Privacy Policy
How STS Medical Mobility Kft. collects, uses, shares and protects personal data, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").
01 Who we are
STS Medical Mobility Kft. ("STS", "we", "us") is the data controller responsible for the personal data described in this notice, except where we act as a processor on behalf of our clients (see section 2). Our full registered details are set out in our Legal Notice.
For any enquiry concerning this notice or the processing of your personal data, please contact our privacy team at privacy@sts-med.com.
02 Scope and our role
This notice applies to personal data we process in connection with this website, our business communications, and the development and operation of the STS Continuum platform. It is important to distinguish two roles:
- STS as controller. When we decide why and how personal data is processed - for example, data from website visitors, prospective clients and business contacts - we act as the controller, and this notice governs that processing.
- STS as processor. When a healthcare organisation uses our platform to process patient data, that organisation is ordinarily the controller and STS acts as a processor on its instructions. In that case, the organisation's own privacy information governs the processing, and we handle the data only under a written data-processing agreement.
This notice describes our processing as a controller. Patients should refer to the privacy information provided by their healthcare provider for processing carried out through that provider.
03 Personal data we collect
Depending on how you interact with us, we may process:
- Contact and identity data - name, organisation, role, email address and any details you include when you contact us or request a briefing.
- Communications data - the content of messages you send us and our correspondence with you.
- Technical and usage data - IP address, device and browser information, and pages visited, collected when you use this website.
- Recruitment data - information you provide if you apply to work with us.
We do not seek to collect special category data (including health data) through this website. Please do not include patient information or other sensitive details in general enquiries.
04 Purposes and legal bases
We process personal data only where we have a lawful basis under Article 6 of the GDPR:
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and providing information you request | Our legitimate interests, or steps taken at your request prior to entering a contract |
| Managing client and supplier relationships | Performance of a contract, or our legitimate interests |
| Operating, securing and improving this website | Our legitimate interests in a secure, functioning website |
| Sending occasional business updates, where you have asked to receive them | Consent, which you may withdraw at any time |
| Complying with legal and regulatory obligations | Compliance with a legal obligation |
Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and you may object to that processing (see section 9).
05 Health and other special category data
Health data is a special category of personal data under Article 9 of the GDPR and receives additional protection. We process such data only within the STS Continuum platform, ordinarily as a processor acting on the documented instructions of a healthcare organisation, and only on a lawful basis recognised under Article 9 - typically the provision of health care or medical diagnosis under appropriate safeguards, or another basis identified by the controlling organisation.
We apply organisational and technical safeguards appropriate to the sensitivity of this data, including access controls, encryption in transit and at rest, pseudonymisation where appropriate, and audit logging.
06 Recipients and processors
We share personal data only as necessary, with:
- Service providers that support our operations - for example, hosting, infrastructure, email and analytics providers - who act as our processors under written agreements.
- Professional advisers, such as legal, accounting and audit firms, where required.
- Authorities, where we are legally obliged to disclose information.
We do not sell personal data and do not use it for profiling for advertising purposes.
07 International transfers
We aim to process personal data within the European Economic Area (EEA). Where a transfer outside the EEA is necessary, we ensure an appropriate safeguard is in place under Chapter V of the GDPR - such as an adequacy decision or the European Commission's Standard Contractual Clauses - and we make information about the relevant safeguard available on request.
08 Retention
We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting or reporting requirements. Enquiry and business-contact data is generally retained for the duration of our relationship and for a reasonable period afterwards; data processed on behalf of a client is retained in accordance with that client's instructions and the applicable data-processing agreement. When data is no longer required, we delete or anonymise it securely.
09 Your rights
Subject to the conditions in the GDPR, you have the right to: request access to your personal data; request rectification of inaccurate data; request erasure; request restriction of processing; object to processing based on legitimate interests; request data portability; and withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please contact privacy@sts-med.com. We will respond within the period required by law. Where STS acts as a processor, we will refer your request to the relevant controller or assist them in responding.
You also have the right to lodge a complaint with a supervisory authority. In Hungary this is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH). You may also contact the supervisory authority in your country of residence.
11 Security
We maintain technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, encryption, network security, logging and staff confidentiality obligations, governed by an information-security management framework. No method of transmission or storage is entirely secure, but we work to protect your data and to respond promptly to any incident.
12 Changes and contact
We may update this notice to reflect changes in our practices or legal requirements. The "last updated" date above indicates when it was last revised, and we will give due prominence to any material changes.
Questions, requests and concerns regarding this notice should be directed to privacy@sts-med.com. Our registered details appear in the Legal Notice.