Privacy policy

Data controller

The personal data collected through this website is controlled by the company named below, which also operates the website.

The dentists who treat you are employed by Zdravstveni zavod Zdravje. Decisions about your data are therefore not made by the company below alone; the scope and the division of responsibility are set out in the “Joint controllers” section.

For questions about the processing of personal data, and to exercise the rights described in this policy, write to info@dcljubljana.si or call 01 436 82 17. You may use this contact point for any processing, whichever of the two controllers carries it out.

Registration details of the website operator:

• DENTALNI CENTER LJUBLJANA zobozdravstvene storitve, d.o.o.
• Vilharjev podhod 1, 1000 Ljubljana, Slovenija
• Reg. no. 7404409000 · Tax no. 93568819
• Okrožno sodišče v Ljubljani (Ljubljana District Court), entered 31 December 2025
• 86.230 Zobozdravstvena dejavnost (dental practice activities)

Joint controllers

Dental care at this address is provided by dentists employed by Zdravstveni zavod Zdravje. Because both organisations together determine the purposes and means of processing your data, they are joint controllers under Article 26 GDPR.

The essence of the arrangement between them is as follows:

• the website, the enquiry form and the database the enquiry is stored in are operated by the company named as the website operator,
• the dental treatment, and the medical records arising from it, are the responsibility of Zdravstveni zavod Zdravje as the dentists’ employer,
• an enquiry submitted through the form is available to both, to the extent needed to arrange an appointment and to provide treatment,
• both are bound by the General Data Protection Regulation (GDPR) and by the professional confidentiality of healthcare workers.

You may exercise the rights described in this policy against either controller; whichever you approach, the right must be honoured. You can use info@dcljubljana.si or 01 436 82 17 as a single point of contact.

Registration details of both joint controllers:

• DENTALNI CENTER LJUBLJANA zobozdravstvene storitve, d.o.o., Vilharjev podhod 1, 1000 Ljubljana, Slovenija
• Zdravstveni zavod Zdravje, Vilharjev podhod 1, 1000 Ljubljana, Slovenija

What data is collected

The website has no user accounts, no sign-in and no registration. We collect personal data when you send it to us through the enquiry form, and to the extent the site needs it to work at all.

The enquiry form collects:

• your name (required),
• your telephone number or your email address (at least one contact detail is required; you may leave the other out),
• the reason for your visit, in free text (required),
• the service and the part of the day you select (optional),
• the time of submission, and a record of when and against which wording you confirmed the privacy notice, agreed to the terms of use and acknowledged that your data is passed to the joint controller.

The free text describing the reason for your visit may contain data about your health. Because the form explicitly invites you to describe the problem briefly, we expect such data and treat it as a special category of personal data under Article 9 of the General Data Protection Regulation (GDPR). Please write only as much as we need in order to arrange an appointment; tell the dentist the details in person.

The form has no other fields. We do not collect data you cannot see on the form, and the form cannot be submitted without all three confirmations: the privacy notice, the terms of use, and your data being passed to the joint controller.

When the form is submitted, the server records the IP address it came from for at most ten minutes, so that it can limit the number of submissions and prevent abuse of the form. The IP address is not written to the database and is never linked to the content of your enquiry. No form field is written to the server logs.

Purposes and lawful basis

We process the data from the form for a single purpose: to contact you and arrange an appointment, or to answer your question. We do not use it for advertising, we send no newsletters, we do not profile you and we make no automated decisions about you.

The lawful bases are:

• for the data from the form: Article 6(1)(b) GDPR: steps taken at your request prior to entering into a contract for a healthcare service,
• for health data in the free text: Article 9(2)(h) GDPR: the provision of health care, where the data is processed by staff bound by the obligation of professional secrecy,
• for measuring website traffic: your consent, Article 6(1)(a) GDPR. Consent is voluntary and you may withdraw it at any time.

The form is not the only way to reach us; you can arrange an appointment by phone without sending us anything through this website.

Cookies and traffic measurement

Until you decide, the site loads no third-party script and stores nothing for traffic measurement. If you allow measurement, we load Google Analytics 4; if you decline or ignore the banner, nothing is loaded.

We store your decision about traffic measurement in your browser (local storage, key dcl-analitika) so that we do not have to ask on every visit. When traffic measurement is not configured, the banner offers no decision but a legal notice, and under the key dcl-obvestilo we record only that you acknowledged it. You can withdraw either through the “Privacy settings” link in the footer of every page; when you do, we also delete the two Google cookies from your device, and the banner appears again.

We run Google Analytics with Google signals and ad personalisation switched off, so data about your visit is not linked to your Google account and is not made available to advertising tools. How long Google keeps the event data is for Google to determine; in our property that period is set to 14 months.

Who receives the data

We do not sell personal data and do not pass it to third parties for their own purposes. Enquiries are visible to staff signed in to this website’s content editor, and to the dental staff who will treat you.

To the extent necessary, data reaches the following recipients:

• Zdravstveni zavod Zdravje, as joint controller and as the employer of the dentists who treat you (to the extent set out in the “Joint controllers” section); the institute is bound by the GDPR and by professional confidentiality,
• the hosting provider running this website and its database, and the provider of the clinic’s mailbox to which the enquiry is sent; both process the data solely on our instructions, as processors, and we will name them on request,
• Google, as the provider of Google Analytics (only if you have allowed traffic measurement),
• OpenStreetMap: the map on the Location page loads only when you choose to show it. Until you do, the page sends no request to openstreetmap.org; once you do, that server receives your IP address and browser details.

We also disclose data where the law requires it or a competent authority demands it.

Google may process traffic data outside the European Economic Area, under the data processing terms it sets. If you do not allow traffic measurement, no such transfer takes place.

How long we keep the data

An enquiry submitted through the form is deleted automatically 90 days after it is sent. That is how long we need it in order to arrange an appointment with you. Whatever is needed for treatment is transferred to the medical record, which is governed by healthcare legislation and falls outside this policy.

The IP address recorded in order to rate-limit submissions is discarded no later than ten minutes after submission.

Your decision about traffic measurement stays in your browser until you withdraw it or clear your browser data.

Security

The connection to this website is encrypted (HTTPS).

Enquiries are stored in this website’s database. The public form does not write to it directly, but through an endpoint that validates the content and limits the number of submissions; only a signed-in user of the content editor can read stored enquiries.

With every submission we also store the times of all three of your confirmations and a fingerprint of each wording you were shown (the privacy notice, the terms of use, and your acknowledgement that your data is passed to the joint controller), so that it is always possible to establish what you agreed to.

Your rights

In relation to your personal data you have the right:

• of access to your data and to a copy of the data we process about you (Article 15 GDPR),
• to rectification of inaccurate data and completion of incomplete data (Article 16),
• to erasure of your data where the conditions in Article 17 are met,
• to restriction of processing (Article 18),
• to have every recipient informed of a rectification, erasure or restriction (Article 19),
• to data portability in a machine-readable format (Article 20),
• to object to the processing (Article 21),
• to withdraw consent where processing is based on it; withdrawal does not affect the lawfulness of processing before it.

Send your request to info@dcljubljana.si, or by post to the company’s registered seat. We reply within one month of receiving it; if the request is complex, or there are several, we may extend that period by up to two further months and will tell you so within the first month.

So that we do not hand your data to the wrong person, we have to establish your identity before acting on a request. Where we have reasonable doubts, we may ask you for additional information. Exercising your rights is normally free of charge.

Complaint to the supervisory authority

If you believe that the processing of your personal data infringes the General Data Protection Regulation (GDPR) or the Slovenian Personal Data Protection Act (ZVOP-2), you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). In the Republic of Slovenia the supervisory authority is the Information Commissioner:

• Informacijski pooblaščenec (Information Commissioner)
• Dunajska cesta 22, 1000 Ljubljana, Slovenia
• gp.ip@ip-rs.si
• +386 1 230 97 30
• www.ip-rs.si

A complaint to the supervisory authority is without prejudice to your right to an effective judicial remedy (Article 79 GDPR). We would be glad if you came to us first, or to the data protection officer named in the next section; most questions we can settle faster ourselves.

Data protection and our data protection officer

When you deal with us, you entrust us with your personal data. The controller of your personal data in this case is Dentalni center Ljubljana (“DCL”), info@zzzdravje.si, telephone: 01/4368-217.

At DCL we understand what privacy means. Everyone working at DCL takes great care to keep your personal data safe with us. To that end we have drawn up rules and procedures, and put technical and organisational measures in place, through which we maintain an appropriate level of security when processing personal data.

If you have any questions about the processing of your personal data, or about exercising your rights in connection with that processing, you may contact our data protection officer (DPO) at any time:

• Peter Možina, LL.B.
• dpo@zzzdravje.si

Changes to this policy

We change this policy when the website or the law changes. The version published on this page is the one in force; the date it last changed is given at the top.