Privacy policy

Last updated: 6 July 2026

1. Data controller

The controller of your personal data is:

Controller:

Dorian BIEGUN, “Filon Médoc”

Address:

72 ter route du Bourg, 33590 Talais, France

SIRET:

101 561 801 00016

Email:

[email protected]

Phone:

+33 6 21 06 63 25

Given its size, the business is not required to appoint a data protection officer (DPO). Any question about your data can be sent directly to the controller above.

2. Data collected and purposes

We collect only the data strictly necessary for the purposes described below. No sensitive data (within the meaning of article 9 GDPR) is collected.

2.1. Browsing the site

When you visit, our host records technical logs: IP address, date and time of connection, pages viewed, browser type. This data is used to keep the site secure and working properly.

2.2. Contact form and quote requests

First name, last name, email, phone, company where applicable, and the content of your message. This data is used to answer your request and to establish a possible contractual relationship.

2.3. Ordering from the online shop

To process an order, we collect: identity (first name, last name), contact details (email, phone), delivery and billing address, basket contents, customisation specifications (colours, text to engrave, brief, artwork/logos uploaded), amount and order history.

2.4. Payment

Payments are handled by our provider Mollie B.V. Your card details (card number, security code) are entered directly on Mollie's secure interface and never pass through our servers: we do not store them. We keep only a transaction identifier and the payment status.

2.5. Prototype approval cycle

The artwork you upload, the prototype produced and your approval or revision decisions (with your comments) are kept for the duration of the order and as contractual evidence.

2.6. Invoicing and accounting

The invoices issued (identity, address, order details and amount) are kept under our accounting and tax obligations.

2.7. Summary of legal bases

Order processing:

performance of the contract (art. 6.1.b GDPR)

Answering contact requests:

pre-contractual measures (art. 6.1.b)

Invoicing / accounting:

legal obligation (art. 6.1.c)

Site security and anti-spam:

legitimate interest (art. 6.1.f)

Prospecting / newsletter:

consent (art. 6.1.a), revocable at any time

3. Recipients and processors

Your data is intended solely for Filon Médoc. It is not sold, rented or transferred to third parties for commercial purposes. The following technical providers may access it, strictly to the extent needed to deliver their service:

• Cloudflare, Inc. (United States): site hosting, database, file storage, DDoS protection and the Turnstile anti-robot service;
• Mollie B.V. (Netherlands): secure payment processing;
• Resend, Inc. (United States): delivery of transactional emails (confirmation, prototype, dispatch, invoice);
• Google LLC (Gmail) (United States): the publisher's business inbox;
• Carriers (La Poste / Colissimo, Mondial Relay): name and delivery address, to deliver the parcel.

3.1. Transfers outside the European Union

Some processors are established in the United States. These transfers are covered by the European Commission's standard contractual clauses and, where applicable, by the providers' membership of the EU-US Data Privacy Framework.

4. Retention periods

• Contact / quote messages: 3 years from the last contact;
• Order and customer account data: for the duration of the commercial relationship, then archived;
• Invoices and accounting records: 10 years (art. L. 123-22 of the French Commercial Code);
• Artwork and prototypes: for the duration of the order, then deleted no later than 3 years after delivery;
• Technical security logs (IP): 12 months maximum;
• Consent to prospecting: until consent is withdrawn, then 3 years.

5. Cookies and trackers

The site uses no analytics, advertising or third-party commercial tracking cookies. Only cookies strictly necessary to the operation of the service are used:

• Cloudflare Turnstile: telling humans apart from robots when forms are submitted;
• Session cookie: keeping the basket and, for administration, the authenticated session.

As these cookies are strictly necessary, they are exempt from prior consent under article 82 of the “Informatique et Libertés” law and the CNIL's recommendations. You can configure your browser to block them, at the risk of breaking some features (form submission, basket).

To measure site traffic, we use Cloudflare Web Analytics, a cookie-free statistics tool that sets no tracker, collects no data that could identify you, and does not follow your browsing from one site to another. As it meets the CNIL's exemption criteria for audience measurement, it requires no consent and therefore involves no cookie banner.

6. Your rights

In accordance with articles 15 to 22 GDPR, you have the following rights over your data:

• right of access and rectification;
• right to erasure (“right to be forgotten”);
• right to restriction of processing;
• right to data portability;
• right to object, in particular to processing for prospecting purposes;
• right to withdraw your consent at any time;
• right to set instructions on what happens to your data after your death.

To exercise these rights, write to us at [email protected] or by post to the registered address, enclosing proof of identity. You will receive a reply within one month at most.

Some data cannot be deleted before its statutory retention period ends (for example: invoices kept for 10 years).

7. Security

We implement appropriate technical and organisational measures to protect your data: encrypted exchanges (HTTPS), password hashing, two-factor authentication for administration, request rate limiting, access control and isolation of uploaded files.

8. Complaint to the CNIL

If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the French data protection authority (CNIL): www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

9. Changes to this policy

This policy may be updated at any time to reflect legal or technical changes. The date of the last update appears at the top of the page. We invite you to check it regularly.

10. Contact

For any question about this policy or about the processing of your data: [email protected] or through our contact page.