Privacy policy

1. Controller
Rocket Dental GmbH, Bahnhofstraße 24, 79798 Jestetten, Germany
Email: privacy@rocket.dental
(see /en/imprint/ for legally required company details)

2. Purposes and Legal Bases
We process personal data to operate this website, respond to enquiries, perform audience measurement/analytics (with your consent), manage newsletter subscriptions, and administer partner/influencer applications. Legal bases: Art. 6(1)(b) GDPR (contract/pre‑contract), Art. 6(1)(f) GDPR (legitimate interests: secure, efficient operation), and— for cookies/tracking and newsletter—your consent under Art. 6(1)(a) GDPR in conjunction with Sec. 25 TDDDG (access/storage on end‑devices). You can withdraw consent at any time with future effect.

3. Hosting & Security (Kinsta, Cloudflare)
We use an EU hosting provider (Kinsta) and a content delivery/security network (Cloudflare). Server log data (IP address, timestamp, requested resource, user agent) are processed to deliver the website and defend against attacks (Art. 6(1)(f) GDPR). Logs are stored only briefly and then deleted or anonymised.

4. Consent Management (Cookie Banner)
Non‑essential cookies/technologies are used only after your consent. You can change or withdraw your choices at any time via the “Cookie settings” link in the footer. Without consent, only technically necessary cookies/storage are set.

5. Web Analytics (Google Analytics 4 via Google Tag Manager)
Analytics runs only with your consent. We use IP anonymisation. Provider: Google Ireland Ltd.; transfers to Google LLC (USA) may occur under EU Standard Contractual Clauses. You can withdraw consent at any time in the cookie settings.

6. Contact Forms & Communication
If you contact us, we process the data you provide (e.g., name, email, message) to handle your request (Art. 6(1)(b)/(f) GDPR) and retain it only as long as necessary to process your request.

7. Newsletter (Brevo)
We use Brevo (Sendinblue) with double opt‑in. Legal basis: your consent, Art. 6(1)(a) GDPR. You can unsubscribe at any time. Processing occurs in the EU; sub‑processors may be involved. Email performance tracking (opens/clicks) occurs only if you have consented.

8. Partner/Influencer Applications (Pipedrive)
We use Pipedrive CRM to administer partner and influencer leads. Legal bases: Art. 6(1)(b) GDPR (pre‑contractual steps) and Art. 6(1)(f) GDPR (efficient processing). Data may be processed in the EU/EEA; where transfers to third countries occur, we rely on Standard Contractual Clauses.

9. Abuse Protection (reCAPTCHA)
To protect forms, we may use Google reCAPTCHA (legitimate interests, Art. 6(1)(f) GDPR). Usage data may be transferred to Google; details are provided by the vendor. The check runs only when you use the form.

10. Social Media (Instagram) – Joint Controllership
For our Instagram page, we and Meta Platforms Ireland Ltd. act as joint controllers under Art. 26 GDPR (“Page Insights Controller Addendum”). Meta assumes primary responsibility. You may exercise GDPR rights against us and/or Meta. See Meta’s privacy information and the Addendum for details.

11. Recipients & International Transfers
Vendors (hosting, CDN, analytics, newsletter, CRM, IT support) process data under data processing agreements. Where data are transferred outside the EU/EEA, we rely on appropriate safeguards (in particular EU Standard Contractual Clauses).

12. Storage Period
We keep personal data only as long as necessary for the purposes stated or as required by law, and then delete or anonymise it.

13. Your Rights
You have the rights of access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent. You may also lodge a complaint with a supervisory authority.

14. Security
We use TLS encryption and appropriate technical and organisational measures to protect your data.

15. Changes
We may update this notice to reflect changes. Last updated: 7 November 2025.