Privacy policy
PRIVACY AND COOKIES POLICY
Facility Mediation - B2B Store and Digital Services
Version 0.2 - 5 September 2026
1. Purpose and scope
This policy describes how Facility Mediation processes personal data in connection with the website https://facility-mediation.com, contact requests, verification of professional eligibility, accounts, orders, payments, invoicing, digital delivery, support and the commercial relationship.
It applies to natural persons acting for their own professional activity or as representatives, employees, contacts or users of a client or prospective organisation. The B2B nature of the store does not exclude the application of the GDPR to the personal data of those individuals.
2. Data controller
Controller: Joëlle BREDA, individual entrepreneur (EI), trading as Facility Mediation
Address: A03, 10 impasse du Prat, 31170 Tournefeuille, France
SIREN: 753 358 571 - SIRET: 753 358 571 00036
Personal data contact: contact@facility-mediation.com
No Data Protection Officer has been appointed as at the date of this version. Requests should be sent to the contact point above.
3. Categories of personal data processed
Depending on interactions with Facility Mediation, the data may include:
- identity and contact details: surname, first name, email address, telephone number and address;
- professional data: organisation, legal name, legal form, position, authority, country, business address, SIREN, SIRET, VAT number or equivalent identifier;
- account and eligibility data: credentials, account status, checks and strictly necessary supporting documents;
- order data: products, prices, discounts, number, date, status and history;
- invoicing and accounting data: identity, address, tax information, invoice and payment;
- limited payment data: method used, status, transaction identifier and information transmitted by the provider; Facility Mediation does not retain the full card number;
- delivery data: delivery address, links, access, downloads, technical logs and evidence of availability;
- messages, support requests, complaints and documents provided;
- technical and browsing data: IP address, device, browser, pages, security logs, cookies and other trackers;
- communication preferences, consents, objections and associated evidence.
4. Purposes and legal bases
4.1 B2B verification, account, order and delivery
Data is processed to verify professional eligibility and the representative's authority, create or manage the account, record the order, verify payment, deliver the product, provide support and manage complaints. For a natural person contracting in their own professional capacity, these processing activities are based on performance of the contract or on pre-contractual measures taken at their request. For representatives, employees and contacts of a legal person or another organisation, they are based on the legitimate interests of Facility Mediation and the organisation concerned in preparing, concluding, performing and securing the B2B relationship, subject to the rights and freedoms of individuals.
4.2 Invoicing, accounting and legal obligations
Information necessary for invoicing, accounting, tax obligations, electronic invoicing and responding to authorities is processed on the basis of applicable legal obligations.
4.3 Security, fraud prevention and defence of rights
Logs, checks and relevant information may be processed to secure the website, prevent abusive access, detect fraud, defend Facility Mediation's rights and retain evidence of transactions. These processing activities are based on legitimate interests, after taking into account the rights and freedoms of individuals.
4.4 Professional direct marketing and communications
Facility Mediation may send professional communications related to the business activity or the existing relationship, where permitted. The individual may object at any time. Where consent is required, it constitutes the legal basis and may be withdrawn at any time.
4.5 Audience measurement and non-essential features
Strictly necessary cookies or trackers are based on the technical necessity of the service. Non-exempt audience measurement, personalisation or advertising tools are based on consent where consent is required.
5. Required data and consequences
Fields identified as mandatory are necessary for professional verification, conclusion or performance of the order, payment, invoicing or delivery. Failure to provide them may prevent account creation, acceptance of the order or provision of the product.
Facility Mediation limits the supporting documents requested to what is necessary to verify identity, business activity or the representative's authority.
6. Sources of data
Data is mainly provided by the individual concerned or by their organisation. Facility Mediation may also verify certain professional information in public registers, with payment, fraud-prevention, invoicing or delivery providers, or from technical data generated by the website.
7. Recipients and service providers
Data is accessible to authorised Facility Mediation personnel and to service providers strictly necessary for their tasks. Depending on the services enabled, the following may in particular be involved:
- Shopify and its authorised providers, for the e-commerce platform, hosting, accounts, orders and technical functions;
- the payment provider displayed at checkout;
- Qonto or any authorised platform actually used for banking, invoicing or electronic invoicing services;
- the digital delivery application or service actually configured;
- email, domain-hosting, support, security and maintenance providers;
- professional advisers, auditors, authorities and courts where necessary or legally required.
Facility Mediation does not sell personal data. The provider inventory must be kept up to date and reflect the actual configuration before publication.
8. Transfers outside the European Economic Area
Some providers or subprocessors may process data from countries outside the European Economic Area. Where required by the GDPR, the transfer is based on an adequacy decision, Standard Contractual Clauses or another recognised mechanism, together with supplementary safeguards where necessary.
Detailed information about transfers and provider safeguards may be requested from contact@facility-mediation.com, subject to information protected by security or contractual confidentiality.
9. Retention periods
Data is retained for the period necessary for each purpose and is then deleted, anonymised or placed in intermediate archives where required. As at the date of this version:
- account data, orders, contracts and evidence of acceptance: for the duration of the relationship, then for five years from its end or the last transaction, unless a specific period applies;
- invoices, accounting records and supporting documents: ten years;
- professional prospect data: three years from the last active contact, unless the individual objects or a shorter period applies;
- support requests and complaints: for the processing period, then for up to five years where retention is necessary for evidence or defence of rights;
- evidence of consent and objection: for the period necessary to demonstrate compliance with obligations;
- security and download logs: for a limited period proportionate to security, fraud and evidence purposes, according to the documented technical configuration;
- cookies and trackers: according to their purpose and the periods displayed in the consent tool.
10. Cookies and other trackers
The website uses trackers that are strictly necessary for the shopping cart, session, security, retention of choices and operation of the store. These trackers may be used without consent where they meet the applicable exemption conditions.
Non-exempt audience measurement, personalisation or advertising trackers must not be placed or read until consent has been obtained. The consent tool must make it comparably easy to accept, refuse and manage preferences, and then to withdraw consent at any time.
The individual's choice is retained for an appropriate period before consent is requested again. The categories, purposes, controllers and durations of trackers must correspond to the technical inventory actually observed.
11. Data subject rights
Under the conditions provided for by the GDPR, any individual may request:
- access to their data;
- rectification of their data;
- erasure of their data;
- restriction of processing;
- data portability where that right applies;
- objection to processing based on legitimate interests, in particular direct marketing;
- withdrawal of consent at any time;
- information about the safeguards governing an international transfer.
The request should be sent to contact@facility-mediation.com. Proof of identity is requested only in the event of reasonable doubt. A response is provided within the time limits laid down by the GDPR.
12. Complaint to the CNIL
An individual who considers that their rights have not been respected may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL): https://www.cnil.fr.
13. Security
Facility Mediation implements technical and organisational measures appropriate to the risks, including access-right management, authentication, backups, access restriction, traceability and incident management. No system guarantees absolute security; incidents are analysed and handled in accordance with applicable obligations.
14. Data processed in CLIENT Deliverables
The CLIENT is responsible for the data entered into the Deliverables after download. Where Facility Mediation does not access that data, it determines neither the purposes nor the means of such processing.
If a support, customisation, hosting or assistance service leads Facility Mediation to process personal data on behalf of the CLIENT, the roles are determined before the service and an agreement compliant with Article 28 of the GDPR is entered into where required.
15. Changes to the policy
The policy may be updated to take account of legal, technical or organisational developments. The applicable version is the version published at the time of consultation. Appropriate information is provided where a material change affects ongoing processing.
16. Contact
Joëlle BREDA EI - Facility Mediation
A03, 10 impasse du Prat, 31170 Tournefeuille, France
contact@facility-mediation.com - +33 6 42 64 76 35