{"id":74,"date":"2026-09-23T13:35:32","date_gmt":"2026-09-23T13:35:32","guid":{"rendered":"https:\/\/imaginative-scarlet-iguana.109-69-119-190.cpanel.site\/?page_id=74"},"modified":"2026-09-28T18:45:06","modified_gmt":"2026-09-28T16:45:06","slug":"privacy-notice-davident","status":"publish","type":"page","link":"https:\/\/davident.hu\/en\/adatkezelesi-tajekoztato\/","title":{"rendered":"Privacy notice"},"content":{"rendered":"

Services<\/p>

Cosmetic dentistry<\/a><\/p>

Saving teeth<\/a><\/p>

Replacing missing teeth<\/a><\/p>

Children\u2019s dentistry<\/a><\/p>

Preventive care<\/a><\/p>

Dental X-rays<\/a><\/p>

Tooth extraction<\/a><\/p>

Oral surgery and implants<\/a><\/p>

Orthodontics<\/a><\/p>

Gum inflammation treatment<\/a><\/p>

Teeth whitening<\/a><\/p><\/div>

Privacy notice<\/h1>\n

\u00a0<\/p>\n\n

\u2022 \u00a0Privacy notice:<\/strong>
\r\nPrepared on the basis of the EU General Data Protection Regulation 2016\/679 (GDPR)
\r\nand its recommendations.<\/p>\n\n

Contents:
\r\nCHAPTER 1 \u2013 Introduction
\r\n1. Legal and regulatory framework
\r\n2. Purpose of this notice
\r\n3. The Data Controller
\r\n4. Data Processors (register) <\/p>\n

CHAPTER 2 \u2013 INFORMATION ABOUT SPECIFIC PROCESSING ACTIVITIES<\/p>

5. Processing of health data and medical records<\/p>

6. Processing based on the data subject\u2019s consent<\/p>

7. Processing of customer, contractual partner and contact person data<\/p>

8. Processing necessary to comply with a legal obligation<\/p>

9. Processing for tax and accounting obligations<\/p>

10. Processing by the Practice in its capacity as a payer<\/p>

11. Processing records of permanent value under the Archives Act<\/p>\n

CHAPTER 3 \u2013 PROCESSING VISITOR DATA ON THE PRACTICE WEBSITE
\u2013 INFORMATION ABOUT THE USE OF COOKIES
\r\n12. General information about cookies
\r\n13. Cookies used on the Practice website and data generated during visits<\/p>\n\n

CHAPTER 4 \u2013 INFORMATION ABOUT DATA SUBJECT RIGHTS
\r\n14. A summary of your rights
\r\n15. Your rights in detail<\/p>\n\n

*<\/p>\n

CHAPTER 1 \u2013 Introduction<\/p>

1. Legal and regulatory framework<\/p>

\u2013 REGULATION (EU) 2016\/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation, \u201cGDPR\u201d)<\/p>

\u2013 Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information<\/p>

\u2013 Act XLVII of 1997 on the Processing and Protection of Health Data and Related Personal Data<\/p>

\u2013 Act CLV of 1997 on Healthcare<\/p>

\u2013 Act XLVII of 2008 on the Prohibition of Unfair Commercial Practices against Consumers<\/p>

\u2013 Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities<\/p>

2. Purpose of this notice<\/p>

REGULATION (EU) 2016\/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (the \u201cRegulation\u201d), requires the Data Controller to take appropriate measures to provide data subjects with all information concerning the processing of their personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and to facilitate the exercise of their rights.<\/p>

The obligation to inform data subjects in advance is also laid down in Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information.<\/p>

This notice fulfils our obligations under these laws.<\/p>

3. The Data Controller<\/p>

The healthcare provider<\/p>

Name: Dr D\u00e1vid Zsila, sole trader<\/p>

Registered office: 1115 Budapest, Etele \u00fat 36\/A<\/p>

\u00c1NTSZ licence number: 8396-3\/2007<\/p>

Practice address: 1115 Budapest, Etele \u00fat 36\/A<\/p>

Person responsible for the processing of personal data<\/p>

Responsible manager: Dr D\u00e1vid Zsila<\/p>

Telephone: +36 20 472 8035<\/p>

Email: davident@davident.hu<\/p>

4. Data Processors (register)<\/p>

The Practice maintains a register containing the details of the Data Processors involved in its personal data processing activities. This register is available for inspection at the Practice.<\/p>

CHAPTER 2 \u2013 INFORMATION ABOUT SPECIFIC PROCESSING ACTIVITIES<\/p>

5. Processing of health data and medical records<\/p>

1. Data subjects may provide their treating dentist with previous and current health data and medical records, including X-rays, reports and examination results, to support the requested service.<\/p>

During examinations, the Data Controller collects, stores, records and processes health data and medical documentation using its own equipment and methods.<\/p>

2. Collecting health data and medical documentation forms part of providing the service (treatment). The treating dentist decides which health data must be collected and stored in accordance with professional requirements.<\/p>

3. Data subjects provide their health data and medical records voluntarily and consent to examinations<\/p>

of their own free will.<\/p>

4. The immediate purpose of processing is to determine which of the Data Controller\u2019s services is appropriate for the data subject, provide a quotation, answer questions and maintain contact.<\/p>

5. Health data necessary for the service may be processed by the dentist and by staff involved in the data subject\u2019s treatment, in accordance with the treating dentist\u2019s instructions and only to the extent required for their duties.<\/p>

6. Retention period: Under Section 30(1) of Act XLVII of 1997, the Data Controller must retain health data and medical records for at least 30 years, discharge summaries for at least 50 years, diagnostic images for 10 years from their creation, and reports relating to those images for 30 years from the date the images were created.<\/p>

6. Processing based on the data subject\u2019s consent<\/p>

1. Where the Practice intends to process personal data on the basis of consent, it must request the data subject\u2019s consent using the content and information specified in the data request form under its data protection policy.<\/p>

2. Consent may also be given by ticking a box while visiting the Practice website, choosing appropriate technical settings for information society services, or by any other statement or action that clearly indicates agreement to the proposed processing in the circumstances. Silence, pre-ticked boxes and inactivity therefore do not constitute consent.<\/p>

3. Consent covers all processing activities carried out for the same purpose or purposes. Where processing serves several purposes, consent must be given for all of them.<\/p>

4. Where consent is given in a written declaration that also concerns other matters, such as entering into a sales or service contract, the request for consent must be clearly distinguishable from those matters and presented in an intelligible, easily accessible form using clear and plain language. Any part of such a declaration that infringes the Regulation is not binding.<\/p>

5. The Practice must not make entering into or performing a contract conditional on consent to processing personal data that is not necessary for performance of that contract.<\/p>

6. Withdrawing consent must be as easy as giving it.<\/p>

7. Where personal data was collected with the data subject\u2019s consent, unless the law provides otherwise, the Data Controller may continue processing it to comply with a legal obligation without further consent, including after consent has been withdrawn.<\/p>

7. Processing of customer, contractual partner and contact person data<\/p>

1. On the legal basis of performance of a contract, the Practice processes the following data of natural persons contracting with it as customers or suppliers for the purposes of entering into, performing or terminating the contract and granting contractual benefits: name, birth name, date of birth, mother\u2019s name, home address, tax identification number, tax number, business or primary agricultural producer licence number, identity card number, registered office and business address, telephone number, email address, website address, bank account number, customer or order number and online identifier, including customer, supplier and loyalty lists. Processing is also lawful where necessary to take steps at the data subject\u2019s request before entering into a contract.<\/p>

Recipients of personal data: the Practice\u2019s staff responsible for customer service, accounting and taxation, and its Data Processors. Retention period: five years after termination of the contract.<\/p>

2. The legal basis for processing the contractual data of natural persons for accounting and tax purposes is compliance with a legal obligation. The retention period for these purposes is eight years.<\/p>

3. On the basis of legitimate interests, the Practice processes the contractual personal data, home address, email address, telephone number and online identifier of the individual signing a contract on behalf of a legal entity, for communication and the exercise of contractual rights and obligations. These data are retained for five years after termination of the contract. Where processing is based on legitimate interests, the data subject has a particular right to object.<\/p>

4. On the basis of legitimate interests, the Practice processes the name, address, telephone number, email address and online identifier of a non-signatory individual designated as a contractual contact person, for communication and the exercise of contractual rights and obligations. As the contact person is employed or engaged by the contracting party, this processing does not adversely affect their rights. The contracting party declares that it has informed the contact person of this processing. These data are retained for five years after the person ceases to act as a contact.<\/p>

5. For all data subjects, recipients of personal data include the head of the Practice, staff responsible for customer service, contact persons, staff responsible for accounting and taxation, and Data Processors.<\/p>

6. Personal data may be transferred to the Practice\u2019s contracted accounting firm for tax and accounting purposes, to Magyar Posta or a contracted courier for postal and delivery services, and to the Practice\u2019s security contractor for property protection.<\/p>

7. Processing is lawful where necessary in the context of a contract or the intention to enter into one (Recital 44), or to take steps at the data subject\u2019s request before entering into a contract (Article 6(1)(b)). Personal data collected through contractual offers may therefore also be processed on this basis as described here. When making or receiving an offer, the Practice must inform the offeror or recipient accordingly.<\/p>

8. Processing necessary to comply with a legal obligation<\/p>

1. Where processing is based on a legal obligation, the underlying legislation determines the categories of data, purposes, retention period and recipients.<\/p>

2. Processing necessary to comply with a legal obligation does not depend on the data subject\u2019s consent, because it is required by law. Before processing begins, the data subject must be told that it is mandatory and must receive clear, detailed information about all relevant facts, particularly the purpose and legal basis, persons authorised to process the data, retention period, the Data Controller\u2019s legal obligation and who may access the data.<\/p>

The information must also cover the data subject\u2019s rights and available remedies. For mandatory processing, this information may be provided by publishing a reference to the legislative provisions containing it.<\/p>

9. Processing for tax and accounting obligations<\/p>

1. To comply with a legal obligation, the Practice processes the statutory data of natural persons doing business with it as customers or suppliers for tax and accounting purposes. Under Sections 169 and 202 of Act CXXVII of 2017 on Value Added Tax, these include tax number, name, address and tax status. Under Section 167 of Act C of 2000 on Accounting, they include name, address, identification of the person or organisation authorising the transaction, signatures of the authorising person and the person confirming execution and, where applicable, the auditor; the recipient\u2019s signature on stock movement and cash management documents and the payer\u2019s signature on receipt counterfoils. Under Act CXVII of 1995 on Personal Income Tax, they include business licence number, primary agricultural producer licence number and tax identification number.<\/p>

2. Personal data are retained for eight years after the legal relationship forming the basis for processing ends.<\/p>

3. Recipients of personal data: the Practice\u2019s staff and Data Processors responsible for taxation, bookkeeping, payroll and social security administration.<\/p>

10. Processing by the Practice in its capacity as a payer<\/p>

1. To comply with statutory tax and contribution obligations, including the calculation of taxes, tax advances and contributions, payroll, social security and pension administration, the Practice processes the personal data prescribed by tax laws of employees, their family members, other workers and benefit recipients with whom it has a payer relationship under Section 7(31) of Act CL of 2017 on the Rules of Taxation.<\/p>

The categories of data are defined in Section 50 of that Act and include personal identification details, previous names and titles, sex, nationality, tax identification number and social security identification number (TAJ). Where tax legislation attaches legal consequences to them, the Practice may also process employee health data under Section 40 of the Personal Income Tax Act and trade union membership data under Section 47(2)(b), to fulfil tax and contribution obligations, including payroll and social security administration.<\/p>

2. Personal data are retained for eight years after the legal relationship forming the basis for processing ends.<\/p>

3. Recipients of personal data: the Practice\u2019s staff and Data Processors responsible for taxation, payroll and social security administration in its capacity as a payer.<\/p>

11. Processing records of permanent value under the Archives Act<\/p>

1. To comply with a legal obligation, the Practice processes records classified as having permanent value under Act LXVI of 1995 on Public Records, Public Archives and the Protection of Private Archival Material, so that the permanently valuable part of its records remains intact and usable for future generations. Retention period: until transfer to the public archive.<\/p>

2. Recipients of personal data: the head of the Practice, staff responsible for records management and archiving, and public archive staff.<\/p>

CHAPTER 3 \u2013 PROCESSING VISITOR DATA ON THE PRACTICE WEBSITE \u2013<\/p>

INFORMATION ABOUT THE USE OF COOKIES<\/p>

12. General information about cookies<\/p>

1. Visitors must be informed on the website about the use of cookies, and their consent<\/p>

must be requested.<\/p>

2. A cookie is data sent by a website to a visitor\u2019s<\/p>

browser as a name\u2013value pair, so that the browser stores it and the same website can later<\/p>

retrieve its contents. A cookie may have an expiry date, remain valid until the browser closes, or<\/p>

remain valid indefinitely. On subsequent HTTP(S) requests, the browser also sends this data<\/p>

to the server. In this way, data on the user\u2019s device is modified.<\/p>

3. Cookies are used because the nature of website services makes it necessary to identify<\/p>

a user, for example to recognise that they have signed in, and then handle subsequent interactions<\/p>

accordingly. The risk is that users may not always be aware of this and that cookies may<\/p>

allow the website operator or another provider to track them,<\/p>

where that provider\u2019s content is embedded in the site, such as Facebook or Google Analytics. A profile can then be created<\/p>

about the user, in which case the cookie\u2019s contents may constitute personal data.<\/p>

4. Types of cookies:<\/p>

4.1. Strictly necessary session cookies: without these, the website<\/p>

would not function properly. They identify the user and help manage, for example,<\/p>

whether the user is signed in or what they have placed in their basket. Typically, only a session ID is stored, while other<\/p>

data is held on the server for greater security. There is a security risk if a session<\/p>

cookie value is not generated properly, as this can permit session hijacking. It is therefore<\/p>

essential that these values are generated correctly. In other terminology,<\/p>

\u201csession cookie\u201d refers to any cookie deleted when the browser closes. A<\/p>

session lasts from opening the browser until closing it.<\/p>

4.2. Functionality cookies: these remember<\/p>

users\u2019 preferences, such as how they want the site displayed. These<\/p>

cookies essentially store preference settings.<\/p>

4.3. Performance cookies: although the name is not directly related to technical performance, it generally<\/p>

refers to cookies that collect information about users\u2019 behaviour on the<\/p>

website, including time spent and clicks. These are typically provided by third-party<\/p>

applications, such as Google Analytics, AdWords or Yandex.ru. They can be used<\/p>

to create profiles of visitors.<\/p>

Information about Google Analytics cookies is available here:<\/p>

https:\/\/developers.google.com\/analytics\/devguides\/collection\/analyticsjs\/cookie-usage<\/p>

Information about Google AdWords cookies is available here:<\/p>

https:\/\/support.google.com\/adwords\/answer\/2407785?hl=hu<\/p>

5. You are not obliged to accept or enable cookies. You can change your browser<\/p>

settings to reject all cookies or notify you when a<\/p>

cookie is sent. Most browsers accept cookies automatically by default, but<\/p>

these settings can generally be changed to prevent<\/p>

automatic acceptance and allow you to choose each time.<\/p>

6. Information about cookie settings in popular browsers is available at the following links:<\/p>

\u2022 Google Chrome: https:\/\/support.google.com\/accounts\/answer\/61416?hl=hu<\/p>

\u2022 Firefox: https:\/\/support.mozilla.org\/hu\/kb\/sutik-engedelyezese-es-tiltasa-amit-weboldak-haszn<\/p>

\u2022 Microsoft Internet Explorer 11: http:\/\/windows.microsoft.com\/hu-hu\/internet-explorer\/deletemanage-<\/p>

cookies#ie=ie-11<\/p>

\u2022 Microsoft Internet Explorer 10: http:\/\/windows.microsoft.com\/hu-hu\/internet-explorer\/deletemanage-<\/p>

cookies#ie=ie-10-win-7<\/p>

\u2022 Microsoft Internet Explorer 9: http:\/\/windows.microsoft.com\/hu-hu\/internet-explorer\/deletemanage-<\/p>

cookies#ie=ie-9<\/p>

\u2022 Microsoft Internet Explorer 8: http:\/\/windows.microsoft.com\/hu-hu\/internet-explorer\/deletemanage-<\/p>

cookies#ie=ie-8<\/p>

\u2022 Microsoft Edge: http:\/\/windows.microsoft.com\/hu-hu\/windows-10\/edge-privacy-faq<\/p>

\u2022 Safari: https:\/\/support.apple.com\/hu-hu\/HT201265<\/p>

Please note, however, that certain<\/p>

website features or services may not work properly without cookies.<\/p>

13. Information about cookies used on the Practice website and<\/p>

data generated during visits<\/p>

1. Data processed during visits: while the website is being used, the Practice may record and process<\/p>

the following information about the visitor and the device used for browsing:<\/p>

\u2022 the visitor\u2019s IP address,<\/p>

\u2022 browser type,<\/p>

\u2022 characteristics of the device\u2019s operating system, including its language setting,<\/p>

\u2022 time of the visit,<\/p>

\u2022 the page, subpage, feature or service visited,<\/p>

\u2022 clicks.<\/p>

We retain these data for a maximum of 90 days and may use them primarily to investigate<\/p>

security incidents.<\/p>

2. Cookies used on the website<\/p>

2.1. Strictly necessary session cookies<\/p>

Purpose of processing: to ensure the website functions properly. These cookies are necessary<\/p>

to allow visitors to browse the website and make full, uninterrupted use of<\/p>

its features and services. This includes, in particular,<\/p>

remembering actions performed on pages and identifying signed-in users during a visit. These cookies are processed only for the visitor\u2019s<\/p>

current session. When the session ends or the browser closes, this type of cookie is<\/p>

automatically deleted from the device.<\/p>

The legal basis for this processing is Section 13\/A(3) of Act CVIII of 2001 on Electronic<\/p>

Commerce Services and Certain Aspects of Information Society Services,<\/p>

under which a service provider may process personal data<\/p>

that are technically necessary to provide the service. All other<\/p>

conditions being equal, the provider must select and always operate<\/p>

the tools used to deliver information society services<\/p>

in such a way that personal data are processed only where<\/p>

strictly necessary to provide the service and fulfil the other purposes specified in that Act,<\/p>

and even then only to the necessary extent and for the necessary period.<\/p>

2.2. Functionality cookies:<\/p>

These remember users\u2019 choices, such as how they would like the<\/p>

website displayed. These cookies essentially store preference settings.<\/p>

The legal basis for processing is the visitor\u2019s consent.<\/p>

Purpose of processing: to improve service efficiency and the user experience, and to make<\/p>

the website easier to use.<\/p>

These data are primarily stored on the user\u2019s device; the website accesses them and may use them to recognise the<\/p>

visitor.<\/p>

2.3. Performance cookies:<\/p>

These collect information about users\u2019 behaviour on the website,<\/p>

including time spent and clicks. They are typically provided by third-party applications, such as Google Analytics<\/p>

or AdWords.<\/p>

Legal basis for processing: the data subject\u2019s consent.<\/p>

Purpose of processing: website analysis and sending advertising offers.<\/p>

CHAPTER 4 \u2013 INFORMATION ABOUT DATA SUBJECT RIGHTS<\/p>

The Practice is committed to enabling data subjects to exercise their rights<\/p>

in all its processing activities.<\/p>

14. A summary of your rights<\/p>

1. Transparent information and communication, and facilitating the exercise of data subject rights<\/p>

2. Right to information in advance where personal data are collected from the data subject<\/p>

3. Information to be provided where the Data Controller has not obtained personal data<\/p>

from the data subject<\/p>

4. Right of access<\/p>

5. Right to rectification<\/p>

6. Right to erasure (\u201cright to be forgotten\u201d)<\/p>

7. Right to restriction of processing<\/p>

8. Notification obligation regarding rectification or erasure of personal data or<\/p>

restriction of processing<\/p>

9. Right to data portability<\/p>

10. Right to object<\/p>

11. Automated individual decision-making, including profiling<\/p>

12. Restrictions<\/p>

13. Informing the data subject about a personal data breach<\/p>

14. Right to lodge a complaint with a supervisory authority<\/p>

15. Right to an effective judicial remedy against a supervisory authority<\/p>

16. Right to an effective judicial remedy against a Data Controller or<\/p>

Data Processor<\/p>

15. Your rights in detail<\/p>

1. Transparent information and communication, and facilitating the exercise of data subject rights<\/p>

Under the Act on the Processing and Protection of Health Data:<\/p>

Patients, or their legal representatives, are entitled to information about their personal identification<\/p>

and health data and may inspect their medical records.<\/p>

In dental care, the patient is informed of and accepts the completion of a course of treatment. The<\/p>

dentist is responsible for definitive treatment. If a course of treatment is interrupted or<\/p>

modified, the treating dentist records the fact and the reasons in the patient\u2019s documentation.<\/p>

The right to information as a patient, beyond data processing: before care begins, the patient must be informed about the provider\u2019s data protection arrangements. The<\/p>

treating dentist or their authorised representative is responsible for informing the patient<\/p>

about the Practice\u2019s data processing procedures. The patient confirms receipt by signing. The signed<\/p>

notice must be attached to the patient\u2019s medical records. Any statement by the patient<\/p>

restricting processing must also be attached, where applicable.<\/p>

Information about treatment is provided by the treating dentist or healthcare professional.<\/p>

The healthcare professional caring for the patient may also explain nursing aspects<\/p>

of treatment. Other healthcare or non-clinical staff may not provide information about the patient\u2019s treatment<\/p>

unless authorised to do so by the treating dentist for that particular patient.<\/p>

Information is provided in person.<\/p>

Under Section 11(1) of the Health Data Act, substantive information about treatment may not<\/p>

be given by telephone or fax. Unless the patient has stated otherwise, the treating dentist or healthcare professional<\/p>

may confirm that the patient is receiving treatment from the provider.<\/p>

1.1. The Data Controller must provide the data subject with all information and communications<\/p>

concerning the processing of personal data in a concise, transparent, intelligible and easily accessible<\/p>

form, using clear and plain language, particularly where information is addressed<\/p>

to a child. Information must be provided in writing or by other means, including, where<\/p>

appropriate, electronically. If requested, it may be provided orally,<\/p>

provided the data subject\u2019s identity has been established by other means.<\/p>

1.2. The Data Controller must facilitate the exercise of data subject rights.<\/p>

1.3. The Data Controller must inform the data subject of action taken in response to a request<\/p>

to exercise their rights without undue delay and in any event within one month<\/p>

of receiving the request. This period may be extended by a further two months under the conditions<\/p>

set out in the Regulation, and the data subject must be informed of the extension.<\/p>

1.4. If the Data Controller does not act on a request, it must inform the data subject without delay and<\/p>

at the latest within one month of receiving the request of the<\/p>

reasons for not taking action and the possibility of lodging a complaint with a<\/p>

supervisory authority and seeking a judicial remedy.<\/p>

1.5. The Data Controller provides information, communications and action relating to data subject rights<\/p>

free of charge, although a fee may be charged in the circumstances specified in the Regulation.<\/p>

Detailed rules are set out in Article 12 of the Regulation.<\/p>

2. Right to information in advance where personal data are collected from the data subject<\/p>

2.1. Data subjects are entitled to information about the facts and circumstances of processing<\/p>

before it begins. They must therefore<\/p>

be informed of:<\/p>

a) the identity and contact details of the Data Controller and its representative;<\/p>

b) the contact details of the data protection officer, where applicable;<\/p>

c) the purposes of the intended processing and its legal basis;<\/p>

d) the legitimate interests pursued by the Data Controller or a third party where processing<\/p>

is based on legitimate interests;<\/p>

e) the recipients to whom personal data will be disclosed, or the categories<\/p>

of recipients, where applicable;<\/p>

f) where applicable, whether the Data Controller intends to transfer personal data to a third country or<\/p>

an international organisation.<\/p>

2.2. To ensure fair and transparent processing, the Data Controller must also provide the data subject<\/p>

with the following information:<\/p>

a) the retention period for the personal data or, if this cannot be specified, the criteria<\/p>

used to determine that period;<\/p>

b) the right to request access to personal data concerning them,<\/p>

rectification, erasure or restriction of processing, to object to such processing,<\/p>

and the right to data portability;<\/p>

c) where processing is based on consent, the right to withdraw that consent<\/p>

at any time, without affecting the lawfulness of processing carried out on the basis of consent<\/p>

before its withdrawal;<\/p>

d) the right to lodge a complaint with a supervisory authority;<\/p>

e) whether providing personal data is a statutory or contractual requirement<\/p>

or a prerequisite for entering into a contract, whether the data subject is required to provide<\/p>

the data, and the possible consequences of<\/p>

not doing so;<\/p>

f) the existence of automated decision-making, including profiling, and, at least in such<\/p>

cases, meaningful information about the logic involved and the significance<\/p>

and expected consequences of that processing for the data subject.<\/p>

2.3. If the Data Controller intends to process personal data further for a purpose other than<\/p>

the one for which it was collected, it must inform the data subject of that new<\/p>

purpose and provide all relevant additional information before further processing begins.<\/p>

Detailed rules on the right to prior information are set out in Article 13 of the Regulation.<\/p>

3. Information to be provided where the Data Controller has not obtained personal<\/p>

data from the data subject<\/p>

3.1. Where personal data have not been obtained from the data subject, the Data Controller must<\/p>

provide the required information within one month of obtaining them at the latest; if the<\/p>

data are used to communicate with the data subject, at the latest at the time of the<\/p>

first communication; or, if disclosure to another recipient is envisaged, at the latest<\/p>

when the personal data are first disclosed. The information must cover the matters described<\/p>

in section 2 above, the categories of personal data concerned, and<\/p>

the source of the data, including, where applicable, whether they came from publicly accessible<\/p>

sources.<\/p>

3.2. The further rules set out in section 2 above on the right to prior information also apply.<\/p>

Detailed rules are set out in Article 14 of the Regulation.<\/p>

4. Right of access<\/p>

4.1. Data subjects have the right to obtain confirmation from the Data Controller as to whether<\/p>

their personal data are being processed and, where that is the case,<\/p>

to access those data and the related information described in sections 2 and 3 above<\/p>

(Article 15 of the Regulation).<\/p>

4.2. Where personal data are transferred to a third country or an international organisation,<\/p>

the data subject has the right to information about the appropriate safeguards<\/p>

under Article 46 of the Regulation relating to that transfer.<\/p>

4.3. The Data Controller must provide the data subject with a copy of the personal data<\/p>

being processed. For any further copies requested, it may charge<\/p>

a reasonable fee based on administrative costs.<\/p>

Detailed rules on the right of access are set out in Article 15 of the Regulation.<\/p>

5. Right to rectification<\/p>

5.1. At the data subject\u2019s request, the Data Controller must rectify inaccurate personal data<\/p>

concerning them without undue delay.<\/p>

5.2. Taking account of the purposes of processing, the data subject also has the right to have incomplete personal<\/p>

data completed, including by providing a supplementary statement.<\/p>

These rules are set out in Article 16 of the Regulation.<\/p>

6. Right to erasure (\u201cright to be forgotten\u201d)<\/p>

6.1. Data subjects have the right to request erasure of their personal data without undue delay,<\/p>

and the Data Controller must erase personal data concerning them<\/p>

without undue delay where:<\/p>

a) the data are no longer necessary for the purposes for which they were collected or otherwise<\/p>

processed;<\/p>

b) the data subject withdraws the consent on which processing is based and there is no<\/p>

other legal basis;<\/p>

c) the data subject objects to processing and there are no overriding legitimate grounds<\/p>

for continuing it;<\/p>

d) the personal data have been processed unlawfully;<\/p>

e) erasure is necessary to comply with a legal obligation under Union or Member State law<\/p>

applicable to the Data Controller;<\/p>

f) the data were collected in connection with information society services<\/p>

offered directly to a child.<\/p>

6.2. The right to erasure does not apply where processing is necessary:<\/p>

a) to exercise the right to freedom of expression and information;<\/p>

b) to comply with an obligation under Union or Member State law applicable to the Data Controller, or<\/p>

to perform a task in the public interest or in the exercise of official authority<\/p>

vested in the Data Controller;<\/p>

c) for reasons of public interest in the area of public health;<\/p>

d) for archiving in the public interest, scientific or historical research, or statistical<\/p>

purposes, where erasure would be likely to make such processing impossible or seriously<\/p>

impair its objectives; or<\/p>

e) to establish, exercise or defend legal claims.<\/p>

Detailed rules on the right to erasure are set out in Article 17 of the Regulation.<\/p>

7. Right to restriction of processing<\/p>

7.1. Where processing is restricted, personal data may, apart from storage, only be processed with<\/p>

the data subject\u2019s consent, to establish, exercise or defend legal claims,<\/p>

to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or<\/p>

a Member State.<\/p>

7.2. Data subjects may request restriction of processing where any of the following<\/p>

conditions applies:<\/p>

a) the accuracy of the personal data is contested, in which case restriction lasts for a period<\/p>

enabling the Data Controller to verify their accuracy;<\/p>

b) processing is unlawful and the data subject opposes erasure, requesting restriction<\/p>

of use instead;<\/p>

c) the Data Controller no longer needs the data for processing, but the data subject<\/p>

requires them to establish, exercise or defend legal claims; or<\/p>

d) the data subject has objected to processing, in which case restriction applies until<\/p>

it is determined whether the Data Controller\u2019s legitimate grounds override those<\/p>

of the data subject.<\/p>

7.3. The data subject must be informed before a restriction on processing is lifted.<\/p>

The relevant rules are set out in Article 18 of the Regulation.<\/p>

8. Notification obligation regarding rectification or erasure of personal data or<\/p>

restriction of processing<\/p>

The Data Controller must communicate any rectification, erasure or restriction<\/p>

of processing to every recipient to whom the personal data have been disclosed, unless this<\/p>

is impossible or involves disproportionate effort. At the data subject\u2019s request,<\/p>

the Data Controller must inform them about these recipients.<\/p>

These rules are set out in Article 19 of the Regulation.<\/p>

9. Right to data portability<\/p>

9.1. Under the conditions set out in the Regulation, data subjects have the right to receive<\/p>

the personal data they have provided to a Data Controller in a structured, commonly used and machine-<\/p>

readable format, and to transmit those data to another<\/p>

Data Controller without hindrance from the controller to which the data<\/p>

were originally provided, where:<\/p>

a) processing is based on consent or a contract; and<\/p>

b) processing is carried out by automated means.<\/p>

9.2. Data subjects may also request direct transfer of their personal data between Data Controllers.<\/p>

9.3. Exercising the right to data portability must not prejudice Article 17 of the Regulation on<\/p>

erasure (\u201cthe right to be forgotten\u201d). The right to data portability does not apply<\/p>

where processing is necessary to perform a task in the public interest or in the exercise of official<\/p>

authority vested in the Data Controller. This right must not<\/p>

adversely affect the rights and freedoms of others.<\/p>

Detailed rules are set out in Article 20 of the Regulation.<\/p>

10. Right to object<\/p>

10.1. Data subjects may object at any time, on grounds relating to their particular situation,<\/p>

to processing based on the public interest or performance of a public task under Article 6(1)(e), or legitimate interests<\/p>

under Article 6(1)(f), including profiling based on those provisions. In that<\/p>

case, the Data Controller must stop processing the personal data unless it<\/p>

demonstrates compelling legitimate grounds for processing that<\/p>

override the data subject\u2019s interests, rights and freedoms, or grounds connected with establishing,<\/p>

exercising or defending legal claims.<\/p>

10.2. Where personal data are processed for direct marketing, the data subject has the right<\/p>

to object at any time to the processing of their data for that purpose,<\/p>

including profiling related to direct marketing. Where the data subject<\/p>

objects to processing for direct marketing, the<\/p>

personal data must no longer be processed for that purpose.<\/p>

10.3. These rights must be explicitly brought to the data subject\u2019s attention at the latest<\/p>

at the first communication, and the information must be presented clearly and separately<\/p>

from any other information.<\/p>

10.4. Data subjects may also exercise their right to object by automated means using technical<\/p>

specifications.<\/p>

10.5. Where personal data are processed for scientific or historical research or statistical<\/p>

purposes, data subjects may object, on grounds relating to their particular situation,<\/p>

to the processing of their data, unless the processing is<\/p>

necessary to perform a task carried out in the public interest.<\/p>

The relevant rules are contained in the Regulation.<\/p>

11. Automated individual decision-making, including profiling<\/p>

11.1. Data subjects have the right not to be subject to a decision based solely on automated processing,<\/p>

including profiling, which produces legal effects concerning them or<\/p>

similarly significantly affects them.<\/p>

11.2. This right does not apply where the decision:<\/p>

a) is necessary to enter into or perform a contract between the data subject and the Data Controller;<\/p>

b) is authorised by Union or Member State law applicable to the Data Controller that<\/p>

also provides suitable measures to safeguard the data subject\u2019s rights, freedoms<\/p>

and legitimate interests; or<\/p>

c) is based on the data subject\u2019s explicit consent.<\/p>

11.3. In the cases described in points (a) and (c), the Data Controller must implement suitable<\/p>

measures to safeguard the data subject\u2019s rights, freedoms and legitimate interests,<\/p>

including at least the right to obtain human intervention from the Data Controller,<\/p>

express their point of view and challenge the decision.<\/p>

Further rules are set out in Article 22 of the Regulation.<\/p>

12. Restrictions<\/p>

Union or Member State law applicable to the Data Controller or Data Processor may, through legislative<\/p>

measures, restrict the scope of rights and obligations under Articles 12\u201322, 34 and 5 of the Regulation,<\/p>

provided the restriction respects the essence of fundamental rights and freedoms.<\/p>

The conditions for such restrictions are set out in Article 23 of the Regulation.<\/p>

13. Informing the data subject about a personal data breach<\/p>

13.1. Where a personal data breach is likely to result in a high risk to the rights<\/p>

and freedoms of natural persons, the Data Controller must inform<\/p>

the data subject without undue delay. The notification must describe, in clear and plain language,<\/p>

the nature of the breach and include at least:<\/p>

a) the name and contact details of the data protection officer or another contact point<\/p>

where further information can be obtained;<\/p>

c) a description of the likely consequences of the breach;<\/p>

d) a description of measures taken or proposed by the Data Controller to address the breach,<\/p>

including, where appropriate, measures to reduce its possible adverse<\/p>

effects.<\/p>

13.2. The data subject need not be informed where any of the following conditions applies:<\/p>

a) the Data Controller has implemented appropriate technical and organisational safeguards and<\/p>

applied them to the affected personal data, particularly<\/p>

measures such as encryption that make the data unintelligible<\/p>

to persons not authorised to access them;<\/p>

b) the Data Controller has taken subsequent measures ensuring that the high risk<\/p>

to the data subject\u2019s rights and freedoms is no longer<\/p>

likely to materialise;<\/p>

c) notification would involve disproportionate effort. In such cases, data subjects must<\/p>

be informed by a public announcement or an equivalent measure<\/p>

that informs them just as effectively.<\/p>

Further rules are set out in Article 34 of the Regulation.<\/p>

14. Right to lodge a complaint with a supervisory authority<\/p>

Data subjects may lodge a complaint with a supervisory authority, particularly in the Member State of their habitual<\/p>

residence, place of work or the alleged infringement, if they<\/p>

consider that the processing of their personal data infringes the Regulation. The<\/p>

supervisory authority receiving the complaint must inform the complainant of the<\/p>

progress and outcome of the complaint, including their right<\/p>

to seek a judicial remedy.<\/p>

These rules are set out in Article 77 of the Regulation.<\/p>

You may seek a remedy by submitting a report or complaint to the supervisory authority:<\/p>

Hungarian National Authority for Data Protection and Freedom of Information<\/p>

Address: 1125 Budapest, Szil\u00e1gyi Erzs\u00e9bet fasor 22\/c<\/p>

Telephone: +36 (1) 391-1400<\/p>

Fax: +36 (1) 391-1410<\/p>

Website: http:\/\/www.naih.hu<\/p>

e-mail: ugyfelszolgalat@naih.hu<\/p>

15. Right to an effective judicial remedy against a supervisory authority<\/p>

15.1. Without prejudice to other administrative or non-judicial remedies, every<\/p>

natural or legal person has the right to an effective judicial remedy against a legally binding decision<\/p>

of a supervisory authority concerning them.<\/p>

15.2. Without prejudice to other administrative or non-judicial remedies, every<\/p>

data subject has the right to an effective judicial remedy where the competent supervisory authority does not<\/p>

handle a complaint or does not inform them within three months of the<\/p>

progress or outcome of the complaint they have lodged.<\/p>

15.3. Proceedings against a supervisory authority must be brought before the courts of the Member State<\/p>

in which that authority is established.<\/p>

15.4. Where proceedings concern a supervisory authority\u2019s decision on which the<\/p>

Board has previously issued an opinion or decision under the consistency mechanism,<\/p>

the supervisory authority must forward that opinion or decision to the court.<\/p>

These rules are set out in Article 78 of the Regulation.<\/p>

16. Right to an effective judicial remedy against a Data Controller or<\/p>

Data Processor<\/p>

16.1. Without prejudice to available administrative or non-judicial remedies, including the<\/p>

right to lodge a complaint with a supervisory authority, every data subject has the right to an effective<\/p>

judicial remedy if they consider that their rights under the Regulation have been infringed<\/p>

through processing of their personal data that does not comply with it.<\/p>

16.2. Proceedings against a Data Controller or Data Processor must be brought before the courts<\/p>

of the Member State in which that controller or processor has an establishment. Such proceedings<\/p>

may also be brought before the courts of the Member State where the data subject habitually resides, unless the<\/p>

Data Controller or Data Processor is a public authority of a Member State acting<\/p>

in the exercise of public powers.<\/p>

These rules are set out in Article 79 of the Regulation.<\/p>

24 May 2018<\/p>

Dr D\u00e1vid Zsila<\/p>

Practice director, specialist dentist<\/p><\/div><\/div>\n\n

\n

DaviDent dental practice \u2022 Address:36\/A Etele \u00fat, ground floor, door 5, Budapest, District XI<\/a> \u2022 Telephone: (+36)-20\/472-8035<\/a> \u2022 Email: davident@davident.hu<\/a><\/p>\n\n<\/div>","protected":false},"excerpt":{"rendered":"

Szolg\u00e1ltat\u00e1sok Eszt\u00e9tikai fog\u00e1szat Fogak megment\u00e9se Fogak p\u00f3tl\u00e1sa Gyermekfog\u00e1szat Prevenci\u00f3s kezel\u00e9sek Fog\u00e1szati r\u00f6ntgen Fogh\u00faz\u00e1s Sz\u00e1jseb\u00e9szet, implant\u00e1ci\u00f3 Fogszab\u00e1lyoz\u00e1s \u00cdnygyullad\u00e1s kezel\u00e9se Fogfeh\u00e9r\u00edt\u00e9s Adatkezel\u00e9si T\u00e1j\u00e9koztat\u00f3 \u00a0 \u2022 \u00a0Adatkezel\u00e9si T\u00e1j\u00e9koztat\u00f3: K\u00e9sz\u00fclt az EU 2016\/679 sz. \u00c1ltal\u00e1nos Adatv\u00e9delmi Rendelet (GDPR) aj\u00e1nl\u00e1sai alapj\u00e1n. Tartalomjegyz\u00e9k: 1. FEJEZET – Bevezet\u0151 1. T\u00f6rv\u00e9nyi, szab\u00e1lyoz\u00e1si h\u00e1tt\u00e9r 2. A T\u00e1j\u00e9koztat\u00f3 c\u00e9lja 3. Az Adatkezel\u0151 bemutat\u00e1sa 4. Az […]<\/p>\n","protected":false},"author":0,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-74","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/davident.hu\/en\/wp-json\/wp\/v2\/pages\/74","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/davident.hu\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/davident.hu\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/davident.hu\/en\/wp-json\/wp\/v2\/comments?post=74"}],"version-history":[{"count":6,"href":"https:\/\/davident.hu\/en\/wp-json\/wp\/v2\/pages\/74\/revisions"}],"predecessor-version":[{"id":406,"href":"https:\/\/davident.hu\/en\/wp-json\/wp\/v2\/pages\/74\/revisions\/406"}],"wp:attachment":[{"href":"https:\/\/davident.hu\/en\/wp-json\/wp\/v2\/media?parent=74"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}