On this page
In this privacy policy we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit our website and use its forms, for what purposes and on what legal basis we do so, how long we keep the data and what rights you have.
1. Controller and contact
The controller responsible for data processing on this website is:
Dr. M.Sc. M.Sc. Martin Jaroch
Zahnarztpraxis Dr. Martin Jaroch
Herz-Jesu-Platz 2
78224 Singen (Hohentwiel)
Germany
Phone: +49 7731 45095
Fax: +49 7731 45098
Email: info@drjaroch.de
We have not appointed a data protection officer. For any questions about data protection and to exercise your rights, please contact the controller directly using the contact details above.
2. Hosting and server log files
HOSTING
Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; the servers are located in Germany. We have concluded a data processing agreement with Hetzner under Art. 28 GDPR. The servers are managed via the Laravel Forge service, which is used solely for server administration (e.g. setting up and updating software).
SERVER LOG FILES
Each time our website is accessed, the web server automatically processes the following data transmitted by your browser:
IP address
date and time of the request
address requested (URL)
previously visited page (referrer)
browser and operating system used (user agent)
We need this data to deliver the website, to ensure its security and stability and to find errors. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. This data is not combined with other data sources. The web server log files and the application's error log are deleted after 14 days.
Your browser reports to us via a security mechanism (Content Security Policy) when it has blocked content on one of our pages that was not permitted. Such a report contains the address of the page including any parameters, the address of the blocked content and possibly a short excerpt of the blocked code, but no IP address; it is deleted after 7 days.
3. Error reports
If a technical error occurs on the website, an error report is automatically sent in live operation by email to the website's technical maintainer, an external service provider acting as our processor. The report is cleaned before it is sent: it contains no form input, no session data, no cookies and no HTTP headers; email addresses, phone numbers and text in quotation marks are made unrecognisable. It may, however, contain the path of the address requested (without parameters). Error reports are not stored on the website's server; the technical maintainer deletes them after 30 days. The legal basis is our legitimate interest in an error-free and secure website (Art. 6(1)(f) GDPR).
4. Backups
We back up the website's database daily. The backups are encrypted as password-protected archives and stored on the server and with a provider of S3-compatible object storage in a region of the European Union. Backups are kept in a staggered scheme: all backups for 7 days, then one per day for another 16 days, one per week for 8 weeks, one per month for 4 months and one per year for 2 years. Data deleted from the live database may therefore remain in an encrypted backup for up to about 31 months; after that it is deleted.
The legal basis is our legitimate interest in protection against data loss (Art. 6(1)(f) GDPR) and, for health data, Art. 9(2)(h) GDPR in conjunction with Section 22 BDSG (German Federal Data Protection Act).
5. Cookies, browser storage and consent
OUR CONSENT BANNER
We ask for your consent with our own cookie banner, not with a third-party service. Under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), storing information on your device and accessing it are only permitted with your consent, unless they are strictly necessary for the service you have requested (Section 25(2) No. 2 TDDDG).
STRICTLY NECESSARY COOKIES AND STORAGE
Without consent we only use the following:
Session cookie: links your requests to one another during your visit, e.g. while you fill in a form; stored for 120 minutes.
XSRF-TOKEN: protects forms against forged requests (CSRF protection); stored for 120 minutes.
cookie_consent: stores your choice in the cookie banner and its version in encrypted form; stored for 365 days.
hero-video-paused (your browser's local storage): remembers that you paused the video on the home page; kept until you clear your browser storage.
click-to-load:google-maps, click-to-load:youtube (your browser's session storage): remembers that you have unlocked the map or videos by clicking the placeholder; deleted when you close the tab.
The legal basis is Section 25(2) No. 2 TDDDG and, insofar as personal data is processed, our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR).
CATEGORIES THAT REQUIRE YOUR CONSENT
Statistics: Google Analytics 4 (section 7)
Marketing: Google Ads (section 8)
External media: Google Maps and YouTube (section 9)
You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page. When you withdraw consent, we delete the cookies of the withdrawn category (Google Analytics: _ga*, Google Ads: _gcl*) and reload the page if these services had already been loaded. If we change the categories, we will ask for your consent again. The lawfulness of the processing carried out until withdrawal remains unaffected.
6. Google Tag Manager and Consent Mode
We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Tag Manager is loaded from www.googletagmanager.com, and only after you have consented to the “Statistics” or “Marketing” category. It controls the loading of the services described in sections 7 and 8. When it loads, your IP address is transmitted to Google.
We use Google Consent Mode (version 2): all consent signals are initially set to “denied” and are set to “granted” only for the categories you have consented to. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
7. Google Analytics 4 (Statistics)
With your consent to the “Statistics” category, we use Google Analytics 4, a web analytics service provided by Google. Google Analytics records how visitors use our website (e.g. pages viewed, time spent, device type, approximate location, where the visit came from) so that we can improve our website. Data is transmitted to www.google-analytics.com, region1.google-analytics.com, *.analytics.google.com and stats.g.doubleclick.net.
Google Analytics sets the cookies _ga and _ga_*, which are stored for up to 2 years. According to Google, IP addresses are not logged or stored in Google Analytics 4.
The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the EU Commission has adopted an adequacy decision (Art. 45 GDPR); in addition, Google has concluded standard contractual clauses. More information: https://policies.google.com/privacy.
8. Google Ads conversion tracking and remarketing (Marketing)
With your consent to the “Marketing” category, we use Google Ads from Google. This lets us measure whether visitors carry out certain actions on our website after clicking one of our ads (conversion tracking) and show ads to people who have visited our website (remarketing). For this purpose, Google sets cookies such as _gcl_au (stored for 90 days). Data is transmitted to www.googleadservices.com, googleads.g.doubleclick.net, td.doubleclick.net and bid.g.doubleclick.net and, depending on the country you visit us from, to www.google.com, www.google.de, www.google.ch or www.google.at. The Consent Mode signals ad_storage, ad_user_data and ad_personalization are granted only with your consent to the “Marketing” category.
The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). More information: https://policies.google.com/technologies/ads.
9. External media (Google Maps, YouTube) and links
Our contact page embeds a Google Maps map (www.google.com/maps/embed), and other pages embed YouTube videos in privacy-enhanced mode (www.youtube-nocookie.com). Both are provided by Google.
The content loads only after you consent to the “External media” category in our cookie settings, or when you load individual content by clicking the placeholder (“Load map” or “Load video”). Such a click counts as consent only for the service concerned (Google Maps or YouTube) and only until you close the tab. Only then does your browser connect to Google’s servers, transferring in particular your IP address, the date and time of the request and the page visited, and Google may store or read information on your device. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework.
The purpose is to show our location and our video content. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. More information: https://policies.google.com/privacy.
Plain links, for example to route planning in Google Maps or to our profiles on Facebook, Instagram, YouTube, X and LinkedIn, do not transmit any data to these providers until you click them. After the click, the privacy terms of the respective provider apply.
10. Fonts
The fonts used on our website are stored on our own server. No connection is made to Google Fonts or any other font service.
11. Appointment request and contact form
When you send us an appointment request via the form, we process the details you enter there: whether you are already a patient of ours, the treatment you are interested in, your name, email address, phone number, date of birth, health insurance, preferred days and times, your message and the time at which you confirmed that you have read this privacy policy. Your message may contain information about your health.
The purpose is to handle your appointment request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures), for health data Art. 9(2)(h) GDPR in conjunction with Section 22(1) No. 1(b) BDSG and, insofar as you voluntarily provide such information, your consent under Art. 9(2)(a) GDPR.
Your request is sent by email to the practice mailbox, which is operated by Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as our processor; you receive a confirmation at your email address. We send the emails via the mail server of STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, also as our processor.
To protect against spam, we use an invisible form field (honeypot) and limit the number of requests per period. For this purpose, your IP address is held in the server's cache for no more than 10 minutes; it is not stored with your request. So that the form cannot be used to send large numbers of confirmation emails to other people's addresses, we also keep a pseudonymised hash of your email address in the cache for 24 hours. The legal basis is our legitimate interest in a form free from misuse (Art. 6(1)(f) GDPR).
Requests submitted through the appointment form are deleted automatically 24 months after they were sent. Copies of the emails sent are kept in the website's mail log for 90 days. For backup copies, see section 4.
12. Digital medical history form
You now fill in the medical history form online with our partner Nelly (Nelly Solutions GmbH, Chausseestraße 29, 10115 Berlin, Germany). The link on our website or in the confirmation of your appointment request takes you to Nelly's website. There you enter your personal details and information about your health; Nelly processes them on our behalf under Art. 28 GDPR and makes them available to our practice. The purpose and legal basis are the same as described below. Nelly's own privacy policy explains which data Nelly itself processes when you open its pages. The following paragraphs describe medical history forms you have sent us through our website so far; we keep them until the retention period ends.
You can use the digital medical history form to send us your details before your treatment. We process your master data (salutation, name, email address, phone number, date of birth, address, health insurance), your answers to 12 health questions, which are stored encrypted, and your handwritten signature. The signature is stored as an image file in non-public storage and can be viewed in the administration area only via signed links that expire after a limited time.
The purpose is to prepare and document your treatment. The legal basis is Art. 9(2)(h) GDPR in conjunction with Section 22 BDSG and Section 630f of the German Civil Code (BGB), as well as your explicit consent under Art. 9(2)(a) GDPR, which you give by ticking the checkbox in the form. The same spam protection as for the appointment form applies (section 11): honeypot, a limit on requests, your IP address held in the cache for no more than 10 minutes and a hash of your email address for 24 hours.
The email notifying the practice contains only your name, contact details and date of birth, and no answers to the health questions; you receive a confirmation at your email address. The data is deleted automatically after the statutory retention period of 10 years (Section 630f(3) BGB), together with the file containing your signature. For backup copies, see section 4.
13. Newsletter (Anti-Tooth-Aging Club)
When you subscribe to our newsletter, we store your email address, the time of your consent and the language you selected. We use the double opt-in procedure: you receive an email with a confirmation link that is valid for 7 days. We send you the newsletter only after you have confirmed. We delete unconfirmed addresses after 30 days.
The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with one click via the unsubscribe link in every newsletter email; your address is then deleted. We keep records of the delivery of each newsletter for 90 days. The newsletter is sent via the mail server of STRATO AG (see section 11). We do not track whether you open the newsletter or click links in it.
14. Recipients and processors
Your data is only received by those who need it for the purposes stated:
Hetzner Online GmbH (hosting, section 2)
STRATO AG (sending emails, sections 11 and 13)
Microsoft Ireland Operations Limited (the practice mailbox at Microsoft 365, section 11)
Google Ireland Limited, only with your consent (sections 6 to 9)
a provider of S3-compatible object storage in the European Union (encrypted backups, section 4)
the website's technical maintainer (error reports and maintenance, section 3)
Nelly Solutions GmbH (online medical history and patient forms, section 12)
We have concluded agreements under Art. 28 GDPR with our processors.
15. Your rights
You have the following rights with regard to the personal data concerning you:
right of access (Art. 15 GDPR)
right to rectification (Art. 16 GDPR)
right to erasure (Art. 17 GDPR)
right to restriction of processing (Art. 18 GDPR)
right to data portability (Art. 20 GDPR)
right to object to processing (Art. 21 GDPR)
You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of the processing carried out until withdrawal. You withdraw your cookie consent via the “Cookie settings” link at the bottom of every page; otherwise an informal message to us is sufficient.
Right to object under Art. 21 GDPR: Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de
16. Obligation to provide data and automated decision-making
Using our forms is voluntary. We need the details marked as required fields in order to deal with your request; without them we cannot accept your request. There is no automated decision-making, including profiling, under Art. 22 GDPR.
17. SSL/TLS encryption
For security reasons, our website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and by the lock icon in your browser. Data you send to us therefore cannot be read by third parties.
Last updated: October 2026