Privacy policy
regarding the medical activities of Eye-Dent Kft. and the https://lunamed.hu/ data processing related to the operation of the website
Introduction
In accordance with the rules of EU Regulation 2016/679 (General Data Protection Regulation, GDPR) , this Notice makes it possible to learn what activities Eye-Dent Kft (hereinafter Data Controller) carries out with the data of natural persons while performing the tasks detailed below. It also explains the rules it follows in doing so and gives insight into its measures for protecting the data it uses. Last but not least, it provides information about all the rights that data subjects have to protect their interests.
The Data Controller provides the mandatory information under Article 13 of the GDPR to data subjects and inquirers as set out below.
- Data Controller details
| Name of the Data Controller: | Eye-Dent Kft | |
| Registered office: | 1027 Budapest Fő utca 62-64 fszt. 2a. | |
| Tax number:Company registration number:Registering court: | 32010118-1-4101-09-402439Court of Registration of the Budapest-Capital Regional Court | |
| E-mail: | szemeszet@lunamed.hu | |
| Phone: | +3630 0739 267 | |
| Website: Hosting provider:Hosting provider contact: Data processing by the hosting provider: | https://lunamed.hu/ WordPress.orghttps://tamogatas.wphu.org/ https://wordpress.org/about/privacy/ |
- Principles of processing personal data
The Data Controller operates in compliance with the following principles:
- The principle of purpose limitation: shows for what purpose the Data Controller stores and uses the data of natural persons in the course of its activities.
- The principle of data minimization: that is, the scope of the data processed is appropriate to the given purpose and limited to what is necessary for it.
- The principle of accuracy: accordingly, for the sake of data subjects and legal compliance, the Data Controller promptly corrects or deletes inaccurate personal data.
The Data Controller receives personal data directly from data subjects. It accepts as binding on itself the performance of those tasks related to the protection of personal data processed in connection with its activities, through which it can, where applicable, help demonstrate to authorities, business partners and the clients concerned that it has acted in compliance with the Regulation, the Info Act and other relevant rules (principle of accountability).
- The main laws governing our data processing activities:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR, hereinafter: the Regulation)
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Info Act)
- Act XLVIII of 2008 on the Essential Conditions of and Certain Limitations to Commercial Advertising Activity
- Act I of 2012 on the Labor Code
- Act CL of 2017 on the Rules of Taxation
- Act C of 2000 on Accounting
- Definitions
GDPR: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
personal data: any information relating to the data subject, such as an identifier, name, number, location data, online identifier, or data relating to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.
special categories of data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic and biometric data processed for the purpose of uniquely identifying natural persons, data concerning health, and data concerning the sex life or sexual orientation of natural persons.
data processing: any operation or set of operations performed on personal data or data files, regardless of the procedure applied, in particular collection, recording, capture, organization, structuring, storage, alteration, adaptation, use, retrieval, transmission, disclosure, alignment or combination, restriction, erasure and destruction, access to the data, preventing further use of the data, taking photographs, sound or image recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints).
data controller: the natural or legal person, or organization without legal personality, which alone or jointly with others determines the purposes and means of the processing of personal data, makes and implements decisions concerning the processing, or has them implemented by a data processor.
data processor: the natural or legal person, or organization without legal personality, which processes personal data on behalf of the data controller.
data subject: a natural person identified on the basis of any specific personal data, or identifiable, directly or indirectly, on the basis of one or more factors. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, online identifier, or one or more factors.
data transfer: making personal data available to a specified third party. Data transfers to EEA member states and to bodies of the European Union are to be regarded as if they took place within the territory of Hungary.
data erasure/deletion: making data unrecognizable by deleting the content or in any other way that achieves an equivalent result.
data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to personal data transmitted, stored or otherwise processed.
EEA member state: a member state of the European Union and another state party to the Agreement on the European Economic Area, as well as a state whose citizens enjoy the same legal status as citizens of a state party to the Agreement on the European Economic Area under an international treaty concluded between the European Union and its member states and a state not party to that Agreement.
third country: any state that is not an EEA member state.
NAIH: the Hungarian National Authority for Data Protection and Freedom of Information, the supervisory authority under the GDPR with respect to Hungary.
emergency: a sudden change in a person's state of health as a result of which, in the absence of immediate medical care, the person would face immediate danger to life
health records: notes, registers or data recorded in any other way, regardless of their medium or form, containing health and personally identifiable data that came to the knowledge of the care provider during treatment.
care provider: the specialist physician carrying out the treatment, the health care professional, and any other person engaged in activities related to the treatment of the person concerned.
close relative: the spouse, direct-line relatives, adopted, step and foster children, adoptive parents, step and foster parents, as well as siblings and the domestic partner.
medical treatment: any activity aimed at the direct examination, treatment, care or medical rehabilitation of the person concerned, and at the processing of their test materials for these purposes, for the purpose of preserving health, preventing, early detection, diagnosing and curing illness, and maintaining or improving a condition that has deteriorated as a result of illness, including the dispensing of medicines, medical aids and spa treatments, emergency rescue and patient transport, as well as obstetric care.
medical confidentiality: the health and personally identifiable data that came to the knowledge of the data controller during treatment, as well as other data learned in connection with treatment that is necessary, ongoing or completed.
- Data processing rules
In the course of our activities, we process the personal data of business partners, colleagues and clients that we learn of in any way and to any extent, in accordance with this Privacy policy, under a confidentiality obligation, and in line with the GDPR and the applicable Hungarian laws.
We may lawfully store the data received in connection with our activities and related tasks, organize it within the limits of the law, and use it to the extent necessary.
We stop data processing immediately if its purpose has been fulfilled or has ceased, and we will consider doing so if the data subject requests it.
The IT systems we use do not involve profiling or automated decision-making.
- Details of data processing related to our activities, by purpose
- Contact and appointment scheduling via the website
Data subjects: Natural persons, or representatives of legal persons, who contact us
Purpose of data processing: Making contact, keeping in touch, providing information
| Type of data | Legal basis | Retention period |
| name | GDPR Article 6(1)(a), the consent of the data subject | Until consent is withdrawn, but for no more than 5 years |
| e-mail address | ||
| phone number |
The data processing procedure:
If you give us your contact details by e-mail, through the “Send us a message” form on the website, or by phone, we will use them to keep in touch, provide information, and deliver our services.
Providing the above data is not mandatory, but without it we cannot keep in touch with you. You may withdraw your consent at any time without giving a reason, but this does not affect the lawfulness of data processing carried out earlier on the basis of your consent. You can withdraw it by sending an e-mail to the address above, and we will carry it out as soon as possible, within 5 working days at most.
Please do not provide any personal data in the free-text “message” field of the website form! We have no authority to process data received this way, so we delete it immediately and permanently.
- Records of job applicants, evaluation of applications, résumés
Data subjects: Persons applying for a job opportunity
Purpose of data processing: evaluating applications, notifying the applicant
| Type of data | Legal basis | Retention period |
| name of the candidate/applicant | GDPR Article 6(1)(a), the consent of the data subject | Until consent is withdrawn, but for no more than 12 months |
| place and date of birth | ||
| home address / mailing address | ||
| qualifications, work experience information | ||
| signature | ||
| e-mail address | ||
| phone number | ||
| in some cases, a photo of the applicant |
The data processing procedure:
Applicants for a given job opportunity send us their résumé and a cover letter. Both may contain personal data that the applicant considers important to share with us in order to be evaluated favorably.
Providing the above data is not mandatory, but without it we cannot evaluate the application and/or there is no way to notify the applicant. You may withdraw your consent at any time without giving a reason, but this does not affect the lawfulness of data processing carried out earlier on the basis of your consent. You can withdraw it by sending an e-mail to the address above, and we will carry it out as soon as possible, within 5 working days at most.
- Data processing related to employment
Data subjects: Persons in an employment relationship with the Data Controller
Purpose of data processing: administration related to the employment relationship, as required by law
| Type of data | Legal basis | Retention period |
| Name | GDPR Article 6(1)(c) legal compliance; Act I of 2012 on the Labor Code.Act CL of 2017 on the Rules of Taxation.Act C of 2000 on Accounting.Act LXXXI of 1997 on Social Security Pension Benefits(…) | o personal data related to the establishment and termination of employment and to pension entitlement may not be discarded.o data related to payment of wages and payroll accounting: may not be discardedo personal data related to naming an employee as a contact person are stored by the Data Controller for the period required by the Accounting Act and tax laws (8 years). |
| name at birth | ||
| mother's name | ||
| permanent address | ||
| place and date of birth, | ||
| name and address of workplace/school | ||
| ID card number | ||
| other data required by law |
The data processing procedure:
The purpose of providing the above data is to comply with the administrative requirements related to employment set by law. Providing the related data is mandatory.
- Contracting with partners and business clients
Data subjects: Natural persons, or representatives of legal persons, who enter into a contract with the Data Controller
Purpose of data processing: Performance of the contract and keeping in touch
| Type of data | Legal basis | Retention period |
| For sole proprietors: name | GDPR Article 6(1)(b), performance of a contract | For 5 years after the contractual relationship expires or ends |
| registered office | ||
| tax number | ||
| for companies: name of the contact person and signatory | ||
| signature | ||
| e-mail address | GDPR Article 6(1)(b), necessary for keeping in touch under the contract | For the duration of the contractual relationship. |
| phone number |
The data processing procedure:
Processing the above personal data is essential for concluding and performing every contract and for the related communication (cooperation).
- Processing of data related to our medical services
Data subjects: a person treated/cared for for the purpose of a medical procedure (client, patient)
Purpose of data processing: performance of the service and keeping in touch
| Type of data | Legal basis | Retention period |
| name, TAJ (Hungarian social security number) | GDPR Article 6(1)(b), performance of a contract | For 5 years after the contractual relationship expires or ends |
| birth data | GDPR Article 6(1)(b), performance of a contract | For 5 years after the contractual relationship expires or ends |
| address data | GDPR Article 6(1)(b), performance of a contract | For 5 years after the contractual relationship expires or ends |
| the patient's complete health records | GDPR Article 6(1)(c), fulfillment of a legal obligation; Section 4(1) of the Eüak Act | 30 years |
| X-ray images and/or photos of the teeth | GDPR Article 6(1)(c), fulfillment of a legal obligation; Section 4(1) of the Eüak Act | 10 years |
| the report prepared on the images | GDPR Article 6(1)(c), fulfillment of a legal obligation; Section 4(1) of the Eüak Act | 30 years |
| e-mail address | GDPR Article 6(1)(b), necessary for keeping in touch under the contract | For the duration of the service (treatment, aftercare, follow-up). |
| phone number |
The data processing procedure:
Processing the above personal data is essential for performing our services and for the related communication (cooperation).
During data collection, we record the time of data collection and the person who collected the data in the health records. Every note or entry in the patient's records is authenticated with a signature or initials and, if necessary, a date; in the case of electronic data processing, the person making the entry can be clearly identified. As the Data Controller, we record and store the personal data provided by the data subject (name, place and date of birth, mother's name, address), as well as the health data recorded before or during treatment, in an electronic database. In the case of a child under the age of 16, we lawfully record and store the child's personal data only to the extent and with the content for which the person exercising parental authority over the child (legal representative) has given or authorized consent.
We store health data in the Cloudent software, which is suitable for this purpose.
- Provider: Cloudent Kft.
- Data processing info: https://www.cloudent.hu/_files/ugd/8b4322_32001fcdcf40404b86e8bfbb8a80575c.pdf
We use Google's system (Gmail) for correspondence with clients.
- Provider: Google
- Data processing info: https://policies.google.com/privacy?hl=hu
- Handling of complaints related to data processing
Data subjects: A natural person who feels that their rights have been violated, the data subject
Purpose of data processing: Identification, conducting the procedure and keeping in contact
| Type of data | Legal basis | Retention period |
| name | GDPR Article 6(1)(c); Compliance with a legal obligation Regulation (EU) 2016/679 (GDPR) | 5 years after the closure of the given case |
| mother's name | ||
| e-mail address | ||
| phone number | ||
| info. on the data processing objected to |
The data processing procedure:
Every data subject is entitled to lodge a complaint regarding the data processing carried out by the Data Controller if they feel they have been harmed.
Providing the data is mandatory for the investigation of the grievance and for keeping in contact, that is, for conducting the proper procedure. Without it, the complaint and/or the complainant cannot be identified, so we have no way of conducting the procedure.
- Handling of invoices, accounting
Data subjects: Partner, client: a sole proprietor or a natural person representing a business entity
Purpose of data processing: Handling of documents under the Accounting Act.
| Type of data | Legal basis | Retention period |
| name | GDPR Article 6(c); Compliance with a legal obligation; Act C of 2000 on Accounting | 8 years after the year of the invoice date |
| for sole proprietors, tax number |
The data processing procedure:
In the case of sole proprietors, the documents may contain personal data. We retain these documents in accordance with the requirements of the Accounting Act.
Providing the data is mandatory under the applicable legislation. If it is not provided, the invoice cannot be accepted.
We store the data electronically using the szamlazz.hu system.
- Provider: KBOSS.hu Kft.
- Privacy info: https://www.szamlazz.hu/adatvedelem/
In the event of an audit, the data will be transferred to the competent authority (NAV).
- NAV
- Contact, info: ebpavig@nav.gov.hu
For bookkeeping we have engaged an external partner (a data processor in this respect), who receives data from us in order to perform this task.
- Partner: Horváth-Nagy Márta, sole proprietor
- Contact, info: horvathnm@gmail.com ; +3630 228 1663
- Use of our website
Data subjects: anyone who visits our website
Purpose of data processing: operating the website and collecting information related to its operation
The https://lunamed.hu/ website currently uses the following cookies:
- strictly necessary cookie, does not require consent
| key | domain | retention period | short description |
| _GRECAPTCHA | www.google.com | 6 months | When Google reCAPTCHA runs, it sets a necessary cookie (_GRECAPTCHA) for the purpose of risk analysis. |
| PHPSESSID | lunamed.hu | persistent | A cookie generated by applications based on the PHP language. It is a general-purpose identifier used to maintain user session variables. It is typically a randomly generated number, and how it is used may depend on the particular site, but a good example is maintaining a user's logged-in status between pages. |
The data processing procedure:
Our website may use so-called “cookie” technology. A cookie is a small text file that the website provider places on the hard drive of your computer. Cookies provide the website with various functions that support its operation.
The user can allow or reject cookies when first entering the website. After that, on every further visit, they have the opportunity to change their earlier decision. If you decide to reject cookies, you may not be able to use certain features of our website properly.
- Our hosting provider partner: WordPress.org
- Data processing info: https://wordpress.org/about/privacy/
- Transfer and disclosure of data
Occasionally, in connection with our activities, we transfer personal data to a third party. Data may be transferred on paper or electronically, and in both cases we make sure that the data is accessible only to the recipient.
- paper-based transfer: by personal handover or by post, addressed specifically to the recipient
- electronically (e-mail): personal data does not appear in the text of the message. Where necessary, personal data is sent or handed over using Google Drive or Microsoft OneDrive, in every case protected with a unique password.
No data is transferred to a third country or an international organization.
As Data Controller, on the legal basis of “performance of contracts” or “legal compliance”, and in addition to the partners indicated in section 6, we transfer data to the following organizations acting as data processors or independent data controllers:
- Raiffeisen Bank Zrt. (independent data controller)
- Data processing info: https://www.raiffeisen.hu/documents/10165/12833/Altalanos_adatvedelmi_es_adatkezelesi_tajekoztato.pdf
Our card / online payment provider:
- SumUp EU Payments, UAB (Lithuania)
- Data processing info: https://www.sumup.com/hu-hu/adatvedelem/
Information: when card payment is used, our company does not receive or process the bank card or other financial data of the client (the paying party). We receive notification only about the result of the transaction from the provider.
- Data security
We ensure the security of the personal data we process through technical and organizational measures and the establishment of procedures.
Only those of our colleagues who need to know personal data in order to perform their duties have access to it.
To ensure data security:
- when designing and operating the IT system, we assess and take into account the possible risks, striving to reduce them continuously
- we monitor emerging threats and vulnerabilities (such as computer viruses, computer intrusions, denial-of-service attacks, etc.) so that we can act in time to avoid or eliminate them
- we protect IT equipment and information handled on paper against unauthorized physical access and environmental effects (e.g. water, fire, electrical surges)
- we monitor our IT system to detect possible problems and incidents
- reliability is a fundamental criterion when selecting the service providers involved in operations
- Under Articles 15-20 of the GDPR, data subjects have the following rights regarding their personal data:
- right to information;
- right of access;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to data portability;
- right to object.
You can exercise your rights by sending a request to the szemeszet@lunamed.hu e-mail address.
The right of access entitles you to request information on whether your personal data is being processed, and if such processing is under way, to access the personal data and to receive information about the security conditions of the processing as well.
The right to rectification means that, at your request, we correct inaccurate personal data without delay and complete incomplete data.
Right to erasure means that we delete your personal data without undue delay in the following cases:
- the personal data is no longer needed for the purpose for which we collected it or otherwise processed it;
- if the consent on which the processing is based is withdrawn and there is no other legal basis for processing the data;
- if we processed the personal data unlawfully;
- we are required to delete the personal data by law.
We cannot delete personal data if the processing is necessary for the establishment, exercise or defense of legal claims.
Upon request, we restrict the use of personal data under the right to restriction of processing , in which case we use the personal data only within a defined scope.
The right to data portability means that, provided it does not infringe the rights and freedoms of others, we send your data to you in a structured, commonly used, machine-readable format, or, at your request, we transfer the data directly to another data controller.
The right to information: During the period of data processing, the data subject may request information from us about the processing of their personal data. Within the shortest possible time from submission of the request, but no later than 30 days, we provide the data subject with information in writing, in plain language, about the data processed, the purpose, legal basis and duration of the processing, and, if the data has also been transferred, about who receives or has received the data and for what purpose.
The right to object: We examine an objection within the shortest possible time from submission of the request, but no later than 15 days, decide on whether it is well founded, and inform you of our decision in writing. If we are unable to comply with the data subject's request for rectification, blocking or erasure, we communicate the factual and legal grounds for refusing the request in writing, or electronically with the data subject's consent, within 30 days of receiving the request.
- Other provisions on data processing
Termination of data processing
We delete all personal data,
- for which the purpose of processing has ceased, or
- for which the data subject's consent for processing is not available,
- for which the data subject has withdrawn the right to process it, or has prohibited the processing, or
- for which there is no statutory legal basis for processing.
Instead of deleting, we block the personal data if the data subject requests this, or if, based on the information available to us, it can be assumed that deletion would harm the data subject's legitimate interests. Personal data blocked in this way is processed only for as long as the purpose of processing that precluded the deletion of the personal data exists.
- Our procedural rules for handling privacy complaints
The procedure: we treat and handle as a complaint every comment sent to us in writing by the natural persons concerned, if it concerns data protection and expresses a grievance about our conduct or omission that is incompatible with this Privacy Policy (hereinafter: complaint).
A complaint can be made by a notification sent to our e-mail address above (electronically) or to our postal address.
The complaint must contain at least: the complainant's name, address (e-mail address), phone number, the date of the grievance, a specific description of the complaint, the complainant's signature, and a statement that, by signing the complaint, the complainant consents to the processing of the data in the complaint for the purposes of the complaint procedure. In the absence of this data and statement, we will not investigate the complaint and will notify the Complainant of this in writing.
We process the Complainant's data solely in connection with the complaint. We do not disclose it to third parties, except for official or court requests specified by law, and we do not use it for business purposes.
We investigate the complaint and give a reasoned written reply within 30 days of receipt, in the same manner as the complaint was submitted (by e-mail or by post). If the 30-day deadline is not sufficient to investigate the complaint, we will inform the complainant. In that case, we will give a reasoned written reply in the same manner as the submission within 3 months of the notification.
If, after investigating the complaint, we find that the Complainant's complaint was factual and justified, we inform the Complainant of the manner and extent of the remedy for the grievance at the same time as the complaint is decided.
If the complaint is rejected, we provide written information that the Complainant may then turn to the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: NAIH) or, in case of a grievance, to the Court.
The NAIH facilitates the enforcement of data subject rights by issuing form letters: https://naih.hu/panaszuegyintezes-rendje.html
Complaints: NAIH; 1055 Budapest, Falk Miksa u. 9-11,
E-mail address: ugyfelszolgalat@naih.hu
tel.: +36(1) 391 1400
website: www.naih.hu
- Data breach and its handling
Data breach: any activity, intervention or omission that allows the unlawful processing of personal data, in particular unauthorized access, alteration, transfer, disclosure, deletion or destruction, as well as accidental destruction and damage.
Anyone who notices such an event in connection with our activities should report it as soon as possible by e-mail to the szemeszet@lunamed.hu or by phone: +3630 0739 267
As Data Controller, we record the report and immediately begin investigating it. If the data breach affected an IT system, we also inform the providers responsible for operating the databases concerned.
To examine the report and handle the incident, we collect all information that may be necessary to identify it, to reduce possible damage and to develop further measures to be taken to remedy it. Where possible, we record
- the time and place of the incident,
- the description, circumstances and effects of the incident,
- the scope and number of data compromised in the incident,
- the scope of persons affected by the compromised data
In addition, in compliance with legal requirements, we notify the Authority (NAIH) within 72 hours.
Data Protection Officer: As Data Controller, in connection with our main activity we process a large amount of personal and health data that can be considered particularly sensitive. On this basis, under Article 37(1)(b) and (c) of the GDPR and Article 35(3)(b) concerning data protection officers, we would be providers obliged to appoint a data protection officer.
In addition, in order to make a proper and lawful decision, we must also take into account section 2.1.3 of Guideline No. 243, under which an individual specialist physician or health professional is not among those obliged to appoint a data protection officer in connection with the processing of their patients' health data.
Based on the combined assessment of all these rules, we have decided that we are not currently appointing a data protection officer for the data processing related to our services.
Note: As Data Controller, we reserve the right to update this Privacy Policy continuously and, in doing so, to unilaterally modify the information detailed in it, also following changes in legislation. The currently effective policy is https://lunamed.hu/ always available on our website.
Budapest, February 2025 Eye-Dent Kft.