Legal

Privacy Policy

Last updated: October 9, 2026

1. CONTROLLER

The controller responsible for the processing of personal data on this website is:

Wegener, Hänger & Abasco Beauty Foundation
represented by Dr. Roman Wegener
F7F6+698, Proche du lycée Amanahune
Bora-Bora
French Polynesia

E-mail: contact@beauty-foundation.org

The Wegener, Hänger & Abasco Beauty Foundation is a non-profit foundation. The controller is the natural person or legal entity that alone or jointly with others decides on the purposes and means of the processing of personal data. We have not appointed a data protection officer.

2. GENERAL INFORMATION AND SCOPE

This Privacy Policy explains which personal data we process when you visit beauty-foundation.org or contact us by e-mail, for example with questions about our procedures or to apply for a free treatment. Personal data means any information relating to an identified or identifiable natural person, such as a name, e-mail address, IP address, or the content of a message.

We are based in Bora-Bora, French Polynesia, outside the European Union, and provide our services to patients worldwide, including in the European Union. Where the General Data Protection Regulation (GDPR) applies to the processing of your personal data, for example because we offer our services to you while you are in the European Union, the information in this Privacy Policy is provided in accordance with it, and the legal bases referred to below are those of the GDPR.

We process personal data only where there is a lawful basis and only to the extent necessary for the purposes described below. Please note that the transmission of data over the Internet (for example by e-mail) can have security gaps; complete protection of data against access by third parties is not possible.

3. HOSTING AND SERVER LOG FILES

This website is hosted by RackNerd LLC, USA, on a server located in the United States. The hosting provider processes data only on our behalf and to the extent necessary to provide the server. All connections to this website are encrypted (HTTPS).

When you access this website, your browser automatically transmits technical information to the web server, which records it in server log files. These log files contain:

  • your IP address,
  • the date and time of access,
  • the requested page or file (URL) and the HTTP status code,
  • the amount of data transferred,
  • the referrer URL (the page you came from, if your browser transmits it),
  • the user agent, which usually identifies your browser type and version and your operating system.

This data is processed to make the website available, maintain its technical stability and security, prevent misuse, and diagnose errors. It is not used to create user profiles and is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website.

Server log files are deleted automatically after 14 days, unless further retention is required to investigate a specific security incident or for legal reasons.

4. CONTACT BY E-MAIL

This website has no contact form. If you contact us by e-mail at contact@beauty-foundation.org, we process your e-mail address, your name, and the content of your message, including any information you provide voluntarily, to answer your request. The legal basis is Art. 6(1)(b) GDPR where your message relates to a treatment or an application for a free treatment, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering the messages sent to us. If your message contains health information, section 5 applies.

Messages sent to us by e-mail are received and stored by the e-mail provider of our inbox, who processes them only on our behalf.

Messages are deleted four weeks after your request has been dealt with, that is, after the conversation has ended, unless statutory retention obligations apply or your message is part of an application (section 5).

5. APPLICATIONS FOR A FREE TREATMENT AND HEALTH DATA

Applications for a free treatment are received by e-mail only. If you ask us about a treatment or apply for a free treatment, your message will usually contain information about your health, your physical appearance, your medical history or your personal situation, and possibly photos. Such information is health data, a special category of personal data under Art. 9 GDPR, and is therefore particularly protected. Please only send us the health information that is needed for your request, and do not send photos or medical documents unless we ask you to.

We process this information only to answer your request and to examine your application, as described on our Non-Profit page: to assess whether you are eligible for a free treatment, to discuss possible further steps with you and, if your application is approved, to arrange your treatment. Applications are reviewed by our application board. The legal basis is your explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. When you write to us about a treatment or an application, please state in your message that you agree to this processing. You can withdraw your consent at any time with effect for the future, for example by e-mail to contact@beauty-foundation.org; we will then stop processing your application and delete the related data, unless statutory retention obligations apply.

Your application is forwarded to a partner surgeon only after it has been approved and after you have confirmed that you want to go ahead. The partner is chosen according to the location that is most suitable for you, so your data may be transferred to a partner surgeon in another country, including countries outside the European Union (see section 10). We will tell you which partner and which country before you confirm.

If your application is rejected, it is deleted four weeks after the decision. If it is approved, we keep it for as long as it is needed to arrange your treatment and delete it four weeks after this has been concluded, unless a longer retention period is required by law.

Applications for a child or teenager should be sent by a parent or legal guardian.

Before the initial online examination or a treatment starts, you receive separate information about how your data is processed in that context, for example by the examining surgeon or the partner facility, and we ask for your consent where required.

6. FONTS AND THIRD-PARTY REQUESTS

The font used on this website (League Spartan) is hosted on our own server. When you open a page, all files are loaded from beauty-foundation.org; no requests are made to third-party servers such as font providers, content delivery networks, or social media platforms. Third-party websites are only contacted if you actively click a link to them.

7. NO COOKIES, ANALYTICS OR TRACKING

This website does not use cookies, does not store any information in your browser (such as local storage), and does not use analytics tools, advertising trackers, social media plugins, or embedded third-party content such as videos or maps.

If this changes, we will update this Privacy Policy and, where required, ask for your consent before such technologies are used.

Where the GDPR applies, we process personal data on the following legal bases, as indicated in the sections above:

  • Art. 6(1)(a) GDPR (consent), together with Art. 9(2)(a) GDPR (explicit consent) for health data, for example in applications for a free treatment (section 5);
  • Art. 6(1)(b) GDPR (contract and steps prior to entering into a contract), for example when your message relates to a treatment or an application;
  • Art. 6(1)(c) GDPR (legal obligation), where statutory retention obligations apply;
  • Art. 6(1)(f) GDPR (legitimate interests), for the secure operation of this website and for answering general messages.

9. RECIPIENTS AND SERVICE PROVIDERS

Personal data is processed by service providers that support the operation of this website and our communication: the hosting provider of this website (RackNerd LLC, USA, see section 3) and the e-mail provider of our inbox. These providers process data only on our behalf and to the extent necessary for their services.

If your application for a free treatment has been approved and you have confirmed it, we forward it to the partner surgeon who will carry out your treatment (see section 5).

We do not sell personal data. We only pass data on to third parties where this is necessary for the purposes described in this Privacy Policy, where we are required to do so by law, or where you have given your consent.

10. INTERNATIONAL DATA TRANSFERS

This website is hosted on a server in the United States (RackNerd LLC, see section 3), so the data processed when you visit the website, such as server log data, is processed in the United States. We are based in French Polynesia, so messages and applications you send us are processed there. If your application is approved and you confirm it, it is transferred to a partner surgeon in the country most suitable for you, which may be outside the European Union.

For the United States, there is an adequacy decision of the European Commission only for certified companies, and for French Polynesia and many other countries there is none. Where these transfers are necessary to handle your request at your request, they are based on Art. 49(1)(b) GDPR. Transfers of applications to a partner surgeon, and transfers of health data in general, are based on your explicit consent under Art. 49(1)(a) GDPR, which you give when you confirm your application after we have told you which partner and which country it will be sent to. Such countries may not offer a level of data protection comparable to that in the European Union; for example, there may be no independent supervisory authority, and your rights may be harder to enforce.

11. RETENTION

We keep personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. The specific retention periods for server log files, messages, and applications are described in sections 3, 4 and 5. When the relevant period ends, the data is deleted.

12. YOUR RIGHTS

Where the GDPR applies, you have the following rights regarding your personal data:

  • the right of access (Art. 15 GDPR),
  • the right to rectification (Art. 16 GDPR),
  • the right to erasure (Art. 17 GDPR),
  • the right to restriction of processing (Art. 18 GDPR),
  • the right to data portability (Art. 20 GDPR),
  • the right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal.

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, please contact us at contact@beauty-foundation.org.

13. RIGHT TO LODGE A COMPLAINT

If the GDPR applies and you believe that the processing of your personal data infringes it, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR). This right exists regardless of any other administrative or judicial remedies. A list of the supervisory authorities in the EU is available from the European Data Protection Board: edpb.europa.eu.

14. SECURITY

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration. Connections to this website are encrypted using HTTPS. Please note that e-mail communication can involve security risks and cannot be guaranteed to be completely secure; this is particularly relevant if you send us health information.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in legal requirements, technical developments, or the operation of this website. The version published on this page is the current version.