Privacy Policy

Last updated: 2026-09-14.

This is a translation of the Spanish privacy policy, which is the reference text. In case of any discrepancy, the Spanish version prevails.

The essentials, in two paragraphs

When you contact us through this website you are not yet a patient of any clinic, so the company processing your data at that first stage is Barmor Inversiones, S.L., which manages this website.

When you book an appointment, your details are passed on to the company that owns the clinic, which then becomes the controller of your data in order to treat you. These are two stages with two different controllers, and it is worth being clear about that from the start.

Who is the data controller?

• Barmor Inversiones, S.L.
• Tax ID (N.I.F.): B26971218
• Registered address: calle Reding 10, 5.º A, 29016 Málaga
• Email: clinicamalaga@bybdental.com
• Phone: 722 23 90 76

Data Protection Officer

Barmor Inversiones, S.L. has appointed a Data Protection Officer, Lock4Data Consultores, S.L. (Tax ID B86750668). You can contact them about any matter relating to the processing of your data, including complaints, at dpo.bybdental@lock4data.es.

The companies that provide the dental care

If you book an appointment, your details are passed on to the company that owns the clinic, which becomes the controller of your data as a healthcare provider:

• Blanca Barrio Dental, S.L. — Clínica Dos Aceras
• Tax ID (N.I.F.): B75746693
• Address: calle Dos Aceras 12, bajo, 29012 Málaga
• Healthcare registry number (NICA): 52384

Why do we process your data?

• To answer your enquiry and offer you an assessment appointment.
• To understand what you need and how urgent it is, so we can guide your enquiry and prioritise it. This involves classifying your interest: further down we explain what this means and how you can object.
• To pass your details on to the clinic, so it can treat you.
• To measure the performance of our advertising campaigns in aggregate.

What data do we process?

• Identification and contact details: name, phone number, email address.
• What you tell us about the reason for your enquiry. If you describe a complaint, a treatment you are interested in or anything about your mouth or your health, that information is health data and receives the enhanced protection the law gives to this category.
• Browsing data and the campaign you came from, if you have accepted cookies.

Please do not give us health data that is not needed to guide your enquiry. Everything else belongs in the in-person visit.

What is the legal basis?

• Your consent (art. 6.1.a GDPR) to answer your enquiry, contact you and pass your details on to the clinic.
• Your explicit consent (art. 9.2.a GDPR) to process the information about your health that you choose to share with us. It is a separate and specific consent: without it we do not process that information.
• Legitimate interest (art. 6.1.f GDPR) solely for aggregate measurement of advertising performance, which does not identify you individually.

You can withdraw your consent at any time, as easily as you gave it, by writing to clinicamalaga@bybdental.com. Withdrawing it does not affect the lawfulness of the processing carried out before.

Use of artificial intelligence

Your first contact may be handled by an automated assistant based on artificial intelligence, not by a person. We will tell you so clearly at the start of the conversation, and you can ask to speak to a person at any time, without giving any reason.

To do this we use language model providers that process the content of the conversation. They are listed in the recipients section below, together with the country where they process data and the safeguard that applies.

Classification of your enquiry

To serve you better and prioritise, we classify enquiries by the type of treatment you ask about and the urgency you express. This is profiling within the meaning of article 4.4 GDPR, and we tell you so plainly.

What we do not do is take automated decisions that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR): nobody is excluded from care because of this classification, and there is always a person behind any decision about your treatment.

You can object to this classification by writing to clinicamalaga@bybdental.com, and you will still be served in exactly the same way.

Who receives your data?

The company that owns the clinic, identified above with its Tax ID, so it can treat you.

We also use providers that process data on our behalf and under our instructions, under a data processing agreement pursuant to article 28 GDPR:

• Anthropic PBC — Conversational assistant: processes the content of the conversation — United States — safeguard: European Commission Standard Contractual Clauses and supplementary measures
• HighLevel Inc. — Sales management and messaging channel (CRM) — United States — safeguard: European Commission Standard Contractual Clauses
• Vercel Inc. — Hosting of this website — United States — safeguard: EU-US Data Privacy Framework
• Google Ireland Ltd. — Advertising campaigns and measurement — Ireland (European Union)
• Meta Platforms Ireland Ltd. — Advertising campaigns and measurement — Ireland (European Union)
• Contabo GmbH — Server and database — Germany (European Union)
• Backblaze, Inc. — Encrypted server backup — Netherlands (European Union), with its parent company in the United States — safeguard: EU-US Data Privacy Framework
• Raiola Networks, S.L. — Domain and corporate email — Spain
• Digitel Tera, S.L. — Telephone switchboard — Spain

We will also disclose your data where required by law.

Third-party services built into the website

The website also uses third-party services that receive some browsing data —at least your IP address—. They do not act on our behalf: each of them processes that data as a controller, under its own privacy policy.

• Microsoft Corporation (Microsoft Clarity) — Analysis of how the site is used, through heatmaps and session replays. Only if you accept analytics cookies — United States — safeguard: EU-US Data Privacy Framework
• Google Ireland Ltd. (Google Fonts) — Website fonts: when the page loads, your browser requests them from Google, which receives your IP address — Ireland (European Union)
• Google Ireland Ltd. (reCAPTCHA) — Protection of the contact form against automated submissions; it receives technical data from your browser and your IP address — Ireland (European Union)
• Google Ireland Ltd. (YouTube y Google Maps) — Videos and map on the site, and the information video we send before your first visit. They only load when you click on them or open the link — Ireland (European Union)

International transfers

Yes, part of your data is processed in the United States. We tell you exactly who and with what safeguard:

• Anthropic PBC (United States) — Conversational assistant: processes the content of the conversation — European Commission Standard Contractual Clauses and supplementary measures
• HighLevel Inc. (United States) — Sales management and messaging channel (CRM) — European Commission Standard Contractual Clauses
• Vercel Inc. (United States) — Hosting of this website — EU-US Data Privacy Framework
• Backblaze, Inc. (Netherlands (European Union), with its parent company in the United States) — Encrypted server backup — EU-US Data Privacy Framework
• Microsoft Corporation (Microsoft Clarity) (United States) — Analysis of how the site is used, through heatmaps and session replays. Only if you accept analytics cookies — EU-US Data Privacy Framework

The United States does not, as a general rule, offer a level of protection equivalent to that of the European Economic Area. The safeguards above are the instruments provided for in Chapter V of the GDPR to cover these transfers. You can request a copy of them by writing to the Data Protection Officer.

How long do we keep your data?

• If you contact us and do not book an appointment: 12 months from the last contact.
• If you book an appointment and your details are passed on to a clinic: 2 years from when your details are passed on to the clinic.
• Once you are a patient of a clinic, your medical records are kept in accordance with healthcare regulations, under the responsibility of the company that owns that clinic.

After those periods, the data is kept blocked only for as long as legal liabilities may arise, and is then deleted.

Do you have to give us your data?

No. It is voluntary, but without your identification and contact details we cannot answer your enquiry or offer you an appointment. If you prefer not to leave your details in a form, you can call us on 722 23 90 76 or write to clinicamalaga@bybdental.com, and we will help you just the same.

What are your rights?

• Access: to know whether we process your data and obtain a copy.
• Rectification: to correct inaccurate data.
• Erasure: to ask us to delete it.
• Objection: to object to processing, including the classification of your enquiry.
• Restriction: to ask us to suspend processing while a complaint is resolved.
• Portability: to receive your data in a structured, commonly used format.
• Withdraw your consent at any time, as easily as you gave it.

To exercise them, write to us at clinicamalaga@bybdental.com or to the Data Protection Officer at dpo.bybdental@lock4data.es, stating which right you are exercising and enclosing a document proving your identity.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es.

Security

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, bearing in mind that we process health data. We review them periodically under the supervision of the Data Protection Officer.

Cookies

The use of cookies is described in our Cookie Policy, where you can change your preferences at any time.

Changes to this policy

We may update this policy to reflect changes in the law or in our processing. The date of the last update appears at the top of the document.