Privacy policy

This policy explains which personal data we collect when you visit k2dental.hr or send us a request through the form, why we collect it, who we share it with, and what your rights are under the General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR.

Who the controller is

Dentalna poliklinika K2 (K2 Dental Polyclinic)
Poliklinika za dentalnu protetiku, parodontologiju, ortodonciju i endodonciju s restaurativnom stomatologijom K2
Petrova 84, 10000 Zagreb, Croatia
OIB (tax number): 32588197979
E-mail: hello@k2dental.hr
Phone: +385 95 231 2399

Data protection officer: Hana Stanković, hello@k2dental.hr

This policy covers the website only. How we process our patients’ data at the polyclinic (medical records, treatment, billing) is explained to you separately at your first appointment.

Appointment form

What data: your first name, last name and e-mail address (required) and, if you enter them, your phone number, the service you are interested in and your message.

Why: to answer your request and arrange an appointment.

Legal basis: taking steps at your request before entering into a contract for health care (Art. 6(1)(b) GDPR). If you mention information about your health in the message yourself, we process it only to arrange the appointment and provide health care, under the duty of professional secrecy (Art. 9(2)(h) GDPR). Please write only what is needed to arrange an appointment.

How: the form is sent directly to our server and immediately forwarded by e-mail to our business mailbox hello@k2dental.hr. The website does not store your request in any database. The request exists only in that e-mail.

How long: we keep e-mails with requests for no longer than 12 months after the last contact and then delete them. If you become our patient, the data needed for your treatment is kept in your medical records for the periods required by law.

If a request is sent on someone else’s behalf (for example, a parent for a child under 16), the person sending it is responsible for being allowed to share that data.

Protecting the form from abuse

To protect the form from automated messages (spam), we use Cloudflare Turnstile. When the form is shown, Turnstile checks whether a real browser is being used. To do so, it processes your IP address and technical data about your browser and device. We do not use this data ourselves, and under its own terms Cloudflare does not use it for advertising. The legal basis is our legitimate interest in keeping the form secure (Art. 6(1)(f) GDPR).

Visiting the website

The website is hosted on the network of Cloudflare. On every visit, your browser sends the technical data needed to show the page (IP address, time, the page address requested, browser type). Cloudflare processes it briefly to deliver the page and to protect it from attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

For visitor statistics we use Cloudflare Web Analytics, which does not use cookies and does not track you across websites. We only see aggregated data, for example how many visits a page had.

Cookies

Our website does not set any cookies itself and does not use advertising or tracking tools. That is why there is no cookie notice.

YouTube videos

Some blog posts show videos from our YouTube channel Doktorica Četkica. YouTube is a service of Google. In newer posts, the video loads from YouTube only when you click to play it. In older posts, the video loads when you open the post, in YouTube’s privacy-enhanced mode (youtube-nocookie.com). Once a video loads, Google receives your IP address and browser data and may store data in your browser, as described in Google’s privacy policy.

Links to other websites

The website contains links to Facebook, Instagram, YouTube and Google Maps. These are not loaded in advance: data is only transferred when you click a link, and the privacy policy of that website then applies.

Who we share data with

We do not sell your data or use it for marketing. We share it only with processors who provide technical services for us, under data processing agreements:

• Cloudflare, Inc. (USA): website hosting, protection from attacks, Turnstile and visitor statistics.
• Google Ireland Limited (Ireland) and Google LLC (USA): business e-mail (Google Workspace), where the form requests arrive.

Both providers may also process data in the USA. Such transfers are based on the EU-U.S. Data Privacy Framework, under which both companies are certified, and on the European Commission’s standard contractual clauses.

Your rights

You have the right at any time:

• to access the data we hold about you and to receive a copy,
• to have inaccurate data corrected,
• to have your data erased,
• to restrict processing,
• to data portability,
• to object to processing based on legitimate interest.

To exercise your rights, write to hello@k2dental.hr. We will reply within one month at the latest.

If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, azop.hr.

Security

The website is served only over an encrypted connection (HTTPS). Form requests are sent encrypted, and only polyclinic staff who need it for their work have access to the business mailbox.

Changes

We update this privacy policy when the way we process data changes. The date of the last change is shown at the top of the page.