Privacy Policy

Deep Plane Málaga & Marbella 2026

Last updated: [5th September]

1. Who is responsible for your data

The controller of your personal data is:

MD SERVIÇOS E SAÚDE LTDA, trading as Meridian Global Institute Limited liability company registered in Brazil Company registration number (CNPJ): 47.597.124/0001-60 Registered office: SGAS 910, Conjunto B, Bloco A, Sala 123, Parte 4, Asa Sul, Brasília – DF, 70.390-100, Brazil

Data protection contact: contact@meridianglobalinstitute.com

We are based in Brazil. Because we offer this Event to physicians located in the European Union, this policy is written to meet the General Data Protection Regulation (EU) 2016/679 ("GDPR") as well as the Brazilian Lei Geral de Proteção de Dados (Law 13.709/2018, "LGPD").

This policy explains what we collect, why, who we share it with, where it goes, how long we keep it, and what you can do about it.

2. What this policy covers

This policy applies to:

• the websites deepplaneprogram.com and meridianglobalinstitute.com;
• registration for and participation in Deep Plane Málaga & Marbella 2026;
• communications with us by email, contact form, or WhatsApp;
• our advertising and marketing activity, including on Meta platforms.

3. What personal data we collect

Information you give us

• Identification: full name, professional title;
• Contact details: email address, telephone or WhatsApp number, country of residence
• Professional data: medical specialty, medical registration or licence number, country of registration, and documentary evidence of your qualification
• Institutional data: clinic or hospital, position, professional website or social media profile (where you provide it)
• Registration data: billing name and address, tax identification number where required for invoicing
• Correspondence: the content of messages you send us by email, contact form or WhatsApp

Information collected automatically

• IP address and approximate location derived from it;
• Device type, operating system, browser and language;
• Pages visited, time on page, scroll depth, links and buttons clicked;
• Referring source, including advertising campaign identifiers (UTM parameters, click identifiers such as fbclid and gclid);
• Cookie and similar identifiers;

Information we do not collect

We do not ask for and do not collect health data about you, dietary restrictions, allergies, or accessibility requirements through our registration process. We do not collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or sexual orientation.

Please do not send us such information. If you have an accessibility or dietary requirement, contact us directly by email and it will be handled by a member of our team on an individual basis, used only for that purpose, and deleted after the Event.

Note on your medical registration: we collect proof of your medical qualification to verify professional eligibility. This is data about your professional credentials, not about your health.

4. Payment data

Payment is processed by our payment provider, Pagaa (pagaa.com.br). When you pay by card, your card number, expiry date and security code are collected and processed directly by Pagaa and its banking partners. We never receive, see or store your full card details.

We receive only confirmation of payment status, the amount, the date, and the identification and billing information needed to issue your invoice and confirm your registration.

Where you pay by international bank transfer, we receive the transfer details supplied by your bank.

5. Why we use your data, and our legal basis

Purpose

• Responding to your enquiry by email, form or WhatsApp;

• Processing your registration and payment, and issuing your invoice;
Verifying that you are a qualified plastic surgeon;
Organising and delivering the Event, including access to the University of Málaga and Ocean Clinic Marbella;
Sending you operational information about the Event you registered for;
Sending marketing emails about future events and programmes;
Measuring and improving our website and advertising;
Advertising on Meta platforms, including audience creation;
Meeting accounting, tax and legal obligations in Brazil;
Establishing, exercising or defending legal claims;

Data used

Contact details, correspondence;

Identification, contact, billing and payment confirmation data;

Professional data and credential documents;

Name, professional data, registration data;

Contact details;

Contact details, engagement data;

Usage and cookie data;

Contact details, online identifiers;

Registration, billing and payment data;

Relevant records;


Legal basis (GDPR)

• Steps taken at your request prior to a contract (Art. 6(1)(b)); legitimate interest in responding (Art. 6(1)(f))

• Performance of a contract (Art. 6(1)(b));

• Performance of a contract (Art. 6(1)(b)); legitimate interest in restricting access to a programme involving human anatomical specimens and live surgery to qualified physicians (Art. 6(1)(f));

• Performance of a contract (Art. 6(1)(b));

• Performance of a contract (Art. 6(1)(b));

• Consent (Art. 6(1)(a)), withdrawable at any time;

• Consent (Art. 6(1)(a)) for non-essential cookies and tracking;

• Consent (Art. 6(1)(a)) — see Section 7;

• Legal obligation (Art. 6(1)(c));

• Legitimate interest (Art. 6(1)(f));


Under the LGPD, the corresponding bases are those set out in Article 7 of that law, in particular execution of a contract, consent, compliance with a legal obligation, and legitimate interest.

6. Cookies and tracking technologies

We use cookies and similar technologies, deployed through Google Tag Manager.


Strictly necessary cookies keep the site working — page delivery, security, and remembering your cookie preferences. These do not require consent.

Analytics cookies — Google Analytics — tell us how visitors find and use the site, which pages hold attention, and where people drop off. Used only with your consent.

Advertising cookies — the Meta Pixel and equivalent technologies — measure the results of our advertising and allow us to show ads to people who have visited our site. Used only with your consent.
Non-essential cookies are not set until you consent through our cookie banner. You can withdraw or change your choices at any time through the cookie settings link on our site, and through your browser settings. Withdrawing consent does not affect processing carried out before withdrawal.

7. Advertising on Meta platforms

We advertise on Facebook and Instagram. Three distinct activities are involved, and we want to be explicit about the third.

Meta Pixel. A tracking script on our website that records visits and actions such as viewing the registration page. Set only with your consent.

Meta Conversions API. Sends equivalent event information from our server to Meta, so that advertising measurement continues to work when browser-based tracking is blocked. It processes the same categories of data, on the same consent basis.

Custom Audiences from customer lists. We may upload lists containing email addresses and telephone numbers to Meta, so that Meta can match them against its own user accounts. This lets us show advertising to people already in contact with us, exclude existing registrants from campaigns, and build "lookalike" audiences of people with similar characteristics.

Identifiers are hashed before upload, but this is a genuine disclosure of your contact details to Meta and we treat it as such. We do this only with your consent, given separately from any other consent. If you have not consented, your details are not uploaded.

For Custom Audiences, we and Meta Platforms Ireland Limited act as joint controllers in respect of the matching operation, under a joint controller arrangement made available by Meta. Meta then processes matched data as an independent controller under its own Privacy Policy:

https://www.facebook.com/privacy/policy

To withdraw consent for this at any time, email contact@meridianglobalinstitute.com asking to be excluded from advertising audiences. We will remove you from our source lists and request deletion from the corresponding audiences. You can also manage advertising preferences directly in your Meta account settings.

8. Email marketing

Marketing emails are sent through ActiveCampaign, which processes your contact details and records whether you open our emails and click links, so that we can send relevant material and measure results.


We send marketing emails only with your consent. Every email contains an unsubscribe link, and unsubscribing takes effect immediately. You can also email us to be removed. Withdrawing consent for marketing does not affect operational emails about an Event you have registered for.

9. Who we share your data with

We do not sell your personal data. We share it with:

Service providers acting on our instructions

• GreatPages — landing page hosting
• Google (Tag Manager, Analytics) — tag management and website analytics
• ActiveCampaign — email marketing and contact management
• [CRM / SPREADSHEET TOOL — name the platform] — registration and contact records
• Pagaa — payment processing
• Meta Platforms — advertising delivery and measurement (see Section 7)
• WhatsApp (Meta) — messaging (see Section 10)

Host institutions

To grant you access to the venues, we share your name and professional registration details with the University of Málaga and with Ocean Clinic Marbella. These institutions require this for access control, insurance, and to satisfy the legal and ethical requirements governing anatomical dissection facilities and clinical environments. This sharing is necessary for your participation and cannot be opted out of while remaining registered.

Professional advisers and authorities

Accountants, lawyers and insurers where necessary, and public authorities where we are legally required to disclose.

10. WhatsApp

We use WhatsApp as a contact channel. If you message us there, your telephone number, profile name and the content of your messages are processed by us and by WhatsApp under WhatsApp's own privacy terms, on servers operated by Meta.

Please do not send sensitive personal information, patient information, or identity documents through WhatsApp. To send us credential documents, use email. If you prefer not to use WhatsApp at all, email works for everything.

11. International transfers

Our operations are based in Brazil, and our service providers operate in the United States and elsewhere. If you are in the European Economic Area or the United Kingdom, your data will be transferred outside that territory.

Brazil does not benefit from a European Commission adequacy decision. Transfers to us are made on the following bases:

• Article 49(1)(b) GDPR — the transfer is necessary for the performance of the contract between you and us, namely your registration for and participation in the Event. We cannot register you, verify your eligibility, invoice you, or admit you to the venues without receiving your data in Brazil.

• Article 49(1)(a) GDPR — your explicit consent, where you have been informed of the risks, in respect of processing that is not necessary for the contract, such as marketing.

Brazil has a comprehensive data protection law (LGPD) and an independent supervisory authority (ANPD), and this policy grants you the rights described in Section 13 regardless of where your data is held.

Transfers to our service providers located outside the EEA are made under Standard Contractual Clauses approved by the European Commission, or under an applicable adequacy decision, as provided in each provider's data processing terms.

You may request further information about these safeguards at contact@meridianglobalinstitute.com.

12. How long we keep your data

Data

• Enquiries that do not lead to registration
• Registration and participation records
• Invoices, payment records and accounting data
• Medical credential documents
• Marketing contact data
• Website analytics and advertising data
• Records needed for legal claims

Retention period

• 24 months from last contact;
• Duration of the Event plus 5 years;
• 5 years, or longer where Brazilian tax law requires;
• Deleted within 90 days after the Event;
• Until you withdraw consent, or after 24 months of no engagement;
• Per the retention settings of the relevant platform, generally up to 26 months;
• Until the applicable limitation period expires.

At the end of these periods, data is deleted or irreversibly anonymised.

13. Your rights

Under the GDPR you have the right to:

• Access — obtain confirmation of whether we process your data, and a copy of it
• Rectification — have inaccurate or incomplete data corrected
• Erasure — have your data deleted where one of the grounds in Article 17 applies
• Restriction — have processing limited in the circumstances set out in Article 18
• Portability — receive data you provided in a structured, machine-readable format, and have it transmitted to another controller
• Object — object to processing based on legitimate interest, and object to direct marketing at any time, absolutely and without needing to give a reason
•  Withdraw consent — at any time, without affecting processing already carried out
• Not be subject to automated decision-making — we do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal or similarly significant effects

Under the LGPD you additionally have the right to confirmation of processing, anonymisation or blocking of unnecessary or unlawfully processed data, information about entities with whom your data has been shared, and information about the consequences of refusing consent.

To exercise any of these rights, email contact@meridianglobalinstitute.com. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. There is no charge, unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting.

14. Complaints

If you are unhappy with how we handle your data, please contact us first — most issues are resolved quickly.


You also have the right to lodge a complaint with a supervisory authority:

• European Economic Area — the data protection authority of your country of residence, work, or where the alleged infringement occurred. The full list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en
• Spain — Agencia Española de Protección de Datos (AEPD), www.aepd.es
• United Kingdom — Information Commissioner's Office (ICO), www.ico.org.uk
• Brazil — Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd

15. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), restricted access on a need-to-know basis, access controls on the systems we use, and selection of service providers that maintain recognised security standards.

Credential documents are stored in restricted-access storage, available only to team members responsible for eligibility verification, and deleted within 90 days after the Event.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by Article 33 and 34 GDPR.

16. Children

The Event is offered exclusively to qualified physicians. Our services are not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe we have, contact us and we will delete it.

17. Changes to this policy

We may update this policy. The current version is always published at this address with the date of last update at the top. Where changes materially affect how we use your data, we will notify registered participants and marketing subscribers by email.

18. Contact

Meridian Global Institute MD Serviços e Saúde Ltda — CNPJ 47.597.124/0001-60 SGAS 910, Conjunto B, Bloco A, Sala 123, Parte 4, Asa Sul, Brasília – DF, 70.390-100, Brazil


Email: contact@meridianglobalinstitute.com | WhatsApp: +556195552910

Deep Plane Spain: Málaga & Marbella is organized by Meridian Global Institute, brand operated by MD SERVIÇOS E SAÚDE LTDA, a limited liability company registered in Brazil under company with registered office at SGAS 910, Conjunto B, Bloco A, Sala 123, Parte 4, Asa Sul, Brasília-DF, 70.390-100, Brazil.