Privacy policy
Last updated: October 2026
1. Data controller
- Controller: TIRBOQUI, S.L.
- Tax ID (CIF): B88462965
- Address: C/ de las Magnolias 37, local 3, 11500 El Puerto de Santa María (Cádiz)
- Email: citas@smilestudio.es
- Phone: 856 14 60 00
2. Why we process your data and on what legal basis
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Website form | Name, phone number, email address, treatment of interest and message | Handle your request and arrange an appointment | Your consent — Art. 6.1.a) GDPR |
| Medical record and healthcare | Identification data and health data | Provide dental care, diagnosis and treatment | Art. 9.2.h) GDPR (preventive medicine, diagnosis and healthcare), in conjunction with Law 41/2002 and the 17th Additional Provision of the LOPDGDD (Spanish Organic Law 3/2018 on Data Protection) |
| Billing and accounting | Identification and financial data | Comply with legal, tax and accounting obligations | Legal obligation — Art. 6.1.c) GDPR |
| Appointment and check-up reminders | Name, phone number, email address | Remind you of your appointments and periodic check-ups | Performance of the care relationship and legitimate interest — Art. 6.1.b) and 6.1.f) GDPR |
| Marketing communications | Name, email address, phone number | Send you information about the clinic's services and news | Your specific, separate consent — Art. 6.1.a) GDPR and Art. 21 LSSI |
| Form security (reCAPTCHA) | IP address and interaction data | Prevent automated spam submissions | Legitimate interest — Art. 6.1.f) GDPR |
| Web analytics | Cookie identifiers and browsing data | Understand how the website is used in order to improve it | Your consent — Art. 6.1.a) GDPR and Art. 22.2 LSSI |
No automated decisions are made and no profiling with legal effects on the data subject is carried out.
3. How long we keep your data
- Form requests that do not lead to an appointment: deleted no later than one year after the last contact.
- Medical record: a minimum of five years from the date of discharge of each care episode, pursuant to Article 17.1 of Law 41/2002, the basic law regulating patient autonomy; without prejudice to any longer periods that may apply under the health regulations of the Regional Government of Andalusia (Junta de Andalucía) or the need to address potential liabilities.
- Billing data: four years for tax purposes (Law 58/2003, General Tax Law) and six years for commercial purposes (Art. 30 of the Commercial Code).
- Marketing communications: until you withdraw your consent or object. Every communication will include a simple, free way to unsubscribe.
Once those periods have elapsed, the data are blocked and remain available only to public authorities, judges and courts, and are deleted once any liabilities have become time-barred.
4. Who we share your data with
We do not disclose your data to third parties, except where legally required. The following categories of providers access them as data processors, under the contract required by Article 28 of the GDPR:
| Provider or category | Service | Location |
|---|---|---|
| DonDominio (Soluciones Corporativas IP, S.L.U.) | Website and email hosting | Spain / EU |
| Patient management and medical record software provider | Clinical management and scheduling | EU |
| Tax, accounting and labor advisors | Compliance with legal obligations | Spain |
| Google Ireland Ltd. / Google LLC | reCAPTCHA (anti-spam) and web analytics | EU / USA |
In addition, your data may be disclosed to health authorities, insurance companies or Courts and Tribunals where there is a legal obligation to do so.
5. International transfers
The use of reCAPTCHA and web analytics may involve a transfer of data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, declared adequate by European Commission Implementing Decision (EU) 2023/1795, which constitutes an appropriate safeguard under Article 45 of the GDPR.
Analytics cookies are only set if you accept them: if you reject them, that transfer does not take place. You can find the details in our cookie policy.
6. Your rights
You may exercise the following rights at any time:
- Access: know what data of yours we process.
- Rectification: correct inaccurate data.
- Erasure: ask for your data to be deleted when they are no longer necessary. This right is limited in the case of the medical record, which the clinic is legally required to keep.
- Restriction of processing.
- Objection to processing based on legitimate interest.
- Portability of the data you have provided to us.
- Withdraw your consent at any time, without affecting the lawfulness of the processing carried out before.
To exercise them, write to citas@smilestudio.es or send a letter by postal mail to C/ de las Magnolias 37, local 3, 11500 El Puerto de Santa María (Cádiz), proving your identity with a copy of your national ID card (DNI) or an equivalent identity document.
If you believe your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
7. Children's data
8. Data security and accuracy
We apply appropriate technical and organizational measures pursuant to Article 32 of the GDPR, including encrypted communications (HTTPS), access control to the clinical software and backups. You guarantee that the data you provide are accurate and agree to inform us of any changes.