Privacy Policy
Last updated: 23 February 2026
Gil Plaquet FilmLab ("we", "us", "our") is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR — EU 2016/679) and Belgian privacy law. This policy explains what data we collect, why, and your rights.
1. Data Controller
Gil Plaquet (sole proprietorship)
Belgium
Email: [email protected]
2. What Data We Collect
- Account information: name, email address, phone number, city, country
- Shipping & billing: postal address, VAT number, company name (when you request invoices or shipping)
- Order data: order numbers, roll stickers, service selections, payment references, order status
- Scanned images: digitised film negatives stored on our servers and CDN, linked to your roll sticker numbers
- Booking data: appointment type, date/time, and contact details for scheduled visits
- Authentication: password hash (we never store your plain-text password), optional 2FA secret
- Technical data: IP address, browser type (from server logs, retained max 90 days)
3. Purposes & Legal Basis
- Service delivery (contract): processing your film, managing orders, delivering scans, scheduling bookings
- Account management (contract): authentication, preferences, customer dashboard
- Invoicing & tax compliance (legal obligation): Belgian law requires retaining invoices and financial records for 7 years
- Email notifications (legitimate interest / consent): order status updates, gallery availability, pickup announcements
- Service improvement (legitimate interest): aggregate, anonymous usage statistics
4. Data Storage & Transfers
- Database: European-hosted server
- File storage: European-based cloud storage for scanned images
- CDN: European-based content delivery network for image delivery
- Archive: on-premises storage for long-term archival
- Email: transactional emails sent via European-based provider
All data is stored and processed within Europe. We do not transfer your data outside the European Economic Area or the United Kingdom.
5. Data Retention
- Account data: retained as long as your account is active, deleted upon account deletion request
- Order & financial records: retained for 7 years after the order date (Belgian tax obligation), anonymised if you delete your account
- Scanned images: stored on our CDN/NAS until 30 days after account deletion or until the roll is archived per our standard process
- Server logs: automatically deleted after 90 days
6. Your Rights
Under the GDPR, you have the right to:
- Access: request a copy of your personal data
- Portability: download your data in a machine-readable format (JSON) from your account settings
- Rectification: correct inaccurate data via your account settings or by contacting us
- Erasure ("right to be forgotten"): delete your account and personal data from your account settings
- Restriction: request we limit processing of your data
- Objection: object to processing based on legitimate interest
- Complaint: lodge a complaint with the Belgian Data Protection Authority (www.dataprotectionauthority.be)
To exercise any of these rights, email us at [email protected] or use the tools in your account settings page.
7. Cookies
We use only essential cookies required for authentication and session management. We do not use tracking, analytics, or advertising cookies.
8. Third-Party Services
- Payment processing: handled by a PCI-compliant third-party provider (their own privacy policy applies at checkout)
- Cloud storage & delivery: European-based providers for file storage and content delivery (data processing agreements in place)
9. Security
We protect your data with HTTPS/TLS encryption, hashed passwords, optional two-factor authentication, and restricted admin access. Scanned images are served via signed, time-limited URLs.
10. Changes to This Policy
We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Significant changes will be communicated via email.
Questions? Contact us at [email protected].