Privacy Policy (English)
Privacy Policy
1. Controller
Munich Dental Academy GmbH
Ferdinand-Maria-Str. 19
80639 Munich
Germany
Phone: +49 89 41629849
Email: info@hajto.de
Commercial Register: HRB 308785, Local Court Munich
Managing Director: Dr. Jan Hajtó
2. General Information on Data Processing
We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR) and applicable national data protection laws.
The processing is carried out for the purpose of providing our website, fulfilling contractual obligations in connection with our training programs and communicating with participants and interested parties.
3. Hosting – DigitalOcean
Our website is hosted by:
DigitalOcean, LLC, USA
Server location: Frankfurt, Germany
Processed data:
IP address
date and time of access
browser type
operating system
referrer URL
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
A data processing agreement pursuant to Art. 28 GDPR has been concluded.
4. Content Delivery Network – Cloudflare
We use Cloudflare for security and performance optimization.
Provider: Cloudflare Inc., USA
Processed data:
IP address
technical connection data
Legal basis: Art. 6(1)(f) GDPR.
Data transfers to the USA are based on appropriate safeguards pursuant to Art. 46 GDPR.
5. Payments – Stripe
Payment processing is carried out via:
Stripe Payments Europe Ltd., Ireland
Processed data:
name
billing address
email address
payment data
IP address
transaction data
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Stripe acts as an independent controller.
6. Transactional Emails – Resend
We use Resend to send transactional emails such as booking confirmations and access data.
Processed data:
name
email address
booking information
Legal basis: Art. 6(1)(b) GDPR.
7. Newsletter
If you subscribe to our newsletter, we process:
email address
name (optional)
The newsletter is sent only based on your explicit consent (Art. 6(1)(a) GDPR).
Registration takes place via double opt-in.
You may withdraw your consent at any time.
8. User Account / Login Area
To access online courses, a password-protected user account is required.
Processed data:
name
email address
billing data
booked courses
learning progress
login timestamps
IP address during access
We log registrations and logins (including failed login attempts) with time, IP address, approximate country and browser identifier to protect your account against misuse and to be able to trace irregularities. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest in the security of our systems). These logs are deleted automatically after 12 months.
Legal basis: Art. 6(1)(b) GDPR.
9. Analytics – Ahrefs
We use Ahrefs Analytics for statistical evaluation.
No marketing cookies are used.
Processed data (anonymised):
page views
referrer
device type
approximate location
Legal basis: Art. 6(1)(f) GDPR.
10. Google Search Console
We use Google Search Console for technical optimisation.
Only aggregated data is processed.
11. Contact
If you contact us, your data will be processed to handle your request.
Legal basis:
Art. 6(1)(b) GDPR
Art. 6(1)(f) GDPR
12. Live chat – Crisp
We offer a live chat on our website. The provider is Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France.
The chat is only loaded when you click the chat icon; no connection to Crisp is made before that. From then on, Crisp stores cookies or entries in your browser's local storage so that your chat can be matched and continued on a later visit.
Data processed:
Your chat messages and any data you provide (e.g. name, email address)
IP address, browser and device information, the page visited
for logged-in customers: name and email address from the customer account, so we can match your request
Purpose: answering your enquiries via chat.
Legal basis:
Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract)
Art. 6(1)(f) GDPR (legitimate interest in quick communication with prospects and customers)
§ 25(2) no. 2 TDDDG for the cookies required to operate the chat
Storage period: we delete chat histories once they are no longer needed to handle your request and no statutory retention obligations apply.
More information: Crisp privacy policy.
13. Phone assistant (AI) – Dial Milo
Calls to our number +49 89 41629849 are answered by an AI phone assistant ("Milo"). It answers questions about our courses and takes waiting-list sign-ups, callback requests and requests about existing bookings. At the start of the call the assistant states that it is an AI assistant and that the call is transcribed. Calls are not audio-recorded.
Provider: Dial Milo, Inhype Live Limited, Kemp House, 152–160 City Road, London EC1V 2NX, United Kingdom, as processor.
Data processed:
Your phone number (if transmitted), date, time and duration of the call
The content of the conversation as a text transcript and summary
Information you give during the call (e.g. name, email address, course of interest, booking reference)
Purpose: answering your request, handling waiting-list, callback and change requests, and traceability for our team.
Legal basis:
Art. 6(1)(b) GDPR (contract or pre-contractual measures)
Art. 6(1)(f) GDPR (legitimate interest in being reachable quickly by phone)
Sub-processors: Telnyx LLC (telephony), Google LLC (Gemini, real-time speech processing), OpenAI, L.L.C. (call summary), Cloudflare, Inc. (network) and DigitalOcean, LLC (hosting in New York, USA). Data is transferred to the United Kingdom and the USA. For the United Kingdom there is an adequacy decision of the EU Commission; transfers to the USA are based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
Storage period: in our system, transcripts are deleted after 90 days. At Dial Milo, call data is stored until we delete it and is deleted no later than 30 days after the end of our cooperation. Records created by the call (e.g. a waiting-list entry or callback request) are kept as long as needed to handle them.
If you prefer not to speak with the AI assistant, you can reach us at any time by email at info@hajto.de.
14. Storage Period
Data is stored only as long as necessary or as required by statutory retention obligations (generally 6–10 years).
15. Your Rights
You have the right to:
access
rectification
erasure
restriction of processing
data portability
objection
You also have the right to lodge a complaint with a supervisory authority.
16. SSL / TLS Encryption
Our website uses SSL/TLS encryption.
17. Photo and video recordings at events
Photo and video recordings may be made during our events.
The recordings may be accessible worldwide on the Internet.
Processing is carried out exclusively on the basis of your express consent in accordance with Art. 6 (1) (a) GDPR.
The recordings will be used for reporting purposes and for marketing measures (website, social media, print).
Consent is voluntary and can be revoked at any time with effect for the future.