1. General

UGB, svetovanje in storitve, d.o.o., Betettova ulica 10, 2000 Maribor, tax number: 86667254, registration number: 8813400000, registered with the District Court in Maribor (hereinafter: “UGB”) is the controller of personal data processed within the scope of this privacy policy.

UGB collects and processes personal data in accordance with the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 4. 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “General Data Protection Regulation” or “GDPR”) and other regulations governing personal data protection.

Our website is: www.klinika-but.si.

2. What personal data is collected and processed?

Personal data collected and processed via the website are the personal data of users who subscribe to e-newsletters or send an inquiry about UGB’s offer via the online form. This personal data includes name and surname, email address, and telephone number (optional).

3. Why is personal data collected and processed?

UGB processes users’ personal data for various purposes: Processing of personal data of website visitors for monitoring received orders and obtaining analytical data for marketing purposes

• Processing of the following user personal data: name and surname, email address, telephone number.

The provision of this personal data by the user is voluntary, but it is a condition for using the aforementioned services. Failure to provide personal data will result in UGB being unable to provide the user with access to the services.

• Processing of personal data for appointment booking

For the purpose of using the “appointment booking” service, the following user personal data is processed: name and surname, telephone number, email address, and type of examination. The provision of this personal data by the user is voluntary, but it is a condition for using the aforementioned services. Failure to provide personal data will result in the UGB provider being unable to provide the user with access to services via the website.

• Processing of personal data for direct marketing purposes

The following personal data: name and surname, email address, postal address, age, type of service performed may be processed for direct marketing purposes via mail or email by UGB, such as: sending news, professional articles and advertisements, sending emails containing news about current and new offers, invitations to social events and for remarketing purposes via Google, Facebook, LinkedIn, Instagram, with the aim of better (more relevant) informing individuals and achieving a higher level of user engagement.

If required by law, UGB will ask the user to grant explicit consent for the processing of their personal data for direct marketing purposes. The user may withdraw consent at any time by sending an email to info@klinika-but.si or by using the unsubscribe link for direct marketing information, which is provided in every UGB email containing direct marketing communication. The withdrawal of consent by the user will not affect the provision of services to the user or the lawfulness of processing based on consent prior to its withdrawal.

• Processing of personal data for analytical purposes

• for monitoring the reading of sent emails, specifically which email you opened or did not open, which links you opened or clicked (which content you read or viewed), and how long you read or viewed individual content.
• for segmenting or profiling users based on the facts from the previous bullet point and further sending personalized (individualized) emails, meaning that different users may receive emails with different content, with the aim of better (more relevant) informing and achieving a higher response rate to sent emails.
• for the purpose of analyzing the user’s journey on the website: where the user arrived from (traffic source), for monitoring time spent on the website, which web pages they visited, which content they downloaded or viewed.
• for segmenting users based on the facts from the previous bullet point and further sending personalized (individualized) messages through multichannel communication, meaning that different users may receive
• messages with different content, with the aim of better (more relevant) informing individuals and achieving a higher level of user engagement.

• Processing of personal data for compliance with legal obligations

UGB may process the user’s personal data in order to fulfill legal obligations imposed by public authorities. This includes, in particular, (i) processing payment information for services to fulfill tax and accounting obligations, and (ii) disclosing information requested by public authorities, including courts, based on and to the extent of generally applicable provisions.

• Processing of personal data for the purposes of legitimate interests pursued by UGB or a third party, if such legitimate interest does not override the interests or fundamental rights and freedoms of the user

UGB may process the user’s personal data for the purposes of asserting, exercising, or defending UGB’s legal claims, to protect the rights and interests of UGB, other users, or third parties, and for the implementation and enforcement of rights and obligations defined in the General Terms and Conditions.

4. To whom do we disclose personal data?

UGB may transfer the user’s personal data to:

1. service providers who perform services for UGB and enable UGB to provide services to users. Services that may be required include, for example: provision of infrastructure and IT services, postal service providers and shipping service providers, customer service provision, improvement of services performed by UGB, website optimization, processing of any other user payments; e.g., accounting services. Unless strictly necessary or required by law, service providers are not authorized to disclose or use the user’s personal data for their own purposes, but rather act on behalf of and under the instructions of UGB;
2. service providers who perform services for UGB and enable UGB to carry out marketing activities, including direct marketing of its own services and products, processing market research, conducting statistical analyses, and remarketing via social networks such as Facebook, Instagram, and Google. Unless strictly necessary or required by law, service providers are not authorized to disclose or use the user’s personal data for their own purposes, but rather act on behalf of and under the instructions of UGB;
3. public authorities, including courts, tribunals, regulators, and other public bodies to the extent necessary for: (i) fulfilling legal obligations imposed on UGB; (ii) protecting and pursuing the rights of UGB, the rights of another user, or third parties, including intellectual property rights; (iii) protecting the security of UGB, another user, or a third party; (iv) implementing and enforcing the rights and obligations defined in the general terms and conditions;
4. parties to transactions, advisors, and consultants for the purposes of UGB’s reorganization, including the sale, merger, or other divestiture of UGB’s business, in whole or in part, and provided that third parties are bound by a privacy policy that ensures an adequate level of protection for the user’s personal data, which is at least equivalent to this Privacy Policy.

The aforementioned companies may be located in countries outside the European Union, including the USA, where the level of data protection may not be as comprehensive as in the European Union, including countries for which the European Commission has or has not adopted a decision confirming that these countries provide an adequate level of personal data protection (hereinafter: “Third Countries”).

UGB undertakes to ensure the implementation of appropriate safeguards for the protection of user’s personal data in the event of data transfer to Third Countries. Appropriate safeguards can be applied, in particular, by implementing personal data transfer agreements based on standard data protection clauses adopted by the European Commission or the relevant data protection supervisory authority and approved by the European

Commission. To obtain a copy of the appropriate safeguards, please send an email to info@klinika-but.si.

5. User Rights Regarding Personal Data

In accordance with the General Data Protection Regulation and applicable legislation, you have the following rights:

• Right of access to personal data: upon your request, we will provide you with information on whether we process personal data about you, and if so, we will also grant you access to your personal data and certain information about the processing (which data we process and the source of this data).
• Right to rectification of personal data: upon your request, we will correct or supplement incomplete or inaccurate data that we process about you.
• Right to request restriction of processing: upon your request, we will restrict the processing of your personal data. We warn you that the request for restriction of processing is a limited right that cannot be applied to all processing activities (restriction of processing is possible, for example, during the verification of the accuracy or completeness of your personal data). We undertake to examine each of your requests with utmost seriousness.
• Right to erasure of personal data: upon your request, we will erase personal data. We warn you that we cannot erase personal data that we maintain due to legal requirements or based on a contractual relationship.
• Right to data portability: upon your request, we will provide you with the personal data you have provided to us in a structured, commonly used, and machine-readable format.
• Withdrawal of consent: you have the right to withdraw your consent to the processing of personal data at any time. After withdrawal, we will erase all data that we collect and process based on consent and cease further processing. The withdrawal of consent has no negative consequences. However, we warn you that it is possible that we will not be able to provide you with certain services after withdrawal. We will not be able to provide you with services when they are services that cannot be performed without processing certain personal data (e.g., after withdrawing consent, we cannot send you our e-newsletters, as we urgently need your email address – and we cannot use it without your consent).
• Right to object to the processing of personal data: you have the right to object to the processing of your personal data that we carry out. You have this right when the processing is for direct marketing purposes or for the transfer of your personal data to third parties for direct marketing purposes. You can also object to processing when we use your data for direct marketing purposes using personalized or individual offers (“profiling”).
• Right to data portability: upon your request, we will provide you with the personal data you have provided to us in a structured, commonly used, and machine-readable format. You are entitled to transmit this data to another controller of your choice.

Any of the above requests and/or notifications may be sent by regular mail or email to the address:

UGB, svetovanje in storitve, d.o.o., Betettova ulica 10, 2000 Maribor,

Email: info@klinika-but.si

The request and/or notification must contain the name and surname, date of birth, and email address information to verify that such a request and/or notification actually originates from the user. If the User sends the request by email and does not specify any other method of communication, UGB will consider the user’s requests and will communicate with the user using the user’s email address.

Notwithstanding the above, every patient who receives a healthcare service at UGB’s clinic also has all rights in accordance with the Patients’ Rights Act (Official Gazette of the Republic of Slovenia, No. 15/08). For more detailed information on these rights, please click here.

6. Duration of Data Processing

The user’s personal data will be processed for the duration of the contract, which becomes effective from the moment the user agrees to the general terms of use of the UGB provider. After the contract expires, personal data may be processed as follows:

1. for the purposes of asserting, exercising, or defending legal claims of the UGB provider – without prejudice to point (d) below;
2. for direct marketing purposes – until the user withdraws consent for such processing or objects to the processing of personal data for direct marketing purposes;
3. for compliance, to fulfill legal obligations imposed on UGB;
4. for any legal, regulatory, or administrative proceedings, including compliance with decisions or orders of relevant courts or administrative or governmental bodies to the extent permitted by law.

Upon expiry of the above-specified period, the user’s personal data will be erased.

7. Social Media Features and Third-Party Payment Service Providers

Our website may use social media features and payment service providers operated by third parties, such as Facebook, Instagram, LinkedIn, Twitter, Bankart, PayPal, etc. These features may (i) collect data (name and surname, email address, telephone number, postal address, date of birth, payment data, your IP address, pages you visit on our website) and (ii) may set cookies or use similar technologies that enable the proper functioning of the respective features. If you are logged into your user account with a third party, the third party will be able to link data about your visit to our website with your user account with that third party. Similarly, the third party may record your interactions with these features even when you visit UGB provider’s Facebook, Instagram, LinkedIn, or Twitter page. Your interactions with these features are governed by the privacy policy of the third party providing this feature. If you wish to learn more about the practices of third parties regarding the collection and processing of personal data, please refer to the third party’s privacy policy.

8. Joint Controllers

For certain aspects of processing, we and the social media platform operators act as joint controllers, i.e., jointly responsible within the meaning of Article 26 of the General Data Protection Regulation (“GDPR”).

UGB manages the following social media pages:

– Facebook and Instagram – the controller is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland;

Therefore, we are a joint controller with Meta Platforms, Inc.

For web tracking methods used by social media platform operators, the platform operators and we act as joint controllers. Web tracking can occur independently of whether you are logged in or registered on the respective social media platform. The legal basis for web tracking methods is your personal consent.

Further information on the recipients or categories of recipients and on the retention periods or criteria for determining the retention period of your personal data collected by social media platform operators can be found in the privacy policies of the individual social media platform operators. We cannot influence these. In the privacy policies of individual social media platform operators, you can also find options regarding the exercise of your rights to disable web tracking methods. You can also contact the platform operators using the contact details provided in the legal information section of the respective platform operator.

In connection with the statistics offered to us by individual social media platform providers, we can only conditionally influence and disable them. We emphasize that we are careful to ensure that the social media platform provider does not provide us with any additional optional statistics.

It cannot be excluded that the social media platform provider may use your profile data and web behavior data to analyze your habits, personal relationships, preferences, etc.

All your public posts on our social media pages remain published indefinitely on the timeline, unless we delete them due to an update of the original topic, illegality of the post, or violation of our guidelines, or if you delete the post yourself.

9. Children’s Privacy

Our website is not intended for children under 15 years of age. To use the website and/or UGB services, you must be at least 15 years old. We do not knowingly collect personal data from children under 15 years of age. If you are under 15 years old, do not use UGB services and do not provide us with your personal data. If you have a child under 15 years of age and are aware that your child has provided their personal data to UGB, you can contact us at info@klinika-but.si and request the exercise of rights to access, rectification, erasure, and/or objection.

10. Links to Other Websites

Our website may contain links to external websites. UGB encourages you to review the privacy and security policies of such linked external websites, whose personal data protection practices may differ from ours. UGB assumes no responsibility for the collection, processing, or disclosure of data on external websites that visitors may access through the UGB website. We advise you to check the privacy policies of these external websites before providing them with your personal data.

11. Cookies

UGB uses so-called cookies on the website to enable user access to certain functions and to obtain information about website visits. A cookie is a file that stores website settings. Websites store cookies on users’ devices, which they use to access the internet, for the purpose of recognizing individual devices and the settings users have applied during access. Cookies allow websites to recognize if a user has previously visited that website, and in advanced applications, they can help tailor individual settings accordingly. Their storage is under the complete control of the user’s browser – the user can restrict or disable cookie storage as desired.

On this site, we use essential sjbs_ cookies, which are used to store user session information and to improve functionality and usability, and typically last for the duration of the session. The site also installs wordpress_gdpr cookies, which remember your choice regarding cookie installation and last for a maximum of one year. Google Analytics 4 cookies (_ga, _gid, _gat) are also installed, which are stored only for the duration of the session or a maximum of two years. IP data in GA4 is anonymized. You can disable Google Analytics cookies in various browsers at the following web link https://tools.google.com/dlpage/gaoptout. You can read more about Google’s privacy policies at https://policies.google.com/privacy?hl=sl.

12. Data Security

Maintaining data security means ensuring the confidentiality, integrity, and availability (for authorized purposes) of personal data. Confidentiality means that only people authorized to use the data can access it. Integrity means that personal data must be accurate and suitable for the purpose for which it is processed. Availability means that authorized users are granted access to data if they need it for authorized purposes. Accordingly, UGB will ensure that appropriate measures are taken against unlawful or unauthorized processing of personal data and against accidental loss or damage to personal data. These principles will be enforced through the implementation of appropriate security measures in the field of hardware and software (including physical entry and system access control, locks, alarms, firewalls, etc.). UGB has established procedures and technologies to maintain the security of all personal data, from the point of collection to the point of destruction.

13. Rights and Remedies

If you have any questions about this Privacy Policy, our use of cookies, or our rules regarding the collection, use, processing, storage, and/or disclosure of personal data, you can contact us at:

UGB, svetovanje in storitve, d.o.o.,

Betettova ulica 10,

2000 Maribor

or send us an email at info@klinika-but.si

or call us by phone at 041-319 907.

In case of a violation of rights related to the processing of personal data, you can file a complaint with the Information Commissioner, Dunajska 22, 1000 Ljubljana or at: gp.ip@ip-rs.si

For faster and more favorable resolution of data protection issues, it is recommended that you address complaints or questions to UGB first, before contacting the authorities.

14. Changes to the Privacy Policy

We reserve the right to change and adapt this Privacy Policy at our discretion and as needed at any time, to reflect actual circumstances and legislation in the field of personal data protection. For this reason, we ask you to check the current version before each submission of personal data, so that you are aware of any changes and additions. Your continued use of the website and UGB services means that you agree to the revised privacy policy. We recommend that you regularly review our privacy policy to ensure you are aware of all changes.

We sincerely thank you for your trust!

Maribor, August 31, 2025