The data we collect, what we do with it, how long we keep it and how to take back control. Without the runaround.
This is a courtesy translation, provided so that you can understand our terms. MEUS PRODUCTION is a French business and these documents are governed by French law: in the event of any discrepancy, only the French version is legally binding.
1. Data controller
The controller of your personal data is the publisher of this site:
Pierre Wilner Meus, Entrepreneur individuel (EI), trading under the name MEUS PRODUCTION.
6 Place Delacroix, 30900 Nîmes, France
+33 7 44 76 67 18 - contact@meusproduction.org
SIREN (French company number): En cours d'attribution - SIRET (French establishment number): En cours d'attribution
The full details are set out in the legal notice.
No data protection officer (DPO) has been appointed: the business does not fall within the cases where that appointment is mandatory. Your requests are handled directly by the controller, at the address above.
2. Data collected
2.1 Data you provide to us
It only reaches us if you enter it yourself. None of it is required in order to browse the site.
- Contact form and quote request: name, email address, phone, company name, project type, estimated budget, message, preferred date
- Quote simulator: the services you select, sent only if you submit the request
- Newsletter sign-up: your email address, sent to our provider to process the request. A fingerprint used to limit repeated requests is described below
- Client portal: billing address, quotes, projects, orders, payment history, messages and downloads
No bank details ever reach us. Card payments take place entirely on Stripe's secure pages: we neither see nor store your card number.
2.2 Data collected automatically
The site has no analytics tool, no advertising pixel and no tracker. We do not build browsing profiles.
The following are processed technically, purely so the service can work:
- your session data, if you sign in to the client portal
- a non-reversible fingerprint of your IP address when available, to limit automated submissions. For the newsletter, a fingerprint of the normalized email address is also used. The associated counter contains these fingerprints, the number of requests and the time of the last request; the plain addresses are not stored in that counter. A counter inactive for more than 24 hours is deleted during the next maintenance run, triggered when the management dashboard is opened, no more than once every 24 hours
- the server's technical logs, kept by our hosting provider for security and fault diagnosis
- the origin of your visit, only if the link you followed states it (“utm” parameters of a link posted on our social media, for example Facebook) or if you arrive through our page for Facebook visitors: it is kept in memory for the visit only, with no cookie and no storage in your browser, and is recorded with your request only if you send one. The same applies to your optional answer to “How did you hear about us?”
3. Purposes and legal bases
Each processing operation answers a specific purpose and rests on a legal basis under the GDPR. We never reuse your data for anything else.
- Answering your contact or quote request - pre-contractual steps taken at your request (article 6(1)(b))
- Carrying out our work: quotes, projects, appointments, orders, payments, access to the client portal and to purchased files - performance of the contract (article 6(1)(b))
- Keeping our accounts and issuing invoices - legal obligation (article 6(1)(c))
- Sending you the newsletter - your consent, which you can withdraw at any time (article 6(1)(a))
- Protecting the site from automated submissions and securing access - legitimate interest in preserving the service (article 6(1)(f))
Your data is neither sold, nor rented, nor transferred, and is not used for any targeted advertising.
4. Recipients and processors
Your data is accessible to the publisher of the site and, where applicable, to the people assisting them, each strictly according to their needs. It is also processed by the following technical providers, who act only on our instructions:
- Hostinger International Ltd - site hosting
- Neon - database hosting, within the European Union (Frankfurt)
- Brevo (France) - sending emails: sign-in links, quotes, confirmations
- Web3Forms - routing form submissions to our mailbox
- Stripe - online payments, acting as controller for card data
- Cloudflare R2 - storage of files and images
- Mux (United States) - hosting and delivery of videos, with no analytics and no cookie
- Unsplash (United States) - some illustrations are loaded from their servers: your browser requests them directly, which passes them your IP address. No cookie is set
- OpenStreetMap - the map on the Contact page stays inactive until you choose to display it or open OpenStreetMap. At that point, your browser contacts the service directly and shares, among other technical data, your IP address.
4.1 Transfers outside the European Union
Site hosting and the database remain within the European Union. Some of the providers listed above are established in the United States: those transfers are framed by the safeguards provided for in the GDPR - the European Commission's standard contractual clauses, or certification under the Data Privacy Framework.
5. Retention periods
The site applies the periods below automatically. The maintenance run is triggered when the management dashboard is opened, at most once every 24 hours. Depending on the data category, expired records are anonymised or deleted.
- Enquiries that go no further: 3 years after the last contact, then automatic anonymisation
- Clients: for the duration of the business relationship, then on request for erasure
- Accepted quotes, orders, payments and invoices: 10 years, under accounting and tax obligations
- Records of emails sent: 12 months. The content of emails is never kept - only the type, the recipient, the subject and the sending status
- Technical payment events: 90 days
- Download links for a purchase: 30 days
- Sign-in sessions: until they expire, 7 days at most
- Anti-abuse counters: deleted during the next maintenance run once they have been inactive for more than 24 hours
Accounting records keep the buyer's name and email even after a request for erasure: the legal obligation to retain them takes precedence over the right to erasure (article 17(3)(b) GDPR).
6. Your rights
You have the following rights over your personal data at any time:
- Right of access - to obtain confirmation that we process your data and to receive a copy of it
- Right to rectification - to have inaccurate or incomplete data corrected
- Right to erasure - to ask for your data to be deleted, subject to our accounting obligations
- Right to restriction - to ask for processing to be frozen while a check is carried out
- Right to object - to object to processing based on our legitimate interest
- Right to portability - to receive, in a machine-readable format, the data you have provided to us and that we process on the basis of your consent or of a contract
- Right to withdraw your consent at any time, without calling into question what was done before. See paragraph 6.1 for how to exercise this right.
- Right to set directives as to what becomes of your data after your death (a right specific to French law)
6.1 How to exercise them
Write to us at contact@meusproduction.org. We answer within one month. Proof of identity may be requested where there is reasonable doubt as to who is making the request.
6.2 Complaint to the supervisory authority
If our answer does not satisfy you, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés: www.cnil.fr - 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. If you live in another EU country, you may also contact your own national supervisory authority.
7. Data security
We put in place technical and organisational measures appropriate to the risk:
- encryption of traffic between your browser and the site (HTTPS)
- access to the management area limited by role: each person sees only what their role justifies
- sign-in to the client portal by single-use link valid for 15 minutes, of which only a fingerprint is stored: a leak of the database would not allow anyone to sign in
- sessions revocable immediately, and suspension of an account taken into account from the very next request
- a log of sensitive operations carried out from the management area
- rate limiting on sign-in attempts and form submissions
- files sold stored outside the site, reachable only through temporary links
No system is infallible. In the event of a data breach likely to result in a high risk to your rights, you would be informed, as would the CNIL, in accordance with articles 33 and 34 GDPR.
9. Changes to this policy
This policy may change, in particular if we add a service or change technical provider. The applicable version is the one published on this page, whose last update date appears below.
Should a processing operation based on your consent change substantially, your consent will be asked for again.
Last updated: 19 September 2026.
The other documents
- Legal notice - Who publishes this site, and where it is hosted.
- Terms and conditions of sale - The framework for our work: quotes, prices, deadlines, rights.
- Cookie policy - What this site stores in your browser.
A question about any of these documents? Write to us at contact@meusproduction.org or call +33 7 44 76 67 18.
Last updated: 19 September 2026.