Privacy Policy | Sorriso Sicuro

1. Data controller

The controller of your personal data is Albadent Group SHPK ("Albadent"), which operates in communications and marketing under the trading name Sorriso Sicuro Albania.

Full legal name: Albadent Group SHPK
Tax identifier / registration number (NIPT/NUIS): L62217032L
Registered office: Rruga Allaman Dervishi, Tiranë 1001, Albania
Telephone: +44 20 4538 2843 · Email: info@sorrisosicuro.al

2. Privacy contact

The controller is established in Albania and offers its services to individuals located in the European Union and in the United Kingdom, including through advertising tools. The processing therefore falls within the scope of the GDPR (Article 3(2)) and, for individuals in the United Kingdom, of the UK GDPR and the Data Protection Act 2018.

For any matter relating to data protection and to exercise your rights, you can contact the controller at info@sorrisosicuro.al.

Data collected in the European Union and the United Kingdom is managed through the HubSpot platform, hosted in the EU region, which acts as a processor on behalf of the controller.

3. Categories of personal data processed

We process only the data needed to respond to your enquiry and to deliver the service:

Identification and contact data

first name and surname;
telephone number;
email address;
country/city of residence (if provided).

Data relating to your enquiry

the dental treatment you are interested in;
clinical needs and information you choose to share with us (for example a description of your case or a panoramic X-ray).

Information about your dental health constitutes a special category of data under Article 9 GDPR and is subject to enhanced safeguards: we process it only if you choose to provide it, on the basis set out in section 4.

4. Purposes of processing and legal bases

PurposeLegal basis

Responding to enquiries, providing information and quotes, handling the initial consultationPre-contractual steps at the request of the data subject (Art. 6(1)(b))

Managing the patient–clinic relationship and delivering the servicePerformance of a contract (Art. 6(1)(b))

Processing health data for clinical assessment and treatment planningExplicit consent (Art. 9(2)(a)) and/or purposes of medicine and healthcare (Art. 9(2)(h))

Operational communications (appointments, follow-ups, travel arrangements)Performance of a contract (Art. 6(1)(b))

Marketing, newsletters and remarketingFreely given, withdrawable consent (Art. 6(1)(a))

Tax, accounting and legal obligationsLegal obligation (Art. 6(1)(c))

Providing your identification and contact data is necessary for us to respond to your enquiry: without it we cannot follow up. Providing health data and marketing consent is optional.

5. How we collect data

We collect the data you provide directly through:

the website and landing pages;
contact forms (managed through HubSpot);
Meta Ads (Facebook and Instagram) and Google Ads campaigns;
WhatsApp, telephone and email.

We do not buy contact lists and we do not collect health data without your knowledge.

6. How consent is handled in our forms

Our forms apply the principle of freely given, specific and granular consent:

Privacy tick box (mandatory): confirmation that you have read this notice, required in order to submit your enquiry.
Marketing consent (separate and optional): a separate, unticked box to receive promotional communications. The service is not conditional on this consent.
Consent to the processing of health data (where relevant): a dedicated box where you provide clinical information.
Withdrawal: you can withdraw any consent at any time (section 12), without affecting the lawfulness of processing carried out before withdrawal.

The site uses strictly necessary cookies and, with your consent, measurement and marketing cookies and tools. Non-essential tools are activated only after you give consent through the cookie banner:

Meta Pixel and Conversions API (Meta Platforms Ireland): measurement and remarketing. For collection via the Pixel, Meta acts as a joint controller;
Google Ads and Google Analytics (Google Ireland): campaign measurement and statistics;
tools for remarketing linked to the platforms listed above.

Cookie choices are managed through a banner with prior blocking and can be changed at any time.

8. Use of the HubSpot CRM

Data collected through our forms is stored in the HubSpot CRM, which we use to manage contacts, calls, consultations, quotes, appointments and follow-ups.

Access: limited to authorised staff, with individual credentials and permission profiles;
Security: HubSpot applies appropriate technical and organisational measures; the relationship is governed by a data processing agreement (DPA) under Article 28 GDPR;
Retention and deletion: data is retained in accordance with section 11 and deleted or anonymised on expiry or at your request.

9. Recipients and processors

Data may be processed on our behalf and on our instructions by parties acting as processors (Article 28 GDPR), including:

HubSpot: CRM platform;
a marketing agency based in London (United Kingdom): management and optimisation of Meta and Google campaigns. The agency uses its own advertising credit, is paid by Albadent on a service basis and does not sell the data or use it for its own purposes: it therefore acts as a processor, not as a joint controller;
providers of hosting, email and messaging services (for example WhatsApp Business);
the advertising platforms Meta and Google (for the Pixel, Meta is a joint controller in relation to collection only).

Processing by each processor is governed by a data processing agreement under Article 28 GDPR. Data may also be disclosed to authorities and professional advisers (for example our accountant) to meet legal obligations.

10. International data transfers

Some processing involves transferring data outside the European Union:

Albania (where the controller is established): Albania is not covered by an adequacy decision of the European Commission; transfers are made on the basis of Standard Contractual Clauses (SCCs) and appropriate supplementary measures;
United States (for example HubSpot, Meta, Google): on the basis of the EU-U.S. Data Privacy Framework and/or SCCs;
United Kingdom (marketing agency): covered by the EU adequacy decision for the United Kingdom.

You can request a copy of the safeguards in place by writing to the contact details given above.

11. Data retention

CategoryRetention period (criterion)

Leads / commercial contacts not convertedUp to 24 months from the last contact, unless withdrawn earlier

Patients (relationship data)For the duration of the relationship and thereafter for the applicable statutory periods

Health data / clinical recordsUp to 10 years, in line with the periods applicable to medical records

Accounting and tax dataFor the statutory period (normally 10 years)

Data processed on the basis of marketing consentUntil consent is withdrawn

At the end of these periods, data is deleted or anonymised.

12. Your rights

As a data subject you may exercise, within the limits of the law, the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

To exercise them you can write to info@sorrisosicuro.al. We will respond without undue delay and in any event within one month.

You also have the right to lodge a complaint with a supervisory authority: in the United Kingdom the Information Commissioner's Office (ICO) (ico.org.uk); in Italy the Garante per la protezione dei dati personali (garanteprivacy.it); in Albania the Commissioner for the Right to Information and Personal Data Protection (IDP).

13. Security, minors and changes

Security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure, including access control, individual credentials and staff confidentiality obligations.

Minors

Our services are aimed at adults. Any processing relating to minors takes place only with the involvement and consent of the person holding parental responsibility.

Changes

This notice may be updated; the current version is always published on this page with the date it was last updated.

Questions about your data? Write to info@sorrisosicuro.al or call +44 20 4538 2843.

Privacy Policy - Sorriso Sicuro