1. Data Controller
within the meaning of Article 4(7) of the GDPR is:
Data Controller
KaVo Dental GmbH
Bismarckring 39
88400 Biberach
Germany
Phone: +49 (0) 7351 56-0
Email: privacy@kavo.com
Managing Directors:
Mr. Armin Imhof
Mr. Oliver Krett
Data Protection Officer
If you have any questions regarding data protection, please contact:
Mr. Stefan Kleinermann
Kleinermann & Sohn GmbH
Max-Planck-Str. 9
52499 Baesweiler
Germany
Phone: +49 (0) 2401 6054-0
Email: dsb@das-datenschutz-team.de
2. Purposes of Processing and Legal Bases
The primary purpose of processing your personal data is the planning, organization, and delivery of training events.
To participate in our training events, registration in the KaVo Portal is required. Through the portal, you can register for training courses, manage your training activities, and track your learning paths. The data required for registration are specified in the registration form and described in Section 3 of this Privacy Notice.
In addition, we process your personal data, where necessary, for the following purposes:
- Issuing visitor badges (Article 6(1)(b) GDPR, where the badge is required for the organization of the event; otherwise Article 6(1)(f) GDPR)
- Issuing certificates of attendance (Article 6(1)(b) GDPR)
- Organizing and processing hotel bookings, where applicable (Article 6(1)(b) GDPR; Article 6(1)(c) GDPR where statutory retention and record-keeping obligations apply)
- Organizing taxi or bus transfers, where applicable (Article 6(1)(b) GDPR where such arrangements are necessary for the organization of the event; otherwise Article 6(1)(f) GDPR)
- Organizing evening events, where applicable (Article 6(1)(b) GDPR where the evening event forms part of the training event; otherwise Article 6(1)(f) GDPR)
- Internal accounting (Article 6(1)(c) GDPR where required by law; otherwise Article 6(1)(f) GDPR)
- Collecting and evaluating participant feedback, where applicable (Article 6(1)(f) GDPR)
- Photographs, audio recordings, and video recordings may be made during KaVo Dental GmbH training events and published in various online and offline media. These recordings may include images of attendees, who are captured incidentally. The recordings may be published on the KaVo Dental GmbH website, in printed publications, and on KaVo Dental GmbH's social media channels. This also applies to events organized in cooperation with third parties. (Article 6(1)(a) GDPR; Article 6(1)(f) GDPR)
Where personal data relating to employees are processed as part of training activities, such processing is carried out on the basis of Section 26 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).
Where processing is based on Article 6(1)(f) GDPR, our legitimate interests include, in particular, the efficient and flexible organization and delivery of training events in terms of time and location, the administrative management of participants, statistical analysis to improve the quality of our services, and the documentation and reporting of training events.
3. Categories of Personal Data
In the course of registration, enrolment, and participation in training events, we process the following categories of personal data:
- Registration in the Portal, enrolment in training courses, management of your training activities, and tracking of learning paths: first name, last name, customer group, country, country code, telephone number, and company information (company name, street and house number, postal code, city, and region)
- Issuance of visitor badges: first name, last name, and the name of your company
- Delivery of training events: where applicable, your shoe size (e.g. for production facility tours requiring the provision of safety shoes), arrival and departure dates, and information relating to hotel bookings
- Issuance of certificates: first name, last name, training course title, and date of participation
- Event feedback: your anonymized or pseudonymized feedback relating to the respective training course
- Reporting, where applicable: photographs, audio recordings, and video recordings.
4. Source of the Data
Registration in the KaVo Portal is required in order to participate in our training events.
Registration for the respective training courses may be completed either by you or by your employer.
5. Obligation to Provide Data
Registration in the KaVo Portal is mandatory in order to participate in our training events. If neither you nor your employer, who wishes to register you for a training course, has an account in the Portal, it will not be possible to register for a training event offered by KaVo Dental GmbH.
6. Data Subject Rights
As a data subject, you have the right to obtain information about the processing of your personal data (Article 15 GDPR), the right to rectification (Article 16 GDPR), the right to erasure ("right to be forgotten") (Article 17 GDPR), the right to restriction of processing (Article 18 GDPR), and the right to data portability (Article 20 GDPR).
You also have the right to withdraw your consent to the processing of your personal data at any time (Article 7(3) GDPR). Withdrawal of your consent does not affect the lawfulness of processing based on your consent before its withdrawal. Furthermore, any continued processing of your personal data on another legal basis, such as compliance with legal obligations (e.g. statutory retention periods), remains unaffected.
We do not use automated decision-making or profiling (Article 22 GDPR).
Right to Object (Article 21 GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data where such processing is based on our legitimate interests (Article 6(1)(f) GDPR). This applies in particular where the processing is not necessary for the performance of a contract. If you exercise your right to object, we kindly ask you to explain the reasons for your objection. We will then cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defence of legal claims. Please address your objection to the contact details of the Data Controller provided above.
If you believe that the processing of your personal data violates applicable data protection laws or otherwise infringes your data protection rights, you have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or the location of our registered office (Article 77 GDPR).
To exercise your data subject rights, please contact the office indicated above. Requests submitted electronically will generally be answered electronically.
The information, communications, and actions to be provided under the GDPR, including those relating to the exercise of data subject rights, are generally provided free of charge. However, in the case of manifestly unfounded or excessive requests, we are entitled to charge a reasonable fee or refuse to act on the request (Article 12(5) GDPR).
Where we have reasonable doubts concerning your identity, we may request additional information necessary to verify your identity. If we are unable to identify you, we may refuse to process your request. Where possible, we will inform you separately if we are unable to identify you (Articles 12(6) and 11 GDPR).
Requests for access to information and other data subject requests are generally processed without undue delay and, in any event, within one month of receipt. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests. In the event of such an extension, we will inform you within one month of receiving your request of the reasons for the delay. If we do not take action on your request, we will inform you without undue delay and within one month of receipt of the request of the reasons for not taking action and of your right to lodge a complaint with a supervisory authority or seek a judicial remedy (Article 12(3) and (4) GDPR).
Please note that you may exercise your data subject rights only within the limits and restrictions provided for under European Union or Member State law (Article 23 GDPR).
7. Recipients and Categories of Recipients of Personal Data
Your personal data will be shared, where necessary for the organization and delivery of the training event, with the relevant internal departments of KaVo Dental GmbH responsible for organizing and conducting the event (e.g. for the issuance of visitor badges), as well as with external service providers (e.g. hotels) involved in the organization and delivery of the event.
Where service providers engaged by us process your personal data on our behalf (e.g. in connection with hosting the Campus website or the use of platforms for collecting seminar feedback), such processing is carried out on the basis of a Data Processing Agreement in accordance with Article 28 GDPR.
8. Transfers of Personal Data to Third Countries
Transfers of personal data to third countries are not intended. Such transfers will only take place where required under existing contractual obligations, for necessary communications, or under other exceptions expressly provided for in Articles 44–49 GDPR.
Where photographs, audio recordings, or video recordings are published on social media platforms, personal data may be transferred to a third country outside the European Union (EU) or the European Economic Area (EEA), in particular to the United States. This applies in particular to the following providers:
- Facebook is a service provided by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Within the European Union, this service is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Hereinafter, both entities are jointly referred to as "Facebook." Facebook's Privacy Policy is available at: https://www.facebook.com/about/privacy
- Instagram is a service provided by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Within the European Union, this service is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Instagram's Privacy Policy is available at: https://privacycenter.instagram.com/policy/
- LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn's Privacy Policy is available at: https://www.linkedin.com/legal/privacy-policy
- XING is a service provided by New Work SE, Baumwall 7, 20459 Hamburg, Germany. XING's Privacy Policy is available at: https://www.xing.com/legalnotice
- X is a service provided by X Corp., 865 FM 1209, Building 2, Bastrop, TX 78602, USA. X's Privacy Policy is available at: https://privacy.x.com/
- Pinterest is a service provided by Pinterest Inc., 635 High Street, Palo Alto, CA 94301, USA. Within the European Union, this service is operated by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Pinterest's Privacy Policy is available at: https://about.pinterest.com/privacy-policy
- YouTube is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Within the European Union, this service is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's Privacy Policy is available at: https://policies.google.com/privacy
- TikTok is a service provided by TikTok USDS Joint Venture LLC, 5800 Bristol Parkway, Suite 300, Culver City, CA 90230, USA. Within the European Union, this service is operated by TikTok Technology Limited, The Sorting Office, Ropemaker Place, Dublin 2, D02 HD23, Ireland. TikTok's Privacy Policy is available at: https://www.tiktok.com/legal/page/eea/privacy-policy/en
9. Data Retention Period
As a general rule, we delete personal data once it is no longer required for the purposes for which it was collected. Personal data may need to be retained, in particular, where it is still required to perform contractual obligations, to establish, exercise, or defend warranty claims and, where applicable, guarantee claims. Where statutory retention obligations apply, personal data will only be deleted after the applicable retention period has expired.