Privacy policy & GDPR

ARTICLE 1: PREAMBLE

This privacy policy applies to the websites Smyline.com and pro.smyline.com, as well as to the MySmyline mobile application (iOS / Android).

The purpose of this privacy policy is to inform users of:

  • How their personal data are collected and processed. Personal data means any data that may identify a user, including first and last name, age, postal address, e-mail address, location or IP address;
  • What rights users have regarding such data;
  • Who is responsible for processing the personal data collected and processed;
  • To whom such data are disclosed;
  • Where applicable, the website’s cookie policy.

This privacy policy supplements the legal notice and the Terms of Use available at: Legal notice.

ARTICLE 2: GENERAL PRINCIPLES GOVERNING DATA COLLECTION AND PROCESSING

In accordance with Article 5 of EU Regulation 2016/679, the collection and processing of user data comply with the following principles:

  • Lawfulness, fairness and transparency: data may only be collected and processed with the consent of the data subject, or on another legal basis provided for by the GDPR. Whenever personal data are collected, the user will be informed that their data are being collected and for what purposes;
  • Purpose limitation: data are collected and processed for one or more specified purposes;
  • Data minimisation: only data necessary for the purposes pursued are collected;
  • Storage limitation: data are retained for a limited period of which the user is informed. Where this information cannot be provided, the user is informed of the criteria used to determine the retention period;
  • Integrity and confidentiality: the data controller undertakes to ensure the integrity and confidentiality of the data collected.

To be lawful under Article 6 of EU Regulation 2016/679, the collection and processing of personal data may only take place if at least one of the following conditions is met:

  • The user has expressly consented to the processing;
  • Processing is necessary for the performance of a contract;
  • Processing is necessary for compliance with a legal obligation;
  • Processing is necessary to protect the vital interests of the data subject or of another natural person;
  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority;
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

ARTICLE 3: PERSONAL DATA COLLECTED AND PROCESSED

A. WEBSITE (Smyline.com / pro.smyline.com)

Personal data collected on the Smyline website include:

  • First and last name
  • E-mail address
  • Phone number
  • How the user heard about Smyline
  • A message written by the user

These data are collected when the user:

  • Completes and submits the contact form

The controller will retain the collected data for:

  • Statistical data: 2 years;
  • Personal data from the contact form: processed via contact@smyline.com and retained for as long as necessary to handle the request, then archived according to applicable retention periods.

Purposes:

  • Collect website audience statistics;
  • Contact prospects by e-mail or phone.

Legal bases:

  • User consent (contact form / non-essential cookies);
  • Legitimate interest (audience measurement, within the limits of cookie consent where applicable).

B. MySmyline MOBILE APPLICATION

Within the MySmyline patient application, the following may in particular be processed:

  • Account identifiers (e-mail, first name, last name, phone, profile photo);
  • Treatment follow-up data (aligner wear time, statistics, calendar);
  • Photos and answers to follow-up questionnaires prescribed by the practitioner;
  • Messages and attachments exchanged with the practitioner (chat);
  • Push notification tokens (Firebase Cloud Messaging);
  • Technical data necessary for operation (logs, anonymised or pseudonymised crash diagnostics where applicable).

Purposes:

  • Provide treatment follow-up and patient–practitioner communication;
  • Ensure security, maintenance and improvement of the application.

Main legal bases:

  • Performance of a contract / treatment pathway with the partner practitioner;
  • Legal obligation where applicable;
  • Legitimate interest (security, prevention of abuse);
  • Consent where required (e.g. notifications, certain cookies / trackers on the website).

Patient accounts are created as part of a pathway prescribed by a partner practitioner; there is no standalone public registration on the store.

C. DISCLOSURE TO THIRD PARTIES

Data may be disclosed to recipients / processors necessary for the service, including:

  • Website host (e.g. Gandi);
  • Website CMS / tools (e.g. WordPress, Axeptio);
  • Audience measurement tools (e.g. Google Analytics), subject to consent where applicable;
  • Application technical providers (EU cloud / API hosting, Firebase for push notifications and diagnostics);
  • The partner practitioner / practice in charge of the patient’s treatment (follow-up and messaging data);
  • Group partners, only where necessary for the service and in compliance with the GDPR.

Personal data are not sold to third parties for commercial purposes.

D. DATA HOSTING

The Smyline and pro.smyline websites are hosted in France (host indicated in the legal notice).

MySmyline application data are hosted / processed mainly in the European Union (cloud infrastructure of the controller / its processors).

Any transfers outside the EU, if they occur, are framed by GDPR safeguards (standard contractual clauses, etc.).

ARTICLE 4: DATA CONTROLLER

A. THE DATA CONTROLLER

The controller of personal data is:

EUROTEKNIKA
Simplified joint-stock company (SAS)
726 rue du Général de Gaulle, 74700 SALLANCHES, France
SIREN: 389 251 745 — SIRET: 389 251 745 00052
RCS Annecy

Brand / service: Smyline / MySmyline

Contact:

The data controller determines the purposes and means of the processing of personal data.

B. OBLIGATIONS OF THE DATA CONTROLLER

The controller undertakes to protect personal data collected, not to disclose them to third parties without informing the user (except legal obligation or processing necessary for the service), and to respect the purposes for which the data were collected.

The website uses an SSL certificate to secure information and data transfers.

The controller also undertakes to notify the user in the event of rectification or erasure of data, unless this would involve disproportionate formalities, costs or steps.

If the integrity, confidentiality or security of the user’s personal data is compromised, the controller undertakes to inform the user and, where applicable, the supervisory authority, under the conditions set by the GDPR.

ARTICLE 5: USER RIGHTS

In accordance with personal data regulations, the user has the rights listed below.

To have a request processed, the user must provide their first and last name and e-mail address.

The controller must respond within a maximum of 30 (thirty) days.

A. USER RIGHTS

a. Right of access, rectification and erasure
The user may access, update, modify or request deletion of their data by e-mailing the controller at contact@smyline.com, stating the purpose of the request.
In the MySmyline application, account deletion is also available via Profile → Settings → Delete account.

b. Right to data portability
The user may request portability of their personal data held in connection with the website or the application to another controller by e-mailing the address above.

c. Right to restriction and objection
The user may request restriction of, or object to, processing under the GDPR by e-mailing the controller.

d. Right not to be subject solely to automated decision-making
Under Regulation 2016/679, the user has the right not to be subject to a decision based solely on automated processing if it produces legal effects concerning them or similarly significantly affects them.

e. Right to determine the fate of data after death
The user may organise what should happen to their collected and processed data after death, in accordance with applicable law.

f. Right to lodge a complaint with the supervisory authority
If the controller does not respond to the user’s request, or if the user believes one of the rights listed above has been infringed, they may contact the CNIL (https://www.cnil.fr) or any competent court.

B. PERSONAL DATA OF MINORS

Under Article 8 of EU Regulation 2016/679 and the French Data Protection Act, only minors aged 15 or over may consent to the processing of their personal data under French law.

If the user is under 15, the consent of a legal representative is required before personal data may be collected and processed.

The publisher reserves the right to verify by any means that the user is over 15, or has obtained the consent of a legal representative.

ARTICLE 6: USE OF COOKIES

The website may use cookie technologies.

A cookie is a small file (less than 4 KB) stored by the website on the user’s hard drive, containing information about the user’s browsing habits.

These files make it possible to process statistics and traffic information, facilitate browsing and improve the service for the user’s comfort.

Where cookies involve the storage and analysis of personal data, the user’s consent is required.

Such consent is considered valid for a maximum of 6 (six) months. After that period, the website will again request authorisation to store cookies on the user’s hard drive.

a. User objection to cookies

Non-essential cookies are placed on the user’s device only after consent. The user may withdraw consent at any time by:

  • Refusing cookie consent in the popup.

More generally, the user may object to cookies by configuring their browser.

Browser configuration help:

If the user disables cookies, they may continue browsing the website. However, any malfunction caused by this action cannot be attributed to the website publisher.

b. Cookies used on the website

The following cookies may be used:

  • WordPress / plugin cookies
  • Axeptio (consent management)
  • Google Analytics where applicable (subject to consent)

The MySmyline application does not use web cookies; it may use technical identifiers (e.g. push tokens) necessary for the service.

ARTICLE 7: CHANGES TO THIS PRIVACY POLICY

This privacy policy may be consulted at any time at: https://smyline.com/en/privacy-policy/

The publisher reserves the right to amend it to ensure compliance with applicable law.

Users are invited to consult this privacy policy regularly to stay informed of any changes.

In the event of a substantial change, the user will be informed by:

  • E-mail and/or information via the website / application.

This privacy policy was last updated on: 16/09/2026.

ARTICLE 8: USER ACCEPTANCE OF THE PRIVACY POLICY

By browsing the website or using the MySmyline application, the user acknowledges having read and understood this privacy policy and accepts its terms, particularly regarding the collection and processing of personal data and the use of cookies on the website.