Privacy
Policy

1. Overview

izzy.agency ("we", "us", "the Studio") is a software studio based in France. We are committed to protecting your privacy and handling your data in compliance with the General Data Protection Regulation (GDPR) and applicable French data protection laws.

This policy explains what data we collect, why we collect it, how we use it, and what rights you have.

2. Data controller

The data controller for all personal data processed through this website is:

izzy.agency
France
Email: [email protected]

3. Data we collect

We collect the minimum data necessary to operate our business and communicate with you.

We do not collect sensitive personal data (health, religion, political opinions, biometrics, etc.).

4. How we use your data

• Contact form submissions: To respond to your inquiry and follow up if relevant. Legal basis: legitimate interest.
• Newsletter: To send you engineering insights, product thinking, and studio updates. Legal basis: your explicit consent.
• Analytics: To understand how visitors use our site and improve the experience. Legal basis: legitimate interest.
• Client engagements: To fulfill our contractual obligations. Legal basis: performance of a contract.

5. Cookies

We use a minimal set of cookies:

• Essential cookies: Required for the website to function (e.g., language preference). These do not require consent.
• Analytics cookies: Set by Google Analytics to measure traffic and usage patterns. These are only placed with your consent.

We do not use advertising cookies, social media tracking pixels, or retargeting technologies.

You can manage cookie preferences through your browser settings. Disabling analytics cookies will not affect your experience on our site.

6. Third-party services

We share data with the following third-party processors, all of whom are GDPR-compliant:

• Google Analytics (Google LLC) - website analytics. Data is anonymized (IP anonymization enabled). Google Privacy Policy
• Newsletter provider - email delivery for our newsletter. We only share your email address. You can unsubscribe at any time via the link in every email.

We do not sell, rent, or trade your personal data to any third party. Ever.

7. Data retention

• Contact form data: Retained for 12 months after your last interaction, then deleted.
• Newsletter subscriptions: Retained until you unsubscribe.
• Analytics data: Retained for 14 months (Google Analytics default with anonymization).
• Client engagement data: Retained for the duration required by French commercial and tax law (up to 10 years for invoicing records).

8. Data security

We implement appropriate technical and organizational measures to protect your data, including:

• HTTPS encryption on all pages
• Access controls limited to authorized team members
• Regular review of third-party service security practices
• No storage of payment card data (payments are processed through secure third-party invoicing)

9. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to restrict processing: Request that we limit how we use your data.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Withdraw consent at any time (e.g., unsubscribe from the newsletter).

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority: www.cnil.fr.

10. International transfers

Some of our third-party processors (e.g., Google) may transfer data outside the EU/EEA. These transfers are protected by Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission, as required by the GDPR.

11. Children

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, contact us immediately and we will delete it.

12. Changes to this policy

We may update this privacy policy to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page indicates the most recent revision. Material changes will be communicated via our website or newsletter.

Contact

For any privacy-related questions or requests, contact us at:
[email protected]