These Personal Data Processing Principles govern how ArtDentistic, s.r.o. processes your personal data, to what extent and for what purposes. At the same time, you will learn what rights you have in connection with the processing of personal data and how you can exercise them. In these Principles, ArtDentistic, s.r.o. is also referred to as "controller" or "we". The controller of personal data is the entity that decides for what purpose and by what means your personal data are processed. These principles apply in particular to the processing of personal data in connection with the operation of the website www.artdentistic.sk.sk.
The identifying data of our company are:
Title: ArtDentistic, s.r.o.
Registered office: i7ekova 21A, 811 02 Bratislava Old Town (Star e9 Mesto)
Company ID (IO): 46 963 201
Registered in the Commercial Register of the Municipal Court Bratislava III,
Section: Sro, File No.: 86769/B
Contact: gdpr@nazovspolocnosti.sk
Your trust is important to us, and therefore when processing personal data we ensure that your data are used transparently, securely, and only to the extent necessary to fulfill the processing purposes.
Rights of the data subject
When processing personal data, you act in the capacity of data subject, i.e., the person whose data we process. As a data subject, you have certain rights in connection with the processing of personal data that allow you to obtain information about what data about you we process, decide on their correction or deletion, restrict their use, or object to their processing. Below, we provide an overview of your rights that you can exercise with regard to the processing of your personal data:
- Right of access you have the right to receive a copy of your personal data that we have available, as well as information about how we use your personal data.
- Right to rectification if you believe that the personal data we hold about you are inaccurate, incomplete, or outdated, please feel free to ask us to correct, update, or supplement this information.
- Right to erasure ("right to be forgotten") you have the right to request the deletion of your personal data.
- Withdraw consent in cases where we process your personal data based on your consent, you have the right to withdraw this consent at any time. Withdrawing consent does not affect the lawfulness of processing of personal data that we carried out based on it.
- Right to restrict processing under certain circumstances, you are entitled to request that we stop using your personal data.
- Right to data portability under certain circumstances, you have the right to request that we transfer the personal data you have provided to us to another third party, according to your choice.
- Right to object you have the right to object to the processing of personal data that is based on our legitimate interests.
- Right to lodge a proposal to initiate proceedings for the protection of personal data if you believe that we process your personal data unfairly or unlawfully, you may submit a petition to the supervisory authority, which is the Office for the Protection of Personal Data of the Slovak Republic.
- Right for it not to apply to you automated individual decision-making, including profiling<\/t1>.
Special conditions for the processing of personal data
Providing personal data through the web form is voluntary. Without providing the data necessary to handle your request, however, we may not be able to respond to your inquiry, contact you, or arrange an appointment.
If you submit an objection concerning the processing of your personal data, you have the right to submit a request or a written application to the registered office address of the controller i7ekova 21A, 811 02 Bratislava Old Town (Star e9 Mesto) or by email:........................... When processing personal data, we do not carry out automated individual decision-making, including profiling.
We obtain personal data at least directly from you when using web forms and during subsequent communication with us. In the case of reviews, we may also obtain personal data from publicly available reviews published through the Google service.
The text below contains detailed information about the processing of personal data, in particular about the purposes of their processing, legal bases, retention periods, or categories of recipients.
- Handling inquiries and communication via the web form
Through the web form, we process your personal data for the purpose of receiving and handling your general inquiries and requests, providing information about our services and healthcare, and ensuring related communication.
Purpose of processing | receiving and handling general inquiries and requests via the web form, providing information about services and healthcare, and ensuring related communication |
Legal basis | Art. 6 par. 1 letter f) of the GDPR Regulation. The controller's legitimate interest is ensuring effective communication with persons who contact the controller through the website, and handling their inquiries and requests |
| Exception to the prohibition on processing special categories of personal data | if the data subject, through the content of the message, provides data relating to their health status and their processing is necessary in connection with the provision or securing of healthcare, the exception under Art. 9 par. 2 letter h) of the GDPR Regulation applies to the prohibition on processing special categories of personal data under Art. 9 par. 1 of the GDPR Regulation |
Category of data subjects | visitors of the website and other persons who, through the web form, request information or contact the controller |
Categories of personal data | first name, last name, email address, telephone number, message content; depending on the content of the message, data relating to the health status of the data subject may also be processed |
Categories of recipients | authorized persons of the controller; providers of technical services ensuring operation, administration, and hosting of the website; entities to which the controller is obliged to provide personal data under law |
Retention period for deletion of personal data | 3 months from the handling of the inquiry or request, or from the termination of the last related communication, if further processing of personal data does not occur on another legal basis |
| Transfer of personal data to third countries or international organizations | does not take place |
- Booking appointments and related communication
Through the web form, we process your personal data for the purpose of receiving and handling your request to book an appointment, arranging the appointment for healthcare, and ensuring related communication.
Purpose of processing | receiving and handling requests to book an appointment, agreeing on and organizing the healthcare appointment, and ensuring related communication with patients and individuals interested in healthcare |
Legal basis | Art. 6 par. 1 letter b) of the GDPR Regulation, if processing is necessary for carrying out measures at the request of the data subject prior to the conclusion of a contractual relationship or for fulfilling an existing contractual relationship |
| Exception to the prohibition on processing special categories of personal data | if, in connection with booking an appointment or subsequent communication, data relating to health status are processed and their processing is necessary for the purposes of providing or securing healthcare, the exception under Art. 9 par. 2 letter h) of the GDPR Regulation applies to the prohibition on processing special categories of personal data under Art. 9 par. 1 of the GDPR Regulation |
Category of data subjects | individuals interested in providing healthcare and patients of the controller who, through the web form, request an appointment or handle related communication |
Categories of personal data | first name, last name, email address, telephone number, message content; depending on the message content, data relating to health status |
Categories of recipients | authorized persons of the controller; providers of technical services ensuring operation, administration, and hosting of the website; entities to which the controller is obliged to provide personal data under law |
Retention period for deletion of personal data | 3 months from the handling of the request or from the termination of the last related communication, if further processing of personal data in connection with the provision of healthcare does not occur or on another legal basis |
| Transfer of personal data to third countries or international organizations | does not take place |
- Publishing reviews
On the website, we may publish reviews and ratings of patients who were patients and were published through the Google service, for the purpose of presenting patients' experiences and informing the public about the quality and scope of the services provided.
Purpose of processing | publishing and presenting reviews and ratings of patients on the website for the purpose of informing visitors about patients' experiences with the healthcare provided and presenting the controller's services |
Legal basis | Art. 6 par. 1 letter f) of the GDPR Regulation, legitimate interest of the controller in presenting its services, references, and patients' experiences through reviews that the data subjects previously published publicly through the Google service |
| Exception to the prohibition on processing special categories of personal data | if the content of a publicly published review contains data relating to health status or provided healthcare, the exception under Art. 9 par. 2 letter e) of the GDPR Regulation applies to the prohibition on processing special categories of personal data under Art. 9 par. 1 of the GDPR Regulation, where it concerns personal data that the data subject has demonstrably made public themselves |
Category of data subjects | patients and other persons who have published a review or rating regarding the controller's services through the Google service |
Source of personal data | publicly available reviews and ratings published by the data subjects through the Google service |
Categories of personal data | first name, last name, or username, profile photo if shown, rating, review content; depending on the content of the review, data relating to health status, treatment received, or provided healthcare may also be processed |
Categories of recipients | authorized persons of the controller; providers of technical services ensuring operation, administration, and hosting of the website; entities to which the controller is obliged to provide personal data under law |
Retention period for deletion of personal data | for the period during which the review is relevant for the purpose of presenting the controller's services, but at most for the duration of its public availability in the source Google service; the review will also be removed if the controller finds that the data subject has removed it or requested the cessation of its further publication and there is no overriding reason for further processing |
| Transfer of personal data to third countries or international organizations | the controller does not carry out transfers of personal data |
We process your data for the purpose of recording the exercised rights of data subjects (e.g., requests for deletion, access to data), as well as recording and handling notifications of breaches of personal data protection.
Purpose of processing | record of exercised rights of data subjects and breaches of protection under Act No. 18/2018 Coll. on the protection of personal data and on amendments to certain laws, recording of exercised rights of data subjects under Chapter III and notifications under Art. 33 and 34 of the Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data |
Legal basis | statutory obligation under Art. 6 par. 1 letter c) of the GDPR Regulation. legitimate interest under Art. 6 par. 1 letter f) of the GDPR Regulation. The main legitimate interest is recording exercised rights and notifications of breaches of personal data protection |
Categories of data subjects | data subjects to whom the submission for exercising a right relates; data subjects to whom the breach of personal data protection relates |
Categories of personal data | data relating for the exercise of a right, data that the notifier provides when reporting a breach of personal data protection |
Categories of recipients | authorized persons in a contractual relationship with the controller, entities to which the controller is obliged to provide personal data under law |
Retention period for deletion of personal data | within 6 months from the expiry of 5 years from the exercise of the right or from the occurrence of the breach of personal data protection |
Transfer of personal data to third countries or international organizations | does not take place |
- Security of the website
We may also process your personal data for the purpose of ensuring proper and secure operation of the website, web forms, electronic communication, and related information systems. This purpose serves in particular to protect against unauthorized access, misuse of the website and forms, malicious activity, technical malfunctions, and cyber threats, as well as to identify and address security incidents.
Purpose of processing | ensuring security and proper operation of the website, web forms, electronic communication, and related information systems, protection against unauthorized access, misuse, spam, malicious activity, and cyber threats, and identifying and addressing security incidents |
Legal basis | legitimate interest under Art. 6 par. 1 letter f) of the GDPR Regulation. The controller's legitimate interest is ensuring information and cyber security, protecting the website and related information systems, and preventing their misuse |
Categories of personal data | technical and operational data recorded when using the website and its services, in particular IP address, date and time of access, requested URL address, device and internet browser data, technical identifiers, data contained in system, access, and security logs, and data related to security incidents |
Retention period for deletion of personal data | standard technical, access, and security logs are stored for the period necessary to ensure security and proper operation of the website, generally for no more than 90 days, depending on the type of log and the technical system used; data related to a specific security incident are stored for the period necessary to investigate it, remove consequences, and adopt corrective measures, or for the duration of related proceedings |
Categories of recipients | authorized persons of the controller; providers of technical services ensuring operation, administration, and hosting of the website; entities to which the controller is obliged to provide personal data under law |
| Categories of data subjects | visitors of the website, persons using web forms, and other persons whose data are recorded in connection with using the website, electronic communication, or handling a security incident |
Transfer of personal data to third countries or international organizations | does not take place |
Date of last update:
