Privacy Policy

This is an English-language translation of the Hungarian Adatkezelési tájékoztató, adapted from Ezüstfény Fogászat Kft.'s (Cg.: 01-09-377306) original Privacy Policy dated 1 November 2021, published on ezustfenyklinika.hu. Sections 1–8 follow the content of the original document, with unchanged legal substance (one contact detail replaced in section 2). Section 9 is a newly added supplement specific to how this website operates. Adaptation date: 2026-08-10, updated 2026-08-11 (cookie consent mechanism and Google Analytics 4 description; international data transfer and GA4 cookies substantiated with sources, consent-expiry mechanism added) and 2026-09-03 (section 9.3 updated with the description of the newly added "Request a callback" form; section 9.3 previously stated that no such form existed).

Ezüstfény Fogászat Kft. (registered seat: 1106 Budapest, Rákosvölgyi utca 1., Hungary; Cg.: 01-09-377306) (hereinafter: Ezüstfény Fogászat or the Data Controller) has drawn up this Privacy Policy ("Policy") in order to fully comply with statutory requirements. The Data Controller processes personal data and information provided by data subjects in full compliance with applicable data protection legislation [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR); Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Info tv.); Act CLIV of 1997 on Healthcare (Eütv.); Act XLVII of 1997 on the Processing and Protection of Health Care and Related Personal Data (Eüak.)].

1. Definitions

Data subject: any natural person who is identified or identifiable, directly or indirectly, based on any information.

Data processing: under applicable law, any operation or set of operations performed on data, regardless of the method used, in particular its collection, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, restriction, erasure and destruction, as well as preventing the further use of the data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris scans).

A Data Controller is any natural or legal person, or organisation without legal personality, who or which, alone or jointly with others, determines the purpose of the processing of data, makes and implements decisions on data processing (including the means used), or has such decisions implemented by a data processor.

Data Processor: a natural or legal person, or an organisation without legal personality, who or which processes personal data under a contract – including a contract concluded pursuant to a legal provision. A Data Processor may not make substantive decisions concerning the processing, may only process personal data that comes to its knowledge in accordance with the Data Controller's instructions, may not carry out processing for its own purposes, and must store and retain personal data in accordance with the Data Controller's instructions.

Personal data: any information relating to an identified or identifiable data subject – in particular the data subject's name and identification number, and one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity – as well as any inference drawn from such data relating to the data subject.

Special category data: all data belonging to the special categories of personal data, i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, health data, and personal data concerning a natural person's sex life or sexual orientation.

Health data: data relating to the data subject's physical, mental, and psychological state, addictions, and the circumstances of illness or death and its cause, whether communicated by the data subject or another person about them, or observed, examined, measured, imaged, or derived by the healthcare provider network; and any other data that can be linked to, or that influences, the foregoing (e.g. behaviour, environment, occupation).

2. The Data Controller, data processors, and the purpose, legal basis, duration, and scope of processing

The controller of personal data is Ezüstfény Fogászat Korlátolt Felelősségű Társaság (registered seat: 1106 Budapest, Rákosvölgyi utca 1., Hungary; Cg.: 01-09-377306; represented by: Miklós Márton András, managing director; e-mail: eszrevetel@ezustfenyklinika.hu).

Ezüstfény Fogászat uses data processors (for operating dental software: Flexi Medical Hungary Zrt., registered seat: 1027 Budapest, Tölgyfa utca 28., Hungary; Cg.: 01-10-140667).

In order to protect the legitimate interests of the data subject(s) and/or its own, the Data Controller is entitled to engage legal services (primarily lawyers and law firms), in the course of which personal data connected with asserting such interests may be transferred to the legal service provider as a data processor, subject to that lawyer's duty of confidentiality under Act LXXVIII of 2017 on the Activities of Attorneys.

Processing takes place in order for the data subject to make use of the healthcare service(s) provided by Ezüstfény Fogászat. To use the service, the following data must be provided: name (birth name), permanent address (correspondence address), place and date of birth, mother's birth name, and TAJ number (Hungarian social security identification number). A valid e-mail address and phone number are also required for appointment scheduling and for notification of completed results.

Ezüstfény Fogászat processes only such personal data as is indispensable for achieving the purpose of processing (using the service) and is suitable for achieving that purpose. Personal data is processed only to the extent and for as long as necessary to achieve the purpose. Personal data provided by the data subject is processed until the data processing purpose is achieved or becomes impossible, or – except in the case of mandatory data processing – until the date of deletion initiated by the data subject.

In accordance with statutory requirements, Ezüstfény Fogászat does not transfer or disclose to anyone the personal data (including special category and health data) provided by the data subject (user) without their express written consent, absent explicit statutory authorisation.

The legal basis for processing is the data subject's voluntary consent, pursuant to points a) and b) of Section 5(1) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.), and Section 12(1)–(2) of Act XLVII of 1997 on the Processing and Protection of Health Care and Related Personal Data (Eüak.).

The Data Controller draws attention to the fact that, when visiting its websites, the web server automatically records certain data about the visit (such as the IP address, the page from which our site was visited, the browser type, the pages viewed, and the time and duration of the visit).For the actual server-access logging by this website's hosting provider, see section 9.4.

3. Participation in the Electronic Health Service Space (EESZT)

The Electronic Health Service Space (EESZT) is a communication platform connecting institutions and providers in the healthcare sector — an e-health service system whose functions make patient care safer, more efficient, and more convenient. It is a modern, unified IT environment, a cloud-based communication space that connects healthcare providers to one another (including hospital, outpatient, and general-practitioner care, as well as pharmacies) with the highest currently available level of data and cyber protection. Through the EESZT, treating physicians can query data relating to a patient's healthcare (medical history) and patient documents created during their care (discharge summaries, outpatient records, lab results, imaging diagnostic findings, e-prescriptions, e-referrals). Ezüstfény Fogászat participates in the EESZT in order to comply with the requirements set out in law.

4. Data security

Ezüstfény Fogászat does everything in its power to secure the data (in particular protecting data against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction and damage, and against becoming inaccessible due to a change in the technology applied) and implements all technical and organisational measures necessary to give effect to the law and to other data and secrecy protection rules.

5. Use of cookies

Ezüstfény Fogászat reserves the right to use so-called tracking technologies (such as cookies or tags) in order to assess how visitors use the website. These technologies help develop and operate the website's usability (for example, by determining the past relationship between a visitor's computer and our pages, and our website's most popular pages).

Where Ezüstfény Fogászat uses cookies, it provides notice – extending to the purpose of processing – and requests consent from website visitors in a manner that has regard to Section 155(4) of Act C of 2003 on Electronic Communications, as well as domestic data-processing practice.

See sections 9.1–9.2 for what browser-stored data and tracking technologies this website actually uses, and under what conditions.

6. The rights of the data subject

The data subject is entitled at any time to request information about the processing of their personal data, and is entitled to request the rectification or completion of their personal data, or (except in the case of mandatory processing) its restriction or erasure.

6.1. Right of access

The data subject is entitled to obtain confirmation from the Data Controller as to whether their personal data is being processed and, if so, is entitled to access in particular:

• the purposes of the processing;
• the categories of personal data processed;
• the recipients or categories of recipients to whom the Data Controller has disclosed or will disclose the personal data (including, where relevant, safeguards for data transfers);
• the envisaged period for which the personal data will be stored, or the criteria used to determine that period;
• their right to request rectification, erasure, or restriction of processing of personal data concerning them, and to object to such processing;
• their right to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH);
• where the data was not collected from the data subject, its source.

Upon request, the Data Controller provides the data subject with a copy of the personal data undergoing processing, or of the document containing it, provided this does not adversely affect the rights and freedoms of others. The first copy is provided free of charge; for any further copies, the Data Controller may charge a reasonable fee based on administrative costs, or may refuse to issue the copy.

6.2. Right to rectification

The data subject is entitled to have the Data Controller rectify inaccurate personal data concerning them upon request, and is also entitled, having regard to the purpose of processing, to request the completion of incomplete personal data.

The Data Controller informs every recipient to whom or with whom the personal data has been disclosed of any rectification, unless this proves impossible or involves disproportionate effort. The Data Controller informs the data subject about these recipients upon request.

6.3. Right to erasure

By way of a written request submitted to the Data Controller, the data subject is entitled to request the erasure of their personal data; the Data Controller complies with such a request unless the data to be erased is necessary for:

• exercising the right to freedom of expression and information;
• compliance with a legal obligation to which the Data Controller is subject;
• reasons of public interest in the area of public health;
• archiving purposes in the public interest, scientific research, or statistical purposes; or
• the establishment, exercise, or defence of legal claims.

The Data Controller informs every recipient to whom or with whom the personal data has been disclosed of any erasure, unless this proves impossible or involves disproportionate effort. The Data Controller informs the data subject about these recipients upon request.

6.4. Right to restriction of processing

The data subject is entitled to have the Data Controller restrict processing of their personal data upon request where:

• the data subject contests the accuracy of the personal data (for the period enabling verification of accuracy);
• the processing is unlawful, but the data subject opposes erasure and requests the restriction of use instead;
• the Data Controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise, or defence of legal claims;
• the processing is based on the legitimate interest of the Data Controller or a third party, and the data subject has objected to the processing.

Except for storage, personal data subject to restriction is processed by the Data Controller only with the data subject's consent, or for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

The Data Controller informs the data subject at whose request processing was restricted before the restriction is lifted.

The Data Controller informs every recipient to whom or with whom the personal data has been disclosed of any restriction of processing, unless this proves impossible or involves disproportionate effort. The Data Controller informs the data subject about these recipients upon request.

6.5. Right to object

The data subject is entitled to object, on grounds relating to their particular situation, to the processing of their personal data. The Data Controller may nevertheless continue processing the data despite the objection where the processing is justified by compelling legitimate grounds which override the interests, rights, and freedoms of the data subject, or which relate to the establishment, exercise, or defence of legal claims.

Where personal data is processed for scientific research or statistical purposes, the data subject is entitled to object, on grounds relating to their particular situation, to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

7. Exercising the data subject's rights

The Data Controller must provide information in an intelligible form within the shortest possible time after the request is submitted, but no later than 25 days. As part of this, the Data Controller informs the data subject of the measures taken, or the reasons for not taking any – in the latter case also informing the data subject of their right to a legal remedy. Where justified by the complexity or number of requests received, the Data Controller may extend this deadline by up to a further 60 days. The Data Controller informs the data subject of any such extension, and the reasons for it, within 30 days of receiving the request.

Information is provided free of charge. The Data Controller provides information in the same manner as the request was made (primarily by post or electronically), unless the requester asks for a different method and the Data Controller is able to comply.

To protect the rights of the data subject and to meet data security requirements, the Data Controller always verifies the identity of the data subject and the person exercising the right on their behalf, and may request further information for this purpose where necessary.

Where a submitted request is manifestly unfounded or excessive, the Data Controller may, in accordance with statutory provisions, charge a fee based on administrative costs, or may refuse to act on the request.

8. Right to a legal remedy

Anyone whose rights have been infringed by the Data Controller's processing may:

• submit a complaint to Ezüstfény Fogászat at the contact details above;
• turn to the courts to protect their data, which will proceed on an expedited basis. The claim may be filed with the Metropolitan Court of Budapest, which has jurisdiction over the Data Controller's registered seat (1055 Budapest, Markó utca 27; phone: +36-1/354-6000; website: https://fovarositorvenyszek.birosag.hu/), or with the court having jurisdiction over the data subject's place of residence or habitual stay;
• seek the assistance of the National Authority for Data Protection and Freedom of Information (NAIH) on any matter relating to personal data (1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 (1) 391-1400; fax: +36 (1) 391-1410; e-mail: ugyfelszolgalat@naih.hu).

Ezüstfény Fogászat reserves the right to amend this Policy; it will provide notice of any such amendment by publishing the amended Policy on its website.

Original dated: Budapest, 1 November 2021 — Ezüstfény Fogászat Kft., Miklós Márton András, managing director.

9. Supplements specific to this website

Sections 9.1–9.5 below did not appear in the inherited Policy above — they are a newly added supplement specific to the operation of this particular website.

9.1. Cookies and browser-stored data on this website

The website uses the following browser-stored data:

Fonts are loaded from the website's own server, not from an external provider (e.g. Google Fonts) — this does not involve the use of cookies or other browser storage.

There are no advertising or remarketing cookies/technologies on the website, and none are planned — the consent banner therefore distinguishes only the two categories above (strictly necessary / analytics), and does not offer a third (advertising) category, since it would be misleading to ask about something that doesn't exist on the website.

9.2. Google Analytics 4 — consent-based, still inactive as of this document

The website is technically prepared to use Google Analytics 4 ("GA4," a service of Google LLC / Google Ireland Limited), under the following conditions:

• Without prior, explicit consent, the GA4 code does not load at all — it neither sets a cookie nor sends a network request to the googletagmanager.com/google-analytics.com domains, until the visitor explicitly accepts analytics cookies in the consent banner. This is a stricter implementation than Google's own "Advanced Consent Mode" recommendation (which already sends anonymous, cookieless signals before consent) — here, the GA4 script itself does not load before consent either.
• Google Consent Mode v2: on every page load, even before the consent banner appears, the browser sets (with no network request) analytics_storage, ad_storage, ad_user_data, and ad_personalization to denied by default. This only changes to analytics_storage: granted upon acceptance; advertising-related storage (ad_storage and related signals) is never enabled under any circumstances, as the website does not use any advertising/remarketing functionality.
• The precondition for activation is currently NOT met: actually loading GA4 requires, in addition to consent, that (a) the clinic has an actual GA4 measurement ID, and (b) the website has been publicly launched with the clinic's written approval (SITE_IS_LIVE = true). Condition (b) is met — the website is public — but condition (a) is not: the clinic does not currently have a GA4 measurement ID. Analytics is therefore prepared but not active — the website sends no data to Google under any circumstances, regardless of whether someone accepts the banner.
• International data transfer: Google Analytics 4 is a service of Google LLC, headquartered in the United States; processing involves a transfer of data outside the European Economic Area. As of the review of this document, Google LLC is an active, certified participant in the EU–U.S. Data Privacy Framework (DPF), and its UK Extension and Swiss-U.S. DPF extension (source: Google's own statement, policies.google.com/privacy/frameworks: "Google LLC ... has certified that it adheres to the DPF Principles," and that this extends to "the EU-U.S. and Swiss-U.S. Data Privacy Frameworks (DPF) and the UK Extension to the EU-U.S. DPF"). The European Commission's Implementing Decision (EU) 2023/1795 of 10 July 2023 (published: OJ L 231, 20.9.2023) established that the U.S. ensures an adequate level of protection for personal data transferred to organisations certified under the DPF — including Google LLC (source: eur-lex.europa.eu, the text of the decision). On this basis, transfers from the EEA to Google LLC, as a certified DPF participant, rest on an adequacy decision under Article 45 GDPR, and do not require separate standard contractual clauses (SCCs). The validity of the DPF adequacy decision is currently the subject of ongoing legal proceedings: the General Court of the European Union dismissed French MEP Philippe Latombe's action for annulment on 3 September 2025; Latombe filed an appeal on 31 October 2025, which the Court of Justice of the European Union accepted on 7 November 2025 (Case C-703/25 P, Latombe v Commission); the hearing date was not yet known as of the review of this document. The above therefore reflects the current legal situation, not intended as a final position — periodic review is required, particularly in light of the outcome of Case C-703/25 P.
• Legal basis: the data subject's voluntary, prior, explicit consent (Article 6(1)(a) GDPR, and Section 155(4) of Act C of 2003 on Electronic Communications). Refusing consent does not restrict any function of the website.
• Withdrawing consent: at any time, just as easily as it was given — clicking the "Cookie settings" link in the website's footer reopens the consent banner, and the prior decision can be changed at any time. Independently of this, the system also automatically asks the visitor again after 365 days (see the ezf_cookie_consent row of the table above, and the note there regarding the legal status of the 365-day interval).
• The structure of the stored consent record (in the browser, in localStorage, under the key ezf_cookie_consent): { "analytics": true/false, "timestamp": "<ISO 8601 timestamp>", "version": <the Policy's consent version number> }. The version number allows a future amendment to the Policy that materially affects processing to automatically invalidate prior consent and prompt the system to ask the visitor again — a decision made under older terms is never silently carried forward.

9.3. Callback request form

The website's /kapcsolat and /en/contact pages offer a "Request a callback" form, through which a visitor can ask for a member of clinic staff to call them back. The phone line remains the primary conversion path (see above) — this form is a secondary, explicit-consent-based option for those who would rather not call immediately.

• Data processed: name and phone number (required fields — the minimum needed to make the callback), plus optionally an e-mail address, preferred callback time (free text), and a message. Processing is limited to the necessary minimum (data minimisation principle) — the website does not request more data than is needed to carry out the callback.
• Purpose of processing: solely to fulfil the callback requested by the visitor.
• Legal basis: the data subject's voluntary, prior, explicit consent (Article 6(1)(a) GDPR) — the form has a checkbox, unticked by default, that explicitly requests consent for this purpose, and the form cannot be submitted without giving consent.
• Recipient: the form's data reaches Ezüstfény Fogászat's info@ezustfenyklinika.hu address in the form of a single e-mail message. The e-mail is sent by a Cloudflare Worker (a serverless function) and the e-mail-sending service Resend — both act as data processors, under the instructions of the Data Controller (Ezüstfény Fogászat), and do not use the data for their own purposes. The exact terms of Cloudflare, Inc.'s and Resend's data processing agreements (DPAs), and the legal basis for any transfer to a third country (the USA) (e.g. a DPF certification, if any), were not available at the time this document was compiled.
• Storage / retention period: The website itself (the Cloudflare Worker) does not log, save to any database, or otherwise store the data submitted through the form anywhere beyond the e-mail sent — the only place the data exists is the sent e-mail, in the info@ezustfenyklinika.hu mailbox (and in Resend's own e-mail-sending log, see above). The retention period in the info@ezustfenyklinika.hu mailbox is governed by the clinic's general e-mail retention practice, which has not been documented as of this document; the retention period of Resend's own log is likewise not documented here.
• Withdrawing consent / erasure request: since the data is not stored in a database or other storage system, "withdrawal" effectively means requesting the deletion of the sent e-mail — this can be initiated under the inherited section 6.3 above (Right to erasure), at the contact details given in this Policy.

9.4. Hosting and data transfer (Firebase Hosting)

The website is operated by Google Ireland Limited's (registered seat: Gordon House, Barrow Street, Dublin 4, Ireland) Firebase Hosting service, as the hosting provider/data processor for the website's static content. The hosting provider may record technical data (e.g. IP address, request timestamp, browser type) during server-access logging, for the purposes of operating, securing, and troubleshooting the website. Since the hosting provider is headquartered within the European Union (Ireland), this hosting service does not in itself constitute a transfer of data to a third country under the GDPR. The exact terms of Google Ireland Limited's data processing agreement (DPA) for the Firebase Hosting service, and the retention period of the logged data, were not available at the time this document was compiled.

9.5. Website indexing status

The website is public and can be indexed by search engines (pages do not carry a noindex tag, except for pages intended purely for internal use).