Data security and protection

What we collect, and what we never collect

We apply the data minimisation principle (Article 5(1)(c) GDPR): if a piece of information is not needed to search for your property, we do not ask for it.

Collected when you complete a form or book an appointment: name, email, phone number, project type, target areas, approximate budget, size and number of rooms, availability, time zone for expatriate clients, and the free-text message you write.

Never collected on this site, in any form:

• Bank details, card numbers, IBAN, proof of income
• Social security number, health data
• Political opinions, religious beliefs, ethnic origin, sexual orientation
• Biometric data
• Passwords: there is no visitor account to create

Acquisition file documents (identity documents, financing plan, purchase offer) are exchanged later, under a signed search mandate, with your hunter and the notary, never through a public form on this site.

Where your data is hosted

The site is static: pages are pre-built and served from a content delivery network, with no visitor-facing database to query. The processes that handle personal data are limited and identified.

The full list of processors, with purpose and transfer safeguard, appears in section 5 of the privacy policy. Analytics and advertising tools (Google, Microsoft, Meta) load only after your explicit consent, and have access neither to your budget nor to the content of your exchanges with a hunter.

Encryption and technical security of the site

The measures below can be checked from the outside, by any public HTTP header analysis tool. They apply to the whole domain, not just to form pages.

• Encryption in transit: HTTPS with TLS 1.3, certificate issued and renewed automatically. Any plain-text request is redirected to HTTPS.
• HSTS: a two-year Strict-Transport-Security header, extended to subdomains, with the preload directive. Once a browser has seen the site, it refuses any unencrypted connection to it.
• Content Security Policy: permitted scripts, styles, images, fonts, connections and frames are listed explicitly. Any undeclared third-party script is blocked by the browser, which limits the impact of an injection.
• Locked form submission: the form-action 'self' directive prevents any form on the page from sending data to an external domain.
• Framing protection: X-Frame-Options and frame-ancestors prevent the site from being embedded in a third-party frame, the classic clickjacking technique.
• Strict file typing: X-Content-Type-Options: nosniff stops browsers from reinterpreting a served file.
• Hardware permissions switched off: camera, microphone, geolocation, payment, accelerometer and USB are disabled through the Permissions-Policy header, including for third-party content.
• Referrer leakage limited: Referrer-Policy: strict-origin-when-cross-origin, so no detailed URL is passed to external sites.
• Sandboxed video: embedded video players run in a sandbox with reduced permissions.
• No account database: the site holds no visitor accounts, so no client password is stored, encrypted or hashed: there are none.

Forms, chat assistant and emails

The entry points that receive data are protected independently of one another.

• Origin checks: every form submission is rejected if it does not come from the site itself, which neutralises forged submissions from a third-party page.
• Rate limiting: the number of submissions per IP address is capped over a rolling window, to block bots and form stuffing.
• Bot trap: a hidden field, left empty by a human, allows automated submissions to be discarded silently.
• Input sanitisation: line breaks and control characters are stripped from fields before the email is sent, to prevent header injection and hidden recipients.
• No intermediate storage: an enquiry goes to the hunter's mailbox and to the internal follow-up application, with no public database exposed on the site.
• Email authentication: outgoing messages are signed with SPF, DKIM and DMARC, which makes spoofing our sending address considerably harder.
• Chat assistant: exchanges travel over HTTPS, are kept for 12 months, and a notice reminds you not to enter sensitive data. They are not used to train any artificial intelligence model.
• Traceable consent: your cookie choice is recorded in a first-party cookie lasting 13 months, with server-side logging, so that what was accepted and when can be evidenced.

Who accesses your data, and how your project stays confidential

An acquisition project, particularly in the luxury and prestige segment, is above all a matter of discretion. Our internal rules are as follows.

• Restricted access: your contact details and your project are available to the hunter handling your search and to the people who assign enquiries, not to the whole firm.
• Protected admin console: access to the site's internal tools goes through server-side authentication, with a session cookie that scripts in the browser cannot read, restricted to the domain and time-limited.
• Anonymity of published references: the completed searches published on the site never name a client in full. Testimonials show a first name followed by an initial, never a full surname.
• Towards sellers and agencies: when a hunter negotiates for you, they pass on what the transaction requires. Your maximum financing capacity is not an argument we hand to the other side.
• Confidential search: the Confidential offer, reserved for projects of 2M EUR and above, exists precisely for buyers who do not want their search circulating on the market. Your brief is never published without your agreement.

Fraud prevention: wire transfers, fake bank details and phishing

The most common fraud in property is not a hacked website: it is the fraudulent email impersonating a professional on the file and providing new bank details a few days before signing. Our rules are simple, and have no exception.

• Home Select never receives your funds. No deposit, no security payment, no purchase price. All sums related to the acquisition pass exclusively through the notary's account.
• We will never email you bank details for a payment linked to the purchase, and we will never ask for your banking credentials, by email, phone or messaging app.
• Our fees are payable on success, at the signing of the deed. No advance, no application fee and no upfront payment is ever required to start a search.
• When in doubt, call. Do not reply to the suspicious email: dial +33 1 78 76 78 10, the number published on this site, and have the request confirmed by voice. A change of bank details announced by email must always be verified by phone with the notary, on a number you found yourself.
• Check the sender domain: our emails come from the homeselect.paris domain. A lookalike variant is not us.

How long your data is kept

Once those periods expire, data is deleted or irreversibly anonymised.

Your rights, and how to actually exercise them

The GDPR gives you the right to access your data, have it corrected, have it erased, object to its processing, request restriction and receive it in a readable format. Exercising these rights is free and requires no justification.

In practice: write to contact@homeselect.paris stating your request. We reply within one month at most. An erasure request is carried out across all our tools, including the internal follow-up application and the newsletter list.

Home Select has not appointed a data protection officer, as the company does not fall within the cases set out in Article 37 GDPR. Requests are handled directly by the data controller. If our answer does not satisfy you, you may refer the matter to the CNIL, 3 place de Fontenoy, 75007 Paris, or file a complaint online at cnil.fr.

In the event of a data breach

No organisation can promise zero risk, and claiming otherwise would be the first red flag. What we do commit to is the conduct we follow should an incident occur.

• Notification to the CNIL within 72 hours of becoming aware of the incident, in accordance with Article 33 GDPR.
• Direct notification of the individuals concerned where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 34.
• A factual description of the nature of the incident, the categories of data affected and the measures taken, without downplaying.

If you spot a security flaw on this site or unusual use of your data, report it to contact@homeselect.paris. A good-faith report will never be met with legal action from us.

What we do not do

• We do not sell, rent or exchange your data with third parties, for any commercial or advertising purpose.
• We make no automated decisions about you within the meaning of Article 22 GDPR. No algorithm sorts projects: a hunter reads every enquiry.
• We set no analytics or advertising cookie before your explicit consent, and refusing is as easy as accepting.
• We never request upfront payment, nor bank details by email or phone.
• We never publish a client's full identity, nor transaction details that would identify them.
• We do not buy prospect lists: our contacts come from our own forms, our clients and our professional network.

Check for yourself

A security claim that cannot be checked is worth very little. The technical measures described above are observable from the outside, without our permission, using free public tools.

• HTTP security header analysis for the domain
• TLS configuration and certificate test
• HSTS status of the domain in the browser preload list
• Full privacy policy, including the list of processors
• Legal notice and identity of the data controller
• Refer a dispute to the CNIL

A question about your data

For any question about the protection of your personal data, the security of the site, or to exercise your rights: contact@homeselect.paris or 01 78 76 78 10. Postal address: 60 rue François 1er, 75008 Paris.