Privacy Policy

1.Who is responsible for your data

The controller of your personal data is:

We are based in Brazil. Because we offer this Event to physicians located in the European Union, this policy is written to meet the General Data Protection Regulation (EU) 2016/679 ("GDPR") as well as the Brazilian Lei Geral de Proteção de Dados (Law 13.709/2018, "LGPD").

This policy explains what we collect, why, who we share it with, where it goes, how long we keep it, and what you can do about it.

2.What this policy covers

This policy applies to:

• the websites meridianglobalinstitute.com and deepplaneprogram.com, including the registration and webinar pages for this Event;
• registration for and participation in Deep Plane Málaga & Marbella 2026;
• communications with us by email, contact form, or WhatsApp;
• our advertising and marketing activity, including on Meta platforms.

3.What personal data we collect

Information you give us

• Identification: full name, professional title;
• Contact details: email address, telephone or WhatsApp number, country of residence;
• Professional data: medical specialty, medical registration or licence number, country of registration, and documentary evidence of your qualification;
• Institutional data: clinic or hospital, position, professional website or social media profile (where you provide it);
• Registration data: billing name and address, tax identification number where required for invoicing;
• Correspondence: the content of messages you send us by email, contact form or WhatsApp.

Information collected automatically

• IP address and approximate location derived from it;
• Device type, operating system, browser and language;
• Pages visited, time on page, scroll depth, links and buttons clicked;
• Referring source, including advertising campaign identifiers (UTM parameters, click identifiers such as fbclid and gclid);
• Cookie and similar identifiers.

Information we do not collect

We do not ask for and do not collect health data about you, dietary restrictions, allergies, or accessibility requirements through our registration process. We do not collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or sexual orientation. Please do not send us such information.

If you have an accessibility or dietary requirement, contact us directly by email and it will be handled by a member of our team on an individual basis, used only for that purpose, and deleted after the Event.

4.Payment data

Payment is processed by our payment provider, Pagaa (pagaa.com.br). When you pay by card, your card number, expiry date and security code are collected and processed directly by Pagaa and its banking partners. We never receive, see or store your full card details.

We receive only confirmation of payment status, the amount, the date, and the identification and billing information needed to issue your invoice and confirm your registration. Where you pay by international bank transfer, we receive the transfer details supplied by your bank.

5.Why we use your data, and our legal basis

Under the LGPD, the corresponding bases are those set out in Article 7 of that law, in particular execution of a contract or preliminary procedures related to it, consent, compliance with a legal obligation, and legitimate interest.

6.Cookies and tracking technologies

We use cookies and similar technologies, deployed through Google Tag Manager, including a server-side tagging environment hosted by Stape.

• Strictly necessary cookies keep the site working — page delivery, security, and remembering your cookie preferences. These do not require consent.
• Analytics cookies — Google Analytics — tell us how visitors find and use the site, which pages hold attention, and where people drop off. Used only with your consent.
• Advertising cookies — the Meta Pixel and equivalent technologies — measure the results of our advertising and allow us to show ads to people who have visited our site. Used only with your consent.
• Embedded videos — testimonial videos on our pages are hosted by Vimeo, which may set its own cookies when you play a video.

Non-essential cookies and tags are not activated until you consent through our cookie banner. You can withdraw or change your choices at any time through the cookie settings on our site and through your browser settings. Withdrawing consent does not affect processing carried out before withdrawal.

7.Advertising on Meta platforms

We advertise on Facebook and Instagram. Three distinct activities are involved, and we want to be explicit about the third.

Meta Pixel. A tracking script on our website that records visits and actions such as viewing the registration page. Activated only with your consent.

Meta Conversions API. Sends equivalent event information from our server to Meta, so that advertising measurement continues to work when browser-based tracking is blocked. It processes the same categories of data, on the same consent basis.

Custom Audiences from customer lists. We may upload lists containing email addresses and telephone numbers to Meta, so that Meta can match them against its own user accounts. This lets us show advertising to people already in contact with us, exclude existing registrants from campaigns, and build "lookalike" audiences of people with similar characteristics.

Identifiers are hashed before upload, but this is a genuine disclosure of your contact details to Meta and we treat it as such. We do this only with your consent, given separately from any other consent. If you have not consented, your details are not uploaded.

For Custom Audiences, we and Meta Platforms Ireland Limited act as joint controllers in respect of the matching operation, under a joint controller arrangement made available by Meta. Meta then processes matched data as an independent controller under its own Privacy Policy.

To withdraw consent at any time, email contact@meridianglobalinstitute.com asking to be excluded from advertising audiences. We will remove you from our source lists and request deletion from the corresponding audiences. You can also manage advertising preferences directly in your Meta account settings.

8.Email communications

Our emails are sent through ActiveCampaign, which processes your contact details and records whether you open our emails and click links, so that we can send relevant material and measure results.

If you have enquired about a programme, we may send you information about that programme — such as availability, fees and registration deadlines — as described in Section 5. Marketing emails about other or future events are sent only with your consent.

Every email contains an unsubscribe link, and unsubscribing takes effect immediately. You can also email us to be removed. Unsubscribing does not affect operational emails about an Event you have registered for.

9.Who we share your data with

We do not sell your personal data. We share it with:

Service providers acting on our instructions

Host institutions

To grant you access to the venues, we share your name and professional registration details with the University of Málaga and with Ocean Clinic Marbella. These institutions require this for access control, insurance, and to satisfy the legal and ethical requirements governing anatomical dissection facilities and clinical environments. This sharing is necessary for your participation and cannot be opted out of while remaining registered.

Professional advisers and authorities

Accountants, lawyers and insurers where necessary, and public authorities where we are legally required to disclose.

10.WhatsApp

We use WhatsApp as a contact channel. If you message us there, your telephone number, profile name and the content of your messages are processed by us and by WhatsApp under WhatsApp's own privacy terms, on servers operated by Meta.

Please do not send sensitive personal information, patient information, or identity documents through WhatsApp. To send us credential documents, use email. If you prefer not to use WhatsApp at all, email works for everything.

11.International transfers

Our operations are based in Brazil, and our service providers operate in the United States and elsewhere. If you are in the European Economic Area or the United Kingdom, your data will be transferred outside that territory.

Brazil does not benefit from a European Commission adequacy decision. Transfers to us are made on the following bases:

• Article 49(1)(b) GDPR — the transfer is necessary for the performance of the contract between you and us, namely your registration for and participation in the Event. We cannot register you, verify your eligibility, invoice you, or admit you to the venues without receiving your data in Brazil.
• Article 49(1)(a) GDPR — your explicit consent, where you have been informed of the risks, in respect of processing that is not necessary for the contract, such as marketing.

Brazil has a comprehensive data protection law (LGPD) and an independent supervisory authority (ANPD), and this policy grants you the rights described in Section 13 regardless of where your data is held.

Transfers to our service providers located outside the EEA are made under Standard Contractual Clauses approved by the European Commission, or under an applicable adequacy decision, as provided in each provider's data processing terms. You may request further information about these safeguards at contact@meridianglobalinstitute.com.

12.How long we keep your data

At the end of these periods, data is deleted or irreversibly anonymised.

13.Your rights

Under the GDPR you have the right to:

• Access — obtain confirmation of whether we process your data, and a copy of it;
• Rectification — have inaccurate or incomplete data corrected;
• Erasure — have your data deleted where one of the grounds in Article 17 applies;
• Restriction — have processing limited in the circumstances set out in Article 18;
• Portability — receive data you provided in a structured, machine-readable format, and have it transmitted to another controller;
• Object — object to processing based on legitimate interest, and object to direct marketing at any time, absolutely and without needing to give a reason;
• Withdraw consent — at any time, without affecting processing already carried out;
• Not be subject to automated decision-making — we do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal or similarly significant effects.

Under the LGPD you additionally have the right to confirmation of processing, anonymisation or blocking of unnecessary or unlawfully processed data, information about entities with whom your data has been shared, and information about the consequences of refusing consent.

To exercise any of these rights, email contact@meridianglobalinstitute.com. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. There is no charge, unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting.

14.Complaints

If you are unhappy with how we handle your data, please contact us first — most issues are resolved quickly. You also have the right to lodge a complaint with a supervisory authority:

• European Economic Area — the data protection authority of your country of residence, work, or where the alleged infringement occurred. The full list is available at edpb.europa.eu;
• Spain — Agencia Española de Protección de Datos (AEPD), www.aepd.es;
• United Kingdom — Information Commissioner's Office (ICO), ico.org.uk;
• Brazil — Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd.

15.Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), restricted access on a need-to-know basis, access controls on the systems we use, and selection of service providers that maintain recognised security standards.

Credential documents are stored in restricted-access storage, available only to team members responsible for eligibility verification, and deleted within 90 days after the Event.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by Articles 33 and 34 GDPR.

16.Children

The Event is offered exclusively to qualified physicians. Our services are not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe we have, contact us and we will delete it.

17.Changes to this policy

We may update this policy. The current version is always published at this address with the date of last update at the top. Where changes materially affect how we use your data, we will notify registered participants and marketing subscribers by email.

18.Contact