bdsg-neu/.
2. Name and address of the person responsible for processing
The person responsible according to the General Data Protection Regulation is:
NEURODONTICS gemeinnützige Stiftung
represented by Dr. med. dent. Wilhelm Entrup
Tel. (0511) - 36 49 916
Fax (0511) - 36 49 911
3. Name and address of data protection officer
The person responsible is:
Tel. (0511) - 36 49 916
Fax (0511) - 36 49 911
Any person concerned can contact our data protection specialist directly any time in case they have questions and suggestions on data protection.
4. Collection of data and information
Handling of personal data
Personal data is information that can be used to identify a person, i.e. information that can be traced back to a person. This includes name, email address or telephone number. We only collect, use and pass on personal data if this is legally permissible or if the person concerned consents to having their data collected. In principle, you can visit our website without leaving behind any personal data. In some cases, however, we need data from you, and precisely in the following situations:
- • contact form
On no account shall the collected data be sold or passed on to third parties for other reasons.
Collection and processing of non-personal data (access data/ server log files)
Every time a person concerned accesses our website, that is to say, every time a file is accessed or an attempt is made to access a file on this server, data is saved about this process in a log file (server log file) with the Webspace provider. This data is not personal and we cannot know, which user retrieved which data.
Specifically, the following record is kept about every access to the website:
- • Name of the file retrieved
- • Date and time of retrieval
- • Amount of data transferred
- • Report on whether the retrieval was successful
- • Report on why retrieval possibly failed
- • Your computer’s operating system and browser software
- • Referrer URL (the last visited page)
- • Host name of the accessing computer (IP-address)
All the data mentioned is evaluated only for statistical analysis, for business and security purposes and for the optimisation of services offered by us and by service providers contracted by us. The anonymous data in the server log files is stored separately from all personal data. Additional personal data is only collected if you are providing this information voluntarily, e.g. in connection with an enquiry. We use this data to constantly improve our website and services to you. However, the provider reserves the right to check the protocol data afterwards if, based on concrete evidence, there is justifiable reason to believe that illegal access took place.
5. Contact options through the website
The website of NEURODONTICS contains buttons which enable you to quickly contact our company electronically, which among other things requires you to indicate an email address. The personal data transmitted by persons concerned on a voluntary basis via a contact form or by email are stored automatically by us exclusively for purposes of processing or contacting the person concerned. All personal data collected will on no account be passed on to third parties.
6. Data protection for digital applications
Application documents and personal data transmitted electronically (e.g. by email or through an integrated application form) shall be processed further exclusively for purposes of completing the application procedure. If in the end an employment contract comes into being between the person responsible for the processing and the applicant, the transmitted data will be stored under full consideration of the legal regulations. If no employment contract comes into being, all transmitted data will be deleted by the person responsible for its processing after announcement of the decision to reject the application, provided that there are no other legitimate interests of the person responsible for processing that run contrary to the deletion. Another legitimate interest in this sense is for example the burden of proof in court proceedings according to the General Equal Treatment Act (AGG).
Our cookies do not store any personal data. Most browsers are configured in such a way that they accept cookies automatically. You can deactivate the option of storing cookies, though, or you can configure your browser in such a way that you get informed every time cookies are sent. Besides, cookies already stored on your computer can be deleted any time through the internet browser or any other software programme. This is possible with all the common internet browsers. Please note that for certain functions of our website cookies are required to enable smooth running of the website and/or for correct display of contents.
8. Deletion and blocking of personal data
Our company stores personal data of the person concerned only for as long as it is required for the attainment of the storage purpose, or for as long as provided for by European statutory provisions, the competent supervisory authority or other applicable German laws.
If the storage purpose ceases to exist or the authorised deadline expires, the personal data will be deleted as a matter of routine and in accordance with legal regulations.
9. Rights of the person concerned
a) Right to confirmation
The person concerned has the right pursuant to Article 15(1) of the General Data Protection Regulation, to get a confirmation from us as to whether personal data is processed in our company. If a person concerned wants to exercise this right to confirmation, he can get in touch with our data protection officer or any other employee in our company any time.
b) Right to information
The right to information is subdivided into two steps. Firstly, the person concerned can demand a confirmation from the person responsible as to whether he processes personal data at all (see Section 9a - Right to confirmation). If no personal data of the person concerned is processed, the person making the inquiry has to be informed about it. If personal data of the person concerned is processed, the said person has a right to information about the data free of charge. In addition, the person responsible also has to provide the following information to the person concerned pursuant to Article 15(1) of the General Data Protection Regulation :
- •the purposes of the processing;
- •the categories of personal data concerned;
- •the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
- •where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- •the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- •the right to lodge a complaint with a supervisory authority;
- •where the personal data are not collected from the data subject, any available information as to their source;
- •the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Furthermore, if personal data is transmitted to third countries or to an international organisation, persons concerned have the right, according to Article 15(2) of the General Data Protection Regulation, to be informed about the appropriate guarantees put in place in connection with the data transfer, as per Article 46 of the General Data Protection Regulation (e.g. standard data protection clauses agreed on or enforceable internal data protection regulations).
If a person concerned wants to exercise this right to information, he can get in touch with our data protection officer or any other employee in our company any time.
c) Right to correction of data
The person concerned has the right pursuant to Article 16 of the General Data Protection Regulation, to demand immediate correction of any false personal data relating to him from the person responsible. Taking into consideration the purpose for the data processing, the person concerned has the right to demand the completion of his incomplete personal data – even by means of a supplementary statement.
If a person concerned wants to exercise this right to correction of data, he can get in touch with our data protection officer or any other employee in our company any time.
d) Right to deletion (“Right to be forgotten”)
The person concerned has the right in accordance with Article 17 of the General Data Protection Regulation to demand of the person responsible that the relevant personal data be immediately deleted, provided that one of the following reasons is correct and as long as the data processing is no longer necessary:
- •the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- •the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
- •the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
- •the personal data have been unlawfully processed;
- •the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
- •the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
Provided that one of the reasons mentioned above is correct and a person concerned would like to initiate the deletion of personal data which is stored at NEURODONTICS he can get in touch with our data protection officer or any other employee in our company any time. The contacted employee will see to it that the request for deletion is immediately complied with.
e) Right to limitation of data processing
The person concerned has the right in accordance with Article 18 of the General Data Protection Regulation to demand of the person responsible that the processing of his personal data be limited if one of the following conditions exists:
- •the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- •the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- •the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- •the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
Provided that one of the reasons mentioned above is correct and a person concerned would like to demand the limitation of personal data which is stored at NEURODONTICS he can get in touch with our data protection officer or any other employee in our company any time. The contacted employee will see to it that the limitation of data processing is immediately complied with.
f) Right to data transferability
The person concerned has the right pursuant to Article 20 of the General Data Protection Regulation to receive personal data concerning him, which he provided to a person responsible for processing, in a standard, structured and machine-readable format.
Besides, she has the right to transmit this data to another person responsible for data processing without hindrance by the current person responsible to whom the personal data had been sent, provided that the processing is based on consent as per Article 6(1) a of the General Data Protection Regulation or Article 9(2) a of the General Data Protection Regulation, or on a contract as per Article 6(1) b of the General Data Protection Regulation, and the processing is done with the help of automated methods, and as long as the processing is not required for the performance of a task which is of public interest or is carried out in exercise of official authority which was transferred to the person responsible.
Furthermore, the person concerned has the right, according to Article 20(2) of the General Data Protection Regulation, when exercising his right to data transferability as per Article 20(1) of the General Data Protection Regulation, to authorise that his personal data be transmitted directly from one person responsible to another, as long as this is technically feasible and provided that the rights and liberties of other persons are not affected by this (Article 20(4) of the General Data Protection Regulation).
In a move to assert the right to data transferability, the person concerned can get in touch with the data protection officer appointed by NEURODONTICS or any other employee of our company any time.
g) Right to object to data processing
The person concerned has the right, pursuant to Article 21 of the General Data Protection Regulation, for reasons arising from his particular situation, to raise objection any time against the processing of his personal data, which is being carried out on the basis of Article 6(1) e or f of the General Data Protection Regulation. This also applies to any kind of profiling based on these regulations.
In the case of the objection, NEURODONTICS will henceforth stop processing the personal data, unless we can prove that there are compelling and legitimate reasons for the processing, which outweigh the interests, rights and liberties of the person concerned, or unless the processing serves the purpose of asserting, exercising or defending legal claims.
If NEURODONTICS processes personal data so as to conduct direct advertising, the person concerned has the right, according to Article 21(2) of the General Data Protection Regulation, to raise objection any time against the processing of personal data for such advertising purposes. This also applies to any kind of profiling, as long as it is connected with such direct advertising. If the person concerned raises objection against NEURODONTICS because of processing data for direct advertising purposes NEURODONTICS will henceforth stop processing personal data for such purposes (Article 21(3) of the General Data Protection Regulation).
Furthermore, the person concerned has the right, pursuant to Article 21(6) of the General Data Protection Regulation, for reasons arising from his particular situation, to raise objection any time against the processing of his personal data, which is being carried at NEURODONTICS for scientific or historical research purposes, or for statistical purposes as per Article 89(1) of the General Data Protection Regulation, unless such processing is required for the fulfilment of a task which is of public interest.
To assert the right to objection, the person concerned can get in touch with the data protection officer at NEURODONTICS or any other employee. Furthermore, the person concerned is at liberty to exercise his right to objection through automated methods - for which technical specifications are used - in connection with the use of services of the information society, Directive 2002/58/EG notwithstanding.
h) Automated decisions on a case-by-case basis including profiling
Any person affected by the processing of personal data has the right, under Article 22 of the General Data Protection Regulation, not to be subjected to a decision based exclusively on automated processing - including profiling - which will have legal repercussions over him or adversely affect him in a similar way, provided that the decision (1) is not required for the conclusion or the fulfilment of a contract between the person concerned and the person responsible, or (2) is permissible, due to legal provisions of the European Union or of the member states, to which the person responsible is subject, and these legal provisions contain adequate measures for the preservation of the rights and liberties as well as the legitimate interests of the person concerned, or (3) is taken with the express consent of the person concerned.
If the decision (1) is required for the conclusion of a contract between the person concerned and the person responsible, or (2) is taken with the express consent of the person concerned, NEURODONTICS will take appropriate measures to uphold the rights and liberties as well as the legitimate interests of the person concerned, which at least comprise the right to obtain powers of intervention by a person on the side of the person responsible, the right to express one’s own point of view and the right to contest a decision.
If a person concerned wants to assert his rights relating to automated decisions, he can get in touch with our data protection officer or any other employee in our company any time.
i) Right to revocation of declaration of consent
The person concerned has the right to revoke a declaration of consent to process personal data any time.
If a person concerned wants to assert his rights relating to revocation of declaration of consent, he can get in touch with our data protection officer or any other employee in our company any time.
10. Usage of Webfonts
a) Google Fonts
https://fonts.google.com/#AboutPlace:about & https://policies.google.com/privacy?hl=en_US
b) Adobe Typekit
https://typekit.com/ & https://www.adobe.com/de/privacy/policies/typekit.html
11. Data protection regulations for use of Google Analytics (with anonymization function)
This website uses Google Analytics (with anonymization function), a web analytics service provided by Google Inc. (“Google”). Web analysis refers to the generation, collection and evaluation of data about user behaviour and the use of individual internet pages. This data usually consists, among other things, of the so-called Referrer URL, which is the address from where the person concerned came to access our website, as well as information about the use of individual sub-pages (e.g. an overview of the web pages visited, the frequency of the visits as well as the time spent on these sites). Web analysis is mainly used to optimise an internet page and for purposes of cost-benefit-analysis. The company that runs Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain view, CA 94043-1351, USA.
The data generated is used by Google to compile online reports about the activities on our web pages and to render further services connected with the use of our internet pages, in addition to the evaluation of the traffic on our website.
In addition, the internet browser on the digital device of the person concerned automatically transmits data to Google for purposes of online analysis, and this happens every time you access a sub-page on this web page which contains an integrated Google Analytics component. Through this technical process in the background of the visited web page, Google gains knowledge of some personal data, like the IP-address of the person concerned. Google uses this specific data to compile reports about the traffic on the website (e.g. the origin of the visitors and number of clicks) and to render other services connected with the use of the website and the Internet on behalf of the website operator. The IP address transmitted by your browser to Google Analytics will not be merged with other data by Google.
The storage of the cookies described above on the digital terminal of the person concerned, enables personal information like the access time, the place from which access was made and the frequency of the visits, as well as the IP-address of the Internet connection used by the person concerned, to be transmitted to Google in the United States of America and to be stored there, whenever a person visits our internet pages. Under some circumstances Google also passes this personal data collected through technical methods to third parties.
The person concerned can prevent the storage of cookies on his computer by our internet page any time by making an appropriate adjustment in the browser software used and in that way permanently reject the storage of cookies. However, we wish to point out at this moment that the person concerned may not be able to use all the functions of this website. Such an adjustment in the settings of the browser software used would also prevent Google from storing cookies on the digital device of the person concerned. In addition, a cookie already stored by Google Analytics can be deleted any time afterwards through the browser software or other software programmes.
Further information and the applicable data protection regulations from Google can be viewed at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. You can get a more detailed explanation regarding Google Analytics through the following link https://www.google.com/intl/de_de/analytics/.
12. Data protection regulations for the use of YouTube
As the persons responsible for processing, we have integrated components of YouTube on this web page. YouTube is a free online video portal that enables users worldwide to post video clips free of charge, and other users to view, evaluate and comment on the videos also free of charge.
The operator of YouTube is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain view, CA 94043-1351, USA.
If the person concerned accesses a page within this website, which has a YouTube component in form of a video integrated in it, the browser software on the digital terminal of the person concerned is automatically prompted by the respective YouTube component to download a version of the corresponding YouTube component from YouTube. Further information about YouTube can be obtained from https:www.youtube.com/yt/about/de/. As a result of these technical processes, YouTube and Google receive information regarding which concrete sub-page of our website is being visited by the person concerned.
It should be stressed that YouTube and Google obtain information through the technical components implemented on this web page only in the case of personal data, that the person concerned has visited our internet page if the person concerned is logged in to YouTube or Google with his personal user data at the same time when our internet page is being accessed. This takes place independently of whether the person concerned clicks on a YouTube video or not. If the person concerned does not want this to happen, he can prevent the transmission of the data by logging off from his YouTube or Google account before visiting our internet page.
You can obtain further information about the collection, processing and use of personal data by YouTube and Google in the data protection regulations at https://www.google.de/intl/de/policies/privacy/.
13. Children & adolescents
Persons concerned who have not yet exceeded 18 years of age should not transmit any personal data to us without the consent of the parents or guardians. Generally, we do not demand any personal data on our websites from children and adolescents, we do not collect any such data and do not pass it on to third parties.
14. Legal basis for data processing
The legal basis for the processing operations, for which we obtain consent for a particular processing purpose, is provided for in the case of our comapny by Article 6(1) a of the General Data Protection Regulation
If the processing of personal data is based on the fulfilment of a contract between the person responsible and the person concerned, as is the case, for example, with processing operations which are necessary for rendering of a service or return service, the processing shall be based on Article 6(1) b of the General Data Protection Regulation. The same applies to processing operations which are required for carrying out pre-contractual measures.
If the processing of personal data becomes necessary through a legal obligation by our practice (e.g. fulfilment of tax duties), then the processing shall be based on Article 6(1) c of the General Data Protection Regulation.
In addition, a situation could arise within our company which requires the processing of personal data to protect essential interests of the person concerned or another natural person. This would be the case, for example, if a visitor were to be injured in our company and consequently his name, age, health insurance company data or other essential personal information would of necessity be passed on to a doctor, a hospital or other third parties. In this case the processing would be based on Article 6(1) d of the General Data Protection Regulation.
Lastly, processing operations could be based on Article 6(1) f of the General Data Protection Regulation. Processing operations can be based on this legal foundation, if the processing is required for the preservation of the legitimate interests of our practice or a third party, provided that the interests, fundamental rights and basic liberties of the person concerned do not predominate, particularly when the person concerned is a child. To that end, the European legislator is here of the view that a legitimate interest could be accepted, if the person concerned is a customer of the person responsible (Recital 47, Clause 2 of the General Data Protection Regulation).
15. Legitimate interests in the processing that are being pursued by the person responsible or a third party
If the processing of personal data is based on Article 6(1) f of the General Data Protection Regulation, our legitimate interest is the execution of our commercial activity for the welfare of our employees and our shareholders.
16. Storage period for personal data
The storage period for personal data is regulated by the respective legal retention period. If this deadline expires, the collected data is deleted as a matter of routine, provided that it is no longer required as a component in the fulfilment or initiation of a contract.
17. Information for obligatory provision of personal data by the person concerned
At this point we would like to inform you that the legislator partly dictates the provision of personal data (e.g. tax regulations) or that the provision of data can arise from contractual provisions (e.g. details of the contracting party). For example, if the person concerned concludes a contract with our company, he is obliged to provide us with personal data. If this data is not provided to us for the completion of a contract, the contract with our company would possibly not take place. The person concerned can get in touch with our datat protection officer any time before providing us with his personal data, and this specialist would gladly explain to him one-on-one whether the provision of the personal data is a legal or contractual requirement. In addition, we shall explain to the person concerned whether the provision of the personal data is binding in the individual case and what consequences the non-provision of the data would have.
18. Existence of an automated decision maker
As a responsible company we refrain from using an automatic decision maker or profiling.
19. Legal validity and governing law