Privacy Policy

Effective from:

This is a translation; in case of any discrepancy, the Hungarian version prevails.

Alphadent Kft. (the "Controller") is committed to protecting your personal data. Under Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), this notice explains how we process your data when you use the https://alpha-dent.eu website and when you contact us through the details given on it.

1. Controller and service provider

Company name
Alphadent Kft.
Registered seat
9400 Sopron, Arany J. utca 13.
Clinic and postal address
9400 Sopron, Arany János u. 13.
Company registration number
08-09-017400
Tax number
14027493-2-08
Managing director
Guzsván Csaba
E-mail
info@alpha-dent.eu
Phone
+36 20 80 80 600
Website
https://alpha-dent.eu

You can send any data protection questions or requests to info@alpha-dent.eu or to the postal address above.

2. Legal framework

  • Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
  • Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.);
  • Hungarian Act XLVII of 1997 on the processing and protection of health and related personal data (Eüak.);
  • Hungarian Act CVIII of 2001 on electronic commerce and information society services (Ekertv.);
  • Hungarian Act C of 2003 on electronic communications (Eht.).

3. What data we process, why, and for how long

3.1. Visiting the website (technical log data)

Purpose
Running the website securely, finding errors and preventing abuse.
Data processed
IP address, time of visit, address of the page viewed, browser and operating system type, referring page.
Legal basis
GDPR Art. 6(1)(f) (legitimate interest: secure and uninterrupted operation of the website); Ekertv. Section 13/A(3).
Retention
Briefly in the hosting provider's logs, for no more than 30 days.
Recipient / processor
hosting provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (https://vercel.com)

3.2. Displaying images

Purpose
Serving the photos on the website quickly and in a size suited to your device.
Data processed
The IP address and browser data your browser sends automatically when downloading an image. Images are loaded without sending cookies.
Legal basis
GDPR Art. 6(1)(f) (legitimate interest: efficient display of the website's content).
Retention
Briefly in the processor's systems, as far as needed to serve the images.
Recipient / processor
image delivery provider: Cloudinary Ltd. (https://cloudinary.com)

3.3. Contacting us by e-mail or phone

Purpose
Answering your questions and arranging appointments.
Data processed
Name, e-mail address, phone number, the content of your message and the agreed appointment.
Legal basis
For appointment requests, GDPR Art. 6(1)(b) (steps taken at your request prior to entering into a contract); for other questions, GDPR Art. 6(1)(f) (legitimate interest: answering enquiries).
Retention
Up to 1 year after your enquiry is closed. If the contact leads to treatment, the data become part of your medical records and are kept under the rules of the Eüak.

3.4. Requesting a treatment plan and quote by sending medical documents

Purpose
Preparing a treatment plan and quote based on the documents you send (e.g. a panoramic X-ray or an earlier treatment plan).
Data processed
The data listed in 3.3, plus the health data you send (special categories of data under GDPR Art. 9).
Legal basis
GDPR Art. 6(1)(b) and GDPR Art. 9(2)(h) (provision of health care), in line with Eüak. Section 4(1).
Retention
If treatment takes place, under Eüak. Section 30: medical records are kept for at least 30 years, diagnostic imaging for 10 years. If no treatment takes place, the data are deleted no later than 1 year after the quote is sent.

Please send medical documents only to the extent needed for the treatment plan, and do not send other people's data. Please note that ordinary e-mail is not end-to-end encrypted; if you consider this a risk, you can bring the documents to the clinic in person.

Our social media pages (Instagram, Facebook) and the map (Google Maps) are only linked from the website, not embedded, so none of your data reaches them when you open the website. If you follow a link or message us there, that provider's own privacy policy also applies. Replies to such messages are handled as described in 3.3.

4. Cookies

This website uses no cookies and stores no data on your device. We use no analytics, remarketing or other tracking tools, so no consent under Section 155(4) of the Eht. is required. The language is set by the website address (e.g. /en, /de).

5. Processors and recipients

Your data are primarily accessible to the Controller's authorised staff, who are bound by professional confidentiality. We use the following processors to run the website (GDPR Art. 28):

We do not sell personal data or pass it on to third parties, except where required by law (e.g. at the request of an authority or court).

6. Transfers outside the European Economic Area

Our processors may also process data outside the European Economic Area (in the United States or Israel). Such transfers are based on an adequacy decision of the European Commission (GDPR Art. 45) - for the United States the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), for Israel Decision 2011/61/EU - or, failing that, on the standard data protection clauses adopted by the Commission (GDPR Art. 46(2)(c)).

7. Data security

In line with GDPR Art. 32, we protect your data with appropriate technical and organisational measures: the website is only available over an encrypted (HTTPS) connection, only authorised staff can access the data, and our systems are kept up to date.

In the event of a personal data breach, we notify the NAIH within 72 hours under GDPR Art. 33. If the breach is likely to result in a high risk to your rights, we also inform you without undue delay under GDPR Art. 34.

8. Your rights

  • Access (GDPR Art. 15): you may ask whether and what data we process about you, and request a copy.
  • Rectification (GDPR Art. 16): you may ask us to correct inaccurate data or complete incomplete data.
  • Erasure (GDPR Art. 17): you may ask us to delete your data. During the mandatory retention period of medical records we cannot do so, under GDPR Art. 17(3).
  • Restriction of processing (GDPR Art. 18): in certain cases you may ask us to store your data but not use them.
  • Data portability (GDPR Art. 20): you may receive data processed by automated means on the basis of a contract in a structured, machine-readable format.
  • Objection (GDPR Art. 21): you may object at any time to processing based on legitimate interest.
  • Automated decision-making (GDPR Art. 22): we make no decisions based solely on automated processing and do not profile you.

You can send your request to info@alpha-dent.eu or by post. We respond without undue delay and within one month at the latest; this can be extended by two further months where necessary, in which case we inform you (GDPR Art. 12(3)). Information and action are free of charge (GDPR Art. 12(5)). We may verify your identity before responding (GDPR Art. 12(6)).

9. Remedies

If you feel that the processing of your data infringes your rights, please contact us first so that we can resolve the issue together. You may also lodge a complaint with the supervisory authority (GDPR Art. 77, Infotv. Section 52):

Authority
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address
1055 Budapest, Falk Miksa utca 9–11.
Postal address
1363 Budapest, Pf. 9.
Phone
+36 1 391 1400
E-mail
ugyfelszolgalat@naih.hu
Website
https://naih.hu

You may also go to court if your rights are infringed (GDPR Art. 79, Infotv. Sections 22-23). Such cases are heard by the regional court (törvényszék), and you may choose to bring the action before the court of your place of residence or stay.

10. Changes to this notice

We update this notice whenever our processing or the law changes. The current version is always available on this page; its effective date is shown at the top.