Privacy policy

This policy describes how we process the personal data of visitors to the website www.fabjan.si and of people who contact us through it. It has been prepared on the basis of Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, ‘GDPR’).

1. Data controllers

The data you send us through this website is processed by two companies, each for its own purposes. They are not joint controllers under Article 26 GDPR: each is responsible for the processing it carries out itself.

For enquiries sent through the website, for consultations, procedures and other healthcare services, for medical records and invoicing, and for cookies and website analytics, the controller is:

ESTETIKA FABJAN d.o.o. Splošna in plastična kirurgija
Poslovna cona A 32, 4208 Šenčur, Slovenia
Company registration number: 1540017000
VAT identification number: SI16426711
Email: estetika@fabjan.si
Telephone: +386 51 327 500

For news updates and newsletters that it sends in its own name, the controller is:

EMAZING, napredne rešitve, d.o.o. (EMAZING d.o.o.)
Opekarna 28A, 1420 Trbovlje, Slovenia
Company registration number: 6549551000
VAT identification number: SI58912258

On behalf of ESTETIKA FABJAN d.o.o. and on its instructions, EMAZING d.o.o. also manages the website, the web forms, the SmartPRM enquiry management system and the analytics and advertising tools; for these tasks it acts as a processor (Article 28 GDPR).

For questions about data processing and to exercise your rights, write to us at estetika@fabjan.si or by post to the address of the controller concerned.

2. What data we process

Enquiry form

In the enquiry form we collect your first name and surname, telephone number, email address, the type of procedure you select from the list, the clinic location (Celje, Šenčur, Ljubljana, Kolomban, Nova Gorica or Maribor) and your message; most fields are required. The forms have an optional tick box for consent to news updates (section 3), and some also have a required tick box by which you agree that ESTETIKA FABJAN d.o.o. may contact you about a consultation.

The type of procedure and the text of your message may reveal information about your health. This is special category personal data under Article 9 GDPR, which we process with additional protection, as described in section 3. Please write in your message only what we need to answer your enquiry.

In the newsletter form in the page footer we collect only your email address.

Further communication

We also process the content of telephone calls, emails and WhatsApp messages that you exchange with us, including photographs and medical reports that you send us for a written assessment or to prepare for a procedure.

Data collected automatically when you visit

the IP address of your device and technical data about your browser (type, operating system, language) that are needed to display the website and protect the forms;
the pages you visit and the time you spend on the website;
the source of your visit: the website you came from, the first page you opened and the number of visits, advertising campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_adg, utm_keyword) and the Google ad click identifier (gclid);
identifiers stored in cookies and in your browser’s local storage and session storage (section 7).

When you submit a form, some of this data (the source of the visit, the first and last page visited, the list of pages visited, the number of visits and the time spent on the website) is attached to your enquiry so that we know which campaign it came from. Which of this data we collect depends on your choice in the cookie settings (section 7).

If you write to us using the WhatsApp button on the website, a label showing the source of your visit (for example a search engine or an advert) and the first page you visited is added to the text of your message. You can see the label in the message before you send it. It is stored only in your browser’s session storage, which is cleared when you close the tab.

3. Purposes and legal bases

Answering your enquiry and arranging an appointment

Controller: ESTETIKA FABJAN d.o.o. We use the data from the form to reply to you by telephone, email or WhatsApp, for an initial assessment and to arrange a consultation or procedure.

Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract.

Health data

Controller: ESTETIKA FABJAN d.o.o. Health data includes information about your health in your enquiry, the photographs and medical reports you send us, and the data created during a consultation, diagnosis and procedure.

Legal basis: Article 9(2)(h) GDPR — medical diagnosis and the provision of health care — in conjunction with Article 9(3) GDPR: the data is processed by health professionals bound by professional secrecy, or by persons under their responsibility. Basis in Slovenian law: the Healthcare Activity Act (ZZDej), the Patients’ Rights Act (ZPacP), the Healthcare Databases Act (ZZPPZ) and the Personal Data Protection Act (ZVOP-2).

We do not rely on your consent for this processing. We publish photographs of patients, for example before and after a procedure, only with the patient’s explicit written consent (Article 9(2)(a) GDPR), which the patient may withdraw at any time.

Medical records

Legal basis: Article 6(1)(c) and Article 9(2)(h) GDPR in conjunction with ZZPPZ and ZPacP — the legal obligation to keep medical records.

Invoicing

Legal basis: Article 6(1)(b) and (c) GDPR in conjunction with tax and accounting regulations.

News updates and newsletters

Controller: EMAZING d.o.o. If you tick the optional box in the enquiry form or sign up for the newsletter, EMAZING d.o.o. may send you news and offers from Estetika Fabjan in the areas that, based on the data you have provided, it considers to be of interest to you.

Legal basis: Article 6(1)(a) GDPR — your consent. Consent is not required: you will receive an answer to your enquiry without it. You can withdraw it at any time using the unsubscribe link in every message or by writing to estetika@fabjan.si; withdrawal does not affect the lawfulness of processing before it. Electronic direct marketing is also subject to the Electronic Communications Act (ZEKom-2).

Website analytics and advertising

Controller: ESTETIKA FABJAN d.o.o. With your consent, we measure visits to the website and the performance of our adverts (Google Analytics, Google Ads and Meta Pixel). Legal basis: Article 6(1)(a) GDPR — consent in the cookie settings, which you can withdraw at any time (section 7). The attribution of the source of your visit, described in section 7, works until you refuse advertising cookies.

Protecting the website and forms

Controller: ESTETIKA FABJAN d.o.o. We protect the forms against automated submissions (spam) with the Cloudflare Turnstile service and with technical checks on submission. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in protecting the website and enquiries.

Establishing, exercising and defending legal claims

We may also process data to establish, exercise or defend legal claims. Legal basis: Article 6(1)(f) GDPR and, for health data, Article 9(2)(f) GDPR.

4. How long we keep data

Medical records and data on services provided: the periods laid down by ZZPPZ for each type of record;
Enquiries that do not lead to treatment, including messages, photographs and medical reports you have sent: 24 months from the last contact; after that we delete or anonymise the data;
Invoices and accounting documents: the periods laid down by tax and accounting regulations;
Data for news updates and newsletters: until you withdraw your consent;
Cookies and browser storage: the duration set by each cookie, or until you delete them in your browser; if you refuse advertising cookies, the data on the source of your visit is deleted;
Data needed to establish, exercise or defend legal claims: until the proceedings are finally concluded or the limitation periods expire.

5. Who we disclose data to

We do not sell your data. We disclose it only to the following recipients:

medical and administrative staff of the clinic to the extent needed for your treatment; medical staff are bound by professional secrecy;
other healthcare providers of the Fabjan group in Slovenia, when the service at the location you have chosen, or as agreed with you, is provided by them;
EMAZING d.o.o., Trbovlje (Slovenia): management of the website, the forms, the SmartPRM system and the analytics and advertising tools on behalf of ESTETIKA FABJAN d.o.o.;
Vercel Inc. (USA): website hosting, and the function that forwards forms to SmartPRM and runs in the Frankfurt region (Germany);
Cloudflare, Inc. (USA): Turnstile, the spam check that switches on when you start filling in a form;
Brevo (France): sending newsletters and, only when SmartPRM is unavailable, a backup copy of your enquiry to our internal address;
the infrastructure provider (servers and database) on which SmartPRM runs;
Elfsight: the WhatsApp chat button and the display of Instagram posts on the website, which load only with your consent to functional cookies;
Google (YouTube, Google Maps): embedded content on some pages, which loads only with your consent to functional cookies;
WhatsApp Ireland Limited, if you write to us via WhatsApp;
advisers (accounting, legal) and public authorities, where required by law.

Analytics and advertising providers, which may also process data for their own purposes, only after your consent in the cookie settings:

Google Ireland Limited / Google LLC: Google Analytics 4 and Google Ads;
Meta Platforms Ireland Limited / Meta Platforms, Inc.: Meta Pixel.

6. Transfers outside the European Economic Area

Some recipients have their registered office or servers in the United States of America. Google LLC, Meta Platforms, Inc., Vercel Inc. and Cloudflare, Inc. are certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023; transfers to these companies take place on the basis of that decision (Article 45 GDPR). For any other transfers outside the European Economic Area, we use the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

You can request a copy of the appropriate safeguards at estetika@fabjan.si.

7. Cookies and similar technologies

The website uses cookies and your browser’s local storage and session storage. You make your choice in the cookie banner shown on your first visit, and you can change or withdraw it at any time with the ‘Cookie settings’ link on the website; you can also delete cookies in your browser. The website also works without cookies that are not strictly necessary. Storing and reading data on your device is subject to the Electronic Communications Act (ZEKom-2).

The banner sorts cookies into four groups:

Strictly necessary: they remember your cookie choice (the emz_cc cookie), protect the website and allow forms to be submitted; they cannot be switched off and do not require consent;
Analytics: Google Analytics 4 and the counting of pages visited and time spent on the website, which is attached to your enquiry when you submit a form; they work only with your consent;
Advertising: Google Ads and Meta Pixel, which work only with your consent. This group also includes the attribution of the source of your visit: campaign parameters (utm, gclid), the website you came from and the number of visits are stored in cookies until you refuse advertising cookies, and are attached to your enquiry when you submit a form; if you refuse them, they are deleted;
Functional: the WhatsApp chat button and Instagram posts (Elfsight) and embedded YouTube and Google Maps content; they do not load without your consent.

Google Tag Manager loads when you open the website, with all consent settings set to ‘denied’ (Google Consent Mode). Google Analytics, Google Ads and Meta cookies are stored only after you give your consent.

8. Your rights

In relation to your personal data, you have the right:

of access: to find out whether we process your data and to receive a copy of it (Article 15 GDPR);
to rectification of inaccurate data and completion of incomplete data (Article 16);
to erasure (Article 17), except for medical records for as long as the retention period under ZZPPZ applies;
to restriction of processing (Article 18);
to portability of the data you have provided to us, in a machine-readable format (Article 20);
to object to processing based on legitimate interest (Article 21);
to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3)).

Send your request by email to estetika@fabjan.si or by post to ESTETIKA FABJAN d.o.o., Poslovna cona A 32, 4208 Šenčur, Slovenia; for news updates and newsletters, also to EMAZING d.o.o., Opekarna 28A, 1420 Trbovlje, Slovenia. So that we do not disclose data to an unauthorised person, we may ask you for information to verify your identity. We reply within one month; for complex requests we may extend this by two months, in which case we will let you know.

As a patient, you also have rights under the Patients’ Rights Act (ZPacP), including the right to see your medical records.

9. Complaints to the supervisory authority

If you believe that the processing of your personal data breaches data protection law, you can lodge a complaint with the supervisory authority:

Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec Republike Slovenije)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Email: gp.ip@ip-rs.si
Telephone: +386 1 230 97 30
www.ip-rs.si

You can also lodge a complaint with the supervisory authority of the EU Member State in which you live or work (Article 77 GDPR). We can resolve most questions more quickly if you contact us first.

10. Links to other websites

The website contains links to our social media profiles (Facebook, Instagram, YouTube, TikTok) and to other websites, for example Leanpay for payment in instalments. We are not responsible for the processing of data on those websites; the privacy policy of their controller applies.

11. Changes to this privacy policy

We may change this policy when our processing procedures or the regulations change. Each new version applies from its publication on this page.

Last updated: 11 November 2026