1. Data Controller
Zahnkompetenzzentrum Dr. med. dent. M.Sc. Sandro Strößner + Team, Leopold-Kell-Straße 25, 06667 Weißenfels, phone 03443 339 65 54, email kontakt@zahnarzt-weissenfels.com. The party responsible within the meaning of the GDPR is Dr. med. dent. M.Sc. Sandro Strößner.
2. The Essentials in Brief
- We set cookies for statistical purposes (Google Analytics 4) only with your consent; unless you click “Accept”, everything stays switched off, and you can withdraw your consent at any time.
- When you access this website, our hosting provider processes technically necessary access data (server log files).
- Our traffic measurement works without cookies and without storing your IP address (only a daily-changing value that cannot be traced back to you).
- The online appointment booking and online reception (Dr. Flex) is a fixed part of the website; the calendar and chat only open once you access them.
- You can reach us via WhatsApp when you open a WhatsApp link yourself or scan the QR code; the website does not load anything from WhatsApp in advance.
- Maps, videos and fonts are not loaded from third-party providers: videos are hosted on our own server, fonts on our own domain zahnkompetenzzentrum.de, and map links only take you to the map service once you click them.
3. Hosting and Server Log Files
This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (data processing agreement under Art. 28 DSGVO (GDPR), server location Germany). Each time the site is accessed, the IP address, date and time, the page accessed, the amount of data transferred, referrer, browser and operating system are automatically stored in log files. The legal basis is Art. 6(1)(f) DSGVO (GDPR) (secure and stable operation). The log files are deleted after no more than 7 days.
4. Reach Measurement Without Cookies
To find out which pages are read and whether the website works technically, we use a self-operated measurement method (script stats.js from our domain zahnkompetenzzentrum.de, analysed on our own server). It does not set cookies and does not store IP addresses; only a hash value that changes daily and cannot be reverse-calculated is formed from the IP address and browser identifier. We record the page visited, referrer, device type, browser language, window width, scroll depth (25/50/75/100%), time on page, technical loading metrics (LCP, CLS, INP), clicks on appointment and phone buttons (label, max. 60 characters, and the area of the page, e.g. header or footer), as well as events such as video start, opening a seal notice, starting and completing the implant cost calculator or a self-test (only the event name and the variant chosen – no inputs, no results), steps in online appointment booking (opened, sent, confirmed – without content) and clicks on external links (destination domain only). If you arrive via one of our Google ads, we additionally record the identifiers of the ad from the destination address (campaign, ad group, network) – without search term, without Google’s click identifier and without any details about you; if you arrive via the website link of our Google Business Profile or our citizen-service portals, only the origin identifier (“gbp” or “portal”). We also count whether the cookie notice was displayed, whether it was actually visible on your screen (a content blocker can hide it) and how you decided in it – “Accept”, “Decline”, close, or not at all before leaving the page; of this, only the event name with its category is stored, like every page view with the daily changing short code and without a cookie; we evaluate it only in aggregated form, in order to see whether the notice reaches you legibly at all. We do not combine the counter data with booking data or other patient data, and the raw data of the counter are deleted after 14 months. Your browser’s “Do Not Track” and “Global Privacy Control” signals are respected. Legal basis: Art. 6(1)(f) DSGVO; consent under Section 25 TDDDG is not required, as no information is stored on or read from your device beyond what is technically necessary.
4a. Google Analytics 4 (only with consent)
If you click “Accept” in the cookie dialog, we load Google Analytics 4 (property G-FB8KLSYESR) directly via the Google tag – without a third-party tag manager. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (e.g. _ga, storage period of up to 2 years) and processes a truncated IP address, device data, pages visited and events such as clicks on phone, email and appointment buttons and the steps of online appointment booking (opened, sent, confirmed – without content). We use this data to identify which pages and which ads lead to appointment requests; for this purpose, events are transmitted to Google Ads (conversion measurement). Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) DSGVO [GDPR], Section 25(1) TDDDG [German Telecommunications and Digital Services Data Protection Act]); without consent, Google Analytics is not loaded (Consent Mode v2, default setting “denied”). Even after your consent, the setting for personalised advertising remains switched off (ad_personalization = “denied”): your data is not used to serve you personalised ads, only for statistics and for measuring the success of our ads. You can withdraw your consent at any time by deleting this website’s cookies in your browser – the dialog will then appear again. Further information: policies.google.com/privacy.
5. Online Appointment Booking and Online Reception (Dr. Flex)
Provider: Dr. Flex GmbH, Stresemannstraße 21, 10963 Berlin. Dr. Flex provides our online appointment booking and our online reception (chat assistant for appointment requests and enquiries) and acts as a processor on our behalf (contract under Art. 28 DSGVO). The integration loads after the page has built; in doing so, your IP address is transmitted to Dr. Flex (Art. 6(1)(f) DSGVO – provision of the appointment and contact function; Section 25(2) No. 2 TDDDG). The appointment calendar and chat assistant only open once you click on them. Details you provide there (e.g. name, contact information, your enquiry) are passed on to Dr. Flex and to our practice for processing (Art. 6(1)(b) DSGVO; for health information, Art. 9(2)(h) DSGVO in conjunction with Section 22 BDSG). Please only enter the information there that is necessary for your enquiry. The online reception is an AI-powered chat assistant (Dr. Flex “Web AI”): your entries are evaluated automatically in order to forward your enquiry to the practice; the AI does not make any treatment decisions, and you can call us instead at any time. Please do not send any clinical findings, X-rays, or other sensitive health data via the chat; a “findings enquiry” in the chat simply forwards your request to the practice. Provider's privacy policy: dr-flex.de/datenschutz.
6. Google Reviews
On the website, we show the number and average rating of our Google reviews together with the date they were last updated. These figures are retrieved by our server from Google at regular intervals and delivered to you from cache – your browser does not make any contact with Google to do this. The reviews themselves are published and checked by Google according to its own guidelines; we have no influence over this. The link on the rating figure leads to the Google Business Profile.
7. Getting in Touch
If you contact us by email or telephone, we process your details in order to deal with your enquiry (Art. 6(1)(b) DSGVO; for health information, Art. 9(2)(h) DSGVO in conjunction with Section 22 BDSG). Please do not send us findings or X-rays by unencrypted email; we are happy to tell you about a secure way to do so. We delete enquiries sent by email no later than six months after they have been fully dealt with, unless statutory retention obligations apply (for example, for treatment records).
7a. Second opinion: uploading a cost plan
On the “Second opinion” page you can upload a treatment and cost plan (PDF, JPG, PNG) and enter your contact details. These details and the file are transmitted to our web server over an encrypted connection and forwarded from there immediately by e-mail to our practice mailbox kontakt@zahnarzt-weissenfels.com; nothing is stored on the web server. The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR/DSGVO), which you give by submitting the form and can withdraw at any time with effect for the future. E-mail transport is encrypted in transit (TLS); there is no end-to-end encryption. We use the documents solely to prepare the second opinion and delete them as soon as they are no longer needed for that purpose, at the latest six months after receipt if no treatment takes place. To protect against misuse, the server checks file type and size and limits the number of submissions per hour; for this purpose, a non-reversible hash value derived from your IP address is held in temporary memory for no more than one hour.
7b. Aftercare companion (notifications)
The aftercare companion runs on our service domain zahnkompetenzzentrum.de. When you activate it there, your browser creates a pseudonymous push subscription (a random address of your browser’s push service), which is stored on our server together with the selected procedure and the date so that we can send you reminders for up to 14 days. Your name is not stored; only the selected procedure with the date is stored. Both are deleted automatically seven days after the end of the companion. Details can be found in the privacy policy of zahnkompetenzzentrum.de; you can unsubscribe from the companion at any time on the companion page or in your browser settings.
7c. Communication via WhatsApp
You can send us messages via WhatsApp, either through the WhatsApp links and QR codes on this website or directly to our practice number. The website itself does not load anything from WhatsApp for this purpose: you only switch to WhatsApp once you open a WhatsApp link or scan the QR code; from that point on, WhatsApp's privacy provisions also apply.
For these messages, we use the practice communication platform Roger from Sanos Group AG, Industriestrasse 44, 8304 Wallisellen, Switzerland. Roger connects our WhatsApp Business account via the official WhatsApp Business API; the technical service provider for this is 360dialog GmbH, Torstraße 61, 10119 Berlin, which, according to the provider, stores the messages in Germany. A data processing agreement under Art. 28 DSGVO is in place with Sanos Group AG; the European Commission has found that Switzerland provides an adequate level of data protection (Art. 45 DSGVO). Sanos Group AG acts as a processor on behalf of the controller and uses only sub-processors that have been approved in advance by the controller. Before any planned addition or change of a sub-processor, Roger informs the contracting party in writing at least thirty (30) days in advance.
If you message us, we process your phone number, your WhatsApp profile name and the content of your messages in order to deal with your enquiry (Art. 6(1)(b) DSGVO; for health information, Art. 9(2)(h) DSGVO in conjunction with Section 22 BDSG). We delete messages as soon as they are no longer required for this purpose, unless statutory retention obligations apply (for example, for treatment records). The app itself is operated by WhatsApp Ireland Limited, Ireland; as an independent controller, it processes connection and usage data in particular and may also transfer data to the USA in the process. Please only send us the information that is necessary for your enquiry, and do not use WhatsApp in emergencies: we read messages during opening hours. If you would prefer not to use WhatsApp, you can reach us just as well by phone, by email or via our online appointment booking.
Our audience measurement counts a click on a WhatsApp button in the same way as a click on a phone or appointment button, recording only the event name and the button label, without any content; where Google Analytics is active with your consent, the click is recorded there as the event “clicks_whatsapp”, likewise without any content.
8. External Links and Map Services
Links to Google Maps, Apple Maps, Instagram, the careers page or professional societies only open the relevant provider's website once you click them. From that moment on, the respective provider's privacy policy applies.
9. Your Rights
You have the right to access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing carried out on the basis of Art. 6(1)(f) DSGVO (Art. 21). Please use the contact details given above to exercise these rights. You may also lodge a complaint with a data protection supervisory authority; the one responsible for us is: Landesbeauftragter für den Datenschutz Sachsen-Anhalt (State Commissioner for Data Protection, Saxony-Anhalt), Otto-von-Guericke-Straße 34a, 39104 Magdeburg (PO Box 1947, 39009 Magdeburg).
10. Currency of this Policy
We update this statement whenever the website or the legal situation changes. The version published here at any given time applies.
