Privacy Policy

Data controller

In accordance with Regulation (EU) 2016/679 General Data Protection Regulation (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), we inform you that the controller of your personal data is:

• Controller: Optimedic S.L.
• Tax ID: B65386344
• Address: Carrer Pompeu Fabra, 12 Local, 08480 L'Ametlla del Vallès (Barcelona)
• Privacy email: [email protected]
• Telephone: +34 938 43 03 36

Data processing activities carried out

Below, we detail the different purposes for which we process your personal data, the legal basis for each processing activity, the categories of data concerned, the retention periods and any possible disclosures to third parties.

1. Contact form

• Data collected: name, email, telephone, company, message and consents.
• Purpose: to respond to your enquiry or commercial/technical request.
• Legal basis: explicit consent of the data subject (Art. 6.1.a GDPR) and, where applicable, the performance of pre-contractual measures (Art. 6.1.b GDPR).
• Recipients: the data is stored in Brevo (Sendinblue), with servers located in the European Union (France). It is not shared with third parties except where legally required.
• Retention: for as long as the commercial relationship is maintained or until the user requests its deletion.

2. Call request form

• Data collected: name, email, telephone and consents.
• Main purpose: to manage the request for telephone contact.
• Secondary purpose (if you accept commercial communications): sending periodic commercial information about Optimedic products and news.
• Legal basis: explicit consent of the data subject.
• Recipients: Brevo (European Union). It is added to the lead management list and, if communications are accepted, also to the newsletter list.
• Retention: until consent is withdrawn or the commercial relationship ends.

3. Newsletter subscription

• Data collected: email and any additional fields provided by the user.
• Purpose: sending periodic commercial communications about Optimedic products, news and events.
• Legal basis: explicit consent of the data subject.
• Recipients: Brevo (European Union).
• Retention: until the user unsubscribes. Each communication will include an unsubscribe link.

4. Web analytics

Optimedic S.L. uses two analytics tools with different purposes, legal bases and processing activities.

4.1. OpenPanel (anonymous analytics, always active)

• Tool: OpenPanel, self-hosted on our own servers.
• Data processed: pages visited, time on page, referrer, clicked links, user-agent. The IP address is processed in memory to generate volatile session identifiers, without being stored persistently.
• Purpose: to measure aggregated website traffic and assess content effectiveness.
• Legal basis: legitimate interest of the controller (Art. 6.1.f GDPR). This measurement is necessary to assess and improve the website and is proportionate because it does not use cookies, does not create individual profiles and does not share data with third parties.
• Recipients: no data is disclosed to third parties. The data is processed entirely on our own infrastructure.
• Retention: the data is aggregated anonymously; session identifiers are volatile and are not stored.

The user may exercise their right to object to this processing based on their particular situation by writing to [email protected].

4.2. Google Analytics 4 (advanced analytics, requires consent)

• Tool: Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (1600 Amphitheatre Parkway, Mountain View, California 94043, USA).
• Data processed: anonymous client identifier stored in a cookie (_ga, _ga_*), IP address truncated before storage, user-agent, technical device information (type, screen resolution, language), visited URL, referrer, approximate geolocation data derived from IP (country and city), as well as events generated by the user's interaction with the site (form submissions, clicks on calls to action, opening product pages, language change).
• Purpose: advanced measurement of site performance, conversion funnel analysis, audience segmentation and campaign attribution.
• Legal basis: explicit consent of the data subject (Art. 6.1.a GDPR), given through the cookie settings panel. Google Analytics is not activated until the user accepts the "Analytics" category.
• Recipients: Google Ireland Limited and Google LLC, acting as data processors.
• Retention: 14 months from the user's last interaction. After that period, the data is automatically deleted by Google.

The user may withdraw their consent at any time by clicking "Configure cookies" in the website footer. Withdrawal will not affect the lawfulness of processing carried out previously.

5. Financial and administrative management

• Purpose: invoicing, accounting and compliance with legal obligations arising from the commercial relationship.
• Legal basis: performance of a contract (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR).
• Recipients: Tax Agency, financial institutions and competent public authorities, only when required by the applicable regulations.
• Retention: the periods established by tax and fiscal regulations (5 years under the General Tax Law; 10 years for tax documentation in compliance with Organic Law 7/2012).

International data transfers

As a general rule, your data is processed within the European Union. The only international transfers arise from:

• Adobe Fonts (Adobe Inc., USA): when loading the website fonts, technical data (IP address, user-agent) is transferred to Adobe servers. Adobe adheres to the EU-US Data Privacy Framework.
• Google Fonts (Google LLC, USA): the Manrope font is loaded from Google servers. Google adheres to the EU-US Data Privacy Framework.
• Google Analytics 4 (Google LLC, USA): only if the user accepts the "Analytics" category in the cookie settings panel. The data described in section "4.2. Google Analytics 4" is transferred (anonymous identifier, truncated IP, interaction events, approximate geolocation). The transfer is based on the Standard Contractual Clauses approved by the European Commission and Google LLC's adherence to the EU-US Data Privacy Framework.

The transfers associated with Adobe Fonts and Google Fonts are limited to technical connection data and do not involve the processing of personally identifiable data beyond the IP address. The transfer associated with Google Analytics 4, on the other hand, requires the user's prior consent and may be revoked at any time from the website's cookie settings panel.

User rights

You have the right to:

• Access: obtain confirmation as to whether your data is being processed and, if so, access it.
• Rectification: request the correction of inaccurate or incomplete data.
• Erasure: request the deletion of your data when it is no longer necessary for the purpose for which it was collected.
• Objection: object to the processing of your data in certain circumstances.
• Restriction: request the restriction of processing in the cases provided for in the GDPR.
• Portability: receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please write to [email protected] or to the postal address: Carrer Pompeu Fabra, 12 Local, 08480 L'Ametlla del Vallès (Barcelona). You must prove your identity by attaching a copy of your ID card or equivalent document.

If you believe that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

Presence on social media

Optimedic S.L. is present on the following social media platforms: Instagram (@optimedicsurgery), LinkedIn, Facebook and X (@Optimedic).

When a user interacts with our social media profiles (comments, reactions, direct messages, following), Optimedic S.L. and the corresponding platform act as joint controllers of the data resulting from that interaction, in accordance with Article 26 of the GDPR.

Optimedic S.L. only accesses the public information on the user's profile. We do not incorporate data from social media into our internal databases without prior explicit consent.

To find out how each platform processes your data, please consult their privacy policies:

• Instagram: https://privacycenter.instagram.com/policy
• LinkedIn: https://www.linkedin.com/legal/privacy-policy
• Facebook: https://www.facebook.com/privacy/policy
• X: https://x.com/en/privacy

Minors

This website is not intended for children under 14 years of age. We do not knowingly collect data from children of that age. If a parent or guardian becomes aware that a minor has provided personal data without their consent, they may contact us at [email protected] to request its deletion.

Security measures

Optimedic S.L. has adopted the necessary technical and organisational measures to guarantee the security of personal data and prevent its alteration, loss, processing or unauthorised access, including: encrypted communications via HTTPS, restricted access to data for authorised personnel, anti-spam protection in forms (honeypot and rate limiting), and hosting on servers with restricted access.

Last updated: April 2026