1. What are cookies?
"Cookies" are small text files placed on your device (computer, tablet, phone) by the websites you visit. Together with related technologies — such as HTML5 localStorage, sessionStorage, IndexedDB, pixel tags, web beacons, SDKs and fingerprinting techniques (collectively, "Tracking Technologies") — they allow a site to recognise your browser, remember your preferences and measure how the site is used. Cookies can be first-party (set by the domain you are visiting) or third-party (set by another domain whose content is embedded in the page), and session (deleted when you close your browser) or persistent (stored for a defined period stated in the tables below).
2. Data controller
The data controller for personal data processed via cookies on this Site is FIXHEN, contactable at privacy@fixhen.com. Where a third-party provider is listed in section 4, that provider acts as an independent controller or as a joint controller for its own portion of the processing; its terms and privacy notices apply in addition to this Policy.
3. Legal basis
We rely on the following legal bases under Articles 6(1) GDPR and 5(3) of the ePrivacy Directive:
- Strictly necessary cookies: exempt from consent under Art. 5(3) ePrivacy Directive as they are strictly necessary for the provision of a service expressly requested by you (i.e. browsing the Site, adding items to cart, signing in, completing checkout).
- Functional, analytics, marketing and operational third-party cookies: your prior, freely given, specific, informed and unambiguous consent obtained through the cookie preferences panel, in line with the CJEU judgment in Planet49 (C-673/17) and EDPB Guidelines 05/2020 on consent.
- Where relevant, we may also rely on our legitimate interests(Art. 6(1)(f) GDPR) for security, fraud prevention and network integrity, subject to an appropriate balancing test.
4. Categories of cookies we use
The examples in the tables below are indicative — exact cookie names, providers and durations may vary over time. The current live inventory is always available in the cookie preferences panel accessible from the footer.
Strictly necessary cookies
Art. 5(3) ePrivacy Directive — exemption; no consent required.
Enable core Site functionality: routing, session persistence, load balancing, cart contents, checkout state, authentication, CSRF protection and secure delivery of pages. The Site cannot function properly without them.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
| sb-*-auth-token | fixhen.com | First-party | Authenticated session for signed-in customers. | 1 year |
| fixhen.cart | fixhen.com (localStorage) | First-party | Persist cart items between visits. | Until cleared |
| cookie_consent | fixhen.com | First-party | Store your cookie preferences. | 12 months |
| __cf_bm | Cloudflare | Third-party | Bot management and abuse protection. | 30 minutes |
Functional cookies
Consent — Art. 6(1)(a) GDPR & Art. 5(3) ePrivacy Directive.
Remember preferences that enhance your experience: language, currency, saved vehicle for fitment, recently viewed products and interface choices. Refusing them does not block core functionality but may reduce personalisation.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
| fixhen.locale | fixhen.com | First-party | Selected language and currency. | 12 months |
| fixhen.garage | fixhen.com | First-party | Saved vehicle for fitment filtering. | 12 months |
| fixhen.recent | fixhen.com | First-party | Recently viewed products carousel. | 30 days |
Analytics & performance cookies
Consent — Art. 6(1)(a) GDPR & Art. 5(3) ePrivacy Directive.
Collect aggregated, pseudonymous statistics about how visitors interact with the Site — pages viewed, load speed, click paths, error rates — so we can measure performance and improve the catalogue, search and checkout.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
| _ga, _ga_* | Google Analytics 4 | Third-party | Distinguish visitors and sessions. | 13 months |
| _plausible | Plausible Analytics (EU-hosted) | Third-party | Aggregate, cookie-less traffic metrics. | 24 hours |
Marketing & advertising cookies
Consent — Art. 6(1)(a) GDPR & Art. 5(3) ePrivacy Directive.
Measure the effectiveness of our advertising campaigns and, where you have consented, deliver relevant remarketing on third-party platforms. Refusing them does not increase or decrease the number of ads you see — only their relevance.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
| _fbp | Meta (Facebook/Instagram) | Third-party | Conversion tracking and remarketing. | 3 months |
| _gcl_au | Google Ads | Third-party | Attribute conversions to Google Ads campaigns. | 3 months |
Operational third-party services
Consent where required — Art. 5(3) ePrivacy Directive.
Cookies and equivalent local-storage items set by embedded services we use to operate the Site: payment providers, fraud prevention, chat support, delivery tracking and 3D product viewers. Consent is requested where the underlying purpose is not strictly necessary.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
| __stripe_mid, __stripe_sid | Stripe | Third-party | Fraud prevention on checkout. | 1 year / 30 min |
| intercom-* | Intercom | Third-party | Persist support chat conversation. | 9 months |
5. How to manage your preferences
You can accept, refuse or fine-tune every non-essential category through the cookie preferences panel presented on your first visit, or reopened at any time via the “Cookie settings” link in the footer. Withdrawal of consent is as easy as giving it and takes effect for the future only; it does not affect the lawfulness of processing carried out on the basis of consent previously given.
You can additionally control cookies through your browser settings — including deleting existing cookies, blocking cookies from specific domains, or refusing all third-party cookies. Instructions are available for Chrome, Firefox, Safari and Edge. Please note that blocking strictly necessary cookies via your browser will prevent parts of the Site from functioning correctly, and we cannot be held liable for the resulting loss of functionality.
We honour Global Privacy Control (GPC) signals for the categories that legally require consent, treating a valid GPC signal as an opt-out from all non-essential categories.
6. Retention periods
Retention periods are stated per cookie in the tables above. Session cookies are deleted automatically when you close the browser. Persistent cookies expire on the date shown or when you clear them manually. Aggregate analytics data derived from cookies is retained for up to 26 months, after which it is either deleted or fully anonymised so that re-identification is no longer reasonably possible.
7. International transfers
Where a third-party provider processes personal data outside the European Economic Area, the transfer is safeguarded by (i) an EU adequacy decision, (ii) the European Commission's Standard Contractual Clauses (Decision 2021/914) with, where appropriate, supplementary technical and organisational measures, or (iii) certification under the EU-US Data Privacy Framework. Copies of the relevant safeguards are available on request at privacy@fixhen.com.
8. Your data-protection rights
Where cookies process personal data you are, subject to statutory conditions, entitled to: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and to withdraw consent at any time (Art. 7(3)). You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (KZLD) or with the supervisory authority of your habitual residence. Contact us at privacy@fixhen.com to exercise these rights; we respond within one month, extendable by two further months for complex requests.
9. Do Not Track
The "Do Not Track" HTTP header is not a settled standard and browsers implement it inconsistently. We therefore do not treat a DNT signal as a substitute for the consent obtained through the cookie preferences panel. We do, however, honour Global Privacy Control (GPC) signals as set out in section 5.
10. Changes to this Policy
We may update this Cookie Policy to reflect changes in law, technology or the services we use. The version in force is always available at https://fixhen-auto-parts-hub.lovable.app/cookies, with an updated "Last updated" date. Material changes to the categories, purposes or third parties involved will trigger a fresh consent request through the preferences panel.
11. Frequently asked questions
+Do I have to accept cookies to use the Site?
No. Strictly necessary cookies are the only ones set without consent, in line with Article 5(3) of the ePrivacy Directive. All other categories require your explicit opt-in and can be refused without affecting your ability to browse, order or receive after-sales support.
+How do I withdraw or change my consent?
Reopen the cookie preferences panel at any time via the ‘Cookie settings’ link in the footer, or by clearing your browser cookies. Withdrawal is as easy as giving consent and takes effect for the future only — it does not affect the lawfulness of processing carried out on the basis of the earlier consent.
+Are analytics cookies used to identify me personally?
No. We configure analytics providers to pseudonymise identifiers, truncate IP addresses and disable cross-site tracking features where technically possible. Data is used in aggregate to improve the Site and is retained for the period stated in the cookie table.
+Do you transfer data outside the European Economic Area (EEA)?
Some third-party providers listed in this policy may process data in third countries. We rely on the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses (2021/914) and, where appropriate, supplementary technical measures. Details are available in our Privacy Policy or on request.
+What happens if I ignore the cookie banner?
Only strictly necessary cookies are set. No optional cookies are placed until you make an active, informed choice. Continued browsing is not treated as consent under EDPB Guidelines 05/2020.
+Do you use dark patterns to obtain consent?
No. Accept and Reject buttons are equally visible and require the same number of clicks. Pre-ticked boxes are not used; no default is set to ‘on’ for any non-essential category, in line with the CJEU Planet49 ruling (C-673/17).
12. Contact
Data protection & privacy queries — privacy@fixhen.com. For an overview of our full data-processing activities, please also see our Terms & Conditions and Returns Policy.