Privacy Policy.
1. Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information can be found in the following sections of this privacy policy.
Data collection on this website
Who is responsible for data collection? Data processing on this website is carried out by the website operator. You can find the contact details in the section “Information about the controller”.
How do we collect your data? On the one hand, your data is collected when you provide it to us, for example via a contact form, by email, by telephone or when booking an appointment online. Other data is collected by IT systems automatically or after your consent when you visit the website. This includes, in particular, technical data such as browser, operating system, IP address and time of page access.
What do we use your data for? Some of the data is processed to provide the website securely and without errors. Other data may – only with your consent – be used to analyse website usage, to measure the success of our advertising or to display external content. We process data from enquiries and appointment bookings for communication, appointment organisation and the initiation or performance of a treatment relationship.
What rights do you have? In particular, you have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can revoke any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.
2. Hosting and technical provision
Hosting with IONOS
We host the content of this website with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (“IONOS”). When the website is accessed, IONOS processes technically necessary data in server log files. This may include, in particular, IP address, date and time of access, requested file or page, referrer URL, browser type and browser version, operating system, host name of the accessing computer, and transfer status and amount of data.
The processing is carried out to provide the website securely, stably and efficiently, to analyse errors and to prevent abusive or harmful access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable and secure provision of our website.
IONOS generally processes personal data on our behalf. We have concluded a data processing agreement with IONOS pursuant to Art. 28 GDPR. The current agreement is version 1.3, as of March 2026. Under it, the contractually agreed processing generally takes place in the European Union or the European Economic Area. Where a transfer to a third country is required for individual services, IONOS ensures compliance with Art. 44 et seq. GDPR under the agreement.
The data is deleted as soon as it is no longer required for the stated purposes, unless statutory obligations or overriding security interests justify longer retention.
3. General information and mandatory information
Data protection
We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Various personal data is processed when you use this website. This policy explains the nature, scope, purpose, legal basis and duration of the respective processing.
Data transmission on the internet, especially in unencrypted email communication, may have security gaps. Complete protection of data against access by third parties is not technically possible.
Information about the controller
The controller responsible for data processing on this website is:
Andreas Haas, M.Sc., dentist
Practice name:
smileDentity – Centre for Aesthetic-Reconstructive Dentistry
Hauptstraße 45
63303 Dreieich
Phone: +49 6103 9956000
Email: info@smiledentity.de
The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.
Storage period
Unless a more specific storage period is stated in this privacy policy, we only store personal data for as long as the respective purpose exists. If you make a justified request for deletion or revoke your consent, we will delete the data unless there are other permissible reasons for retaining it. Statutory retention obligations, in particular professional, tax and commercial law obligations, remain unaffected.
Legal bases
Depending on the processing, we rely in particular on Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) or Art. 6(1)(f) GDPR (legitimate interest). For special categories of personal data, in particular health data, Art. 9(2) GDPR and Section 22 BDSG (German Federal Data Protection Act) also apply. If information is stored on or accessed from your device, Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act) also applies.
Recipients and processors
We only transfer personal data if there is a legal basis for doing so. Service providers only receive data to the extent necessary. Where they act as processors, we conclude agreements pursuant to Art. 28 GDPR. Where providers process personal data for their own purposes, their supplementary privacy information applies.
Transfers to third countries
Individual services may transfer data to recipients outside the European Union or the European Economic Area. Where an adequacy decision exists, the transfer takes place on this basis. For recipients in the USA certified under the EU-U.S. Data Privacy Framework, the European Commission’s adequacy decision can be relied upon. In addition, standard contractual clauses and further safeguards may be used. Details are described for the respective services.
Revocation and objection
You can revoke your consent at any time with effect for the future. The lawfulness of the processing carried out until revocation remains unaffected.
If processing is based on Art. 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. If data is processed for direct marketing purposes, you may object to the processing, including any related profiling, at any time without giving specific reasons.
Your data protection rights
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure under the statutory conditions (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability for automated processing based on consent or a contract (Art. 20 GDPR)
- Objection to certain processing (Art. 21 GDPR)
- Revocation of consent given, with effect for the future (Art. 7(3) GDPR)
You also have the right to lodge a complaint with a data protection supervisory authority. The authority generally responsible for the controller is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden.
Hessian Commissioner for Data Protection and Freedom of Information
SSL or TLS encryption
For security reasons and to protect confidential transmissions, this website uses SSL or TLS encryption. You can recognise an encrypted connection in particular by “https://” and the lock symbol in your browser.
4. Cookies and consent management
Cookies and similar technologies
Our website uses cookies and similar technologies. Session cookies are regularly deleted at the end of the session. Persistent cookies remain on your device until their storage period expires or until you delete them manually. Cookies may originate from us or from third-party providers.
Technically necessary cookies and access to your device are based on Section 25(2)(2) TDDDG; we base the subsequent processing on Art. 6(1)(f) GDPR, unless a more specific legal basis applies. We only use analytics, marketing and other non-essential technologies with your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
Details of the services, cookies and storage periods used are displayed in the consent dialogue. You can change your selection at any time via the “Cookie Settings” link or icon.
Borlabs Cookie
We use Borlabs Cookie to obtain, manage and document your consent. The provider is Borlabs GmbH, Germany. Borlabs Cookie stores your consent decision, the time, the scope of consent, the version of the consent dialogue used and a randomly generated identifier. According to the provider, the consent information is generally stored locally on our website or in your browser.
The processing is necessary to implement your selection and to be able to prove consent given. The legal bases are Section 25(2)(2) TDDDG, Art. 6(1)(c) GDPR and, additionally, Art. 6(1)(f) GDPR. Our legitimate interest lies in legally compliant consent management.
You can change the stored decision at any time via the cookie settings. Revocation does not affect the lawfulness of the previous processing.
5. Contact and communication
Contact form with Contact Form 7
We use the WordPress plugin Contact Form 7 by the developer Takayuki Miyoshi or Rock Lobster, Inc. to provide our contact form.
When you write to us via the contact form, we process the information entered there, in particular your name, contact details, the content of your message and technically generated metadata, in order to handle your request and answer any follow-up questions.
If your enquiry relates to an existing or intended treatment relationship, the processing is based on Art. 6(1)(b) GDPR. Otherwise, we base the processing on our legitimate interest in the efficient handling of enquiries addressed to us pursuant to Art. 6(1)(f) GDPR. Where consent is requested, the processing is based on Art. 6(1)(a) GDPR.
Please avoid submitting detailed health information via the general contact form. Where you voluntarily provide health data that is necessary to handle a treatment enquiry, we also process it on the basis of Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) BDSG. The processing is carried out by or under the responsibility of a member of a health profession who is bound by professional secrecy.
The data you submit will be deleted as soon as your enquiry has been conclusively handled and there are no statutory retention obligations or other permissible reasons for further storage.
Further information on Contact Form 7 can be found at: Contact Form 7 privacy information
Enquiries by email and telephone
If you contact us by email or telephone, we process the data provided to handle your request. The legal basis is Art. 6(1)(b) GDPR where a contract or pre-contractual measures are concerned, otherwise Art. 6(1)(f) GDPR. Where necessary, we also process health data in accordance with Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) BDSG. The data is deleted once the purpose has been achieved, subject to statutory retention obligations.
Protection against abusive entries with Google reCAPTCHA
Where activated on a form, we use Google reCAPTCHA. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. reCAPTCHA is used to distinguish automated access, spam and abusive form entries from entries made by humans.
For this purpose, Google may process in particular the IP address, referrer URL, time and duration of the visit, mouse and keyboard movements, device and browser information, language settings, screen resolution, Google cookies present in the browser and the result of the risk analysis. According to Google, when reCAPTCHA is executed it sets in particular the cookie “_GRECAPTCHA”. With reCAPTCHA v3, a largely invisible, continuous risk assessment takes place; with reCAPTCHA v2, a checkbox or an image task may be displayed.
Due to the potentially extensive data processing and connection to Google, reCAPTCHA is only loaded on this website with your prior consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without consent, it may not be possible to use the form protected by reCAPTCHA; alternatively, you can contact us by email or telephone. You can revoke your consent at any time via the cookie settings.
Google LLC is certified under the EU-U.S. Data Privacy Framework. For transfers to the USA, the European Commission’s adequacy decision can be relied upon; standard contractual clauses may also be used.
Information about Google reCAPTCHA
Spam protection with Antispam for Contact Form 7
To protect our contact form against automated entries, spam and abusive use, we use the WordPress plugin “Antispam for Contact Form 7” by Codekraft Studio.
When checking a form submission, the plugin processes in particular the IP address and technical characteristics of the request. According to the provider, the IP address is processed for the spam check but not stored permanently. The check takes place locally within our WordPress installation. As a rule, this plugin does not transmit the form data to a central antispam service or an external antispam API.
The plugin can create a local dictionary of spam and non-spam terms from components of incoming messages. In the process, individual, normalised or otherwise modified words from a submitted message may be stored in the WordPress database. This information is used exclusively for the local detection and prevention of spam.
The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website, our IT systems and our communication channels against automated entries, spam and abusive use.
Where health data is voluntarily provided via the contact form and parts of it are processed in the local dictionary, the processing is additionally based on Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) BDSG.
The stored information will be deleted as soon as it is no longer required for the detection and prevention of spam or the local dictionary is reset, unless there are statutory reasons for further storage. Further information on the plugin can be found at: https://wordpress.org/plugins/cf7-antispam/
Email delivery with WP Mail SMTP
For the reliable sending of emails from our WordPress installation, we use the WordPress plugin “WP Mail SMTP”. The plugin configures the WordPress email function so that emails are sent via the SMTP or email service we have set up.
When you use our contact form, the following data in particular may be processed via the configured mail server and transmitted to us:
- Name and contact details
- Email address
- Telephone number, if provided
- Content of the message
- Date and time of submission
- Technical sending and delivery information
- Any health information provided voluntarily
The processing serves the secure and reliable transmission of your enquiry to the responsible staff at our practice. If your enquiry relates to an existing or intended treatment relationship, the processing is based on Art. 6(1)(b) GDPR. In all other cases, the processing is based on our legitimate interest in the secure and reliable handling of incoming messages pursuant to Art. 6(1)(f) GDPR.
Where you voluntarily submit health data, it is additionally processed on the basis of Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) BDSG. The processing is carried out by or under the responsibility of a member of a health profession who is bound by professional secrecy.
We use the following provider for sending emails: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (“IONOS”). The mail provider processes the data required for sending in order to transmit and technically deliver the message. Where the provider acts as a processor on our behalf, a data processing agreement pursuant to Art. 28 GDPR is in place.
If email logging is activated, the sender and recipient address, subject, time of sending, sending status, technical error messages and – depending on the configuration – the content or attachments of the email may also be stored in our WordPress installation. Logging serves to analyse errors and ensure reliable email delivery. The legal basis is Art. 6(1)(f) GDPR.
The data will be deleted as soon as it is no longer required for handling the enquiry and technical delivery control, and there are no statutory retention obligations or other permissible reasons for further storage. Further information on WP Mail SMTP can be found at: https://wordpress.org/plugins/wp-mail-smtp/
6. Online appointment booking with Dr. Flex
We offer the option of booking an appointment online. For this purpose, we use the Dr. Flex service of Dr. Flex GmbH, Stresemannstraße 21, 10963 Berlin, Germany. The system displays available appointments and allows appointments to be booked, changed or cancelled.
When booking an appointment, the following may be processed in particular: name, contact details, date of birth, insurance status, preferred practice or practitioner, type of appointment, appointment time and any other voluntary information. Health data may be inferred from the selected practice, speciality or type of appointment.
The processing is carried out to initiate or perform the treatment relationship pursuant to Art. 6(1)(b) GDPR. Where health data is processed, Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) BDSG also applies. Dr. Flex processes the data required to organise appointments and transmits the booking information to us. Within the booking process, the privacy information of Dr. Flex also applies.
The booking module is only loaded after you have actively selected or enabled it. Where loading the module itself triggers access to your device or a transfer of data that is not technically necessary, we base this on your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
Dr. Flex states that it operates the platform in Germany on certified servers. The data is only stored for as long as is necessary for organising appointments, performing the treatment relationship or fulfilling statutory obligations.
7. Analytics and statistics
IONOS WebAnalytics
Where activated for the hosting package, we use IONOS WebAnalytics from IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. The service produces statistical evaluations, for example of page views, length of visit, bounce rates, visitor sources, approximate locations, browsers, operating systems and device types.
For this purpose, IONOS processes in particular the referrer, requested page or file, browser type and version, operating system, device type, access time and an anonymised IP address. According to IONOS, WebAnalytics does not use cookies for this and does not provide us with any data that directly identifies individual visitors.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in data-minimising statistical evaluation and technical optimisation. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.
Google Tag Manager
We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Tag Manager is used to manage website tags centrally. It does not generally create its own analysis profiles, but it can technically establish a connection to Google and trigger other services. In the process, in particular the IP address, browser and device information and the page accessed may be processed.
Tag Manager and the non-essential tags managed through it are only used in accordance with the selection you have made in the consent dialogue. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can revoke your consent at any time via the cookie settings.
Google LLC is certified under the EU-U.S. Data Privacy Framework. Where data is transferred to the USA, the transfer can be based on the adequacy decision; standard contractual clauses may also be used.
Google Analytics
With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us to understand how visitors use our website and how we can improve content and user guidance.
In particular, the following may be processed: pages accessed, time and duration of the visit, referrer URL, approximate geographical origin, browser, operating system, device, screen resolution, language settings, session and event data, interactions and pseudonymous identifiers. Google uses cookies or similar technologies.
Google states that it does not log or store IP addresses of users from the EU or the EEA. The IP address is used on European servers to derive approximate location information and is then discarded.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Under the Basic Consent Mode we use, Google Analytics is not used without your consent. You can revoke your consent at any time via the cookie settings.
User-related event data is deleted in accordance with the retention period set in our Google Analytics property. Aggregated reports may remain available for longer. Recipients may be Google Ireland Limited, Google LLC and affiliated companies. Google LLC is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses may also be used.
Data privacy and security in Google Analytics
Google Analytics opt-out browser add-on
Microsoft Clarity
With your consent, we use Microsoft Clarity, an analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Clarity shows us how visitors use our website, for example where they click and how far they scroll. This allows us to identify where navigation is not working smoothly and to improve it.
In particular, the following may be processed: mouse movements, clicks, scrolling behaviour, pages accessed, time and duration of the visit, referrer URL, approximate geographical origin, browser, operating system, device, screen resolution and pseudonymous identifiers. From this data, Clarity creates heatmaps and session recordings that reproduce the page visit. Entries in form fields and text content are masked before transmission and are not recorded. Clarity uses cookies or similar technologies.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Clarity is not loaded without your consent. You can revoke your consent at any time via the cookie settings.
According to Microsoft, session recordings are generally deleted after 30 days and aggregated evaluations such as heatmaps after 13 months. Recipients may be Microsoft Ireland Operations Limited, Microsoft Corporation and affiliated companies. Processing in the USA is possible. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses may also be used.
8. Advertising and performance measurement
Google Ads
With your consent, we use Google Ads from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to display ads in Google Search and, where applicable, in the Google advertising network, and to measure their success.
In doing so, Google may process in particular the IP address, browser and device information, pages accessed, time, referrer URL, advertising and cookie identifiers, campaign information, Google Click Identifier and interactions with ads and our website. Depending on your Google account settings, Google may associate data with your account and use it for its own advertising purposes.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can revoke your consent at any time via the cookie settings. Google LLC is certified under the EU-U.S. Data Privacy Framework. For possible transfers to the USA, the adequacy decision can be relied upon; standard contractual clauses may also apply.
Advertising and privacy at Google
Google Ads conversion tracking
With your consent, we use Google Ads conversion tracking. This allows us to recognise whether a user performs an action defined by us on the website after clicking on a Google ad, for example clicking on a telephone or email link, submitting the contact form or opening or completing the online appointment booking.
For this purpose, conversion cookies or similar identifiers may be used, and in particular the time of the ad click, pages accessed, action performed, IP address, browser and device data, cookie and advertising identifiers, click ID, campaign and conversion data may be processed. As a rule, we receive statistical evaluations and no information that would allow us to directly identify visitors.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent can be revoked at any time via the cookie settings. The above information on Google Ads applies to recipients and transfers to third countries.
Google Consent Mode
We use Google Consent Mode v2 in Basic Mode to technically transmit the consent decision you have made via Borlabs Cookie to the Google tags used on our website.
In the consent dialogue, the Google services integrated via Google Tag Manager are managed under the “Statistics” category. If you consent to this category or to the Google Tag Manager listed there, the services Google Analytics 4 and Google Ads conversion tracking stored in Tag Manager can be activated. Google Analytics is used for the statistical analysis of website usage. Google Ads conversion tracking is used to measure whether users perform an action defined by us on our website after clicking on a Google ad. Microsoft Clarity is also integrated via Google Tag Manager, but is only loaded if you separately consent to the “Microsoft Clarity” service in the “Statistics” category and the consent signal analytics_storage has been granted. Details can be found in the section “Microsoft Clarity”.
Before you give your consent, Google Analytics 4 and Google Ads conversion tracking are not loaded under the Basic Consent Mode we use. In this case, no cookieless analytics or conversion signals are transmitted to Google for modelling purposes either. With your consent, the consent signals required for the respective processing, in particular analytics_storage, ad_storage, ad_user_data and, where applicable, ad_personalization, can be transmitted to Google in accordance with the technical configuration.
The legal basis for storing information on your device or accessing it is Section 25(1) TDDDG. The legal basis for the subsequent processing of personal data is your consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time via the cookie settings with effect for the future.
9. External content and maps
Google Maps
This website may embed maps from the Google Maps service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Maps is only loaded once you actively enable the map or consent to the corresponding category in the consent dialogue.
When the map is loaded, in particular the IP address, browser and device data, location data, page accessed, time and usage and interaction data may be transmitted to Google. If you are logged in to a Google account, Google may associate the use with your account.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent can be revoked at any time via the cookie settings. Google LLC is certified under the EU-U.S. Data Privacy Framework. For possible transfers to the USA, the adequacy decision can be relied upon; standard contractual clauses may also be used.
10. Language versions and Polylang
Polylang
To provide the German and English language versions, we use the WordPress plugin Polylang from the provider WP SYNTEX. The translated content is stored locally in our WordPress installation. As a rule, therefore, no website content or personal data is transmitted to WP SYNTEX or an external translation service for translation when you simply access the site or switch language.
Polylang may set the technically necessary cookie “pll_language” to store the language you have selected and to provide it again on subsequent visits or technically necessary requests. The processing serves to display the website in the language you have chosen. The legal bases are Section 25(2)(2) TDDDG and Art. 6(1)(f) GDPR. Our legitimate interest lies in a user-friendly multilingual presentation.
The language cookie is stored for the period specified in the cookie overview or deleted earlier if you remove it in your browser.
11. Updates and changes to this privacy policy
We adapt this privacy policy when the website, the services used or legal requirements change. The version published on this website at the time is authoritative.
As of: 14 September 2026