Skip to content
Royalty

Privacy policy

As of: September 2026

1. Controller

Royalty Group Ltd, Maayanot 68, 2014200 Yuvalim, Israel. Email: info4u@royaltyr.com, phone: +972 54 241 2605 (“we”).

2. Representative in the EU (Art. 27 GDPR)

We are appointing a representative in the European Union pursuant to Art. 27 GDPR; the details will be added here. [Name and address to follow.]

3. What data we process

  • Contact data: name, phone number, email address, country of residence, preferred language.
  • Details of your enquiry: desired treatment, timeframe, messages to us.
  • Health data: e.g. x-ray images (such as panoramic scans), findings, photos of your teeth, information on complaints, pre-existing conditions and medication.
  • Organisational data: travel dates, accommodation, and passport data where required for the hotel booking.
  • Technical data when visiting the website: IP address, date and time, pages viewed, browser type (server log files).

4. Purposes and legal bases

  • Handling your enquiry, preparing a treatment plan and cost estimate, organising and accompanying the treatment: Art. 6(1)(b) GDPR.
  • Health data: Art. 6(1)(a) together with Art. 9(2)(a) GDPR (your explicit consent).
  • Promotional information by WhatsApp or email: Art. 6(1)(a) GDPR (consent).
  • Operation and security of the website (server log files): Art. 6(1)(f) GDPR; our legitimate interest in secure and stable operation.
  • Compliance with legal obligations: Art. 6(1)(c) GDPR.

5. Recipients

  • Partner clinic in Georgia: Tbilisi Dental — reviews your documents, prepares a treatment plan and treats you.
  • Accommodation and transfer services — only the data needed for the booking.
  • Hosting: Vercel Inc. (servers in Frankfurt am Main, Germany).
  • Email: Zoho.
  • Our team in Israel that handles your enquiry.
  • WhatsApp Ireland Ltd. when you contact us via WhatsApp (in particular metadata; message content is end-to-end encrypted).
  • Meta Platforms Ireland Ltd. when you use a form on Facebook or Instagram.

6. Transfers to third countries

Our partner clinic is in Georgia. There is no EU Commission adequacy decision for Georgia. The level of data protection there may be lower than in the EU, and enforcing your rights may be harder.

The transfer is based on your explicit consent (Art. 49(1)(a) GDPR) and because it is necessary for the treatment you have requested (Art. 49(1)(b) GDPR).

Your data is also processed in Israel. There is an EU Commission adequacy decision for Israel.

7. Retention

Enquiries that do not lead to treatment are deleted 5 years after the last contact. After treatment we keep your data for as long as it is needed for aftercare, and beyond that only where statutory retention obligations apply. The clinic keeps treatment records according to the rules that apply to it.

8. Cookies and tracking

This website uses the Google Ads tag of Google Ireland Ltd. to measure our advertising. It is only loaded after you have consented via our cookie banner (§ 25(1) TDDDG); without your consent no advertising or analytics cookie is set.

Data may be transferred to Google, including to the USA. You can change your consent at any time with effect for the future via the banner.

To book a free consultation call we use Calendly (Calendly LLC, USA). The booking page opens only when you click the button; only then does Calendly process your name, email address, phone number and the time you choose, in order to arrange the call (Art. 6(1)(b) GDPR). The transfer to the USA rests on the EU-US Data Privacy Framework or standard contractual clauses.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw a consent at any time with effect for the future (Art. 7(3) GDPR), e.g. by email to info4u@royaltyr.com.

You have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU member state of your residence (Art. 77 GDPR).

10. Obligation to provide data

Providing your data is voluntary. However, without health data no treatment plan can be prepared.

11. No automated decision-making

We do not take decisions based solely on automated processing within the meaning of Art. 22 GDPR.

12. Residents of Switzerland

The Swiss Federal Act on Data Protection (FADP) applies in addition. The competent authority is the Federal Data Protection and Information Commissioner (FDPIC). Your data is transferred to Georgia and Israel — with your consent or because it is necessary for the requested treatment.