Privacy policy
Who we are and our role
DigiDent is run by Spics Digital Marketing SH.P.K., registered with the Kosovo Business Registration Agency (ARBK), NUI 812274893, Rruga Ukë Bytyqi, Prizren, Kosovo. Contact, including for data protection: hello@digident.app. We have no data protection officer.
Under Law No. 06/L-082 on Protection of Personal Data (“the Law”), we are the controller for the data of visitors to www.digident.app, of people who request a demo or write to us, of customer clinics and the people who act for them, and for account security. For everything a clinic enters in the app, the clinic is the controller and we are a processor.
The site and app are not aimed at children under 16 and we do not knowingly collect their data; if we learn of it, we delete it.
Our website and demo requests
| When | Data | What for | Legal basis (Article) |
|---|---|---|---|
| Every visit | IP address, browser and request details | Showing and protecting the site (the site can't be shown without it) | Legitimate interest, 5(1.6) |
| Google Analytics 4 | Pages viewed, device, browser, approximate location | Visit statistics | Consent, 5(1.1) |
| Demo or email | First name, last name, email, message; clinic name optional; for the form, also your IP address. The form isn't sent without the required fields | Replying, the demo, protecting the form from abuse | Legitimate interest, 5(1.6); steps before concluding a contract, 5(1.2), for individuals |
Google Analytics (Google LLC) loads only if you accept it, with advertising features off. If you reject it, the site works the same. You can withdraw consent at any time under “Cookie settings” at the bottom of our pages; the Analytics cookies are deleted and earlier processing is not affected (Article 6(3)). See the Cookie policy. We add no one to a mailing list and send no marketing.
Clinics and their staff
Clinics. We use the clinic's identification and contact details, contacts of the people acting on its behalf, the plan, invoices, payments and support requests, which the clinic gives us. Purposes: the contract, billing, support, notices about changes to the service, prices or terms (not marketing), tax duties and legal claims. Basis: contract (5(1.2)) for individuals, legal obligation (5(1.3)) for invoices, otherwise legitimate interest (5(1.6)). Without these details no contract can be concluded.
Staff. The clinic admin creates your account (we create the first one) with your name, email and role; you activate it through a link sent by email, so an email address is required. We are the controller only for your account and login data, the audit trail (any patient details in it we process only for the clinic), technical logs, your IP address and support, to keep the service secure (legitimate interest, 5(1.6)).
Patient data
Clinics keep patient records in DigiDent. The clinic is the controller: it decides about this data and informs its patients, including child patients. We are the processor and act only on its instructions and the Data processing agreement. We never use the data for ourselves: not for testing, analytics or marketing, and not to train AI. Patients should contact their clinic; we pass on requests that reach us.
Who receives data and where
We don't sell personal data or share it for advertising.
| Recipient | What for | Where |
|---|---|---|
| Hosting providers | Website, app, email | In the EU |
| File storage and backups provider | Clinic files, backups | In the EU |
| Google LLC | Analytics (with consent) | US, in the EU-US Data Privacy Framework |
Public authorities (tax administration, courts, AIP) receive data only as far as the law requires. Clinics receive the named list of sub-processors with the contract, and on request at hello@digident.app.
EU member states are on the AIP's list of countries with adequate protection (Decision No. 22/2025, 30 April 2025), so no authorisation is needed; the US only for companies in the Framework. Some of our providers are US companies; data reaching them in the US moves only under the Framework or another lawful safeguard. For Albania, the IDP likewise recognises Kosovo, the EU member states and US companies in the Framework (Decision No. 01, 30 April 2025). We send a copy of the safeguards on request.
How long we keep data
| Data | How long |
|---|---|
| Website visits, technical logs | Briefly |
| Google Analytics | Event data 2 months; cookies up to 2 years |
| Demo requests, emails | 12 months after the last exchange; if they lead to a contract, as for customers |
| Customer emails | While the contract runs, then 12 months after the last exchange |
| Contract, invoices, payments | As long as Kosovo tax and accounting law requires |
| Staff accounts, audit trail, patient data in support requests | With the clinic's data, within 90 days of the end of the contract; for the free trial, see the Terms |
| Backups | Until they expire in the regular cycle; restored only to recover the service |
How we protect data
We protect data with encryption in transit, personal accounts with roles, an audit trail, private file storage and access limited to the people who run the service; clinics receive a fuller description with the contract and on request. For breaches of data we control, we notify the AIP within 72 hours of becoming aware, unless the breach is unlikely to put people's rights and freedoms at risk (Article 33), and tell affected people when the risk is high (Article 34). For a clinic's data, we tell the clinic without undue delay and within 48 hours (see the Data processing agreement).
Your rights
You have the right of access (Article 14), rectification (15), erasure (16), restriction of processing (17), portability where processing is based on consent or contract (19) and objection (20), and you can withdraw consent at any time (6(3)). We make no decisions based solely on automated processing and do no profiling (Article 21).
Write to hello@digident.app. It is free; we may refuse clearly unfounded or excessive requests or charge a reasonable fee. We reply without undue delay and within 1 month; for complex or numerous requests, up to 2 more months, and we tell you why within the first month. If we don't act on your request, we tell you why within 1 month and that you can complain (Article 11). In Albania (Law No. 124/2024): within 30 days, with any extension never beyond 60 days from receipt (Article 12(4)).
Limits: we keep invoices as tax law requires even if you ask us to delete them; your clinic admin can change most of a staff profile.
Your right to object
Where we rely on legitimate interests (the website, security, questions, contact persons at clinics), you can object at any time on grounds relating to your situation. We then stop the processing, unless we have compelling legitimate grounds that override yours or need the data for legal claims.
Complaints
Information and Privacy Agency (AIP): Rr. “Zejnel Salihu” No. 22, 10000 Prishtina, Kosovo; info.aip@rks-gov.net; aip.rks-gov.net. In Albania: the Commissioner for the Right to Information and Personal Data Protection (IDP), Law No. 124/2024, Rr. “Abdi Toptani”, Nd. 5, 1001 Tirana, idp.al. You can also go to court (Article 54).
Changes, language and contact
Before material changes (new purposes, recipients or transfers, or a different way to use your rights) we notify customers by email and on the site; we tell you before using data for a new purpose. This policy is published in Albanian and English; if they differ, the Albanian version prevails. Contact: hello@digident.app.