Privacy Policy

Last updated: 23 February 2026

Gil Plaquet FilmLab ("we", "us", "our") is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR — EU 2016/679) and Belgian privacy law. This policy explains what data we collect, why, and your rights.

1. Data Controller

Gil Plaquet (sole proprietorship)
Belgium
Email: [email protected]

2. What Data We Collect

Account information: name, email address, phone number, city, country
Shipping & billing: postal address, VAT number, company name (when you request invoices or shipping)
Order data: order numbers, roll stickers, service selections, payment references, order status
Scanned images: digitised film negatives stored on our servers and CDN, linked to your roll sticker numbers
Booking data: appointment type, date/time, and contact details for scheduled visits
Authentication: password hash (we never store your plain-text password), optional 2FA secret
Technical data: IP address, browser type (from server logs, retained max 90 days)

3. Purposes & Legal Basis

Service delivery (contract): processing your film, managing orders, delivering scans, scheduling bookings
Account management (contract): authentication, preferences, customer dashboard
Invoicing & tax compliance (legal obligation): Belgian law requires retaining invoices and financial records for 7 years
Email notifications (legitimate interest / consent): order status updates, gallery availability, pickup announcements
Service improvement (legitimate interest): aggregate, anonymous usage statistics

4. Data Storage & Transfers

Database: European-hosted server
File storage: European-based cloud storage for scanned images
CDN: European-based content delivery network for image delivery
Archive: on-premises storage for long-term archival
Email: transactional emails sent via European-based provider

All data is stored and processed within Europe. We do not transfer your data outside the European Economic Area or the United Kingdom.

5. Data Retention

Account data: retained as long as your account is active, deleted upon account deletion request
Order & financial records: retained for 7 years after the order date (Belgian tax obligation), anonymised if you delete your account
Scanned images: stored on our CDN/NAS until 30 days after account deletion or until the roll is archived per our standard process
Server logs: automatically deleted after 90 days

6. Your Rights

Under the GDPR, you have the right to:

Access: request a copy of your personal data
Portability: download your data in a machine-readable format (JSON) from your account settings
Rectification: correct inaccurate data via your account settings or by contacting us
Erasure ("right to be forgotten"): delete your account and personal data from your account settings
Restriction: request we limit processing of your data
Objection: object to processing based on legitimate interest
Complaint: lodge a complaint with the Belgian Data Protection Authority (www.dataprotectionauthority.be)

To exercise any of these rights, email us at [email protected] or use the tools in your account settings page.

7. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking, analytics, or advertising cookies.

8. Third-Party Services

Payment processing: handled by a PCI-compliant third-party provider (their own privacy policy applies at checkout)
Cloud storage & delivery: European-based providers for file storage and content delivery (data processing agreements in place)

9. Security

We protect your data with HTTPS/TLS encryption, hashed passwords, optional two-factor authentication, and restricted admin access. Scanned images are served via signed, time-limited URLs.

10. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Significant changes will be communicated via email.

Questions? Contact us at [email protected].