In brief. Nobody is suspicious of a hardware store. And yet, between the loyalty card that records every purchase, the deposit with a photocopy of your ID to rent a sander, the recycling-centre access badge that time-stamps your visits and the contractor quotes circulating by email, your life as a DIY enthusiast produces a remarkably precise file: floor area of your home, nature of the work, presence of children, estimated income, hours when you are out. This guide inventories those traces, sets out what you have the right to refuse, and suggests simple habits for buying a drill without telling your life story.
References verified on 11 October 2026 on Légifrance, and on the websites of the CNIL, the DGCCRF and ADEME. This article provides general information and is no substitute for advice from a qualified lawyer.
Introduction: the chattiest aisle in your everyday life
When we list the places where we "leave data behind", we think of the bank, the doctor, social media. Never the Saturday-morning DIY store. Yet it is one of the retailers that learns the most about you, because it doesn't sell products: it sells projects.
Buying three bags of cement means you're pouring a slab. Buying a motorised gate means you have land and you're equipping it. Buying a child's bed, sky-blue paint and a stair safety gate announces a birth more reliably than any birth card. And once all of that is linked to a loyalty card number, itself linked to a delivery address, the store doesn't just know your tastes: it knows your home, its condition, its approximate value and the timeline of your projects.
Rarely out of malice. Almost always because it's commercially useful, and because nobody objects.
Part 1 — The inventory: who records what
The retailer's loyalty card
This is the centrepiece. In the big DIY and garden chains, the so-called "free" card mainly serves to link all your receipts together. What the file typically contains:
| Data collected | What it reveals |
|---|---|
| Detailed purchase history | The nature and progress of your renovation work, room by room |
| Delivery address | Your home, sometimes a second residence |
| Amount and frequency | An estimate of your renovation budget, and therefore of your income |
| Checkout times | Your usual schedule, your days off |
| Returns and after-sales service | The equipment in your home and its age |
There is nothing illegal in any of this: a loyalty programme rests on a legal basis (performance of the membership contract, or consent for marketing). But the GDPR requires data minimisation: a retailer cannot demand your full date of birth, your family situation or your occupation in order to issue you a discount card. The CNIL regularly points this out regarding loyalty cards: fields that aren't necessary must be optional.
Quotes, installation and "in-home advice"
As soon as you move from the product to the service (taking measurements, fitting a kitchen, installing a boiler, an insulation assessment), things step up a level. The file then contains plans, photos of your interior, sometimes the number of occupants, the type of heating, the year of construction, the financing method. This information is passed on to subcontracted fitters, to lenders, sometimes to renovation brokers.
It is precisely this pipeline that later feeds the cold calls about insulation or heat pumps — a sector the DGCCRF and the CNIL have been monitoring closely for years.
Tool rental and the deposit
To rent a cement mixer, scaffolding, a wallpaper steam stripper or a mini-digger, you will almost always be asked for ID and proof of address, sometimes a card pre-authorisation. Asking for a guarantee is legitimate: you're walking away with several thousand euros' worth of equipment.
What is questionable is the retained photocopy. The CNIL points out that a business may verify an identity document by inspecting it, but that keeping a copy must remain exceptional and justified. You can ask:
- that the document be checked without being scanned;
- if a copy is kept, for how long and where;
- to redact unnecessary details (full document number, place of birth) on a copy of proof of address.
The recycling-centre badge
Many local authorities have fitted their recycling centres with access controls: badges, number-plate recognition, weighing. The aim is genuine — reserving the service for residents, limiting trade waste, enforcing volume quotas. But the system produces a log: who came, when, with what, how many times.
In other words, your local council knows that you cleared out a garage in March, dropped off rubble in April and a sofa in May. This data falls under the GDPR: a specific purpose, a limited retention period, information provided to users. You can ask the data protection officer (DPO) of your local authority or waste management body for the corresponding processing record.
Connected devices in the garden and the workshop
DIY has gone online: robot mowers that map your garden, wifi-linked irrigation timers, gates and shutters controlled by app, site cameras, thermostats. Each of these devices creates an account, hence an identifier, hence a history.
A robot mower, for example, stores the map of your garden and the time slots when nobody disturbs it — in other words, information about when you're out. For cordless tools, a plain universal battery charger stays perfectly silent, whereas a "connected" model with app tracking adds yet another account to manage.
Part 2 — Why these traces really matter
They describe your home better than a survey
A DIY purchase history is a condition report on the property: the age of the fittings, whether insulation work has been done, the presence of a pool, a garage, a fireplace. This information is of interest to insurers, renovation brokers, estate agents and cold callers.
They flag a temporary vulnerability
A building site is an open house: doors removed, scaffolding up, alarm disconnected, materials stored outside. Deliveries of heavy materials publicly announce that there's something worth taking. Being discreet about work in progress isn't paranoia, it's basic prudence — and it starts with not posting geotagged photos of your project.
They tell the story of your family life
A stair gate, a garden shed, an access ramp, a walk-in shower replacing a bathtub: DIY tracks the stages of life. A birth, adolescence, a parent losing independence, a separation (two successive delivery addresses). These are inferred personal circumstances data, and they are worth a lot in marketing.
Part 3 — What you can refuse, in practice
At the checkout
An emailed receipt is not compulsory. Since the end of automatically printed till receipts became widespread, retailers offer to send them by email or text. That is a collection of your contact details. You can ask for a paper receipt: it is still issued on request.
Other simple habits:
- Keep loyalty separate from payment. If you want to collect rewards, use a dedicated email alias for retailers rather than your main address, and fill in only the fields marked mandatory with an asterisk.
- Refuse the postcode asked for verbally. It is never needed to take payment.
- Pay cash for small purchases. For a packet of screws, there's no point linking the transaction to your bank account. Payment traces are covered in our guide on what your bank statement says about you.
For the warranty
Many people create an online account "for the warranty". In most cases it's pointless: the legal guarantee of conformity (two years, Articles L. 217-3 et seq. of the French Consumer Code) applies on production of proof of purchase, not on enrolment in a programme. Registering online mainly serves to extend a warranty commercially — and to capture your contact details.
The habit that actually helps is purely practical: keep your invoices. An expanding file folder will do, or a portable document scanner if you prefer digital, provided you store the files locally rather than on a mainstream sync service.
For equipment rental
- Ask for your ID to be checked rather than copied.
- Prefer a deposit cheque that isn't cashed or a temporary card pre-authorisation over handing over your bank details.
- Check how long the file is kept: once the equipment has been returned and the deposit released, there is no justification for keeping a copy of your ID card.
- For small, one-off but repeated needs, buying rather than renting avoids any paperwork: an entry-level jigsaw sometimes costs less than three rentals.
For quotes
- Ask for the quote without a site visit where possible (areas supplied by you, not photos of your interior).
- Explicitly decline the "I would like to receive offers from our partners" box.
- Register with Bloctel and, if you do get a call, point out that cold calling about energy-efficiency renovation has been banned since the Act of 24 July 2020 (Article L. 223-1 of the Consumer Code).
- Use a phone number dedicated to admin matters rather than your personal line. An anonymous text message is often enough for a first contact or to answer a private seller's ad without handing over your number.
Part 4 — The special case of the garden and the neighbours
A garden is a semi-public space. A trimmed hedge, a new shed, a newly installed pool: everyone can see, and some of these things fall under planning rules (prior declaration, development tax). Aerial views and land registry records are also public.
Two practical points:
- Cameras and smart doorbells. They must film only your own property, never the public road or your neighbour's land. The CNIL is consistent on this point, and a badly aimed installation can become an offence. To secure a site without filming, a standalone site alarm with a siren, no camera and no online account does the job.
- Dealings with neighbours. Sharing a mower, a comment about an overhanging tree, the noise of Sunday DIY: these are subjects that sour quickly. A clear, courteous message with no name attached can sometimes settle a nuisance without opening up a lasting feud between two front doors.
Part 5 — Taking back control: the checklist
| Action | Effort | Effect |
|---|---|---|
| Dedicated email alias for retailers | 5 min | Severs the link between private life and marketing |
| Paper receipt rather than email | 0 | No contact details handed over |
| Cash for small purchases | 0 | No link between bank and project |
| Refusing a photocopy of your ID | 2 min | Limits the risk in the event of a leak |
| Access request (Article 15 GDPR) to your retailer | 15 min | Reveals the real extent of the file |
| Unsubscribing from newsletters and marketing texts | 10 min | Reduces cold contact |
| Registering with Bloctel | 5 min | Reduces calls |
| Checking which way your cameras point | 20 min | Compliance and peace with the neighbours |
Exercising your right of access, in practice
Send an email to the retailer's DPO (their contact details are in the privacy policy) asking for: the list of data held, its origin, the recipients, the retention period, and a copy of your purchase history. The data controller has one month to reply (Article 12 of the GDPR). If there's no answer, filing an online complaint with the CNIL is free.
For a recycling-centre badge, the same approach applies to the DPO of the local authority or waste management body. Specifically ask about the retention period for the entry logs: that is often where practices are vaguest.
The most common mistakes
- Believing an online account is needed for the warranty. It isn't: proof of purchase is enough.
- Giving your address for a purchase you're taking with you. It only serves targeting purposes.
- Accepting a photocopy of your ID "because that's the procedure". Ask for the legal basis and the retention period; the question alone is often enough to change practice.
- Posting your project live. Time-stamped, geotagged photos of building work signal an open house.
- Forgetting the accounts tied to connected devices when you move house or resell a piece of garden equipment. A robot mower sold on with its account takes the map of your garden with it. A electronic contact cleaner spray is no substitute for a factory reset: remember to do one before any resale.
Key takeaways
DIY and gardening are activities where you feel at home, and therefore safe. That is precisely why we let our guard down: we hand over our email at the checkout, we let someone photocopy our ID card for a sander, we describe our whole project in a detailed quote.
None of these gestures is serious on its own. Put end to end, they add up to a description of your home, your budget and your absences that you would never have agreed to if someone had asked for it all at once. The good news is that the fix is easy: a dedicated email address, a polite refusal at the till, a question about retention periods. The GDPR is on your side; you just have to use it.
Sources and references: CNIL — loyalty cards and customer relationship programmes, Légifrance — Consumer Code, Articles L. 217-3 and L. 223-1, DGCCRF — cold calling and energy-efficiency renovation, ADEME — how recycling centres work, Bloctel.
