Skip to content
Luce star iconLuce logo

Legal

Privacy Policy

At LUCE DENTAL TECH SL, we are committed to protecting and respecting your privacy.

Last updated: 10/1/2026

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), LUCE DENTAL TECH SL informs users of the website www.luce.es about its policy regarding the treatment and protection of personal data of users and customers that may be collected during browsing or contracting services through its website.

1. Data Controller

LUCE DENTAL TECH SL
NIF: B21971098
Address: Carrer del Comte d'Urgell, 25 - Ground Floor, 08011 Barcelona
Email: privacidad@luce.es
Phone: +34 934 230 919

2. Personal Data We Process

The personal data that LUCE DENTAL TECH SL may collect and process includes:

2.1 Data provided directly by the user

  • Identification data: name and surnames, DNI/NIE/Passport, date of birth.
  • Contact data: postal address, email address, phone number.
  • Health data: information about your dental health necessary for the safe provision of our dental jewelry services, relevant medical history, allergies, current medication.
  • Economic data: bank details, credit/debit card for payment management.
  • Image data: dental photographs for treatment follow-up and consent for promotional use when expressly authorized.

2.2 Data obtained during browsing

  • IP Address
  • Browser type
  • Operating system
  • Pages visited
  • Time spent
  • Visit origin

3. Purposes of Processing

The personal data collected will be processed for the following purposes:

  • Service provision: Managing the placement, maintenance and follow-up of dental jewelry, as well as any service related to the user's dental health.
  • Administrative management: Billing, accounting and compliance with legal obligations.
  • Commercial communications: Sending information about our products, services, offers and news, provided that the user has given express consent.
  • Service improvement: Statistical and navigation analysis to improve user experience and our services.
  • Customer service: Management of queries, complaints and information requests.
  • Legal compliance: Comply with applicable legal obligations, especially in health matters.

4. Legal Basis for Processing

The legal basis for processing your personal data is:

  • Contract execution: Processing is necessary for the provision of contracted dental jewelry services.
  • Data subject consent: For sending commercial communications, processing health data and using images for promotional purposes.
  • Compliance with legal obligations: Especially in tax, health and anti-money laundering matters.
  • Legitimate interest: To keep the website secure and working, by detecting and fixing errors; to improve our services; and to measure the effectiveness of our advertising using only the click identifier supplied by the advert, without your contact details.

5. Data Recipients

Your personal data may be communicated to:

  • Health professionals: Dentists and dental clinics in our network for service provision.
  • Public Administrations: When legally required (Tax Agency, health authorities, law enforcement).
  • Financial entities: For payment and collection management.
  • Service companies: Providers that process data on LUCE's behalf: web hosting and content delivery, corporate email, database and sign-in, email delivery, technical error detection and web analytics. Section 6 names them and says where they process the data.
  • Web analytics: If you accept analytics cookies, Google (Google Analytics) and Mixpanel receive the pages you visit and the actions you take on the website, your cookie identifiers, details of your device and browser and, in Google's case, your approximate location, and, in Mixpanel's case, your account's internal identifier if you are signed in; Mixpanel also records some sessions with form fields hidden and without recording the content of your account or of payments. Google Analytics receives nothing, and its tag is not even loaded, until you accept analytics cookies. So that these analytics and marketing tools load from our own domain, our servers forward their requests, with your IP address, to each provider without storing them, apart from our hosting provider's temporary technical logs.
  • Advertising platforms: If you accept marketing cookies, Meta and Pinterest (and Google, if you also accept analytics cookies, since its tag only loads with them) receive through their tags the pages you visit, the actions you take (for example, sending an enquiry or buying) and your cookie identifiers, to measure and improve our ads. Meta and Pinterest act as joint controllers with LUCE for collecting and transmitting that data: under their joint controller addenda, LUCE is responsible for informing you and obtaining your consent before that collection, and each platform is responsible for what it does with the data once received. You may exercise your rights over that processing with LUCE or with either platform (Article 26 GDPR). With your consent to marketing — whether by accepting the marketing category in Cookie settings or by ticking the optional marketing box on a contact form — we disclose to Meta Platforms Ireland Ltd. an irreversibly hashed (SHA-256) version of your email address and, where you provide it, your phone number, together with advertising cookie identifiers where present, your IP address, your browser's user agent, the page from which you sent the form and the estimated value of your enquiry, to measure the effectiveness of our advertising. The legal basis is your consent (section 4); you can withdraw it at any time in Cookie settings or by writing to the address given in section 1, without affecting the handling of your enquiry or the lawfulness of processing carried out beforehand. Without that consent, we do not disclose your email, phone number, name, message, IP address or cookie identifiers. If you reached us by clicking one of our adverts, we report to Meta only that a contact occurred, using the click identifier the advert itself supplied, your browser's user agent, the page and the estimated value of the enquiry, on the basis of our legitimate interest in measuring the effectiveness of our advertising (section 4); you may object at any time by writing to the address given in section 1. We never disclose your name or your message. The same applies to purchases: if you accept marketing cookies, we send Meta the full order data (hashed email address, IP address, user agent and Meta cookie); if you do not and you reached us through one of our adverts, we report to Meta only the purchase, using the click identifier of the advert, your browser's user agent and the order's value, products and number, on the basis of our legitimate interest in measuring the effectiveness of our advertising (section 4); you may object at any time by writing to the address given in section 1. Without a click identifier or a user agent we send nothing. Google Analytics receives the full purchase from our servers only if you accept analytics cookies; otherwise, it receives nothing.

All our service providers are contractually bound to maintain the confidentiality and security of personal data.

6. International Transfers

Some of the providers involved in running this website are established outside the European Economic Area (EEA), mainly in the United States, or can access the data they process from there. In those cases the transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), where the US company is certified under it, or on the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), included in our contract with each provider. These are the providers, what they do with your data and which safeguard applies:

  • Cloudflare, Inc. (United States): hosts the website and our servers, so it processes your IP address and the content of each request; delivers images and videos; and stores the files the service produces; signed consent documents and signatures are stored in Cloudflare R2 storage in the European Union (EU jurisdiction). Safeguard: Data Privacy Framework and standard contractual clauses.
  • Supabase Pte. Ltd. (Singapore): hosts our database and the sign-in system on servers in the European Union (Paris, France). Its staff and sub-processors may access the data from Singapore or the United States to provide support and maintenance. Safeguard: standard contractual clauses.
  • Stripe Payments Europe, Limited (Ireland): processes payments. You enter your card details directly on Stripe's page and LUCE never receives them. The Stripe group may process payment data in the United States and processes some of it as a controller to prevent fraud and meet its legal obligations. Safeguard: Data Privacy Framework and standard contractual clauses.
  • Resend (Plus Five Five, Inc., United States): sends our emails, such as your order confirmation or our internal notice of an enquiry you send us, and keeps its logs in the United States. Safeguard: Data Privacy Framework and standard contractual clauses.
  • Sentry (Functional Software, Inc., United States): records technical errors on the website and our servers so we can fix them. We configure it so that reports do not include your name, email address or IP address; if you are signed in they carry your account's internal identifier, and the screen recording attached to an error hides all text and images. It stores them in the European Union (Frankfurt, Germany); its staff may access them from the United States to provide support. Safeguard: Data Privacy Framework and, failing that, standard contractual clauses.
  • Google Ireland Limited and Google LLC (United States): if you accept analytics cookies, measure how the website is used with Google Analytics and, if you also accept marketing cookies, how well our ads perform in Google Ads (section 5). Google also hosts our email (Google Workspace). Visits from the EEA are collected on servers in the European Union, which use your IP address only to work out your approximate location and do not store it; Google may then process the data in the United States. Safeguard: Data Privacy Framework and, failing that, standard contractual clauses.
  • Mixpanel, Inc. (United States): if you accept analytics cookies, analyses how the website is used (section 5). It stores the data in the European Union; its staff may access it from the United States to provide support. Safeguard: Data Privacy Framework and standard contractual clauses.
  • Meta Platforms Ireland Limited (Ireland): receives the data described in section 5 and may transfer it to Meta Platforms, Inc. in the United States. Safeguard: Data Privacy Framework and standard contractual clauses.
  • Pinterest Europe Limited (Ireland): if you accept marketing cookies, receives the data described in section 5 and may transfer it to Pinterest, Inc. in the United States. Safeguard: Data Privacy Framework and standard contractual clauses.
  • WhatsApp Ireland Limited (Ireland): if you choose to message us on WhatsApp, processes your phone number and the messages we exchange and may transfer them to Meta Platforms, Inc. in the United States. Safeguard: Data Privacy Framework and standard contractual clauses.

You can check which companies are certified under the Data Privacy Framework at www.dataprivacyframework.gov/list and read the standard contractual clauses on eur-lex.europa.eu (Decision 2021/914). You can also ask us for a copy of the safeguards that apply to any of these transfers by writing to the address given in section 1.

Google, Meta and Pinterest also process the data they receive through their marketing tags as controllers, for their own purposes; their own privacy policies explain the transfers they make. We will update this section before we engage a new provider outside the EEA.

7. Retention Period

Personal data will be retained for the following periods:

  • Customer data: During the term of the contractual relationship and, subsequently, during the limitation period for applicable legal actions (generally 5 years for personal actions). With every order we also store your IP address, your browser data and, if you arrived from an ad, its click identifiers (gclid, fbclid, ttclid), regardless of your cookie preferences, to keep the order record, handle payment disputes and chargebacks, prevent fraud and measure our advertising within the limits described in section 5, and we keep them for that same period. The basis is contract performance, compliance with legal obligations and our legitimate interest in preventing fraud and measuring advertising.
  • Health data: In accordance with applicable health legislation, at least 5 years from the end of treatment.
  • Data for commercial purposes: Until the user requests deletion or withdraws the consent granted.
  • Navigation data: Maximum 2 years from collection.

8. Data Subject Rights

In accordance with the GDPR, you have the following rights:

  • Right of access: Obtain confirmation as to whether we are processing your personal data and access to it.
  • Right to rectification: Request rectification of inaccurate or incomplete data.
  • Right to erasure: Request the deletion of your data when they are no longer necessary for the purposes for which they were collected.
  • Right to restriction: Request the restriction of processing in the cases provided for in the GDPR.
  • Right to portability: Receive your data in a structured, commonly used and machine-readable format.
  • Right to object: Object to the processing of your data, especially for direct marketing purposes.
  • Right to withdraw consent: When processing is based on consent, you may withdraw it at any time.

To exercise these rights, you can contact LUCE DENTAL TECH SL by:

  • Email: privacidad@luce.es
  • Postal mail: Carrer del Comte d'Urgell, 25 - Ground Floor, 08011 Barcelona

You must attach a copy of your DNI or equivalent identification document. If acting through a representative, you must also provide a document proving the representation.

We also inform you of your right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your personal data violates applicable regulations.

9. Security Measures

LUCE DENTAL TECH SL has adopted the necessary technical and organizational measures to guarantee the security and integrity of data, as well as to prevent its loss, alteration and/or access by unauthorized third parties, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed.

Among the implemented measures are:

  • Encryption of sensitive data
  • Access control through authentication
  • Periodic backup copies
  • Staff training in data protection matters
  • Regular security audits
  • Action protocols for security incidents

10. Minors' Data

LUCE DENTAL TECH SL services are not aimed at persons under 18 years of age. If it is necessary to process data of minors for the provision of services, the consent of parents or legal guardians will be required.

11. Social Networks

LUCE DENTAL TECH SL has a presence on major social networks (Facebook, Instagram, Twitter, LinkedIn). The processing of data of persons who become followers on LUCE DENTAL TECH SL social networks will be governed by this section, as well as by those conditions of use, privacy policies and access regulations that belong to the social network that applies in each case.

LUCE DENTAL TECH SL will process your data for the purposes of correctly managing its presence on the social network, informing you of its activities, products or services, as well as for any other purpose that social network regulations allow.

12. Privacy Policy Modifications

LUCE DENTAL TECH SL reserves the right to modify this privacy policy to adapt it to legislative or jurisprudential developments, as well as industry practices. In such cases, it will announce on this page the changes introduced with reasonable advance notice of their implementation.

Cookie Preferences

We use our own and third-party cookies. Necessary ones keep the website working; analytics and marketing cookies are only used if you accept them. You can accept, reject or configure them. Cookie policy