Privacy policy

Controller

The controller within the meaning of data protection law, in particular the EU General Data Protection Regulation (GDPR), is:

Dr. Friederike Krop
Specialist orthodontist
Bajuwarenstraße 7, 85435 Erding, Germany
Phone: +49 8122 3059
E-mail: praxis@dr-krop.de

Your rights as a data subject

Using the contact details above, you can exercise the following rights at any time:

• access to your data stored by us and its processing (Art. 15 GDPR),
• rectification of inaccurate personal data (Art. 16 GDPR),
• erasure of your data stored by us (Art. 17 GDPR),
• restriction of processing where we may not yet delete your data due to legal obligations (Art. 18 GDPR),
• objection to the processing of your data by us (Art. 21 GDPR), and
• data portability, provided you have consented to the processing or concluded a contract with us (Art. 20 GDPR).

If you have given us consent, you can withdraw it at any time with effect for the future.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may lodge a complaint with a supervisory authority at any time, e.g. the authority responsible in the federal state of your residence or the authority responsible for us, the Bavarian State Office for Data Protection Supervision (BayLDA). A list of supervisory authorities with addresses is available at: www.bfdi.bund.de.

Provision of the website and server log files

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you access our website, information transmitted by your browser is automatically stored in server log files: IP address, date and time of access, page accessed, amount of data transferred, browser type and operating system, and the previously visited page (referrer). Processing is based on our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). IONOS stores the IP address in anonymised form only; the data is deleted after eight weeks. It is not passed on to third parties or transferred to countries outside the EU. A data processing agreement (Art. 28 GDPR) is in place with IONOS.

Cookies

This website does not use cookies for analytics or advertising and does not use any tracking services. Consent via a cookie banner is therefore not required. Technically necessary storage in your browser only occurs if you actively load external content (map, booking), see below.

Contact by e-mail or phone

If you contact us by e-mail or phone, we process your details (name, contact details, content of the enquiry) to handle your enquiry and for possible follow-up questions. The legal basis is Art. 6(1)(b) GDPR (initiation or performance of a treatment relationship) or Art. 6(1)(f) GDPR. We process health data on the basis of Art. 9(2)(h) GDPR. Data is deleted as soon as it is no longer required for the purpose and no statutory retention obligations apply. Providing your data is voluntary; without contact details, however, we cannot answer your enquiry. Please note that unencrypted e-mails could be read by third parties.

Online booking (eTermio)

We use the eTermio service for online appointment booking. The calendar is only loaded when you click one of the “Book a consultation” or “Load calendar” buttons; until then no connection to eTermio is established. On clicking, your IP address and the data you enter (name, contact details, requested appointment) are transmitted to eTermio GmbH, Mainz-Kastel, and processed there on our behalf (data processing agreement pursuant to Art. 28 GDPR). Processing takes place exclusively on servers in Germany. The legal basis is the implementation of pre-contractual measures at your request (Art. 6(1)(b) GDPR); health data you provide when booking is processed on the basis of Art. 9(2)(h) GDPR. Loading the calendar and any storage in your browser are strictly necessary for the booking service you have explicitly requested (Section 25(2) No. 2 TDDDG). If you prefer not to connect to eTermio, you are welcome to book your appointment by phone. Further information can be found in eTermio's privacy policy: www.etermio.com/datenschutz.

Google Maps

On the contact page we embed a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded when you click “Show map”. Only then is data, in particular your IP address, transmitted to Google; this may involve a transfer to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw for the future by closing the map or leaving the page. Further information: policies.google.com/privacy.

Job applications

If you apply to us by e-mail or post, we process your application documents solely for the purpose of the application procedure. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG). After the procedure has been completed, the documents are deleted no later than six months afterwards, unless you have consented to longer storage for future vacancies or legal obligations require otherwise.

Patient reviews

On the home page and the “Book a consultation” page we display reviews that patients have submitted on our public eTermio profile. They are imported from there when the website is built and shown with star rating, date, abbreviated name and text as published there. No data of visitors to our website is processed in the course of this. If you would like your own review removed, please contact eTermio or us.

Instagram

We link to our Instagram profile. When you click the link you leave our website and the privacy policy of Meta Platforms Ireland Limited applies. No Instagram content is embedded on our website and no data is transmitted to Meta.

Fonts and external content

All fonts are served locally from our server. No connection is made to Google Fonts or other font providers.

Retention period

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. Treatment records are kept for ten years (Section 630f(3) BGB), tax-relevant records for up to ten years. Data from appointment bookings, enquiries or job applications that do not lead to a treatment or employment relationship is deleted once the matter has been dealt with.

SSL encryption

To protect the security of your data during transmission, we use state-of-the-art encryption (TLS/SSL) via HTTPS.

Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The new privacy policy then applies to your next visit.

Questions about data protection

If you have questions about data protection, please e-mail praxis@dr-krop.de or call +49 8122 3059 to reach the person responsible for data protection at our practice.

Last updated: October 2026. This English version is provided for convenience. In case of doubt, the German version applies.