ES
DE
Phone Logo +34 971 942 257
WhatsApp Logo Whatsapp
Make an appointment

Privacy Policy, effective: November 2025.

This Privacy Policy informs you about the type, scope, and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offering and the associated websites, functions, and content, as well as external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”). With regard to the terminology used, such as “processing” or “controller,” we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

General Information

The controller responsible for the collection, processing, and use of personal data within the meaning of data protection law, as well as for the content, is:

Dr. Víctor J. Hernández Darias – VHD.Dental
Dentist * Orthodontist * Oral and Maxillofacial Surgeon

Avenida de Joan Miró 295,
07015 Palma de Mallorca

Phone (+34) 971 94 22 57
Email: info@vhd-dental.com

Col. No. 07001360
NIE/DNI/NIF 78852805L

Types of Data Processed:

  • Inventory data (e.g., names, addresses)
  • Contact data (e.g., email address, phone numbers)
  • Content data (e.g., text entries, photographs, videos)
  • Usage data (e.g., visited websites, interest in content, access times)
  • Meta/communication data (e.g., device information, IP addresses)
  • Contract data (e.g., subject matter of the contract, term, customer category)
  • Payment data (e.g., bank details, payment history)

Categories of Data Subjects

Visitors and users of the online offering (hereinafter collectively referred to as “users”).

Purpose of Processing

  • Provision of the online offering, its functions, and content
  • Responding to contact inquiries and communicating with users
  • Security measures
  • Reach measurement / marketing
  • Processing of orders and payments in the online shop
  • Management of subscriptions and contractual relationships
  • Provision of personalized content based on user behavior

Relevant Legal Bases

In accordance with Article 13 GDPR, we inform you of the legal bases for our data processing. Where the legal basis is not explicitly stated in this Privacy Policy, the following applies: the legal basis for obtaining consent is Article 6(1)(a) and Article 7 GDPR; the legal basis for processing for the performance of our services and contractual measures and for responding to inquiries is Article 6(1)(b) GDPR; the legal basis for processing to fulfill legal obligations is Article 6(1)(c) GDPR; and the legal basis for processing to safeguard our legitimate interests is Article 6(1)(f) GDPR. Where processing is necessary to protect vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis.

Security Measures

In accordance with Article 32 GDPR, taking into account the state of the art, implementation costs, the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

Cooperation with Processors and Third Parties

If, in the course of our processing, we disclose data to other persons or companies (processors or third parties), transmit data to them, or otherwise grant them access to the data, this is done only on the basis of legal permission (e.g., if the transfer of data to third parties, such as payment service providers, is necessary for contract performance pursuant to Article 6(1)(b) GDPR), your consent, a legal obligation, or our legitimate interests (e.g., when using agents, web hosts, etc.).

If we commission third parties to process data on the basis of a so-called data processing agreement, this is done in accordance with Article 28 GDPR.

Transfers to Third Countries

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of using third-party services or disclosing or transferring data to third parties, this will only take place if it is necessary to fulfill our (pre-)contractual obligations, based on your consent, due to a legal obligation, or based on our legitimate interests. Subject to statutory or contractual permissions, we process or have data processed in a third country only if the special requirements of Articles 44 et seq. GDPR are met.

Storage Period

Data collected in the course of an order or subscription will be stored for the duration of the contractual relationship. After termination of the subscription or completion of the order, your data will be deleted or anonymized in accordance with statutory retention periods, unless there are legal obligations requiring further storage.

Newsletter Distribution via Brevo (formerly SendinBlue)

We use Brevo (formerly SendinBlue) as a service provider for sending our newsletters. Brevo is a platform operated by Sendinblue GmbH and is subject to the data protection regulations of the European Union.

The data provided when subscribing to the newsletter (e.g., email address) is stored on Brevo’s servers and used exclusively for sending the newsletter. The data is not passed on to third parties.

Brevo enables the organization and analysis of newsletter distribution. Using Brevo, we can analyze the behavior of newsletter recipients, such as how many recipients have opened the newsletter and how often certain links within the newsletter were clicked. This data is collected in pseudonymized form and used exclusively to improve our content. No association of this data with the identity of the respective user takes place.

Legal Basis for Newsletter Distribution

The newsletter is sent on the basis of your consent pursuant to Article 6(1)(a) GDPR. You may revoke your consent at any time. Revocation can be effected via the unsubscribe link in the newsletter or by notifying us. Data processing carried out prior to revocation remains lawful.

Analysis by Brevo

Brevo allows us to analyze the behavior of newsletter recipients. This includes evaluating how many recipients have opened the newsletter and how often each link was clicked. In this way, we can determine which content is particularly relevant to recipients and tailor future newsletters accordingly. The data is collected exclusively in pseudonymized form and is not linked to other personal data of recipients.

The analysis is carried out on the basis of Article 6(1)(f) GDPR, as we have a legitimate interest in optimizing and improving our newsletter.

Storage Period

The data you provide for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted after you unsubscribe. Data stored for other purposes remains unaffected.

Conclusion of a Data Processing Agreement

We have concluded a data processing agreement with Brevo, obligating Brevo to protect our customers’ data and not to disclose it to third parties. This agreement complies with the requirements of the GDPR and ensures that Brevo processes data only in accordance with our instructions and implements the necessary technical and organizational measures to protect personal data.

Cookies and Right to Object to Direct Advertising

“Cookies” are small files that are stored on users’ devices. Various information may be stored within cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies or “session cookies” are cookies that are deleted after a user leaves an online offering and closes their browser. Such a cookie may store, for example, the contents of a shopping cart or a login status. “Permanent” or “persistent” cookies remain stored even after the browser is closed. For example, the login status may be stored if users return after several days. Likewise, user interests may be stored in such cookies and used for reach measurement or marketing purposes. “Third-party cookies” are cookies offered by providers other than the controller operating the online offering (otherwise, if only its own cookies are involved, they are referred to as “first-party cookies”).

Deletion of Data

The data processed by us will be deleted or restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated otherwise in this Privacy Policy, stored data will be deleted as soon as it is no longer necessary for its intended purpose and no statutory retention obligations prevent deletion. If data is not deleted because it is required for other legally permissible purposes, its processing will be restricted. This means the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Business-Related Processing

In addition, we process

  • Contract data (e.g., subject matter of the contract, term, customer category).
  • Payment data (e.g., bank details, payment history)

of our customers, interested parties, and business partners for the purpose of providing contractual services, customer support, marketing, advertising, and market research.