Privacy Notice

This Privacy Notice (hereinafter referred to as the “Notice”) applies to the personal data collected and processed by Szenttamási Dental Korlátolt Felelősségű Társaság (hereinafter referred to as the “Data Controller”), acting as a data controller.

This Notice covers the processing of personal and health-related data in connection with the provision of dental care, including appointment scheduling, patient records, diagnostic and treatment documentation, administrative activities, and billing.

Data Controller and Contact Details

Name: Szenttamási Dental Korlátolt Felelősségű Társaság

Registered office: 8086 Felcsút, Fő utca 70., Hungary

Company registration number: 07-09-036444

Tax number: 32761429-1-07

Website: https://pozsonyident.hu/

Email address: martin.szenttamasi@gmail.com

The Data Controller processes personal data in accordance with all applicable legislation, primarily including:

• Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter referred to as the “Information Act”);
• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as the “GDPR”);
• Act CLIV of 1997 on Healthcare;
• Act XLVII of 1997 on the Processing and Protection of Health Data and Related Personal Data (hereinafter referred to as the “Health Data Act”);
• Act V of 2013 on the Civil Code;
• Act C of 2000 on Accounting (hereinafter referred to as the “Accounting Act”);
• Act CVIII of 2001 on Electronic Commerce Services and Certain Issues Related to Information Society Services;
• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities;
• Decree No. 62/1997 (XII. 21.) of the Ministry of Welfare on Certain Aspects of the Processing of Health Data and Related Personal Data;
• Act CL of 2017 on the Rules of Taxation.

Definitions

In accordance with the definitions and interpretative provisions set out in Article 4 of the GDPR and Section 3 of the Information Act, the following terms shall have the meanings indicated below for the purposes of this Notice.

Data Processor: A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller.

Processing: Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Data Transfer: Making personal data available to a specified third party.

Pseudonymisation: The processing of personal data in such a manner that the personal data can no longer be attributed to a specific individual without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person.

Recipient: A natural or legal person, public authority, agency, or another body to which personal data is disclosed, whether or not it is a third party. Public authorities that may receive personal data in the framework of a particular inquiry in accordance with European Union or Member State law shall not be regarded as recipients. The processing of such data by those public authorities must comply with the applicable data protection rules according to the purposes of the processing.

Data Subject: An identified or identifiable natural person whose personal data is processed.

Third Party: A natural or legal person, public authority, agency, or body other than the data subject, the Data Controller, the Data Processor, and persons who, under the direct authority of the Data Controller or Data Processor, are authorised to process personal data.

Third Country: Any country outside the European Economic Area (EEA).

Special Categories of Personal Data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person’s sex life or sexual orientation.

Profiling: Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, particularly to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

Personal Data: Any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Data Processing Activities

Data Processing Related to Applying for Dental Care

Data processing performed when contacting the clinic, including the administration of individuals applying for dental treatment.

Contacting the Clinic Through the Website (https://www.pozsonyident.hu)

Personal data processed:

1. First name and last name – Purpose: Administration of applicants for dental treatment and communication.
2. Email address – Purpose: Administration of applicants for dental treatment and communication.
3. Comments field (optional) – Applicants may provide additional personal information, including health-related data, such as diagnostic examination results, dates of examinations, medical conditions, and the dates from which those conditions have existed. Purpose: Allowing individuals applying for dental treatment to describe, in their own words, the reason for contacting the clinic and any health concerns.

Legal basis for processing each of the above categories:

The processing is necessary for the performance of a contract to which the data subject (applicant) is a party, or in order to take steps at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR.

The processing is also necessary for compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) of the GDPR and Section 12(2) of the Health Data Act.

Where applicable, the processing of health data is carried out in accordance with Article 9(2)(h) of the GDPR.

Online Appointment Booking Through the Website (https://www.pozsonyident.hu)

Personal data processed:

1. First name and last name – Purpose: Administration of applicants for dental treatment and communication.
2. Email address – Purpose: Administration of applicants for dental treatment and communication.
3. Comments field (optional) – Applicants may voluntarily provide additional personal data, including health-related information such as diagnostic examination results, the dates of examinations, existing medical conditions, and when those conditions began. Purpose: Allowing applicants to explain the reason for booking an appointment, contacting the clinic, or describing their health concerns.

Legal basis for processing each of the above categories:

The processing is necessary for the performance of a contract to which the data subject (applicant) is a party, or to take steps at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR.

The processing is necessary to comply with a legal obligation applicable to the Data Controller, pursuant to Article 6(1)(c) of the GDPR and Section 12(2) of the Health Data Act.

The processing of special categories of personal data is carried out in accordance with Article 9(2)(h) of the GDPR.

Appointment Booking by Telephone

Personal data processed:

1. First name and last name – Purpose: Administration of applicants for dental treatment and communication.
2. Email address – Purpose: Administration of applicants for dental treatment and communication.
3. Telephone number – Purpose: Administration of applicants for dental treatment and communication.

Legal basis for processing each of the above categories:

The processing is necessary for the performance of a contract to which the data subject (applicant) is a party, or to take steps at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR.

The processing is necessary for compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) of the GDPR and Section 12(2) of the Health Data Act.

Article 9(2)(h) of the GDPR applies to the processing of relevant health-related personal data.

Patient Records

Health data necessary for dental treatment is processed by the dentist and other persons involved in the patient’s care, including dental assistants, in accordance with the instructions of the treating dentist and only to the extent necessary for the performance of their duties.

Personal data processed and purposes:

1. First name and last name – Patient identification and administration.
2. Hungarian social security identification number (TAJ number).
3. Place and date of birth – Patient identification and administration.
4. Email address – Communication.
5. Residential address – Communication.
6. Telephone number – Communication.
7. Laboratory examination results, hospital discharge summaries, medical history provided by the data subject for the purpose of taking their medical history, and diagnostic imaging results – Taking the patient’s medical history, establishing a diagnosis, and developing treatment recommendations.

Legal basis for processing each of the above categories:

The processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the data subject’s request before entering into a contract, pursuant to Article 6(1)(b) of the GDPR.

The processing is necessary for compliance with a legal obligation applicable to the Data Controller, pursuant to Article 6(1)(c) of the GDPR and Section 12(2) of the Health Data Act.

The processing of relevant health-related personal data is carried out in accordance with Article 9(2)(h) of the GDPR.

Billing and Payment for Dental Services by Bank Card

This section concerns the processing of personal data in connection with invoicing and payment for dental care.

Issuing Invoices

Personal data processed:

1. First name and last name – Purpose: Issuing an invoice.
2. Email address – Purpose: Sending electronic invoices.
3. Residential address – Purpose: Issuing an invoice.

Legal basis for processing each of the above categories:

The processing is necessary for compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) of the GDPR and the Accounting Act.

Bank Card Payments

When accepting bank card payments, the Data Controller does not receive or process the patient’s (payer’s) bank card details or other financial information.

The Data Controller only receives information from the payment service provider regarding the outcome of the transaction.

For payments made by bank card, the payment service provider involved in processing the transaction acts as an independent data controller.

The Data Controller’s bank card payment service provider:

Name: OTP Bank Nyrt.

Registered office: 1051 Budapest, Nádor utca 16., Hungary

Company registration number: 01-10-041585

Tax number: 10537914-4-44

Data Processing on the Website

When visiting the pozsonyident.hu website, the Data Controller processes data for the purposes of monitoring the operation of its services, refining and supplementing visitors’ searches, providing personalised services, and preventing misuse.

Cookie Management on the Website (https://pozsonyident.hu)

The website uses HTTP cookies to ensure proper operation and improve the user experience.

If visitors do not accept all cookies, certain parts of the website may not function properly.

Cookies are small text files that a website may use to enhance the user experience.

The website uses different types of cookies, some of which are necessary for the website to function correctly.

Cookies are stored in the visitor’s browser, and their use requires the user’s permission. Some cookies used on the website are provided by third parties.

Cookie settings can also be changed at any time through the browser.

Necessary Cookies

Necessary cookies support the use of the website by enabling essential functions. The website cannot function properly without these cookies.

Statistics Cookies

Statistics cookies provide the website owner with information about which content visitors prefer and how they interact with the website. The data is not linked to a specific individual.

Retention Period of Personal Data

If no contract is concluded because the applicant does not attend dental treatment, the Data Controller shall delete the personal data provided without undue delay.

If the applicant receives dental treatment, pursuant to Section 30(1)–(2) of the Health Data Act, medical documentation and the personal data contained therein must be retained for at least 30 years from the date of collection.

Discharge summaries must be retained for at least 50 years.

Images created using diagnostic imaging procedures must be retained for 10 years from the date on which they were taken, while reports prepared on the basis of those images must be retained for 30 years from the date on which the images were taken.

After the applicable retention periods have expired, the data shall be deleted.

The Data Controller retains data relating to invoicing for eight years pursuant to Section 169(2) of the Accounting Act.

Recipients of Personal Data and Categories of Recipients

Subcontractor of the Data Controller No. 1

Name: Dr. Varasdi Fanni Virág

Registered office: 8700 Marcali, Hársfa utca 21., Hungary

Registration number: 58451319

Tax number: 47959167-1-34

Subcontractor of the Data Controller No. 2

Name: Dr. Márta Zsolt

Registered office: 1111 Budapest, Kende utca 4., 5th floor, Door 14, Hungary

Registration number: 60604961

Tax number: 91170473143

Data Processor No. 1

Name: Flexi Medical Cloud Zrt.

Registered office: 1027 Budapest, Tölgyfa utca 28., Hungary

Company registration number: 01-10-140667

Tax number: 27303296-2-41

Email address: support@flexi-dent.hu

The Data Processor operates the online appointment booking software available on the Data Controller’s website: https://www.flexi-dent.hu/

Data Processor No. 2

Name: KBOSS.hu Kereskedelmi és Szolgáltató Korlátolt Felelősségű

Registered office: 1031 Budapest, Záhony utca 7., Hungary

Company registration number: 01-09-303201

Tax number: 13421739-2-41

The Data Processor provides invoicing and invoice information services to the Data Controller through the following website: https://www.szamlazz.hu/szamla/main

Data Processor No. 3

Name: Sybell Informatika Korlátolt Felelősségű Társaság

Registered office: 1138 Budapest, Tomori utca 34., 2nd floor, Hungary

Company registration number: 01-09-293034

Tax number: 25859502-2-41

The Data Processor provides website hosting services for the Data Controller. Website: https://sybell.hu/

Data Processor No. 4

Name: Countwise Korlátolt Felelősségű Társaság

Registered office: 8087 Alcsútdoboz, Szabadság utca 18., Hungary

Company registration number: 07-09-037314

Tax number: 27524048-1-07

The Data Processor performs accounting-related tasks for the Data Controller.

Data Processor No. 5

Name: GRÓF DENTAL Korlátolt Felelőségű Társaság

Registered office: 8000 Székesfehérvár, Megyeház utca 11., Hungary

Company registration number: 07-09-025382

Tax number: 25032817-2-07

The Data Processor provides dental laboratory services to the Data Controller.

Other Data Processors

Data Processor No. 5

Name: Erhardt Róbert

Address: 6035 Ballószög, Széchenyi u. 24., Hungary

Telephone: (+36) 70 397-6755

Email: info@praxismarketing.hu

Data Processor No. 6

Name: Kocsis Roland, Sole Proprietor

Address: 2800 Tatabánya, Bárdos László u. 4., Hungary

Telephone: +36 30 092 6930

Email: kocsis.roland@krdigital.hu

The Data Processor provides website maintenance, advertising management, and appointment booking system management services to the Data Controller.

Data Processor No. 7

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data Processor No. 8

Meta Platforms Ireland Ltd.

4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Apart from the persons and organisations listed above, personal data may only be accessed by employees of the Data Controller who have the appropriate authorisation and whose access is strictly necessary for the performance of their duties.

The Data Controller is required to submit data to the Electronic Health Service Space (Elektronikus Egészségügyi Szolgáltatási Tér – EESZT).

Transfer of Personal Data to Third Countries or International Organisations

The Data Controller does not transfer personal data to any third country or international organisation.

Automated Decision-Making, Including Profiling

No automated decision-making, including profiling, takes place during data processing.

Source of Personal Data

The Data Controller collects personal data directly from the data subject.

Possible consequences of failing to provide personal data: The applicant may not be able to receive dental treatment.

Data Security Measures

The Data Controller implements all necessary technical and organisational measures to ensure the secure processing and storage of personal data.

The Data Controller stores the processed data on password-protected IT devices and systems.

The data is stored in a reliable server environment with high availability.

Physical security is ensured through an electronic access control system and a video surveillance system.

Rights Related to the Processing of Personal Data

The rights available to you as a data subject depend on the legal basis of the processing.

Certain rights may not apply or may not be relevant where particular legal bases are used.

The following table illustrates the rights that may be exercised under each legal basis.

Right of Access

You have the right to request information from the Data Controller as to whether your personal data is being processed.

Where such processing is taking place, you have the right to obtain information about the purposes of processing, the personal data concerned, the recipients to whom your data has been disclosed, the source from which the Data Controller obtained the data, the applicable retention periods, and your rights relating to the processing.

You are also entitled to information concerning automated decision-making and profiling, as well as the applicable safeguards where personal data is transferred to a third country or an international organisation.

When exercising your right of access, you are also entitled to request a copy of your personal data.

If you submit your request electronically, the Data Controller shall provide the requested information electronically unless you request otherwise.

Where exercising your right of access would adversely affect the rights and freedoms of others, particularly trade secrets or intellectual property rights, the Data Controller may refuse to fulfil your request to the extent necessary and proportionate.

If you request multiple copies of the information, the Data Controller may charge a reasonable fee based on the administrative costs of producing the additional copies.

Right to Rectification

You have the right to request that the Data Controller rectify inaccurate personal data concerning you without undue delay.

Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by means of a supplementary statement.

When requesting rectification, you must provide supporting information demonstrating the accuracy of the proposed changes.

This enables the Data Controller to determine whether the new information is correct and whether the previous data may be amended.

The Data Controller also encourages you to report any changes to your personal data as soon as possible in order to facilitate lawful processing and the effective exercise of your rights.

Right to Erasure (Right to Be Forgotten)

You have the right to request the erasure of your personal data by the Data Controller.

If you request the deletion of some or all of your personal data, the Data Controller shall erase the relevant data without undue delay where:

1. The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
2. The processing was based on your consent, you have withdrawn that consent, and there is no other legal basis for processing.
3. The processing was based on the legitimate interests of the Data Controller or a third party, you have objected to the processing, and there are no overriding legitimate grounds for continued processing, except in cases involving objections to processing for direct marketing purposes.
4. The personal data has been unlawfully processed.
5. The personal data must be erased to comply with a legal obligation.

Where the Data Controller has made personal data public and is required to erase it under the conditions described above, the Data Controller must take all reasonable steps, including technical measures, taking into account available technology and implementation costs, to inform other data controllers processing that information that the data subject has requested the erasure of links to, copies of, or replications of the personal data.

Under Article 17(3) of the GDPR, the Data Controller is not required to erase personal data in every situation.

For example, erasure may not be required where processing is necessary for the establishment, exercise, or defence of legal claims.

Right to Restriction of Processing

You have the right to request that the Data Controller restrict the processing of your personal data where any of the following conditions apply:

1. You contest the accuracy of the personal data. In this case, processing may be restricted for a period enabling the Data Controller to verify the accuracy of the information.
2. The processing is unlawful, but you oppose the erasure of the personal data and request restriction of its use instead.
3. The Data Controller no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defence of legal claims.
4. You have objected to processing. In this case, the restriction applies until it has been determined whether the legitimate grounds of the Data Controller override your legitimate grounds.

Restriction of processing means that, apart from storage, the Data Controller shall not process the personal data concerned unless you have consented to such processing.

Even without your consent, the restricted data may be processed where necessary for the establishment, exercise, or defence of legal claims, the protection of the rights of another natural or legal person, or reasons of important public interest of the European Union or a Member State.

Right to Data Portability

You have the right to request that the Data Controller provide you with the personal data you have supplied based on consent or a contractual legal basis, where such data is processed by automated means, for example through a computer system.

The data must be provided in a structured, commonly used, and machine-readable format.

You may request the data for the purpose of transferring it to another data controller.

Where technically feasible, you may also request that the Data Controller transfer the personal data directly to another controller designated by you.

Where exercising your right to data portability would adversely affect the rights and freedoms of others, the Data Controller may refuse to fulfil your request to the extent necessary.

This right does not apply where the processing is necessary for the performance of a task carried out in the public interest.

Right to Object

Where the processing of your personal data is based on the legitimate interests of the Data Controller or a third party, or is necessary for the performance of a task carried out in the public interest, you have the right to object to such processing at any time on grounds relating to your particular situation.

This includes profiling based on the aforementioned legal grounds.

The Data Controller is not required to comply with your objection if, following an individual assessment, it:

1. Demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms; or
2. Establishes that the processing is necessary for the establishment, exercise, or defence of the Data Controller’s legal claims.

However, if the Data Controller cannot demonstrate such circumstances, it shall erase the personal data concerned by the objection without undue delay.

Withdrawal of Consent

Where the legal basis for processing is your consent, you have the right to withdraw that consent at any time and request the erasure of your personal data.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

If you provided your consent through the Data Controller’s online interface, for example by ticking a checkbox or selecting relevant technical preferences through a privacy dashboard, the Data Controller shall provide an equally simple method for withdrawing that consent.

Submission of Requests and Response Deadlines

As a data subject, you may exercise the rights described above by sending an email to the electronic contact address specified in Section 1 or by sending a letter to the registered office of the Data Controller.

The Data Controller shall inform you of the action taken in response to your request without undue delay and, in any event, within 30 days of receiving your request.

This includes informing you if your request has been refused and providing the reasons for that refusal.

Where necessary, taking into account the complexity and number of requests, the 30-day period may be extended by a further 60 days.

The Data Controller shall inform you of any extension and the reasons for the delay within 30 days of receiving your request.

Information and actions relating to the exercise of data subject rights are provided free of charge.

However, where your request is manifestly unfounded or excessive, particularly because of its repetitive nature, the Data Controller may:

• Charge a reasonable fee, taking into account the administrative costs of providing the requested information or taking the requested action; or
• Refuse to act on the request.

Legal Remedies Related to Data Processing

Right to Lodge a Complaint and Right to Judicial Remedy

If you believe that the Data Controller has violated applicable data protection legislation, particularly the provisions of the GDPR, in the course of processing your personal data, you have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Complaints may be submitted using any of the following contact details:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal address: 1363 Budapest, P.O. Box 9, Hungary

Email: ugyfelszolgalat@naih.hu

Website: www.naih.hu

Independently of your right to lodge a complaint, you may also seek judicial remedy if your rights have been infringed.

The court shall deal with such proceedings as a matter of priority.

Such proceedings fall within the jurisdiction of the regional courts.

At your discretion, proceedings may be initiated before the regional court having jurisdiction over your place of residence, place of stay, or the registered office of the Data Controller (Budapest-Capital Regional Court).

A list of the regional courts and their contact details is available at: http://birosag.hu/torvenyszekek