Privacy Policy

This is a courtesy translation. The legally binding version is the German original.

Draft – must be reviewed by the practice or a lawyer before publication. This website sets no cookies of its own. Two external services (Cloudflare Turnstile, OpenStreetMap) are loaded only after you consent; consent is obtained through the “Privacy settings” notice and can be withdrawn there at any time.

Protecting your personal data is important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, BDSG, TDDDG). In this privacy policy we inform you about the most important aspects of data processing on our website.

1. Controller

The controller responsible for data processing on this website is:

Mohammad Said Hawali Praxis für Oralchirurgie & Implantologie am Rosenthaler Platz Brunnenstraße 181, 10119 Berlin Phone: +49 30 2832758 Email: info@oralchirurgie-rosenthaler.com

2. General information on data processing

We process personal data only to the extent necessary to provide a functioning website and our content and services. Depending on the purpose, the legal basis is your consent (Art. 6(1)(a) GDPR), the performance or initiation of a contract (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c) GDPR) or our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR). Personal data is deleted as soon as the purpose for storage no longer applies and no statutory retention obligations prevent deletion.

3. Hosting and server log files

This website is hosted by Cloudflare (Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, or Cloudflare, Inc., USA). Each time the site is accessed, technically necessary access data is automatically processed in server log files: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the request and the IP address. This data serves the delivery, security and stability of the website and is not merged with other data sources (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place; for any data transfers to third countries, the EU Standard Contractual Clauses apply.

4. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

Where activated, we use Cloudflare Web Analytics to statistically evaluate the use of our website. Cloudflare Web Analytics works without cookies, without cross-device tracking and without creating personal user profiles; no data is sold to third parties for advertising purposes. The legal basis is our legitimate interest in designing our offering to meet demand (Art. 6(1)(f) GDPR).

6. Contact, referral and feedback form

If you send us enquiries or feedback via our contact, referral or feedback form, we process the data you provide solely to handle your request (Art. 6(1)(a) and (b) GDPR). The principle of data minimisation applies – please do not submit any special categories of personal data (e.g. detailed health data) via the form. Transmission is by email to our practice; the data is not stored in a database on this website. To protect against automated misuse (spam) we may use Cloudflare Turnstile (Cloudflare Germany GmbH, Rosental 7, 80331 Munich). Turnstile is loaded only after your explicit consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). In that case your IP address and technical characteristics of your browser are transmitted to Cloudflare and a cookie (e.g. __cf_bm) may be set. Without consent Turnstile is not loaded – the form remains fully usable and we rely solely on server-side checks without any third party. Your enquiry data remains with us until you ask us to delete it; statutory retention obligations remain unaffected.

7. Online job applications

If you apply through our application form, we process the data you submit – name, contact details, your possible start date, your message and the documents you upload – solely to conduct the application procedure. The legal basis is Art. 6(1)(b) GDPR in conjunction with § 26(1) BDSG (deciding on the establishment of an employment relationship); for any information you volunteer beyond that, additionally your consent under Art. 6(1)(a) GDPR. Transmission is by email to the practice; your documents are neither stored nor placed in a database on this website, and there is no applicant portal. The spam protection described in section 6 applies here as well (Cloudflare Turnstile, only after your consent).

Please do not submit special categories of personal data (such as health data or details of religion, origin or trade-union membership). Following the principle of data minimisation, we also do not need a photograph, your date of birth or your marital status. Within the practice, only the people involved in the selection process have access to your documents; they are not passed on to third parties.

If we do not offer you a position, we delete your application documents no later than six months after the procedure ends. That period rests on our legitimate interest in defending against possible claims under the German General Equal Treatment Act (Art. 6(1)(f) GDPR). If you would like us to keep your documents on file for future vacancies, please tell us: we will then retain them for twelve months on the basis of your consent, which you may withdraw at any time. If an employment relationship is established, your data is transferred to your personnel file.

8. Online appointment booking (Doctolib)

For online appointment booking we link to the external service Doctolib (Doctolib GmbH, Mehringdamm 51, 10961 Berlin). Only when you click the corresponding button are you redirected to the Doctolib platform, where Doctolib’s privacy policy applies. The redirection takes place on the basis of your consent or our legitimate interest in efficient appointment organisation (Art. 6(1)(a) or (f) GDPR).

9. Map display (OpenStreetMap)

On the home and contact pages we embed an interactive map based on OpenStreetMap. The map is loaded only after you consent: if you have agreed to the external services, the map loads automatically; without consent it stays disabled and is loaded only after you explicitly click (“two-click solution”). Before loading, no connection to a map service is established and no data is transmitted. Once the map is loaded, your IP address is transmitted to the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) to provide the map tiles (Art. 6(1)(a) GDPR). No cookies are set and no tracking is carried out. Further information: https://osmfoundation.org/wiki/Privacy_Policy

For the two external services (Cloudflare Turnstile, OpenStreetMap) we obtain your consent through the “Privacy settings” notice. Accepting and declining carry equal weight there and both take a single click. If you decline, the website remains fully usable, forms included. We store your decision locally in your browser only (localStorage, key or-consent); no cookie is set for it and the value is not transmitted to us. You can change or withdraw your decision at any time via the “Privacy settings” link in the footer. Withdrawal takes effect for the future.

11. Fonts

All fonts are served locally from our server (self-hosted). There is no connection to third-party servers (e.g. Google Fonts); no personal data is transmitted to third parties when the fonts are loaded.

12. Your rights as a data subject

With regard to the personal data concerning you, you have the following rights:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to the contact details above is sufficient.

13. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59–61, 10555 Berlin

14. Currency and changes to this privacy policy

This privacy policy is current as of September 2026. As our website develops or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy.