Personal data processing policy
This policy explains how we process personal data of website visitors, consultation prospects and clinic contact persons.
1. Controller and contact
The controller is 1st mdc s.r.o., Company ID (IČO) 11724161, VAT ID (DIČ) CZ11724161, Lomená 269, 252 25 Zbuzany, Czech Republic. For questions or to exercise your rights, email 1stds.eu@gmail.com.
2. Inquiries and consultation requests
We use information submitted through the contact form and calculator to answer your inquiry, prepare a consultation and take steps before a possible contract. The checkbox confirms that you have read this policy; it is not consent to marketing.
3. Categories of data
We may process your first and last name, email, telephone number, clinic name, number of chairs, message, selected modules and interest in a pilot offer. We also technically store the page language, form source, page path and submission time. Hosting and optional analytics providers may process the IP address, device and browser information, and interactions with the page.
4. Purposes and legal bases
We process inquiries to respond and take pre-contractual steps under Article 6(1)(b) GDPR. Necessary technical records and limited retention of communications are used for website security and the protection of legal claims based on legitimate interests under Article 6(1)(f) GDPR. Google Analytics, Microsoft Clarity, Meta Pixel and Google Maps are activated only with consent under Article 6(1)(a) GDPR.
5. Retention
Inquiries that do not lead to a contract are retained for no longer than 12 months after the last communication. Data relating to a contract is retained for the duration of the contract and afterwards only for as long as necessary to protect legal claims or comply with legal obligations. Accounting data is retained for the period required by accounting rules according to the type of record; tax data is retained for the period required by tax rules according to the type of document and any related proceedings. The cookie choice is stored for 180 days. Technical and analytics retention follows the settings and terms of the relevant provider.
6. Recipients and providers
The website uses Netlify for hosting, Google Cloud/Firebase for storing inquiries and CRM authentication, and—with consent—Google Analytics and Google Maps, Microsoft Clarity and Meta Pixel. Contracted IT suppliers may access data only where necessary, and public authorities may receive data where required by law.
7. Transfers outside the EU/EEA
Some providers may process data in the United States or other countries outside the EU/EEA. Transfers rely on an adequacy decision, the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, depending on the relevant provider’s terms.
8. Your rights
You have rights of access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time without affecting the lawfulness of earlier processing; cookie consent can be changed or withdrawn in the cookie settings on this page. You also have the right to lodge a complaint with the competent data protection supervisory authority.