Last update: May 6, 2026 - Version 1.1
This policy describes how Magh Assist Sàrl (Switzerland) and Magh Assistance Sàrl (Algeria) - together « Maghassist »We« - collect, use, store and protect the personal data of individuals (»you«) who subscribe to our cover for the Algerian diaspora established outside Algeria and who benefit from our medical care services in Algeria. It also specifies the use of cookies and tracers on the site. maghassist.com.
Given the international nature of our business, we comply cumulatively with :
- the new Swiss Federal Data Protection Act (nLPD), which came into force on 1er September 2023, applicable to Magh Assist Sàrl ;
- the Algerian law no. 18-07 of June 10, 2018 on the protection of individuals with regard to the processing of personal data (authority : ANPDP), applicable to Magh Assistance Sàrl ;
- the Regulation (EU) 2016/679 (RGPD) and the ePrivacy Directive, insofar as we offer our services to persons located in the European Economic Area ;
- applicable U.S. federal and state laws, including the CCPA/CPRA (California), the VCDPA (Virginia), on CPA (Colorado), the CTDPA (Connecticut) and the’UCPA (Utah).
1. Joint processors
Magh Assist Sàrl and Magh Assistance Sàrl act as joint data controllers within the meaning of Article 26 of the RGPD. Magh Assist Sàrl ensures the commercial, contractual and financial relationship with subscribers; Magh Assistance Sàrl ensures the operational execution of medical care in Algeria. A co-responsibility agreement frames the division of our respective obligations; the essential points are specified therein.
Contracting entity (Switzerland)
Magh Assist Sàrl
Rue du Sablon 2, C/O Kainjoo SA, CP 116
CH-1110 Morges, canton of Vaud, Switzerland
Email: contact@maghassist.com
Medical business unit (Algeria)
Magh Assistance Sàrl
Cité Soummam, Lot N° 03, Bab Ezzouar
16000 Algiers, Algeria
Email: contact@maghassist.com
2. Single point of contact and representatives
- Privacy Contact Point (DPO) : dpo@maghassist.com - you can exercise your rights with either entity, at this single address.
- EU representative (art. 27 RGPD): As Magh Assist Sàrl is established in Switzerland (outside the EEA), a representative has been appointed for persons located in the EEA - [name, address, email - TO BE DESIGNATED].
- US Privacy Officer : privacy@maghassist.com.
3. Categories of data collected
- Identification : surname, first names, date and place of birth, nationality, ID/passport number, photo.
- Contact details : postal address (country of residence and address in Algeria, if applicable), telephone number, e-mail address.
- Family : composition of insured household, family relationship, beneficiaries.
- Health data (special / sensitive categories) : declared medical history, pathologies, current treatments, reports, examination results (ECG, complementary examinations), prescriptions, data on hospital care in Algeria, data on home care (aerosols, oral suction, pressure sores, ulcers, diabetic foot, punctures, infusions, injections), data on medical transport, invoices for care.
- Financial data : IBAN/RIB, credit card data (tokenized via payment provider), payment history, currency.
- Contractual data: plan underwritten, coverage period, claims and emergency files (24/7, pediatric, geriatric).
- Technical data : IP address, connection identifiers, logs, device type, browser, cookie data (see Part B).
Health data is processed with a reinforced level of protection: access restricted to authorized medical and administrative staff, hosted on a compliant infrastructure and encrypted at rest and in transit.
4. Purpose and legal basis
| Purpose | Legal basis RGPD / nLPD | Legal basis law 18-07 (Algeria) |
|---|---|---|
| Underwriting, contract management, claims | Performance of the contract (art. 6.1.b RGPD; art. 31 al. 1 nLPD) | Contract performance (art. 7) |
| Health data processing for medical care, emergencies, consultations, treatment and transport | Explicit consent (art. 9.2.a RGPD) + preventive medicine and health care (art. 9.2.h); art. 6 al. 7 nLPD for sensitive data | Express consent and prior authorization from ANPDP (art. 18) |
| Invoicing, accounting, fraud control | Legal obligation (art. 6.1.c) / legitimate interest (art. 6.1.f) | Legal obligation |
| Site and account security | Legitimate interest | Legitimate interest |
| Recruitment («View open positions») | Pre-contractual measures (art. 6.1.b) and consent | Consent |
| Audience statistics (analytics) | Consent (ePrivacy / art. 6.1.a) | Consent |
| Direct marketing, prospecting, retargeting | Consent | Consent |
| Response to requests to exercise rights, litigation | Legal obligation / legitimate interest | Legal obligation |
5. Recipients and subcontractors
- Authorized staff of Magh Assist Sàrl (underwriting, management, accounting) and Magh Assistance Sàrl (medical team and care coordination).
- Partner care network in Algeria: doctors, clinics, hospitals, laboratories, ambulance drivers and medical transport providers (under medical confidentiality).
- Kainjoo SA (Morges, Switzerland), for the administrative domiciliation of Magh Assist Sàrl.
- Payment provider: [Stripe / Worldline / other - TO BE COMPLETED].
- Host of the site and insured area: [name, country - TO BE COMPLETED].
- Analytics and advertising tools: Google Analytics 4, Google Ads, Meta Ads (see Part B).
- External advisors: lawyers, experts, auditors, administrative or judicial authorities on request.
Each subcontractor is bound by a processing agreement (DPA) imposing security measures, confidentiality and compliance with transfer rules.
6. International data transfers
The service architecture involves flows between Switzerland, Algeria and, where applicable, the EEA and the USA (third-party cookies, technical subcontractors).
6.1 Switzerland / EEA → Algeria flows
Operational medical treatment takes place in Algeria. Algeria is neither recognized as an adequate country by the European Commission, nor listed as a state offering equivalent protection by the Swiss Federal Data Protection Commissioner (FDPIC). Transfers from Switzerland, the EEA or the UK to Algeria are therefore governed by :
- visit Standard Contractual Clauses of the European Commission (decision 2021/914) signed between Magh Assist Sàrl and Magh Assistance Sàrl, completed by the UK IDTA addendum where applicable; ;
- visit Swiss CLAs recognized by the FDPIC, in accordance with art. 16 nLPD ;
- a transfer impact analysis (TIA) and additional measures (end-to-end encryption, pseudonymization, access controls); ;
- otherwise, your explicit and informed consent to the transfer (art. 49.1.a RGPD / art. 17 nLPD).
6.2 Algeria → foreign countries
For transfers from Algeria to Switzerland (contracting entity) or to SaaS providers located in the EEA or the United States, we apply the’article 44 of law 18-07 which requires prior authorization from the ANPDP, and we only transfer data to countries offering a sufficient level of protection or with equivalent contractual guarantees.
7. Shelf life
| Category | Duration |
|---|---|
| Hedging contract data | Contract duration + 10 years (Swiss civil statute of limitations, art. 127 CO) |
| Medical files and claims | 10 years from end of treatment (evidence, medical litigation) |
| Accounting documents and invoices | 10 years (art. 958f of the Swiss Code of Obligations / Algerian accounting requirements) |
| Unsolicited applications and open positions | 2 years from last contact |
| Commercial prospecting data | 3 years from last contact |
| Analytical and advertising cookies | 13 months maximum |
| Technical and safety logs | 12 months |
8. Security
We implement appropriate technical and organizational measures: TLS 1.2+ encryption, encryption at rest, partitioning of medical databases, strict management of authorizations, double authentication for administrators, logging, encrypted backups, regular intrusion tests and an incident response plan. In the event of a data breach likely to give rise to a risk, we notify the PFPDT (art. 24 nLPD) and the ANPDP, as well as the competent EEA authorities where applicable, as soon as possible and no later than 72 hours, and inform the persons concerned when required by law.
9. Your rights
9.1 Persons located in Switzerland (nLPD)
- Right to information and inquiry (art. 25 nLPD).
- Right to rectification, deletion and delivery/transmission of data (art. 28 and 32 nLPD).
- Right to oppose processing and withdraw consent.
- Right to seize Federal Data Protection and Information Commissioner (FDPIC).
9.2 Persons located in the EEA and the United Kingdom (RGPD / UK GDPR)
- Right of access, rectification, deletion («right to be forgotten»).
- Right to limit and object to processing.
- Right to data portability.
- Right to withdraw your consent at any time, without retroactive effect.
- Right to define post-mortem directives (France, art. 85 LIL).
- Right to lodge a complaint with your authority (CNIL in France, ICO in the UK, or any other competent EEA authority, accessible via edpb.europa.eu).
9.3 Persons located in Algeria (law 18-07)
- Right to information, access and communication.
- Right of correction, update and deletion.
- Right to object on legitimate grounds.
- Right to seize’National Authority for the Protection of Personal Data (ANPDP).
9.4 Residents of the United States (California, Virginia, Colorado, Connecticut, Utah, etc.)
- Right to Know / Access To know the categories and elements of personal information collected, the sources, purposes and recipients over the last 12 months.
- Right to Delete Request the deletion of your personal data.
- Right to Correct Correcting inaccurate information.
- Right to Opt-Out of Sale or Sharing We do not «sell» your personal information within the meaning of the CCPA, but we may «share» it for targeted advertising purposes. You can object to this by clicking on «Do Not Sell or Share My Personal Information» in the footer, or by activating the Global Privacy Control (GPC) signal.
- Right to Limit Use of Sensitive Personal Information To limit the use of your sensitive data (health, financial data) to strictly necessary purposes.
- Right to Non-Discrimination no discrimination for exercising your rights.
- Authorized Agent you can appoint a proxy to exercise your rights (written proof is required).
To exercise any of these rights, please write to dpo@maghassist.com enclosing proof of identity. We respond within 30 days (RGPD/nLPD), 45 days (CCPA, extendable once) and as soon as possible in application of law 18-07.
10. Specific mention CCPA/CPRA - California
Over the past 12 months, Maghassist has collected the following categories of personal information (according to CCPA nomenclature): identifiers, Cal. Civ. Code §1798.80(e) information, protected characteristics, commercial information, Internet/network information, geolocation data, sensory information (where applicable), sensitive information (government identification number, health data, financial data), inferences. We do not sell this information for a fee. We may «share» it with our advertising partners (marketing cookies); you may object to this at any time.
11. Minors
Our services are intended for adults. Minors may be registered as entitled by a parent or legal guardian. We do not knowingly collect data from minors under the age of 13 pursuant to COPPA and under the age of 16 pursuant to RGPD without the verifiable consent of the holder of parental authority.
Part B - Cookie policy
B.1 What is a cookie?
A cookie is a small file stored on your terminal (computer, smartphone, tablet) when you visit a website. It enables us to recognize your browser, memorize your preferences or measure your audience. We also use similar technologies (pixels, web beacons, local storage, SDK).
B.2 Categories of cookies used
| Category | Purpose | Legal basis | Consent required |
|---|---|---|---|
| Strictly necessary | Authentication, security, shopping cart, load balancing, cookie selection memory. | Legitimate interest / contract performance | No (ePrivacy exemption) |
| Audience measurement / Analytics | Understand site usage, improve user experience, aggregate statistics. | Consent | Yes |
| Marketing / Advertising | Targeted advertising, retargeting, campaign performance measurement, sharing with advertising partners. | Consent | Yes |
B.3 Detailed list of cookies
| Name | Transmitter | Purpose | Category | Duration |
|---|---|---|---|---|
| maghassist_session | Maghassist | Authenticated user session | Required | Session |
| XSRF-TOKEN | Maghassist | Protection against CSRF attacks | Required | Session |
| cookie_consent | Maghassist | Remembering your consent choices | Required | 6 months |
| wp-* / wordpress_logged_in_* | WordPress | Publisher and connected account management | Required | Session / 14 days |
| _ga, _ga_* | Google Analytics 4 | User distinction and audience measurement | Analytics | 13 months |
| _gid | Google Analytics | User identification | Analytics | 24 heures |
| _gcl_au | Google Ads | Allocation of advertising conversions | Marketing | 3 months |
| _fbp, fr | Meta (Facebook) | Pixel Meta - retargeting and advertising measurement | Marketing | 3 months |
| li_sugr, bcookie, lidc | Insight Tag - B2B campaigns (where applicable) | Marketing | 3 to 24 months | |
| [Other trackers] | [COMPLETE according to your stack]. | — | — | — |
The exact list is updated automatically by our Consent Management Platform (CMP). Check the «Manage my cookies» panel for the real-time version.
B.4 Collecting and managing your consent
On your first visit, a banner allows you to’accept, of refuse or customize by category, the deposit of non-strictly necessary cookies. As long as no choice is expressed, only strictly necessary cookies are deposited. Refusal is as easy as acceptance, in compliance with the requirements of the CNIL and EEA authorities.
You can change or withdraw your consent at any time:
- via the «Manage my cookies» footer ;
- via the link «Do Not Sell or Share My Personal Information» (California residents) ;
- by activating the Global Privacy Control (GPC) in your browser - we respect it automatically; ;
- by configuring your browser to block or delete cookies (Chrome, Firefox, Safari, Edge).
Withdrawal of consent has no retroactive effect and does not affect the lawfulness of prior processing.
B.5 Specific features by jurisdiction
- Switzerland (nLPD) : prior information required and right to object; for marketing cookies involving high-risk profiling, we obtain explicit consent.
- EU / EEA / United Kingdom : prior consent required for all non-essential cookies (art. 5.3 of the ePrivacy directive, art. 82 of the LIL in France).
- Algeria (law 18-07) : cookies containing personal data are subject to the principles of the law: information, consent and the possibility of opposition. No advertising cookies are placed without prior consent.
- United States (CCPA/CPRA & state laws) : marketing cookies are qualified as «sharing» cookies for targeted advertising purposes; you can object to them via the dedicated link or via a GPC signal, which we treat as a valid opt-out request.
B.6 Cookie transfers
Some service providers (Google, Meta, LinkedIn) process data from the United States. These transfers are governed by l‘EU-U.S. Data Privacy Framework and its extension, the Swiss-U.S. DPF, by the Clauses Contractuelles Types (EU and Switzerland) and, for Algeria, by the guarantees provided for in article 44 of law 18-07.
12. Modifications to the present policy
This policy may change. Any substantial modification will be notified to you by e-mail and/or via a banner on the site at least 15 days before it takes effect. The date of the update appears at the top of the page. Any substantial change concerning cookies will require a new request for your consent.
13. Contact and authorities
- DPO Maghassist: dpo@maghassist.com
- Magh Assist Sàrl : Rue du Sablon 2, C/O Kainjoo SA, CP 116, CH-1110 Morges, Switzerland
- Magh Assistance Sàrl : Cité Soummam, Lot N°03, Bab Ezzouar, 16000 Alger, Algeria
- FDPIC (Switzerland) : www.edoeb.admin.ch
- ANPDP (Algeria) : www.anpdp.dz
- CNIL (France) : www.cnil.fr - other EEA authorities via edpb.europa.eu
- California Privacy Protection Agency: cppa.ca.gov