Updated on 14 October 2024
- Personal information
The intermediation services offered on the Site involve the processing of personal data. This policy informs you of the characteristics of this processing and of your rights with regard to your personal data. This privacy policy has been drawn up in accordance with Act no. 78-17 of 6 January 1978 (known as the “Data Protection Act” or “LIL”) and the General Regulation on the Protection of Personal Data (“RGDP”) no. 2016/679.
- Who is this policy aimed at?
This policy is addressed to all persons who use the Site (hereinafter the “User(s)”). More specifically, this includes :
- internet users browsing the Site
- people who use the Site’s contact form
- users who wish to obtain a personalised quote for a reconstructive, plastic, bariatric, aesthetic, hair, dental and/or reproductive surgery treatment offered by the Establishments listed on the Site.
- Who is the data controllerfor the intermediation service ?
For the intermediation service offered through the Site, the data controller for the data collected is the company GoldMax, whose official address is “Avenue Corniche Fleurie, 06200 Nice, France”, registered in the Nice Trade and Companies Register under number 507 436 566 (hereinafter the “Intermediary” or “Data Controller”).
For Services (in particular treatments) relating to reconstructive, plastic, cosmetic, bariatric, hair, dental and/or reproductive surgery offered by the Establishments listed on the Site, the data controllers are the Establishments themselves with which Users are put in contact, with their prior and express agreement.
The Establishments concerned are partner structures of the Intermediary (the “Partner Establishments”) listed as such on the Site. They may be clinics, hospitals or any other type of structure dedicated to surgery, facial or body care. The Establishments concerned have the particularity of being based abroad. They may be located in European Union countries (e.g. Spain, Cyprus, Hungary, etc.) or outside (Turkey, Dubai, Tunisia, etc.). Each Establishment has a presentation page on the Site.
To find out more about these other data controllers and the processing operations concerned, you are invited to consult article 9 of this Privacy Policy.
- Purposes and legal basis of processing
The main purpose of processing the User’s personal data is to provide the intermediation service offered on the Site. In the context of this Service, the sub-purposes of processing and the legal bases are specified in the table below:
| N° | PURPOSE(What the Intermediary uses the data for) | LEGAL BASIS (What authorises us to process data) |
| 1 | Transmission of the data entered by the User in the “Personalised Quote” form on the Site to the partner Establishments corresponding to the search criteria; the identity of the partner Establishments is shown on the Site under the heading “Partner Establishments” | The express prior consent obtained on the form (or by e-mail) |
| 2 | To respond to requests for personalised quotes from non-partner clinics or when the request for a quote relates to a surgical operation or concerns a country that is not on the list of partners | Legitimate interest |
| 3 | To respond to requests for information from the personalised quotation contact form | Legitimate interest |
| 4 | Payment of business introducer commissions on transactions carried out with partner clinics/hospitals | Legitimate interest |
| 5 | Hosting the site | Legitimate interest |
| 6 | Measuring the website audience using Google Analytics trackers | Express prior consent |
| 7 | Playback of videos on the website using trackers | Express prior consent |
| 8 | Management of opposition rights | Legitimate interest |
- Personaldata subject to processing
| N° | PURPOSE(Purpose for which the Intermediary uses the data) | Personal data processed |
| 1 | Transmission of the data entered by the User in the “Personalised Quote” form on the Site to the partner Establishments corresponding to the search criteria, the identity of the partner Establishments appearing on the Site under the heading “Partner Establishments” | Surname, first name, e-mail address, telephone number, type of operation, country |
| 2 | Respond to requests for personalised quotes made from non-partner clinic files or when the request for a quote relates to a surgical operation or concerns a country not on the list of partners | Surname, first name, e-mail address, telephone number, type of operation, country, sponsor, IP address |
| 3 | Reply to requests for information from the contact form on the contact page | Surname, first name, e-mail address, telephone number, subject of request, IP address |
| 4 | Payment of referral fees on transactions carried out with partner clinics/hospitals | Surname, first name, establishment concerned, type of transaction, price |
| 5 | Site hosting | Site data and connection data (IP addresses, logs, terminals, etc.) |
| 6 | Measuring the website audience by means of tracers | Connection data (IP addresses, terminals, pages consulted) |
| 7 | Playback of videos on the website using cookies | Connection data (IP addresses, terminals, pages consulted) |
| 8 | Management of opposition rights | Surname, first name, e-mail, reason, date of request |
- Length of time data is kept by the Intermediary
| N° | PURPOSE | DATA RETENTION PERIOD |
| 1 | Transmission of the data entered by the User in the “Personalised Quote” form on the Site to the partner Establishments corresponding to the search criteria. | 3 years from the date of the quote request |
| 2 | Responding to requests for personalised quotes made from non-partner clinics or when the request for a quote relates to a surgical operation or concerns a country that is not on the list of partners | Immediate deletion after responding to the User (unless the User finally agrees by e-mail to be put in contact with partner establishments) |
| 3 | Reply to requests for information from the form on the contact page | 3 years from the date of the request |
| 4 | Payment of business introducer commissions on transactions carried out with partner clinics/hospitals | The data processed to establish commissions is deleted immediately after payment of the invoices, which are kept for 10 years |
| 5 | Site hosting | Connection data is kept for a maximum of a few months. Backups are kept for 3 months. |
| 6 | Measuring the website audience using cookies | The cookies used have a maximum lifetime of 13 monthsThe information collected by means of these tracers is kept for a maximum of 25 months |
| 7 | Playback of videos on the website using cookies | The cookies used have a maximum lifetime of 13 monthsThe information collected through these cookies is kept for a maximum of 25 months |
| 8 | Management of opposition rights | 3 years from the date of the request |
- Mandatory or optional nature of data collection
The data collected is mandatory in order to achieve the purposes of the processing.
- Data sources
The data is transmitted directly by the person concerned.
The Intermediary is informed when the User has received Services from a partner Establishment.
- Data recipients
The Intermediary, as the party responsible for processing the intermediation service, undertakes not to pass on the personal data collected except where this is necessary to fulfil the purposes defined above.
Where these third parties are themselves data controllers, data will only be transferred with the prior and express consent of the data subject.
| N° | Category of recipient | Recipients |
| 1 | Subcontractors | -Site hosting: O2switch |
| 2 | Third-party recipientsProcessing managers | -Partner establishments marked as “Partner Establishment” on the establishment files. Data is only transmitted to partner establishments corresponding to the criteria requested by the User. |
| 3 | Third-party recipients for cookiesProcessors | To find out more about third-party cookies and the way in which the publishers of these third-party solutions process your personal data in their capacity as data controllers, we invite you to read their cookie policy:YouTube – Google : https://policies.google.com/technologies/cookies?hl=fr |
Data transmitted to recipients responsible for processing is processed by the latter, in accordance with their own confidentiality policy and under their sole responsibility. The User is invited to contact the data processors concerned to find out about their terms and conditions.
- What security measures have been put in place?
The Data Controller implements the appropriate technical and organisational measures in order to guarantee a level of security appropriate to the risk.
The data controller shall take measures to ensure that any natural person acting under its authority or under that of the processor, who has access to personal data, does not process it unless instructed to do so by the data controller or unless obliged to do so.
- Transfer of data to a country outside the European Union
The Data Controller may transfer personal data outside the European Union to subcontractors and/or third-party recipients who are themselves data controllers (see article 9). In particular, data may be transferred to the following countries: Turkey, Cyprus, Tunisia, Thailand and Dubai.
The Data Controller undertakes to ensure that such transfers are made :
- to countries with an adequate level of protection within the meaning of the European data protection authorities (which is the case, for example, of Cyprus)
- with appropriate safeguards pursuant to article 46 of the GDPR when the legislation of the country in question does not provide an adequate level of protection (as in the case of Turkey). The European Commission’s Standard Contractual Clauses are then signed with each recipient concerned.
- List ofpartner healthcare professionals
When you submit a request on our site, it is sent directly to our carefully selected partner healthcare professionals. Over the years, we have built up solid relationships with these establishments in order to guarantee our applicants an impeccable quality of service.
Our intermediation service is entirely free of charge, and its sole purpose is to simplify your access to the medical establishments we have rigorously selected, by ensuring that they comply with the strictest health and safety standards.
Each request is handled by qualified account managers, specially trained to offer you personalised advice and expert support. We are here to ensure that you receive a reliable, efficient service that meets your expectations, so that you can approach your situation with confidence from the trusted care professionals we call on:
Turkey: Istanbul Aesthetic Center, Esnan Dental, Medical Park, Natural Clinic, Hisar Continental Hospital, Bahceci Fertility, Metropolmed. Spain: Reproclinic. Cyprus: Cyprus IVF Hospital. Hungary: Suba Dental. Thailand: Bangkok Plastic Surgery.
Although we work with these trusted establishments, it is important that you carry out your own checks to ensure that the establishment you choose is exactly what you want. We also encourage you to compare services and request additional quotes from other available clinics or hospitals, either online or through your friends, in order to make the most informed choice possible.
- Automated decision-making
The processing does not involve fully automated decision-making.
- Fate of personal data after death – Right of access, rectification, deletion and portability of data
The person concerned by a processing operation may define directives relating to the conservation, deletion and communication of his/her personal data after his/her death. These directives may be general or specific.
Data subjects also have the right to access, object to, rectify, delete and, under certain conditions, port their personal data. The data subject has the right to withdraw consent at any time if consent is the legal basis for the processing.
The request must indicate the surname and first name, e-mail or postal address of the person concerned, and must be signed and accompanied by valid proof of identity.
You may exercise these rights by sending an e-mail to the person responsible for this policy using the contact form by clicking here.
For data processing carried out by partner establishments, the data subject is invited to contact the establishment concerned directly.
- Complaints
The person concerned by a processing operation carried out by the Intermediary has the right to lodge a complaint with the CNIL supervisory authority (EDPS): https://www.edps.europa.eu/