The protection of your personal data is important to us. This privacy policy explains which data we process when you visit our website and when you contact us, for what purpose and on what legal basis. It is based on the General Data Protection Regulation (GDPR), the Austrian Datenschutzgesetz (DSG, Austrian Data Protection Act) and the Telekommunikationsgesetz 2021 (TKG 2021, Telecommunications Act 2021).

The controller responsible for data processing is:

If you have any questions about data protection or wish to exercise your rights, please use the contact details given above. No data protection officer has been appointed for our single-doctor practice, as this is not required by law.

We only process personal data if one of the following legal bases applies:

• Consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021): e.g. for Google Analytics, Google Ads and Google Maps. You can withdraw your consent at any time with effect for the future.
• Contract and pre-contractual measures (Art. 6(1)(b) GDPR): e.g. appointment requests and your treatment.
• Legal obligation (Art. 6(1)(c) GDPR): e.g. the documentation obligation under § 19 Zahnärztegesetz (ZÄG, Dentists Act) and the tax retention obligations under § 132 Bundesabgabenordnung (BAO, Federal Fiscal Code).
• Legitimate interests (Art. 6(1)(f) GDPR): e.g. the secure and stable operation of this website and protection against misuse.
• Health data (Art. 9(2)(h) GDPR in conjunction with the Zahnärztegesetz): for the purposes of preventive healthcare, diagnosis and treatment.

Under § 165(3) TKG 2021, information may only be stored on or read from your device with your consent, unless this is strictly necessary for the use of the website that you have requested.

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you access the website, technically necessary data are processed, in particular your IP address, the date and time of access, the page accessed, the previously visited page and browser and operating system information (server log files).

This is necessary in order to deliver the website to you and to ensure its security, for example to fend off attacks (Art. 6(1)(f) GDPR). The log files are automatically deleted by the host after a short time.

Content such as blog posts, our own visitor statistics and “Like” entries is stored in a database with the provider MongoDB Atlas (MongoDB, Inc., USA).

Data processing agreements (Art. 28 GDPR) are in place with both providers. Any transfer to the USA is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on EU standard contractual clauses.

Server log files are kept for no longer than 3 months (Art. 6(1)(f) GDPR in conjunction with § 165(3) TKG 2021). A copy of the standard contractual clauses is available on request.

To obtain your consent, we use the consent tool CookieYes provided by CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. On your first visit, a window appears in which you can choose which categories you allow:

• Essential (always active): CookieYes stores your choice in a cookie (“cookieyes-consent”, lifetime of up to 1 year). If you open another language version or change the language, the website remembers your choice in a cookie (“STELLA_LOCALE”) that is deleted when you close your browser. The light/dark mode is stored in your browser’s local storage (“dental-theme”).
• Statistics: Google Analytics (see section 5).
• Marketing: Google Ads conversion tracking (see section 5).

As proof, your consent is logged by CookieYes (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). The European Commission has adopted an adequacy decision for the United Kingdom.

Withdrawal: Using the “Cookie settings” link at the very bottom of every page, you can change or withdraw your choice at any time. You can also delete cookies and website data in your browser.

Google Analytics and Google Ads set cookies only after you have given your consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Tag Manager

The Tag Manager is a tool we use to integrate the Google services into the website. It does not set any cookies itself, but it establishes a connection to Google servers, in the course of which your IP address is transmitted. It is loaded when you access the website because it also provides the consent tool CookieYes (Art. 6(1)(f) GDPR).

Google Analytics 4 (category “Statistics”)

Google Analytics helps us understand how the website is used so that we can improve it. Among other things, it records the pages accessed, time spent on the site, approximate location (country/city), device and browser information, and clicks on the phone, WhatsApp or appointment booking buttons. For this purpose, cookies such as “_ga” and “_ga_*” are set with a lifetime of up to 2 years. IP addresses are not stored by Google Analytics 4 in the EU. The analytics data are deleted after 14 months at most.

Google Ads conversion tracking (category “Marketing”)

If you reach the website via one of our Google ads, we can measure whether, for example, an appointment request follows. For this purpose, cookies such as “_gcl_*” are set. We do not learn who you are.

We use Google Consent Mode: your choice is passed on to Google. As long as you have not consented, Google does not set any cookies; however, cookieless signals without identifiers (e.g. that a page view has taken place) may be transmitted to Google. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). A transfer to Google LLC in the USA is possible. Google is certified under the EU-US Data Privacy Framework. Further information: policies.google.com/privacy.

On the home page, we show the location of our practice using Google Maps (provider: Google Ireland Limited). The map is only loaded when you click “Load map” (two-click solution). Before that, no data are transmitted to Google.

After the click, a connection to Google is established. In the process, Google receives in particular your IP address and may set cookies. Data may also be transferred to the USA (EU-US Data Privacy Framework). The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR). This consent applies only to the respective page view. Alternatively, you can use the “Open in Google Maps” link.

In addition, we count page views using our own simple statistics. Only the following are stored: the page accessed, the time and the domain of the page you came from (e.g. “google.com”). We also count clicks on the buttons for calls, email, WhatsApp, appointment booking and the medical history form. Only the type of click, the page and the time are stored. If a visit comes from one of our Google ads (recognisable by an addition to the web address), we only note this as yes/no – the identifier itself is not stored.

In doing so, we store no IP address, no browser identifier and no cookies and do not use any third-party services. It is not possible to identify you personally. The statistics help us see which content is in demand (Art. 6(1)(f) GDPR).

If you mark a blog post with “Like”, we store an irreversibly encrypted value (hash) derived from your IP address, but not the IP address itself. This prevents a post from being rated more than once by the same person (Art. 6(1)(f) GDPR). The value is stored for as long as the post exists.

For online appointments, we use the booking system Termin365. The booking opens only after you click, in a new window at stelladent.termin365.at. No booking data are processed on our website itself.

The data you enter there (e.g. name, date of birth, phone number, email address, preferred appointment and reason for the visit) are processed by the provider of Termin365 on our behalf (Art. 28 GDPR). The purpose is to allocate and manage your appointment (Art. 6(1)(b) GDPR; for health-related information, Art. 9(2)(h) GDPR). The provider’s privacy notice also applies on the booking page.

After an online booking, Termin365 may redirect you to our confirmation page. There we only count that an appointment was booked and the time – without names, IP addresses or cookies (Art. 6(1)(f) GDPR, legitimate interest in evaluating our services). If you have consented to the Google services, the booking is also reported to Google Ads as a conversion.

You can complete the medical history form online via the service powerforms.at. This also involves the processing of health data, such as previous illnesses, medication and allergies. The data are transmitted in encrypted form. The provider processes the data on our behalf (Art. 28 GDPR).

We need this information for safe dental treatment (Art. 9(2)(h) GDPR in conjunction with the Zahnärztegesetz, Art. 6(1)(b) and (c) GDPR). The completed form becomes part of your patient records.

If you call us, write us an email or contact us via WhatsApp, we process your details (e.g. name, phone number, email address and your request) in order to respond to your enquiry (Art. 6(1)(b) and (f) GDPR; for health information, Art. 9(2)(h) GDPR).

We keep your enquiry and our reply for up to 6 months in case of follow-up questions, unless they become part of your patient records.

WhatsApp is provided by WhatsApp Ireland Limited (Meta), Merrion Road, Dublin 4, Ireland. The WhatsApp button opens WhatsApp only after you click it; no data are transmitted before that. Messages are end-to-end encrypted, but Meta processes metadata (e.g. phone number, time) and may also transfer these to the USA (EU-US Data Privacy Framework).

Please avoid sending sensitive health data via WhatsApp or unencrypted email where possible; instead, discuss them with us by phone or in person.

On our website, we link to our profile on Instagram. This is a simple link, not an embedded plugin. Data are only transmitted when you click the link and visit Instagram. There, Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) is responsible for data processing.

The fonts used on this website are stored locally on our server. When a page is accessed, no connection is established to Google Fonts or other font providers.

We only store personal data for as long as is necessary for the respective purpose or as required by statutory obligations:

• Patient records, including the medical history form and X-rays: at least 10 years (§ 19(3) ZÄG)
• Invoices and accounting records: 7 years (§ 132 BAO)
• Enquiries by phone, email or WhatsApp: up to 6 months for follow-up questions, unless they become part of the patient records
• Your cookie choice: until you change it or delete your browser data
• Google Analytics data: 14 months at most; cookies up to 2 years
• Server log files: no longer than 3 months

Under the GDPR, you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless there is a statutory retention obligation
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

No automated decision-making, including profiling (Art. 22 GDPR), takes place. An informal message to the contact details given above is sufficient for your request. We will respond within one month.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority:

This website is protected by TLS encryption (HTTPS). You can recognise this by the padlock symbol in your browser’s address bar. We also take technical and organisational measures to protect your data against loss, misuse and unauthorised access.

We adapt this privacy policy when our website, the services used or the legal situation change. The version published on this page at any given time applies.

Last updated: November 2026