Privacy policy
This page explains what IZ FIX does with your personal data, under Regulation (EU) 2016/679 and the French Data Protection Act of 6 January 1978 as amended. It is written to be understood, not to impress.
Who is responsible
IZ FIX, a French simplified joint-stock company, 37 rue du Luxembourg, 77580 Pierre-Levée, France, registered with the Meaux Trade and Companies Register under no. 918 169 400, is the controller for the processing described here. For any question, or to exercise your rights: contact@iz-fix.com.
We have not appointed a data protection officer: it is not mandatory in our situation, as our processing involves neither large-scale monitoring nor special categories of data.
What we collect, and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email, phone, delivery address (entered in our checkout form, or on the Stripe payment page for express checkout) | Process and deliver your order, keep you informed, handle after-sales | Performance of the contract |
| Order details and invoice | Accounting and tax obligations, warranty follow-up | Legal obligation |
| Email, if you subscribe to our offers (page “Get our offers” or box ticked at checkout) | Sending you our sales, new arrivals and codes, a few times a year | Consent, which you can withdraw in one click in every email |
| Referring site (domain name only), first page viewed, campaign parameters in the address | Know which channel (Google search, social network, campaign…) brings the customers who order | Legitimate interest; you can object on this page |
| Email and contents of an unpaid basket | Offer you the chance to resume an interrupted order | Legitimate interest; you can object by ticking the box at checkout, or in one click in every email |
| Name, email, phone, description of the fault or device | Answer a request for a quote, a repair or a buy-back | Pre-contractual steps taken at your request |
| Email, valued device, stated condition and offer from the trade-in calculator | Email you the trade-in offer shown, at your request (a single email, no reminders), and pass it to the workshop | Pre-contractual steps taken at your request |
| IP address and technical call log | Site security and traceability of access to our workshop interface | Legitimate interest in securing the service |
| Email and shipped order | Ask for your review, once, a week after dispatch | Legitimate interest, with opt-out in the email |
| First name, initial of your surname, rating and text of your review | Publish your review on the site, marked “Verified purchase” | Consent, given by ticking the box on the form |
| Email and the Mac you are looking for | Tell you once when a matching Mac arrives | Consent, confirmed by clicking the link in our email |
| Trade-in voucher code, amount and email | Deduct the value of the Mac we bought from you from a purchase | Performance of the contract |
| Gift card: recipient's first name and email, sender's name, message | Send the gift card to the person it is for, and let it be spent | Performance of the contract |
| Questions asked to the site assistant (personal data masked), page viewed | Answer your questions about our Macs, the warranty, delivery or trade-ins; nothing is kept | Legitimate interest (answering the question you ask) |
| First name, phone, time slot and subject of a call-back request | Call you back, at your request | Pre-contractual steps taken at your request |
We collect no special category data, we carry out no profiling, and we take no automated decisions producing legal effects concerning you.
What we do not do
- We do not sell or rent your data to anyone.
- We use no advertising tracker and no embedded social network. The only measurement is the anonymous audience measurement described below.
- We keep no card details: they go straight to the payment provider.
Cookies and local storage
This site uses no advertising or analytics cookies. No consent banner is therefore required, and we do not show one.
Audience measurement. We count visits with Umami, without cookies and without following you from one site to another. The page viewed, a few steps of the journey (trade-in calculator, add to basket, basket and checkout steps, without the model, the price or your details), the referring site, the browser type and the country are recorded as aggregate statistics; your IP address is used to count unique visitors and is not kept. The script and the measurements go through our own site: your browser does not contact Umami directly. On the basket and checkout pages, no measurement script is loaded: only the name of the step reached is sent, by our site. This measurement relies on our legitimate interest in understanding how the shop is used, and falls within the exemption for audience measurement recognised by the CNIL. You can opt out at any time:
- Your basket is kept in your browser's local storage, on your own device. It reaches us only when you place an order, and you can clear it by clearing the site data.
- A session cookie is set only when signing in to the administration area, to keep that session open. It is strictly necessary and does not concern shop visitors.
- Where your visit came from (the site you came from, reduced to its domain name, the first page viewed and, if any, the campaign parameters in the address) is kept in your browser's session storage and cleared when you close the tab. It reaches us only if you place an order, attached to that order, so that we know which channels bring us customers. No cookie or identifier is used, and nothing is sent to a third party. This relies on our legitimate interest; you can object with the audience measurement setting above, and we also respect the Global Privacy Control signal if your browser sends it.
- If you arrive from a Google ad (an address carrying a "gclid" click identifier), a banner asks whether we may tell Google that a visit from that ad led to a purchase, a trade-in request or a call-back request. If you accept, the click identifier is kept with your order (or trade-in request, the trade-in offer you ask us to email you, or your call-back request) and sent to Google Ads with the date and amount of the order (or the date of the request, without any amount), for at most 90 days after the click; Google receives neither your name, nor your address, nor your email. If you decline or do not answer, nothing is kept. This relies on your consent, which you can withdraw by writing to us; the identifier is erased after 25 months, like the rest of the visit origin. No Google cookie or script is used for this.
- The site assistant (button at the bottom right) only opens if you ask for it. It is an online AI provided by Anthropic, not a local AI: our server sends your questions to Anthropic to get the answer, after automatically removing anything that looks like an email, a phone number, an IBAN or a card number; Anthropic receives neither your name nor your IP address. We do not keep your conversations: only anonymous counters (number of conversations, of questions…). The conversation stays in your tab's session storage and is cleared when you close it. If you then place an order or send a trade-in request during the same visit, we only note that the assistant was used (nothing from the conversation), unless you object to measurement or your browser sends the Global Privacy Control signal. Please do not write personal data in the assistant. The "Get a call back" form (first name, phone, time slot) comes straight to us, never to Anthropic, and is only used to call you back.
The basket and the session cookie fall within the exemption in article 82 of the French Data Protection Act: they are strictly necessary to provide the service you have asked for.
Who your data is shared with
Your data is accessible only to our team and to the technical providers below, who act on our behalf and on our instructions.
| Provider | Role | Data | Location |
|---|---|---|---|
| Vercel | Site and image hosting | Technical logs, IP addresses, uploaded files | European Union (Paris) for execution; company established in the United States |
| Supabase | Database (orders, enquiries, accounts) | Identity, contact details, delivery address, order history | European Union (Paris); company established in the United States |
| Stripe | Card payments (including Apple Pay and Google Pay) | Card details, email, amount; for express checkout, name, phone and delivery address entered on its payment page | Ireland and the United States |
| PayPal | PayPal account payments | Email, amount, delivery address | Luxembourg |
| Email provider | Order, tracking and reminder emails | Email, first name, order number | Either the company's own mail server or Resend (United States), depending on the setting chosen |
| Klarna | Pay in instalments, only if you choose it at checkout | Identity, email, address, amount; Klarna checks creditworthiness itself | Sweden; Klarna then acts as a separate controller, under its own policy |
| Cloudflare (Turnstile) | Anti-robot check at checkout and when a form is sent (contact, trade-in, account sign-in, trade-in offer by email) | IP address and technical characteristics of the browser, for the duration of the check; no cookie is set | Cloudflare's global network; company established in the United States |
| Carrier | Delivery of orders, and the search for nearby pickup points (street if you pick one, postcode and city: never your name or contact details) | Name, postal address, phone, email | France and the European Union |
| IGN (Géoplateforme, French national address database) | Address suggestions while you type (delivery address, search for pickup points around your street; France); location of an express checkout address, to pick the nearest pickup point | The address text (being typed, or given at express checkout), sent by the shop's server: neither your IP address nor your name | France; IGN, a French public body |
| Anthropic | Site assistant: answers to the questions asked in the chat window, only if you open it | The text of your questions, after automatic removal of emails, phone numbers, IBANs and card numbers, and the page viewed. Never your name, your IP address or your call-back request | United States (Anthropic, PBC); transfer covered by the European Commission's standard contractual clauses |
| Umami | Cookieless audience measurement | Page viewed, referrer, browser type, country (aggregate statistics) | Depends on the service's hosting; relayed through our site |
Your order details are also passed to our workshop, which prepares and ships the devices, and to the carrier you have chosen. Your quote, repair or buyback requests, the trade-in offers you ask us to email you and your call-back requests are passed to the workshop over an authenticated link, so that it can answer them.
Transfers outside the European Union
The site and the database are hosted in the European Union, in Paris: your orders and enquiries are stored there. Several of our providers are nevertheless companies established in the United States (Vercel, Supabase, Stripe, Cloudflare, and Resend if that email service is used), which may access them to maintain their service. Questions asked to the site assistant are processed by Anthropic in the United States, once personal data has been masked.
These transfers are covered by the European Commission's standard contractual clauses and, where applicable, by our providers' certification under the EU–US Data Privacy Framework. You may obtain a copy of the safeguards in place by writing to contact@iz-fix.com.
How long we keep it
| Data | Period | Reason |
|---|---|---|
| Orders and invoices | 10 years | Accounting obligation (article L123-22 of the French Commercial Code) |
| Customer reviews | Published: while online, removed on request. Rejected: 12 months | Publishing reviews, handling a dispute about moderation |
| Enquiries, quotes, buy-back requests, trade-in offers sent by email | 3 years after the last exchange; Google Ads click identifier of an offer: 25 months | Managing the commercial relationship |
| Call-back requests (first name, phone, time slot, subject) | 12 months after the last exchange | Calling you back, at your request, from the site assistant |
| Conversations with the site assistant | Not kept by the shop: only anonymous counters (number of conversations, of questions…). The conversation stays in your browser tab until you close it | Answering your questions |
| Abandoned baskets and recovery token | 6 months | Beyond that, a reminder serves no purpose |
| Origin of an order (referring site, landing page, campaign) | 25 months; the channel alone (for example “Google search”) stays with the order | Measuring how well our sales channels work |
| Workshop interface call log, including IP address | 12 months | Security and traceability of access |
| Anti-abuse traces for forms, orders and sign-ins (IP address) | 24 hours | Protecting the site against automated submissions |
| Referral (personal code, referrer's and friend's orders) | With the orders concerned: 10 years | Applying the friend's discount and rewarding the referrer; accounting obligation |
| Subscription to offers by email | 7 days if not confirmed; erased when you unsubscribe; 3 years after subscribing at most. Welcome code (offered until 26/10/2026): address removed 30 days after it ends; “code already given” fingerprint: 3 years | Sending you our offers, at your request; having given the welcome code only once |
| Availability alerts (email and search) | 7 days if not confirmed; otherwise 30 days after the alert is sent, 12 months at most | Telling you when a Mac arrives, at your request |
| Trade-in vouchers (code, amount, email) | 3 years after issue | Following up the buy-back of your device |
| Gift cards: recipient's name and email, sender's name, message | 12 months after the card's end date; code, amounts and uses: 10 years with the orders | Sending the card and letting it be spent; accounting obligation |
| Opt-out list (fingerprint of the email address) | 3 years after opting out | Respecting your refusal of reminders and review requests |
| Payment data | Not kept by the shop | Handled directly by Stripe or PayPal |
Your data during a repair or buy-back
If you send us a device, we may access its contents only so far as necessary for the diagnosis or recovery requested. We open no personal file without a technical need, and we keep no copy once the work is finished and you have confirmed your recovery.
Any device we buy back has its storage securely erased before resale. We nevertheless recommend that you back up and erase your data, and sign out of your Apple Account, before sending us a device.
Your rights
At any time, free of charge, you may:
- access the data we hold about you, and obtain a copy;
- have it corrected if it is inaccurate;
- ask for it to be erased, except where the law requires us to keep it, an invoice for example;
- ask for processing to be restricted while something is checked;
- object to processing based on our legitimate interest, in particular order reminders and review requests: by ticking the box at checkout, or through the link at the bottom of each of those emails;
- withdraw your consent at any time, for example to have a published review removed or an alert deleted;
- receive your data in a machine-readable format, or have us send it to another provider.
Write to contact@iz-fix.com setting out your request. We reply within one month. If there is genuine doubt about your identity, we may ask for proof — only in that case.
If our answer does not satisfy you, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr. You may also complain to the supervisory authority of your own country of residence.
Security
Traffic to and from the site is encrypted. Administration passwords are stored as hashes, never in clear. Our workshop access keys are encrypted in the database, and every call is logged with its origin.
Last updated: 30 September 2026.