Updated October 14, 2024
- Personal data
The intermediation services offered on the Site involve the processing of personal data. This policy informs you of the characteristics of this processing and your rights over your personal data. This privacy policy is drawn up in accordance with Law No. 78-17 of 6 January 1978 (known as the “Data Protection Act” or “DPA”) and the General Data Protection Regulation (“GDPR”) No. 2016/679.
- Who is this policy for?
This policy applies to all persons who use the Site (hereinafter the “User(s)”). This applies more specifically to:
- Internet users who browse the Site
- people who use the Site’s contact form
- Users wish to obtain a personalized quote for restorative, plastic, bariatric, cosmetic, hair, dental and/or reproductive medicine surgery treatment offered by the Establishments referenced on the Site.
- Who is the data controller for the Intermediation Service?
For the Intermediation Service offered through the Site, the data controller for the data collected is the company GoldMax, whose official address is “Avenue Corniche Fleurie, 06200 Nice, France” registered with the RCS of Nice under number 507 436 566 (hereinafter “the Intermediary” or “Data Controller”).
For Services (including treatments)of reconstructive, plastic, aesthetic, bariatric, hair, dental and/or reproductive medicine surgery offered bythe Establishments referenced on the Site, the data controllers are the Establishments themselves with which the Users are put in contact, with their prior and express agreement.
The Establishments concerned are partner structures of the Intermediary (the “Partner Establishments”) referenced as such on the Site. These may be clinics, hospitals or any other type of structure dedicated to surgery, facial or body care. The Establishments concerned have the particularity of being based abroad. They may be located in countries of the European Union (e.g.: Spain, Cyprus, Hungary, etc.) or outside (Turkey, Dubai, Tunisia, etc.). Each Establishment has a presentation sheet on the Site.
To find out more about these other managers and the processing concerned, the person is invited to consult article 9 of this Privacy Policy.
- Purposes and legal basis of processing
The main purpose of processing the User’s personal data is to carry out the Intermediation Service offered on the Site. In the context of this Service, the sub-purposes of processing and the legal bases are specified in the table below:
| No. | PURPOSES (For what purposes does the Intermediary use the data) | LEGAL BASIS (What allows us to process data) |
| 1 | Transmission of the data that the User has entered in the “Personalized quote” form on the Site, to the partner Establishments corresponding to the search criteria. The identity of the Partner Establishments appears on the Site under the heading “Partner Establishments” | Express and prior consent obtained on the form (or by email) |
| 2 | Respond to requests for personalized quotes made from non-partner clinical records or when the quote request relates to a surgical operation or targets a country not on the list of partners | Legitimate interest |
| 3 | Respond to inquiries from the custom quote contact form | Legitimate interest |
| 4 | Payment of business introducer commissions on transactions carried out with partner clinics/hospitals | Legitimate interest |
| 5 | Site hosting | Legitimate interest |
| 6 | Measuring the website’s audience using tracersGoogle Analytics | Express and prior consent |
| 7 | Playing videos on the website using trackers | Express and prior consent |
| 8 | Management of opposition rights | Legitimate interest |
- Personal data subject to processing
| No. | PURPOSES (For what purposes does the Intermediary use the data) | Personal data processed |
| 1 | Transmission of the data that the User has entered in the “Personalized quote” form on the Site, to the partner Establishments corresponding to the search criteria. The identity of the Partner Establishments appears on the Site under the heading “Partner Establishments” | Name, first name, email, telephone, type of operation, country |
| 2 | Respond to requests for personalized quotes made from non-partner clinical records or when the quote request relates to a surgical operation or targets a country not on the list of partners | Name, first name, email, telephone, type of operation, country, sponsor, IP address |
| 3 | Respond to inquiries from the Inquiry Contact Form on the Contact Page | Name, first name, email, telephone number, subject of the request, IP address |
| 4 | Payment of business introducer commissions on transactions carried out with partner clinics/hospitals | Name, first name, establishment concerned, nature of the operation carried out, price |
| 5 | Site hosting | Site data as well as connection data (IP addresses, logs, terminals, etc.) |
| 6 | Measuring the website’s audience using tracers | Connection data (IP addresses, terminals, pages viewed) |
| 7 | Playing videos on the website using trackers | Connection data (IP addresses, terminals, pages viewed) |
| 8 | Management of opposition rights | Name, first name, email, reason, date of request |
- Duration of data retention by the Intermediary
| No. | PURPOSES | DATA RETENTION PERIOD |
| 1 | Transmission of the data that the User has entered in the “Personalized quote” form on the Site, to the partner Establishments corresponding to the search criteria. | 3 years from the quote request |
| 2 | Respond to requests for personalized quotes made from non-partner clinical records or when the quote request relates to a surgical operation or targets a country not on the list of partners | Immediate deletion after responding to User(unless the latter finally gives his agreement by email to be put in contact with partner establishments) |
| 3 | Respond to inquiries from the form on the contact page | 3 years from the date of application |
| 4 | Payment of business introducer commissions on transactions carried out with partner clinics/hospitals | The data processed for the establishment of commissions are deleted immediately after payment of the invoices. Invoices are kept for 10 years |
| 5 | Site hosting | Login data is kept for a maximum of a few months. Backups are kept for 3 months. |
| 6 | Measuring the website’s audience using tracers | The cookies placed have a maximum lifespan of 13 months. The information collected through these tracers is kept for a maximum period of 25 months. |
| 7 | Playing videos on the website using trackers | The cookies placed have a maximum lifespan of 13 months. The information collected through these tracers is kept for a maximum period of 25 months. |
| 8 | Management of opposition rights | 3 years from the date of application |
- Mandatory or optional nature of data collection
The data collected is mandatory to achieve the processing purposes.
- Data sources
The data is transmitted directly by the person concerned.
When the User has benefited from Services from a Partner Establishment, the Intermediary is informed.
- The recipients of the data
The Intermediary, as data controller of the Intermediation Service, undertakes not to transmit the personal data collected except when this is necessary to fulfill the purposes defined previously.
When these third parties are themselves data controllers, the transfer of data is carried out only in the event of prior and express consent from the person concerned.
| No. | Category of recipients | Recipients |
| 1 | Subcontractors | -Site hosting: “O2Switch” |
| 2 | Third party recipients Data controllers | – Partner establishments marked as “Partner establishments” on the establishment files. The data is transmitted only to the Partner establishments corresponding to the criteria requested by the User. |
| 3 | Third-party recipients for tracers Data controllers | To learn more about third-party cookies and how the publishers of these third-party solutions process your personal data in their capacity as data controller, we invite you to read their cookie policy: YouTube – Google: https://policies.google.com/technologies/cookies?hl=fr |
Data transmitted to recipients responsible for processing are processed by the latter, in accordance with their own privacy policy and under their sole responsibility. The User is invited to contact the relevant data controllers to find out their conditions.
- What security measures are in place?
The Data Controller implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
The Data Controller shall take measures to ensure that any natural person acting under its authority or that of the processor, who has access to personal data, does not process them, except on instructions from the Data Controller, unless required to do so.
- Transfer of data to a country outside the European Union
The Data Controller may be required to transfer personal data outside the European Union to subcontractors and/or third-party recipients who are themselves data controllers (see Article 9). Transfers may in particular be made to the following countries: Turkey, Cyprus, Tunisia, Thailand, Dubai.
The Data Controller undertakes to ensure that these transfers are carried out:
- to countries with a level of protection deemed adequate by the European data protection authorities (which is the case, for example, in Cyprus)
- with appropriate safeguards pursuant to Article 46 of the GDPR where the legislation of the country in question does not provide an adequate level of protection (as for Turkey). The European Commission’s Standard Contractual Clauses are then signed with each recipient concerned.
- List of partner healthcare professionals
When you submit a request on our site, it is sent directly to our carefully selected healthcare professional partners. Over the years, we have built strong relationships with these establishments in order to guarantee our applicants an impeccable quality of service.
Our intermediation service is completely free and has the sole purpose of simplifying your access to the medical establishments that we have rigorously selected, ensuring that they comply with the strictest standards in terms of safety and health.
Each request is handled by qualified account managers, specially trained to offer you personalized advice and expert support. We are here to ensure you a reliable, efficient service that meets your expectations, so that you can approach your situation with confidence with trusted care professionals whom we call upon:
Türkiye: Istanbul Aesthetic Center, Esnan Dental, Medical Park, Natural Clinic, Hisar Continental Hospital, Bahceci Fertility, Metropolmed. Spain: Reproclinic. Cyprus: Cyprus IVF Hospital. Hungary: Suba Dental. Thailand: Bangkok Plastic Surgery.
Although we work with these trusted facilities, it is important that you do your own research to ensure that the facility you choose is a good fit for your needs. We also encourage you to compare services and request additional quotes from other available clinics or hospitals, either online or through contacts, in order to make the most informed choice possible.
- Automated decision making
The processing does not provide for fully automated decision-making.
- Fate of personal data after death – Right of access, rectification, deletion and portability of data
The person concerned by a processing may define guidelines relating to the retention, deletion and communication of their personal data after their death. These guidelines may be general or specific.
The person concerned by processing also benefits from a right of access, opposition, rectification, deletion and, under certain conditions, portability of his personal data. The person concerned has the right to withdraw his consent at any time if consent constitutes the legal basis of the processing.
The request must indicate the first and last name, email or postal address of the person concerned, and be signed and accompanied by valid proof of identity.
She can exercise these rights by contacting the person responsible for this policy by email via the contact form in clicking here.
For data processing carried out by Partner Establishments, the person concerned is invited to contact the Establishment concerned directly.
- Claim
The person concerned by processing carried out by the Intermediary has the right to lodge a complaint with the CNIL supervisory authority (EDPS): https://www.edps.europa.eu/