Privacy policy

Data controller

Mecapack, 8 rue Johannes Gutenberg, 85500 Les Herbiers, France. For any question about your data, contact: contact@mecapack.com.

Data collected and purposes

We only collect the data required for the following purposes:

• Contact form: last name, first name, company, email, phone number, country and state or French département (sales requests), type of project, message, attachment, origin of your visit (page viewed and referring website), IP address (abuse prevention). Purpose: to answer your sales, administrative or after-sales request.
• Technical datasheet request: name, company, email, machine model viewed, origin of your visit (referring website), IP address (abuse prevention). Purpose: to send you the technical datasheet and follow up with you about your project.
• PACK EXPO meeting request (mecapack.com): first name, last name, company, email, origin of the visit (advertising campaign), IP address (abuse prevention). Purpose: to arrange a meeting at the Mecapack booth at PACK EXPO and follow up with you about your project.
• Audience measurement: anonymised technical data (pages viewed, navigation path, session duration), only if you consent to analytics cookies.
• Third-party content: Google Maps and YouTube are only loaded after your explicit consent (see our cookie policy).

Legal bases

• Consent (Art. 6(1)(a) GDPR) — analytics cookies, third-party content, optional marketing communications.
• Pre-contractual measures (Art. 6(1)(b)) — answering a sales or meeting request.
• Legitimate interest (Art. 6(1)(f)) — website security, fraud prevention (anti-spam check on the form).
• Legitimate interest (Art. 6(1)(f)) — sales follow-up of technical datasheet requests; you can object at any time by writing to contact@mecapack.com.

Retention periods

• Contact data (prospects): 3 years from the last exchange.
• Unsuccessful job applications: 2 years from the last contact, unless you object.
• Audience measurement data: 13 months (CNIL recommendation).
• Consent preferences: 13 months.

Recipients

Your data is intended for the Mecapack departments handling your request (sales, administration, after-sales). It may be shared with our technical processors, who are bound by a contractual confidentiality obligation: hosting provider (Hostinger International Ltd., EU), transactional email provider (Semantiq, France), form routing automation (self-hosted n8n, France), internal request-tracking tool (hosted on the same infrastructure).

Transfers outside the EU

If you consent to third-party content (Google Maps, YouTube), technical data (IP address, technical identifiers) may be transferred to the United States by Google LLC. These transfers take place under the EU-US Data Privacy Framework. You can withdraw this consent at any time via our cookie policy.

Your rights

Under the GDPR, you have the following rights:

• Right of access to, and a copy of, your data.
• Right to rectification.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability.
• Right to object and to withdraw your consent at any time.
• Right to set instructions regarding your data after your death.

To exercise these rights, write to contact@mecapack.com stating your request. A copy of an identity document may be requested if there is reasonable doubt about your identity.

You may also lodge a complaint with the CNIL (the French data protection authority) if you believe that the processing of your data does not comply with the regulations.

Security

The website is served over HTTPS and hosted on dedicated infrastructure behind a Traefik reverse proxy with Let's Encrypt certificates. Form submissions are encrypted and subject to anti-spam checks (honeypot, identity scoring, MX verification of email addresses).

Changes

This policy may be updated to reflect technical, regulatory or organisational changes. The date of the last update is shown at the top of this document.