Privacy policy

The controller of the personal data processed through this website, within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR), is VAN-DON-DENT Kft., trading as Harajda Dent, Várkerület 47., 9400 Sopron, Hungary.

You can reach us about any data protection matter by email at info@harajdadent.hu, by telephone on +36 (99) 50 60 90, or by post to the address above. Company and regulatory details are set out in the imprint.

This policy covers the website. Anything recorded about you during treatment at the practice is medical documentation and is governed by Hungarian healthcare law in addition to the GDPR.

The practice has not appointed a data protection officer. The obligation to appoint one applies to public authorities and to organisations whose core activity involves large-scale monitoring or large-scale processing of special category data, and a practice of this size falls outside it. The practice keeps this under review and will confirm its current position on request.

Data protection questions are handled by the practice management. Write to info@harajdadent.hu and mark the message for the attention of the practice manager.

The appointment request form is the only place on this website where you are asked for personal data. Two fields are required, the rest are yours to leave blank.

The message field is free text, so it may end up containing information about your health, for example a symptom, a previous treatment, a diagnosis made elsewhere or an anxiety about dental work. Article 9 of the GDPR treats information about health as a special category of personal data and protects it more strictly.

We process it in order to prepare and provide dental care, under Article 9(2)(h) read with Article 9(3) of the GDPR, which permits health data to be processed by professionals bound by an obligation of professional secrecy, and, so far as anything you write goes beyond that, on the explicit consent you give by choosing to write it.

Two practical points follow. Only what you type is stored, so please keep the message short and leave clinical detail for the consultation, where it can be discussed properly. And access is deliberately narrow: your request is visible to reception staff and to the treating dentists, all of whom are bound by medical confidentiality, and to nobody else.

Appointment requests are handled internally by the practice's own reception team. They are not passed to a call centre, an agency or any marketing partner, and no request data is ever sold or shared with advertisers.

The request is stored in a database hosted for us by Supabase in Frankfurt, Germany, inside the European Union. It stays in the European Union at all times. Reception opens it in a password-protected area of this website that no visitor can reach.

While a request is open, reception records what is needed to arrange your care: a short factual note, the status of the request, a reminder to call you back, and the appointment time once one is agreed. Those notes are stored with the request and deleted with it.

The website's server log records only that a request arrived, for which treatment and in which language, and whether it was saved successfully. It does not contain your name, telephone number, email address or message. Those logs are short-lived and are deleted on the schedule set out below.

The same protected area contains a staff-only desk used to ask the website developer for changes to these pages. It carries no patient data, only the text a staff member writes about the website itself.

If you telephone the practice, reception notes only what is needed to arrange your appointment and enters it the same way a request from the website is entered.

If you write to info@harajdadent.hu, your message and your email address are stored in the practice mailbox for as long as the matter is live.

Where the WhatsApp button is shown on this site, it is a link and nothing more: no chat is opened and no data is sent until you choose to tap it. WhatsApp is operated by Meta Platforms Ireland Limited under its own terms and privacy policy, so your telephone number and whatever you write in the chat are processed by Meta on its own account, and we cannot control that. If you would prefer not to use it, the telephone number and email address above reach exactly the same people.

Two kinds of measurement run on this site, and they are treated differently because they work differently.

Vercel Analytics and Vercel Speed Insights run on every visit. They count page views and measure loading speed, and they record only coarse technical facts such as the page, the referring site, the country, the device type and how quickly the page rendered. They set no cookie, store no identifier on your device and build no profile of you. We rely on our legitimate interest in knowing which pages are used and whether they load properly, under Article 6(1)(f) of the GDPR.

Google Analytics 4 and Google Ads conversion measurement run only if you accept statistics and marketing cookies. Google Analytics reports how the site is used, including pages viewed, sessions, approximate location at country or region level, device type and how you arrived. Google Ads conversion measurement records whether an appointment request followed a click on one of our advertisements. Both rely on your consent, under Article 6(1)(a) of the GDPR.

Google Consent Mode v2 is what enforces that: every Google tag is told your choice before it runs, so with statistics and marketing declined the tags set no cookies and send no measurement, and with them accepted they behave normally.

You can change your mind at any time using the Cookie settings link in the footer of every page. Withdrawing consent does not affect anything measured before you withdrew it. The cookie policy lists every cookie and storage item by name.

The contact page shows the practice address as plain text with a button that loads a map. Nothing is requested from Google until you press that button. Once you do, an embedded Google map is loaded into the page, and Google receives your IP address and may set its own cookies in your browser. The address, opening hours and directions are fully readable without loading the map.

Where the site shows the practice's Google rating and short review excerpts, our own server fetches them from Google once a day and then serves them from our pages. Your browser does not contact Google to display them, and no information about you is sent to Google when you read them.

Web forms attract automated submissions. The appointment form carries checks that require no data about you at all: a hidden field that only a bot fills in, and a check that the form was not submitted faster than a person could type.

In addition, the practice may use a bot check such as Cloudflare Turnstile and a rate limit on submissions. Where those are active, your IP address is processed briefly for the single purpose of telling a person from an automated script, and is not used to identify you, to profile you or for any other purpose. The legal basis is our legitimate interest in keeping the form usable and the practice reachable, under Article 6(1)(f) of the GDPR.

Our hosting provider also keeps short-lived server logs for the same reason, which is described under retention below.

Everything above, summarised. Each purpose has exactly one basis, and none of them is advertising to you personally.

We do not sell personal data, we do not share it with advertisers, and we do not use it to build profiles. A small number of service providers process data on our behalf, on our written instructions and under a data processing agreement as required by Article 28 of the GDPR.

Beyond these providers, personal data is disclosed only where the law requires it, for example to an authority acting within its powers.

Appointment requests are stored and processed inside the European Union. The hosting, database and email providers above operate the services used by this site from EU data centres.

Google is the exception worth naming. Where you consent to analytics or advertising cookies, or choose to load the map, data may be transferred to the United States. Google is certified under the EU-US Data Privacy Framework, an adequacy decision of the European Commission, and standard contractual clauses approved by the Commission apply in addition. If you decline statistics and marketing cookies and do not load the map, no such transfer takes place.

We keep personal data only as long as it is needed, and the periods below are the practice's standing defaults.

Under the GDPR you have the following rights in relation to your personal data.

To exercise any of these rights, write to info@harajdadent.hu, telephone +36 (99) 50 60 90, or send a letter to the practice address. Please describe what you would like us to do. We answer within one month of receiving a request, and will tell you if a complex request needs longer, which the GDPR allows up to a further two months.

Where we cannot otherwise establish who you are, we may ask for enough information to confirm your identity, so that nobody else can obtain your data by asking for it. Requests are free of charge, except where a request is manifestly unfounded or excessive.

If you believe we have handled your data unlawfully, you may complain to the Hungarian supervisory authority: the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), based in Budapest, whose contact details and complaint form are published at naih.hu. If you live in another EEA country, you may also complain to your own national supervisory authority.

You may also take the matter to court instead of, or as well as, complaining to the authority. Proceedings may be brought before the Hungarian tribunal (törvényszék) with jurisdiction over the practice's registered seat or, if you prefer, the one for your own place of residence.

The measures below are the ones that actually apply to this website, described in plain terms.

No transmission over the internet can be guaranteed to be completely secure. Please send only what is needed through the form, and leave detailed clinical history for the consultation.

This website is not directed at children under 16 and we do not knowingly collect their personal data through it. An appointment for a child should be requested by a parent or guardian, who can give the details and describe the reason for the visit. If you believe a child has sent us personal data through this site, contact us and we will delete it.

We do not make decisions about you by automated means alone, and we do not profile you. Every appointment request is read and answered by a person.

We review this policy whenever the website changes in a way that affects personal data, and at least once a year. The effective date and the date of the last review are shown at the top of this page. Where a change materially affects how your data is used, we will say so on the website rather than leave it to be noticed.

The cookie policy lists every cookie and storage item this site uses. The terms of use cover what this website is for, and the imprint carries the company and regulatory details.