Privacy Protection
In the following, we will inform you about the type, scope and purpose of the processing of personal data by our company in accordance with the legal requirements of data protection law (in particular in accordance with BDSG n.F. and the European General Data Protection Regulation ‘GDPR’). This data protection declaration also applies to our websites and social media profiles. With regard to the
definition of terms such as “personal data” or “processing”, we refer to Art. 4 GDPR.
Name and contact details of the person responsible
Our responsible person (hereinafter “responsible person”) within the meaning of Art. 4 no. 7 GDPR is:
TRAUMATOLOGY ORTHOPEDICS MALLORCA, S.L.
Cami dels Reis 308, bloque A 3era planta
E-07010 Palma
Managing Director PD Dr. med. Patric Garcia
Doctor register number: 070710257
Tax number: B70639943
Email address: info@tom-mallorca.com
Types of data, purposes of processing and categories of data subjects
In the following we will inform you about the type, scope and purpose of the collection, processing and use of personal data.
- Types of data we process
Usage data (access times, websites visited, etc.), inventory data (name, address, etc.), contact details (telephone number, e-mail, fax, etc.),
- Purposes of processing according to Art. 13 Parra. 1 c) GDPR
Fulfillment of statutory retention requirements, optimization and statistical evaluation of our services,
improve user experience, design the website in a user-friendly manner, customer service and customer care, process contact requests.
- Categories of data subjects according to Art. 13 Para. 1 e) GDPR
Visitors / users of the website, customers, interested parties.
The data subjects are collectively referred to as “users”.
Legal basis for processing personal data
In the following we will inform you about the legal basis for the processing of personal data:
- If we have obtained your consent for the processing of personal data, the legal basis is Art. 6 Para. 1 S. 1 lit. a) GDPR.
- If processing is necessary to fulfill a contract or to carry out pre-contractual measures, which are carried out at your request, the legal basis is Art. 6 Para. 1 S. 1 lit. b) GDPR.
- If processing is necessary to fulfill a legal obligation to which we are subject (e.g. statutory retention requirements), the legal basis is Art. 6 Para. 1 S. 1 lit. c) GDPR.
- If processing is necessary to protect the vital interests of the data subject or another natural person, the legal basis is Art. 6 Para. 1 S. 1 lit.d) GDPR.
- If processing is necessary to safeguard our interests or the legitimate interests of a third party and if your interests or fundamental rights and freedoms do not outweigh your interests, Article 6 (1) sentence 1 lit.f) GDPR is the legal basis.
Transfer of personal data to third parties and processors
As a matter of principle, we will not pass on any data to third parties without your consent. If this is the case, then the transfer takes place on the basis of the aforementioned legal bases, e.g. when transferring data to online payment providers for the fulfillment of a contract or due to a court order or due to a legal obligation to surrender the data for the purpose of criminal prosecution, to avert danger or to enforce intellectual property rights. We also use contract processors (external service providers e.g. for web hosting our websites and databases) to process your data. If data is passed on to the processors as part of an agreement for order processing, this always takes place in accordance with Art. 28 GDPR. We carefully select our processors, check them regularly and have given us the right to issue instructions with regard to the data. In addition, the processors must have taken suitable technical and organizational measures and comply with the data protection regulations according to BDSG new version and GDPR
Data transfer to third countries
The adoption of the European General Data Protection Regulation (GDPR) created a uniform basis for data protection in Europe. Your data will therefore mainly be processed by companies for which the GDPR applies. Should the processing by third party services take place outside the European Union or the European Economic Area, then these must meet the special requirements of Art. 44 ff. GDPR. This means that processing takes place on the basis of special guarantees, such as the establishment of a
data protection level that is officially recognized by the EU Commission or compliance with officially recognized special contractual obligations, the so-called “standard contractual clauses”. In the case of US companies, submission to the so-called “Privacy Shield”, the data protection agreement between the EU and the USA, fulfills these requirements.
Deletion of data and storage duration
Unless expressly stated in this data protection declaration, your personal data will be deleted or blocked as soon as the purpose for storage no longer applies, unless further storage is necessary for evidential purposes or if there are statutory retention requirements. This includes, for example, commercial law retention obligations for business letters in accordance with Section 257 (1) HGB (6 years) and tax retention obligations in accordance with Section 147 (1) AO of documents (10 years). When the prescribed retention period expires, your data will be blocked or deleted, unless the storage is still necessary for the conclusion or fulfillment of a contract.
Existence of automated decision-making
We do not use automatic decision-making or profiling.
Provision of our website and creation of log files
- If you only use our website for information purposes (i.e. no registration and no other transmission of information), we only collect the personal data that your browser transmits to our server. If you want to view our website, we collect the following data:
- IP address;
- Internet service provider of the user;
- the date and time of the request;
- browser type;
- language and browser version;
- content of the call;
- time zone;
- Access status / HTTP status code;
- amount of data;
- Websites from which the request came;
- Operating system.
A storage of this data together with other personal data does not take place.
2. This data is used to ensure that our website is user-friendly, fully functional and secure, to provide you with its features and content, and to optimise and analyse the website statistically.
3. The legal basis for this is our legitimate interest in data processing, which is also based on the purposes set out above, in accordance with Article 6(1)(f) of the GDPR.
4. For security reasons, we store this data in server log files for a period of 90 days. Upon expiry of this period, the data is automatically deleted, unless we require it for evidential purposes in the event of attacks on the server infrastructure or other legal infringements.