Privacy policy

1.Who is responsible?

The controller within the meaning of the General Data Protection Regulation (GDPR) for the data processing described here is:

Atelier Dentaire Arnoldy S. à r. l.
15, route de Luxembourg, L-6633 Wasserbillig, Luxembourg
Phone +352 26 74 07 61 · Email info@arnoldy.lu

For job applications, our sister company is also a controller; see section 6.

Please send any questions about data protection to this address by email or post.

Our data protection officer is Manfred Heckens, who can be contacted by post at the address above, marked “Data Protection Officer – confidential”.

2.When you visit the website

Each time you visit the website, your browser transmits technical data. Our hosting provider, i.e. the company on whose servers the website is hosted, stores this data in server logs:

IP address
date and time
page or file accessed
the page you came from (if your browser sends this information)
browser and operating system
status code (whether the request was successful) and amount of data transferred

Purpose: Delivering the website, finding errors, detecting and fending off attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.
Storage period: Our hosting provider keeps the access logs for 14 days and the error logs for 7 days. They are then deleted.
Recipients: Our hosting provider, Host Europe GmbH in Cologne (Germany). It processes the data on our behalf (Art. 28 GDPR) and uses further service providers for this, including outside the EU (see section 9).

The connection to this website is encrypted (HTTPS).

3.No cookies, no third-party content

This website does not store cookies or similar data on your device, nor does it read any. We do not measure audience reach, do not display advertising and do not embed content from other providers, so there are no map services, no videos from external platforms and no social media buttons. That is why we do not ask for your consent to cookies.

4.When you call or write to us

We process what you tell us, for example your name, practice, phone number, email address and your enquiry.

Purpose: Processing and answering your enquiry.
Legal basis: Art. 6(1)(b) GDPR if it concerns an order or a business relationship. In all other cases, Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).
Recipients: Our email provider, also Host Europe GmbH in Cologne (Germany), as processor (Art. 28 GDPR). In addition, our IT service provider, which looks after our systems and, in doing so, has access to our email inbox. It likewise processes the data on our behalf (Art. 28 GDPR).
Storage period: See section 7.

5.Contact form

What you enter in the form is sent encrypted (HTTPS) to our web server at Host Europe (see section 2). A small program on this server immediately sends your details by email to our inbox info@arnoldy.lu. Your message is not stored on the web server itself. No other service is involved. The form does not set cookies or load third-party scripts.

Fields: Name, email address and message. All three are required; there are no other fields.
Spam protection: A field that is invisible to visitors and is only filled in by automated programs. If it is filled in, the message is not sent. This allows us to detect spam without cookies.

Purpose and legal basis are the same as in section 4, as are the recipients: Host Europe as hosting and email provider, and our IT service provider. The storage period is set out in section 7.

Please do not enter any patient data in the form.

6.Job applications

We accept applications by email at info@arnoldy.lu. We process your details and documents, for example your CV and certificates. Please only send what is necessary for your application.

Controllers: Our staff are employed either by Atelier Dentaire Arnoldy S. à r. l. or by our sister company CAD-CAM Luxemburg S. à r. l., both at 15, route de Luxembourg, L-6633 Wasserbillig. Both companies decide on applications together. They are therefore joint controllers for applications (Art. 26 GDPR). The two companies have agreed that Atelier dentaire Arnoldy provides you with information, answers your questions and handles requests to exercise your rights. However, you can also exercise your rights against either of the two companies.
Purpose: Deciding whether to hire you.
Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into an employment contract). If we would like to keep your documents for future vacancies, we will ask for your consent beforehand (Art. 6(1)(a) GDPR). You can withdraw it at any time.
Recipients: Your email arrives in our general inbox. Our email provider and our IT service provider (see section 4) process the messages on our behalf.
Storage period: Six months after the application process has ended, after which we delete your documents. Longer only if you have given your consent (see Legal basis). If you are hired, the documents are placed in your personnel file.

7.How long we keep data

Enquiries that do not lead to a business relationship: one year after the last message.
Messages about an order or an invoice: for as long as commercial and tax law obligations require. For accounting records, this is ten years under the Luxembourg Commercial Code (Code de commerce). The legal basis is Art. 6(1)(c) GDPR.
Server logs and applications: see sections 2 and 6.

8.Links to other providers

Directions (OpenStreetMap)

The “Directions” link leads to OpenStreetMap, a service of the OpenStreetMap Foundation. Your browser connects to its servers only when you click the link. The privacy policy of the OpenStreetMap Foundation applies: https://osmfoundation.org/wiki/Privacy_Policy (external site, opens in a new window).

Instagram

Our links to Instagram lead to our profile on Instagram, a service of Meta Platforms Ireland Limited. Your browser connects to its servers only when you click one of these links. Instagram’s privacy policy applies: https://privacycenter.instagram.com/policy (external site, opens in a new window).

9.Sharing of data

Your data is only received by the service providers named above and, for job applications, by our sister company (see section 6), in each case only to the extent that they need it for their task. We only pass data on to authorities if we are required to do so by law.

Our hosting and email provider Host Europe is part of the GoDaddy group. According to its list of sub-processors, Host Europe may also use entities outside the EU and the EEA for operations, security and technical support, for example in the USA, the United Kingdom, Switzerland, Ukraine and Singapore. These entities may have access to data from sections 2, 4 and 5. For the United Kingdom and Switzerland, the European Commission has found an adequate level of data protection; for the USA, only for companies certified under the EU-US Data Privacy Framework. Beyond that, under its data processing agreement, Host Europe only uses such entities if the GDPR requirements for transfers to third countries are met (Art. 44 et seq. GDPR).

For Ukraine, Singapore and non-certified companies in the USA, there is no such decision. On request, we will tell you which appropriate safeguards under Art. 46 GDPR apply to these transfers and how you can obtain a copy of them.

We do not make any decisions based solely on automated processing, and we do not create profiles.

10.Do you have to provide data?

You are under no legal or contractual obligation to provide us with data. Without the technical data described in section 2, however, your browser cannot display the website. Without contact details, we cannot reply (see section 5). Without documents, we cannot assess an application or conclude an employment contract with you.

11.Your rights

You have the right

to obtain information about the data we hold about you (Art. 15 GDPR),
to have incorrect data rectified (Art. 16),
to have your data erased (Art. 17),
to have processing restricted (Art. 18),
to receive your data in a commonly used format or have it transmitted (Art. 20),
to withdraw consent at any time with effect for the future (Art. 7(3)).

To do so, write to us at info@arnoldy.lu or by post.

Your right to object

If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data. This does not apply if we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. Nor does it apply if we need the data to establish, exercise or defend legal claims.

12.Complaint to the data protection authority

If you believe that we are not processing your data lawfully, you can lodge a complaint with the Luxembourg data protection authority:

Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
cnpd.public.lu

You can also contact the supervisory authority in the EU member state in which you live or work. You can also contact us first.

13.Legal framework

The applicable legislation is the General Data Protection Regulation (Regulation (EU) 2016/679), the Luxembourg Data Protection Law of 1 August 2018 and, for cookies, the amended Law of 30 May 2005 on data protection in electronic communications.

14.Changes

If the website or our service providers change, we will update this policy. The version bearing the date above applies.

At a glance