Privacy Policy

UPTC SH.P.K. PRIVACY POLICY

UPTC SH.P.K. places special importance on safeguarding your privacy. Therefore, we wish to inform you about the types of personal data we collect, how we process, store, protect, and disclose such data, as well as your rights throughout this process.

Lawfulness of Data Collection and Processing

The collection and processing of personal data by UPTC SH.P.K. is carried out in accordance with the Constitution of the Republic of Albania (in particular, Article 35), international conventions ratified by the Republic of Albania, Law No. 124/2024 "On the Protection of Personal Data" and the secondary legislation issued pursuant to and for the implementation of this Law, as well as any other applicable legal and regulatory framework requiring the collection and processing of personal data. In drafting and implementing this Privacy Policy, UPTC SH.P.K. has also taken into consideration the European Union's General Data Protection Regulation (GDPR) (EU) 2016/679. In accordance with this regulatory framework and accepted commercial standards, the collection and processing of personal data by UPTC SH.P.K. is lawful where:

You have provided your consent for the collection and processing of your personal data for one or more specific purposes. Such consent may be given in writing, electronically, or by any other form or mechanism that clearly expresses your intention;
The processing is necessary for entering into or performing a contract or other legal relationship to which you are or will become a party;
The processing is necessary for compliance with a legal obligation;
The processing is necessary to protect the vital interests of an individual;
The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; or
The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject.

Types of Data We Collect

UPTC SH.P.K. collects and processes your personal data (such as your first name, father's name, surname, date of birth, place of birth, place of residence, ID card or passport details, personal identification number, age, gender, health data and other sensitive personal data, photograph, email address, telephone number, etc.) when you apply through this website and voluntarily provide such information by completing forms or applications for one or more of the purposes specified below in this Privacy Policy.

UPTC SH.P.K. also collects and processes information relating to your use of our website (for example, your interest in specific topics while browsing our website) through the IP address of the computer or mobile device you use to access the website, as well as through cookies and similar automatic tracking technologies.

An IP (Internet Protocol) address is a numerical identifier assigned to your computer's browser when you access the Internet and is automatically provided by your Internet Service Provider.

An IP address does not, in itself, constitute personally identifiable information, since different individuals may access the Internet using the same device.

Cookies are small files stored in your browser when you visit the UPTC SH.P.K. website. They enable the recognition of your browser and collect and store information regarding the services you have used or the topics in which you have expressed an interest.

Other technological tracking tools, such as mobile identifiers, web beacons, and similar technologies, are small graphic files embedded in websites or emails. They are primarily used to monitor user activity and transmit information to a central server, which may belong to the hosting website, an advertising network, or another third party.

How We Collect Your Personal Data

We collect your personal data through: Online forms and applications; Our call center; Telephone or email communications; Third parties (such as public authorities or business partners), where permitted by applicable law; and Your devices when you use our website or applications.

Purpose of Data Collection and Processing

Personal data is collected and processed for the following purposes:

To schedule appointments and/or register you and create your patient record for the provision of dental, medical, or aesthetic consultations and treatments;
To provide dental, medical, or aesthetic diagnosis and treatment;
To contact you for medical purposes in connection with the continuation of your treatment or medical procedures;
To process an application and/or conclude a valid agreement for the provision of one or more of our products and/or services;
To identify issues relating to our products and services, respond to complaints, and improve the quality of our services;
To comply with applicable legal, regulatory, and/or contractual obligations;
To manage overdue obligations or exercise other legal and contractual rights by UPTC SH.P.K., either independently or in cooperation with third parties or competent law enforcement authorities;
To conduct scientific research, statistical analyses, surveys, and other analytical activities;
To personalize and promote products, services, or topics that you have expressed interest in or may reasonably be interested in; to communicate important information regarding the Company's products and services, updates or changes, promotional offers related to the Clinic's activities, whether independently or in cooperation with other organizations; and to send informational messages and conventional or digital marketing communications (only where you have provided your explicit consent), using any appropriate communication channels available for these purposes;
To communicate with you for any other purpose based on your request or notification. For these purposes, UPTC SH.P.K. implements appropriate technical and organizational measures to protect personal data against unauthorized access, misuse, alteration, disclosure, or loss. UPTC SH.P.K. guarantees that personal data is processed solely for the purposes specified above while ensuring the confidentiality, integrity, and security of the information.

Disclosure and Transfer of Personal Data

UPTC SH.P.K. may disclose your personal data to companies within the same corporate group (parent and subsidiary companies). In the event of a change of control resulting, for example, from a sale, merger, insolvency, bankruptcy, or a similar transaction, UPTC SH.P.K. reserves the right to transfer your personal data to the acquiring or succeeding entity. In such circumstances, your personal data will continue to be processed in accordance with this Privacy Policy, except where amendments to this Policy are made in accordance with the section on

Changes to the Privacy Policy

below and/or where such amendments are required by applicable law or are introduced to improve the collection and processing of personal data.

UPTC SH.P.K. also cooperates with third-party service providers and contractors that assist in the provision, management, and delivery of its products and services, or that provide operational support for the website, information technology services, data analysis, research, statistical analysis, email distribution, advertising, and promotional activities. Through appropriate contractual arrangements, UPTC SH.P.K. requires these third parties to process your personal data solely for the purposes necessary to perform the services agreed upon and prohibits them from using or disclosing your personal data for any other purpose.

UPTC SH.P.K. may also disclose your personal data to public authorities or other third parties in the following circumstances: a) To comply with applicable legal obligations; b) Where disclosure is necessary to protect your safety or the safety of others, to safeguard the public interest in the field of public health, or to investigate and prevent fraud or other risks; c) For the management of overdue obligations or the protection and enforcement of our legal or contractual rights, either directly by UPTC SH.P.K. or in cooperation with third parties or competent law enforcement authorities, including in the event of the assignment or transfer of rights and obligations to a third party; d) In exceptional circumstances, in response to threats or risks to individuals, property, or for the protection of fundamental rights; e) To public and health authorities where disclosure is required by law; f) To public or regulatory authorities, including the Ministry of Health and Social Protection, the Albanian Agency for Medicines and Medical Devices (AKBPM), the Directorate of Taxes (DPT), or other competent authorities, as well as private entities for the reimbursement of healthcare expenses; g) To other healthcare professionals where necessary for the provision of the requested healthcare services; h) To substitute physicians, collaborating physicians, third-party service providers, contractors, and business partners, including suppliers, payment processors, IT maintenance providers, consultants, and promotional partners, only where such disclosure is justified, necessary, and subject to appropriate safeguards.

We do not disclose your personal data for commercial or marketing purposes without your prior consent.

Personal data will not be transferred to a third country or an international organization except as permitted under the conditions set out in this Policy. In exceptional cases, personal data may be transferred outside the Republic of Albania only where an adequate level of data protection is ensured in accordance with the requirements of Law No. 124/2024 "On the Protection of Personal Data" and the General Data Protection Regulation (GDPR).

Our website may contain links to third-party websites that operate under their own privacy policies. UPTC SH.P.K. does not transfer your personal data to such websites. However, you are encouraged to review the privacy policies of those websites, as UPTC SH.P.K. is not responsible for and does not guarantee how such third parties collect, process, or protect your personal data once you leave our website.

Data Security and Retention Period

To ensure the security of personal data, UPTC SH.P.K. has implemented and maintains appropriate technical and organizational measures designed to prevent unauthorized access, unlawful processing, accidental loss, destruction, or damage to personal data, while ensuring its confidentiality, integrity, and availability.

Notwithstanding these measures, you should be aware that certain risks may arise from external cyberattacks that are beyond the reasonable control of UPTC SH.P.K. and cannot be entirely prevented.

The security measures implemented by UPTC SH.P.K. include, among others:

Data anonymization
Data encryption
Pseudonymization
Role-based access controls
Periodic monitoring and auditing of systems and processes that process personal data; and
Other technical and organizational safeguards appropriate to the nature of the data processed.

Your personal data will be retained only for as long as necessary to:
a) Fulfill the purposes for which the data was collected;
b) Perform and manage the contractual relationship;
c) Comply with applicable legal and regulatory obligations;
d) Resolve disputes or legal proceedings;
e) Exercise or defend legal rights;
f) Protect the public interest; and
g) Archive data for public interest, scientific research, or historical purposes, where permitted or required by law. Accordingly, personal data is generally retained:
i. For a minimum period of five (5) to ten (10) years following the termination of the relevant relationship;
ii. For a longer period where required in connection with ongoing or anticipated legal proceedings or other legal obligations; and
iii. For a longer period where required under applicable archival legislation, to which UPTC SH.P.K. is subject.

Your Rights

At any time, you have the right to:

Be informed about the personal data being processed and the purposes of such processing;
Access the personal data that has been collected and processed about you;
Request the correction, updating, or completion of inaccurate or incomplete personal data;
Request the restriction of processing in the circumstances provided for by applicable law;
Request the cessation of further processing and/or the erasure of your personal data where such processing is no longer necessary or where you have withdrawn your consent;
Receive your personal data in a structured, commonly used, and machine-readable format and exercise your right to data portability, where applicable;
Object to the processing of your personal data or withdraw your consent at any time, where processing is based on consent; and
Not be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects concerning you. However, the erasure of personal data may not be possible where one or more of the grounds set out in the "Data Security and Retention Period" section above apply. Furthermore, due to technical and operational limitations, it may not be possible to permanently erase every copy of your personal data stored in backup systems or server archives. In exercising your rights, you may also opt out of receiving communications, emails, newsletters, promotional materials relating to the products and services of UPTC SH.P.K., or other marketing notifications by using the unsubscribe link provided in such communications or by changing your communication preferences. You may exercise the rights described above by submitting a formal request to UPTC SH.P.K. at the address provided on this website, by email at [email protected], or by telephone at +355 67 608 4446. You may also contact the Data Protection Officer (DPO): Telephone: +355 68 400 6737. Upon receipt of your request, the relevant departments of UPTC SH.P.K. will assess your request and inform you of the actions taken within the time limits prescribed by applicable law. If you have a complaint regarding the processing of your personal data, you may contact UPTC SH.P.K. directly. You also have the right to lodge a complaint with the Commissioner for the Right to Information and Protection of Personal Data through www.idp.al, or to seek any other legal remedies available under applicable law.

Children's Privacy

UPTC SH.P.K. collects and processes the personal data of children solely for healthcare-related purposes and only in accordance with applicable legal requirements. UPTC SH.P.K. is committed to ensuring the privacy and protection of children's personal data through appropriate safeguards and in compliance with applicable data protection legislation.

Contacting UPTC SH.P.K. Regarding Privacy and Your Personal Data

If you have any questions, concerns, requests, or complaints regarding the collection or processing of your personal data, you may contact UPTC SH.P.K. through any of the following channels:

• Head Office: Loni Dhamo Neighborhood, Lushnje, Albania
• Any branch office of UPTC SH.P.K. in Albania
• Email: [email protected]
• Telephone: +355 67 608 4446
• Data Protection Officer (DPO): +355 68 400 6737

Upon receipt of your request, the relevant departments of UPTC SH.P.K. will review and assess your request and will inform you of the actions taken within the time limits prescribed by applicable law.

If you believe that your concerns regarding the collection or processing of your personal data have not been adequately addressed, you have the right to lodge a complaint with the Commissioner for the Right to Information and Protection of Personal Data at www.idp.al, or to pursue any other remedies available under applicable law. Changes to the Privacy Policy UPTC SH.P.K. reserves the right to amend or update this Privacy Policy and the products and services it offers at any time. Any amendments shall become effective upon their publication on this website, notification by email, or through any other appropriate means of communication. Your continued use of this website after such changes have been published shall constitute your acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically to remain informed of any updates and of our current data protection practices.

If you do not agree with the terms of this Privacy Policy, you should discontinue using this website. Declaration of Accuracy I confirm that the information I have provided is accurate, complete, and truthful. I acknowledge that UPTC SH.P.K. may collect and process my personal data solely for purposes related to the provision of its products and services. User Declaration I acknowledge and agree that my personal data may be processed by UPTC SH.P.K. in accordance with Law No. 124/2024 "On the Protection of Personal Data" for the purpose of receiving products and services and for the fulfillment of applicable legal obligations. Such processing shall be carried out in accordance with applicable law and with appropriate technical and organizational measures to ensure a high level of security. ☐ I Agree ☐ I Do Not Agree Consent to Further Processing of Personal Data By providing my consent, I authorize UPTC SH.P.K. to use my personal data to provide me with personalized information regarding its products and services and to contact me through various communication channels for marketing and promotional purposes. ☐ I Agree ☐ I Do Not Agree Consent to the Transfer of Personal Data I authorize UPTC SH.P.K. to transfer my personal data to third parties for further processing in accordance with this Privacy Policy and applicable law. I understand that I may withdraw this consent at any time without affecting the lawfulness of processing carried out before such withdrawal. ☐ I Agree ☐ I Do Not Agree