Privacy Policy

Effective date: 4 April 2024
Last updated: 19 October 2026

1. General Information

Dea Clinic is the brand name under which healthcare services are provided by POLIKLINIKA ALABDULLA d.o.o. (hereinafter referred to as “Dea Clinic”, the “Clinic”, “we”, “us”, or the “Data Controller”).

Dea Clinic respects the privacy of its patients, clients, and website visitors and is committed to protecting their personal data.

This Privacy Policy explains what personal data we collect, why and how we process it, with whom we may share it, how long we retain it, and what rights you have regarding your personal data.

This Policy applies to the use of our website at https://dea-clinic.com, contact forms, newsletter subscriptions, Dea Clinic Gold Club registrations, and other features available through our website.

Data Controller details:

Clinic / Brand name: Dea Clinic
Legal entity: POLIKLINIKA ALABDULLA d.o.o.
Croatian Personal Identification Number (OIB): 31870130477
Court Registry Number (MBS): 081535006
Address: Ulica kneza Branimira 28, 10040 Zagreb, Croatia
Email: poliklinika@dea-clinic.com
Phone: +385 1 405 9203
Website: https://dea-clinic.com

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), applicable Croatian legislation, and other relevant legal requirements.

2. Personal Data We Collect

Depending on how you interact with our website and services, we may collect the following categories of personal data.

Information you provide directly:

Full name
Email address
Telephone number
Content of messages and inquiries
Preferred consultation date or appointment
Type of service or subject of inquiry
Other information you voluntarily provide through forms or communications with the Clinic
Information required for newsletter or Dea Clinic Gold Club registration

Technical and website usage information:

IP address, where collected
Browser type, operating system, and device information
Pages visited and interactions with our website
Date and time of access
Source of website traffic
URL of the page from which a contact inquiry was submitted
Cookie information and consent preferences
Campaign identifiers and advertising click identifiers, where available

Marketing attribution information:

To identify traffic sources and evaluate the effectiveness of marketing campaigns, we may process UTM parameters, including:

utm_source – traffic source
utm_medium – marketing channel type
utm_campaign – campaign identifier
utm_content – advertisement or creative variant identifier
utm_term – keyword or other targeting identifier

Other available advertising campaign and click identifiers may also be processed.

Special categories of personal data:

As Dea Clinic provides healthcare services, users may include information relating to their health, symptoms, treatments, or other medical circumstances in their inquiries.

Such information constitutes a special category of personal data and is processed only where an appropriate legal basis and a valid condition under Article 9 of the GDPR apply, subject to suitable technical and organisational safeguards.

We recommend that users avoid submitting unnecessary health-related or other sensitive information through general website contact forms.

3. Purposes and Legal Bases for Processing

We process personal data for the following purposes.

Handling contact inquiries

We use information submitted through contact forms to respond to inquiries, provide information about services, arrange consultations, and communicate with users.

Depending on the nature of the inquiry, processing may be based on steps taken at the request of the individual before entering into a contract, performance of a contract, or our legitimate interest in responding to general business inquiries.

Healthcare service administration

Where applicable, personal data may be processed to arrange appointments, provide healthcare services, and comply with legal and professional obligations.

Additional requirements under Article 9 of the GDPR and applicable healthcare regulations apply to the processing of health data.

Website analytics

Subject to appropriate consent, we process website usage information to analyse traffic, understand visitor interests, and improve website functionality and content.

Marketing campaign attribution

We process information about traffic sources, campaigns, and advertisements to evaluate advertising performance, measure conversions, and identify marketing activities that generate customer inquiries.

Where this processing is based on consent, users may withdraw their consent at any time.

Newsletter and Dea Clinic Gold Club

Subject to appropriate consent, we use personal data to send news, benefits, promotional offers, and other communications associated with our newsletter and Gold Club.

Security and legal compliance

Certain personal data may be processed to protect our website, prevent misuse, establish or defend legal claims, and comply with applicable legal obligations.

4. Contact Forms and EasyBusy CRM

Our website uses contact forms developed with Contact Form 7 as part of the WordPress platform.

Personal information submitted through these forms may be automatically transferred to EasyBusy CRM, an external customer relationship management system used to organise and manage inquiries.

The following information may be transferred to EasyBusy CRM:

Full name
Email address
Telephone number
Message content
Subject or type of inquiry, where available
Preferred consultation date, where provided and where its transfer is supported
URL of the page from which the inquiry was submitted
Technical information associated with the inquiry
Marketing campaign and traffic source information, where processed for the relevant purpose

Data is transferred through API communication between our website and the EasyBusy CRM system.

The purpose of using the CRM system is to maintain centralised inquiry records, improve communication, organise requests, and evaluate marketing effectiveness.

Marketing attribution information may be associated with an individual inquiry to identify which campaign or advertisement brought the user to the Dea Clinic website before submitting the form.

Submitting information to the CRM does not automatically result in promotional communications. Marketing messages are sent only where an appropriate legal basis exists.

Where EasyBusy or other service providers process personal data on behalf of the Clinic, such processing is governed by appropriate contractual and security safeguards in accordance with applicable law.

5. Google Tag Manager, Google Analytics and Marketing Tracking

We use Google Tag Manager (GTM) to manage analytics and marketing tags on our website.

These may include Google Analytics and technologies associated with Google advertising, including conversion tracking, campaign performance measurement, and remarketing where enabled.

These technologies may collect information about website usage, pages visited, user interactions, devices, browsers, and traffic sources.

The use of non-essential analytics and marketing technologies is subject to appropriate consent collected through our cookie consent management system.

Depending on the service and its configuration, Google may process certain information as an independent data controller or in another applicable capacity.

For further information, please refer to Google's Privacy Policy:

https://policies.google.com/privacy

6. UTM Parameters and Session-Based Data Storage

To measure marketing campaign effectiveness, our website uses UTM tags and other available traffic attribution parameters.

When users visit our website, information about the campaign, source, and advertisement through which they arrived may be recorded.

To preserve this information while users navigate between pages, it may be temporarily stored using the browser's sessionStorage technology.

sessionStorage allows information to remain available during navigation within the same browser tab. The information is generally removed when that tab's session ends, although browsers may restore it through their session recovery mechanisms.

Our system may record:

First-touch attribution: the first recorded traffic source and campaign during the session.
Last-touch attribution: the most recently recorded traffic source and campaign during the session.

When a contact form is submitted, relevant marketing attribution information may be associated with the inquiry and transferred to EasyBusy CRM.

The storage and use of marketing parameters are subject to applicable personal data protection requirements and consent where required.

7. Cookies and Complianz

Our website uses cookies and similar technologies for functionality, analytics, marketing attribution, and displaying third-party content.

We use Complianz to manage user consent for cookies and related technologies.

Categories may include:

Functional technologies: required for essential website operation and remembering selected preferences.
Statistics technologies: used to analyse website traffic and usage.
Marketing technologies: used to measure advertising campaign effectiveness, conversions, and other marketing activities.
Third-party content: may include services such as Google Maps that process certain technical information when loaded.

Users can manage their consent preferences through the cookie banner and cookie settings link available on our website.

Withdrawal of consent does not affect the lawfulness of processing performed before consent was withdrawn.

Further information about the technologies we use is available in our Cookie Policy.

8. Google Maps

Our website may display interactive maps using Google Maps, a service provided by Google.

When a map is loaded, Google may process technical information, including the user's IP address, browser and device information, and other data associated with the use of the service.

Google may also use cookies or similar technologies, depending on how the service is configured and used.

Where consent is required to load third-party content, Google Maps content is enabled following the user's appropriate consent choice.

For further information, please visit:

https://policies.google.com/privacy

9. Newsletter and Dea Clinic Gold Club

Users may voluntarily subscribe to our newsletter and Dea Clinic Gold Club.

When registering, we may collect:

Email address
Full name, where provided
Information about interests and preferences voluntarily shared by the user

We use this information to send news, service information, special offers, promotions, and Gold Club benefits.

The legal basis for promotional communications is user consent where required by applicable law.

Users may unsubscribe at any time through an unsubscribe link, where available, or by sending a request to poliklinika@dea-clinic.com.

Information may be processed by technical email distribution service providers, subject to appropriate contractual and security arrangements.

10. Sharing Personal Data with Third Parties

We do not sell personal data to third parties.

Where necessary for the purposes described in this Policy, personal data may be disclosed or made available to the following categories of recipients:

Website hosting and technical maintenance providers
The EasyBusy CRM service provider
Email and newsletter service providers
Google, in connection with analytics, advertising, and mapping services
Other contracted service providers processing information under our instructions
Competent public authorities where disclosure is required by law

We require service providers acting as data processors to apply appropriate safeguards and process personal data only for the agreed purposes.

11. International Data Transfers

Certain third-party service providers may process personal data outside the European Economic Area (EEA).

Where such transfers occur, appropriate GDPR safeguards must be applied, including adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms, depending on the applicable circumstances.

12. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law or justified by another valid legal basis.

Information submitted through contact forms and stored in CRM records is retained according to inquiry management requirements, communication needs, and applicable retention periods.

Newsletter and Gold Club information is processed until consent is withdrawn or the relevant purpose ends, unless another legal basis justifies further retention.

Marketing parameters stored in sessionStorage generally remain available for the duration of the browser tab session. Information linked to an inquiry and transferred to the CRM is subject to the retention period applicable to that inquiry record.

Information that must be retained to comply with legal obligations, medical record requirements, or the protection of legal interests may be stored for longer periods in accordance with applicable legislation.

13. Your Rights

Under the GDPR and applicable data protection legislation, you have the right to:

Request access to your personal data
Request correction of inaccurate or incomplete information
Request deletion of personal data where legal conditions are met
Request restriction of processing
Object to processing based on legitimate interests
Request data portability where applicable
Withdraw consent for processing based on consent
Lodge a complaint with a competent supervisory authority

To exercise your rights, please contact:

poliklinika@dea-clinic.com

We respond to requests in accordance with applicable statutory deadlines and obligations. Certain rights may be restricted where legal obligations require continued storage or processing.

If you believe that your data protection rights have been violated, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP):

14. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, unauthorised disclosure, or alteration.

These measures may include access controls, restrictions on user permissions, secure communications, information system protection, and other safeguards appropriate to the nature of the data processed.

Although we take reasonable security precautions, no method of electronic storage or transmission can guarantee absolute security.

15. Third-Party Links

Our website may contain links to websites and services operated by third parties.

We are not responsible for the content or privacy practices of external websites. We encourage users to review the privacy policies of third-party websites before using their services.

16. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in our business operations, technologies, or applicable legislation.

Updated versions will be published on this website with the corresponding date of the latest revision.

Where required by applicable law, we will provide additional notice of significant changes or obtain renewed consent.

17. Data Protection Contact

For questions about personal data processing, exercising your rights, or this Privacy Policy, please contact:

Dea Clinic
POLIKLINIKA ALABDULLA d.o.o.
OIB: 31870130477
MBS: 081535006
Ulica kneza Branimira 28
10040 Zagreb, Croatia

Email: poliklinika@dea-clinic.com
Phone: +385 1 405 9203
Website: https://dea-clinic.com

We respond to inquiries in accordance with applicable personal data protection legislation.