GN MENTA DENT 17 Kft.
(registered office: 9012 9083 Écs, Ifjúság utca 4.; hereinafter: the Company)
pursuant to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) (hereinafter: the REGULATION), by Resolution No. 2/2018. (05.24.) adopted by the Company’s supreme body, adopted and put into force the following Privacy Notice on 25 May 2018, based on the Data Processing Policy adopted by Resolution No. 1/2018. (05.24.) of the Company’s supreme body.
„personal data”: any information relating to an identified or identifiable natural person („data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
„processing”: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
„restriction of processing”: the marking of stored personal data with the aim of limiting their processing in the future;
„profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
„pseudonymisation”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific natural person without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
„filing system”: any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis;
„controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
„processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
„recipient”: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall comply with the applicable data protection rules according to the purposes of the processing;
„third party”: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data;
„the data subject’s consent”: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
„personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed;
„genetic data”: personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person concerned;
„biometric data”: personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
„data concerning health”: personal data related to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about his or her health status;
„main establishment”:
in relation to a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered the main establishment;
in relation to a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place, insofar as the processor is subject to specific obligations under this Regulation;
„representative”: a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation;
„undertaking”: a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;
„group of undertakings”: a controlling undertaking and its controlled undertakings;
„binding corporate rules”: personal data protection policies adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;
„supervisory authority”: an independent public authority established by a Member State pursuant to Article 51;
„supervisory authority concerned”: a supervisory authority which is concerned by the processing of personal data because:
the controller or processor is established on the territory of the Member State of that supervisory authority;
data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or
a complaint has been lodged with that supervisory authority;
„cross-border processing of personal data”:
processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State;
„relevant and reasoned objection”: an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union;
„information society service”: a service as defined in Article 1(1)(b) of Directive (EU) 2015/1535 of the European Parliament and of the Council;
„international organisation”: an organisation and its subordinate bodies governed by public international law, or any other body set up by, or on the basis of, an agreement between two or more countries.
Company name: GN MENTA DENT 17 Kft.
Tax number: 25974928-2-08
Registered office: 9083 Écs, Ifjúság utca 4.
Central telephone number: +36-20/375-30-83
E-mail: nitagorog@gmail.com
Website: www.shioulette.com
HOSTING SERVICE PROVIDER:
Company name: Magyar Hosting Kft.
Registered office: 1132 Budapest, Victor Hugo utca 18-22.
Tax number: 23495919-2-41
EU VAT number: HU23495919
Company registration number: 01-09-968314
This Privacy Notice is published on our Company’s website, the mentadent.hu website, and at our Company’s dental office located at 9083 Écs, Ifjúság utca 4.
The REGULATION lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data, and protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data.
The Regulation shall apply to the processing of personal data wholly or partly by automated means, and to the processing otherwise than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
The Regulation shall apply to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
The Regulation shall apply to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
the monitoring of their behaviour as far as their behaviour takes place within the Union.
The Regulation shall apply to the processing of personal data by a controller not established in the Union but in a place where Member State law applies by virtue of public international law. The Company declares that it does not transfer data covered by this Regulation to third countries.
Personal data shall be:
processed lawfully, fairly and in a transparent manner in relation to the data subject („lawfulness, fairness and transparency”);
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes shall not be considered incompatible with the initial purposes („purpose limitation”);
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed („data minimisation”);
accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay („accuracy”);
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as they will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of this Regulation subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject („storage limitation”);
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures („integrity and confidentiality”);
the controller shall be responsible for, and be able to demonstrate compliance with, the above („accountability”).
The controller shall take appropriate measures to provide any information referred to in the Regulation relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, especially for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. At the request of the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
information at the start of processing: the name and contact details of the controller and its representative, if any; the contact details of the data protection officer, if any; the purpose and legal basis of the processing; the consequences of failure to provide the data; in case of legitimate-interest-based processing, the legitimate interest pursued; when data are collected, the categories and source of personal data; information on automated decision-making and profiling; in case of data transfers, the recipients or categories of recipients; information on transfer to third countries and safeguards; storage period and criteria used to determine it; the rights of the data subject; the right to lodge a complaint with a supervisory authority;
right of access: the data subject has the right to obtain access to personal data and the following information: a copy of the personal data, purposes of the processing, categories of data, information on automated decision-making and profiling, information on the source when data are not collected from the data subject, recipients to whom the data have been or will be disclosed, information on transfers to third countries and safeguards, storage period and criteria used to determine it, the rights of the data subject, and the right to lodge a complaint with a supervisory authority;
right to rectification: the data subject is entitled to have inaccurate personal data corrected without undue delay, and to have incomplete personal data completed; this right may be exercised free of charge;
right to erasure (right to be forgotten): the data subject has the right, and the controller is obliged, to erase personal data where processing is no longer necessary, the data subject withdraws consent and there is no other legal basis, the data subject objects and there are no overriding legitimate grounds for the processing, the processing is unlawful, or erasure is required for compliance with a legal obligation. If the controller has made the data public and is obliged to erase them, it shall take reasonable steps to inform other controllers processing the data that the data subject has requested erasure of any links to, or copies or replications of, those personal data;
right to restriction of processing: the controller shall restrict processing at the request of the data subject if the data subject contests the accuracy of the personal data, the processing is unlawful and the data subject opposes the erasure of the data, the controller no longer needs the personal data but the data subject requires them for the establishment, exercise or defence of legal claims, or the data subject has objected to processing and the controller is still verifying whether its legitimate grounds override those of the data subject;
right to data portability: the data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller; he or she may request direct transmission to another controller where technically feasible;
rights related to automated decision-making and profiling: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, except where necessary for entering into or performance of a contract between the data subject and the controller, authorized by law, or based on the data subject’s explicit consent;
right to object: the data subject may object to the processing of his or her data where the legal basis is public authority/public interest or legitimate interests, in the case of direct marketing, or profiling related to direct marketing. Processing must cease unless there are compelling legitimate grounds or legal claims.
If you wish to contact us via our website, the following data must be provided, which qualify as personal data under the REGULATION, and the processing of such personal data is necessary for making contact and maintaining communication. Please be informed that your above personal data will be stored only until the purpose of the contact initiated by the data subject is concluded, after which your data will be destroyed. If processing continues later, the further storage of your data shall take place in accordance with the agreement necessary for the commencement of such processing.
Please be informed that the above processing is based on your consent, and without providing the above data, contact via our website will be unsuccessful and we will not be able to provide information.
personal data: name, email address, telephone number, IP address
purpose of processing: necessary for establishing contact and maintaining communication; in the case of the IP address, indispensable for carrying out technical operations
duration of processing: until the purpose of the contact is concluded
legal basis of processing: consent of the data subject
Please be informed that our website uses security cookies, which, however, do not process personal data, therefore the data subject’s consent is not required, as their sole purpose is the transmission of communications over an electronic communications network. Please be informed that under the Tools/Settings menu, you have the option to delete cookies under Privacy settings.
Please be informed that the website is operated by the controller itself. Please be informed that the website uses a hosting service provider, which qualifies as a processor under the REGULATION:
Company name: Magyar Hosting Kft.
Registered office: 1132 Budapest, Victor Hugo utca 18-22.
Tax number: 23495919-2-41
EU VAT number: HU23495919
Company registration number: 01-09-968314
The hosting provider is entitled to process all personal data provided by the data subject with regard to all data subjects, for the purpose of proper operation of the website and making it available to the data subjects. Please be informed that such processing lasts until the termination of the agreement with the provider, or until the data subject submits a deletion request to the controller or the processor. The legal basis of processing is the data subject’s consent, as well as the relevant provisions of the Hungarian Information Act and the Act on electronic commerce services and certain issues of information society services.
personal data: all personal data provided on the website
purpose of processing: indispensable for the operation of the website
duration of processing: until termination of the contract with the provider
legal basis of processing: consent of the data subject
Your rights related to processing are set out in Sections V and VI of this notice.
The purpose of processing is the protection of the equipment, furniture and dental technical instruments located in the office operated by the Company at its premises. The controller informs the data subjects that the camera system does not make image or audio recordings. GN MENTA DENT 17 Kft. only makes recordings in the rooms of the office to such extent and in such manner as is not contrary to the recommendation of the NAIH and the relevant legislation.
GN MENTA DENT 17 Kft. processes the image and voice of the data subjects during camera surveillance. The installed cameras are capable of producing recordings of such quality as to allow the unique identification of participants. The legal basis of processing is the statutory authorization provided by Act CXII of 2011 on informational self-determination and freedom of information. The circumstances and conditions of processing are determined by the provisions of the Information Act.
GN MENTA DENT 17 Kft. declares that it has taken appropriate security measures to protect personal data appearing in camera recordings against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction and damage and inaccessibility resulting from changes in the technology used.
GN MENTA DENT 17 Kft. has ensured that employees having access to the data have been properly informed of data protection requirements.
personal data: image and voice of the data subject
purpose of processing: property protection and observation of the premises, which does not affect treatments
duration of processing: no recording is made
legal basis of processing: consent of the data subject
Controller:
Company name: GN MENTA DENT 17 Kft.
Your rights related to processing are set out in Sections V and VI of this notice.
Please be informed that, within the meaning of the REGULATION, the controller processes personal data and special categories of personal data when it processes your health data for the purpose of carrying out its dental activities. In this context, it processes all your personal data, as well as your medical history related to dental treatment.
The legal basis of processing is Act XLVII of 1997 on the processing and protection of health and related personal data, as well as the statutory authorization under the Information Act, and the consent of the data subject. Following data collection, the data are stored for at least 30 years pursuant to the law on the processing and protection of health and related personal data.
In order for the data subject to be eligible to receive healthcare services in our practice, it is essential for the protection of his or her life and physical integrity that the controller processes and keeps records of his or her health data. Before treatment begins, the treatment form, which must be completed by the data subject, serves to ensure that the treating physician can verify all health data necessary for the given treatment — which, in addition to special categories of data, also includes the processing of personal data for the purpose of identifying the patient — and thereby reduce or eliminate the risks of treatment (e.g. allergic reactions, etc.).
The controller declares that it processes such data in paper form and in a separate electronic dental and patient registration system, and grants access only to designated processors working as employees of the Company. The controller informs the data subject that it transfers special categories of data to third parties only where the use of a dental technician is necessary during treatment.
personal and special categories of data: all personal data of the data subject, and the health data indispensable in connection with the treatments
purpose of processing: property protection and observation of the premises, which does not affect treatments
duration of processing: no recording is made
legal basis of processing: consent of the data subject
Processor:
Company name: GN MENTA DENT 17 Kft.
Dental and patient registration system:
Company name: Flexi Medical Hungary Korlátolt Felelősségű Társaság
Tax number: 24131140-2-41
Company registration number: 01-09-991891
Registered office: 1027 Budapest, Tölgyfa utca 28
Central telephone number: 06-1-792-1234
Email: info@flexi-dent.hu
Website: flexi-dent.hu
The controller informs the data subject that if it detects an infectious disease, it transfers the data subject’s health and identification data to public authorities on the basis of legal authorization and obligation.
Your rights related to processing are set out in Sections V and VI of this notice.
Please be informed that our Company is a business association obliged to keep double-entry bookkeeping under the applicable legislation. Accordingly, it is required to appoint an accountant or accounting firm licensed to perform bookkeeping activities. In order for our Company to fulfil its obligation under the Accounting Act, the VAT Act and the Act on the Rules of Taxation to issue invoices relating to a given economic event and to fulfil its statutory reporting obligations, it is required to transfer personal data within the meaning of the REGULATION to the company entrusted with accounting, which in this case qualifies as a processor.
personal data: all personal data of the data subject which the applicable legislation requires to be included on the strict-accounting document called an „invoice” (name, address)
purpose of processing: fulfilment of legal obligations
duration of processing: 8 years
legal basis of processing: consent of the data subject, statutory authorization
The controller shall take appropriate measures to provide the data subject with all information and notices relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, especially where information is addressed specifically to children. The information shall be provided in writing or by other means, including, where appropriate, electronic means. At the request of the data subject, the information may be provided orally, provided that the identity of the data subject has been verified by other means.
The controller shall facilitate the exercise of the data subject’s rights. The controller may not refuse to act on the request of the data subject to exercise his or her rights unless it demonstrates that it is not in a position to identify the data subject.
The controller shall provide information on action taken on a request under the data subject’s rights without undue delay and in any event within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, that period may be extended by a further two months. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
If the controller does not take action on the request of the data subject, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action, and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
The provision of information and any action taken shall be free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may, taking into account the administrative costs of providing the information or communication or taking the action requested:
charge a reasonable fee; or
refuse to act on the request.
The burden of demonstrating the manifestly unfounded or excessive character of the request lies with the controller.
Where the controller has reasonable doubts concerning the identity of the natural person making the request, it may request the provision of additional information necessary to confirm the identity of the data subject.
The information to be provided to the data subject may also be supplemented by standardized icons in order to give, in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they shall be machine-readable.
For complaint handling, the following data must be provided by the data subject; such data serve exclusively to identify the data subject and maintain communication:
name
address
telephone number
email address
description of the complaint
Our Company informs you that if you experience unlawful processing by our Company, you may lodge a complaint with the competent Authority via the following contact details:
National Authority for Data Protection and Freedom of Information
1125 Budapest, Szilágyi Erzsébet fasor 22/c.
1530 Budapest, P.O. Box 5.
+36-1-391-1400
Our Company also informs you that in the event of unlawful processing, you also have the right to apply to a court.
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.
The controller shall notify the competent supervisory authority of the personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. The data subject need not be informed if any of the following conditions are met:
the controller has implemented appropriate technical and organizational protection measures, and those measures were applied to the personal data affected by the breach, in particular measures such as encryption, which render the personal data unintelligible to any person who is not authorized to access it;
the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to above is no longer likely to materialize;
it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.
If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so.
Our Company informs you that if you experience unlawful processing by our Company, you may lodge a complaint with the competent Authority via the following contact details:
National Authority for Data Protection and Freedom of Information
1125 Budapest, Szilágyi Erzsébet fasor 22/c.
1530 Budapest, P.O. Box 5.
+36-1-391-1400
Our Company also informs you that in the event of unlawful processing, you also have the right to apply to a court.
The controller undertakes to ensure the security of the personal data processed by it and to take those technical measures that ensure that the collected, stored and processed data are protected, and shall do everything in its power to prevent their destruction, unauthorized use and unauthorized alteration.
The controller reserves the right to unilaterally amend this statement subject to notifying users. Information on amendments to this privacy statement shall be published on the Website. Following the entry into force of the amendment, the user, by using the service, acknowledges the provisions of the amended statement by implied conduct.
