Privacy Policy
Home Select, a property hunting firm founded in 2011 and based at 60 rue François 1er, 75008 Paris, France, places great importance on protecting your personal data. This privacy policy provides detailed information about how we collect, use, store, and secure your information, in accordance with Regulation (EU) 2016/679 of April 27, 2016 (GDPR) and French Law No. 78-17 of January 6, 1978, as amended (Data Protection Act).
1. Data Controller
The data controller is:
- HOME SELECT - VOTRE CHASSEUR IMMOBILIER
- SAS (Simplified Joint-Stock Company) with a share capital of 1 000,00 €
- 60 rue François 1er, 75008 Paris, France
- SIRET: 531 223 931 00068 / Trade Register (RCS): Paris 531 223 931
- Email: contact@homeselect.paris
- Phone: +33 1 78 76 78 10
- Legal representative: Jean Mascla, President
- Professional license: {{carteT}} (issued by the {{carteTDelivreePar}})
Home Select has not appointed a Data Protection Officer (DPO) as defined by Article 37 of the GDPR (the company does not process data on a large scale under Article 37-1). For any questions regarding your personal data, contact the data controller directly at contact@homeselect.paris.
2. Data Collected
We only collect data necessary for the purposes described below, in accordance with the data minimization principle (Article 5-1-c GDPR).
2.1 Via contact forms and appointment scheduling
- First and last name
- Email address
- Phone number
- Property project type (purchase, rental, sale)
- Preferred arrondissements or municipalities
- Approximate budget
- Desired surface area and number of rooms
- Availability and appointment slots
- Timezone (for expatriate clients)
- Free-form message
This data is transmitted via a secure webhook (HTTPS) to our automation platform, then deleted from the server after processing.
2.2 Via live chat (Crisp)
- Content of exchanged messages
- Email address (if voluntarily shared in the conversation)
- IP address (anonymized by Crisp)
- Pages visited at the time of the exchange
Crisp SAS is a French company whose data is hosted exclusively in France. No transfer outside the EU occurs for chat data.
2.3 Via site navigation (with your consent)
- IP address (anonymized by Google Analytics via ip_anonymization parameter)
- Pages visited and navigation paths
- Visit duration and bounce rate
- Traffic source (search engine, direct link, social network)
- Browser type, operating system, and screen resolution
- Approximate geographic location (city level, no precise address)
This data is collected only if you have accepted analytics cookies via the consent banner.
2.4 Data we do not collect
Home Select never collects: banking details, social security numbers, health data, political opinions, religious beliefs, ethnic origins, sexual orientation, or biometric data. We do not carry out any automated profiling within the meaning of Article 22 GDPR.
3. Processing Purposes and Legal Basis
Each data processing activity relies on an identified legal basis under Article 6 GDPR:
| Purpose | Legal basis (Article 6 GDPR) | Data concerned |
|---|---|---|
| Responding to contact requests and scheduling appointments | Consent (Art. 6-1-a) | Name, email, phone, message |
| Executing property search mandate | Contract performance (Art. 6-1-b) | Identity, search criteria, budget |
| Live chat assistance | Legitimate interest (Art. 6-1-f) | Chat messages, email if shared |
| Sending Paris real estate market information | Consent (Art. 6-1-a) | |
| Audience measurement and site improvement | Consent (Art. 6-1-a) for cookies | Anonymized navigation data |
| Behavioral analysis (heatmaps, session recordings) | Consent (Art. 6-1-a) | Site interactions (clicks, scrolling) |
| Legal obligations (contractual documents, Tracfin) | Legal obligation (Art. 6-1-c) | Contractual documents, supporting documents |
4. Retention Period
In accordance with the storage limitation principle (Article 5-1-e GDPR), your data is retained for the following periods:
| Data type | Retention period | Legal basis |
|---|---|---|
| Contact data (non-client prospects) | 3 years from last contact | CNIL recommendation (Deliberation No. 2016-264) |
| Client data (search mandate) | Contract duration + 5 years | Civil statute of limitations (Art. 2224 Civil Code) |
| Contractual documents (mandates, invoices) | 10 years | Commercial statute (Art. L.123-22 Commercial Code) |
| Online appointment data | 30 days after the appointment | Automatic deletion |
| Chat conversations (Crisp) | 12 months | Legitimate interest (service improvement) |
| Navigation data (analytics) | 14 months maximum | CNIL recommendation |
| Cookie consent | 13 months | CNIL guidelines (September 17, 2020) |
After these periods, data is deleted or irreversibly anonymized.
5. Data Recipients and Processors
Your data may be shared with the following categories of recipients, in strict compliance with our contractual obligations and the GDPR:
5.1 Processors hosting data in France / EU
| Processor | Headquarters | Data hosting | Purpose |
|---|---|---|---|
| Crisp SAS | Nantes, France | France | Live chat, real-time client assistance. Data hosted exclusively in French datacenters. No transfer outside the EU. |
| OVH SAS | Roubaix, France | France | Appointment confirmation email delivery (SMTP server). Data hosted in OVH datacenters in France. |
5.2 Processors with regulated EU transfer
| Processor | Headquarters | Transfer safeguard | Purpose |
|---|---|---|---|
| Vercel Inc. | Walnut, CA, USA | EU-U.S. DPF + SCCs | Website hosting, serverless function execution (EU region) |
| Google LLC | Mountain View, CA, USA | EU-U.S. DPF + SCCs | Audience measurement (Google Analytics 4), only with your consent. IP anonymized. |
| Microsoft Corp. | Redmond, WA, USA | EU-U.S. DPF + SCCs | Behavioral analytics (Microsoft Clarity: heatmaps, sessions), only with your consent |
| Make.com (Celonis SE) | Munich, Germany (EU HQ) | EU HQ, EU servers | Contact form processing automation (webhooks) |
5.3 Other recipients
- Home Select property hunters: our 16 hunters, as commercial agents, access prospect contact data in the context of their search mandate
- Competent authorities: in case of legal obligation (tax authorities, Tracfin, judicial authorities)
Your data is never sold, rented, or exchanged with third parties for commercial or advertising purposes.
6. Transfers Outside the EU
Some of our technical processors are located in the United States. These transfers are governed by the following mechanisms, in accordance with Chapter V of the GDPR:
- EU-U.S. Data Privacy Framework (DPF): Vercel, Google, and Microsoft are certified under the DPF (European Commission adequacy decision of July 10, 2023)
- Standard Contractual Clauses (SCCs): in addition to the DPF, standard contractual clauses adopted by the European Commission (Implementing Decision 2021/914 of June 4, 2021) are incorporated into our processing agreements
Processors without EU transfer: Crisp SAS (France) and OVH SAS (France) host all data in datacenters located in France. Make.com (Celonis SE) is headquartered with servers in the EU (Germany). No transfer outside the EU occurs for these providers.
7. Your Rights
Under Articles 15 to 22 of the GDPR, you have the following rights:
- Right of access (Art. 15 GDPR): obtain confirmation of whether your data is being processed and receive a copy, together with the information specified in Article 15-1 (purposes, categories, recipients, retention periods)
- Right to rectification (Art. 16 GDPR): correct inaccurate data or complete incomplete data
- Right to erasure (Art. 17 GDPR): request deletion of your data when processing is no longer necessary, you withdraw consent, or you exercise your right to object
- Right to restriction (Art. 18 GDPR): obtain restriction of processing while data accuracy is being verified or in case of objection
- Right to portability (Art. 20 GDPR): receive your data in a structured, commonly used, machine-readable format (CSV, JSON), and transmit it to another data controller
- Right to object (Art. 21 GDPR): object at any time to processing based on legitimate interest, for reasons relating to your particular situation
- Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7-3 GDPR)
How to exercise your rights
Send your request by email to contact@homeselect.paris or by registered mail to:
Home Select, Data Protection
60 rue François 1er, 75008 Paris, France
We may ask you to verify your identity (copy of ID document) in accordance with Article 12-6 GDPR. We will respond within one month of receiving the request. This period may be extended by two additional months in case of complexity or high number of requests (Article 12-3 GDPR), in which case you will be informed.
Complaint to the CNIL
If you believe your data processing is not GDPR-compliant, you may file a complaint with the French Data Protection Authority (CNIL):
- Address: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- Online: www.cnil.fr/fr/plaintes
- Phone: +33 1 53 73 22 22
8. Cookies and Trackers
In accordance with Article 82 of the French Data Protection Act and CNIL guidelines of September 17, 2020, homeselect.paris uses cookies subject to your prior consent.
Principle
No analytics or advertising cookies are set before you have expressed your choice via the consent banner. Your choice is stored for 13 months. You can change your preferences at any time via the "Manage cookies" link in the footer.
Technical cookies (consent exempt)
- hs-cookie-consent (1st party): stores your consent choice (localStorage, 13 months). Exempt under Article 82(2) (strictly necessary for the requested service).
- crisp-client/* (Crisp SAS, France): live chat session identifier. Exempt as a cookie necessary for the chat service requested by the user.
Analytics cookies (consent required)
Google Analytics 4 (Google LLC, Mountain View, CA, USA)
- _ga: anonymous user identifier (duration: 2 years)
- _ga_*: session state persistence (duration: 2 years)
- Purpose: anonymized audience measurement (visitors, page views, traffic sources)
- IP anonymization: enabled (ip_anonymization parameter)
- Google Privacy Policy: policies.google.com/privacy
- Opt-out: Google Analytics browser opt-out add-on
Microsoft Clarity (Microsoft Corporation, Redmond, WA, USA)
- _clck: user identifier (duration: 1 year)
- _clsk: session identifier (duration: 1 day)
- Purpose: behavioral analytics (heatmaps, scroll maps, anonymized session recordings)
- Microsoft Privacy Policy: privacy.microsoft.com
Advertising cookies
The homeselect.paris website does not use any advertising, remarketing, or behavioral targeting cookies.
9. Data Security
In accordance with Article 32 GDPR, Home Select implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk:
Technical measures
- Encryption in transit: HTTPS protocol (TLS 1.3) across the entire site, SSL certificate issued and managed by Vercel
- Secure hosting: Vercel infrastructure SOC 2 Type II certified, with 24/7 monitoring and multi-region redundancy
- Chat data in France: Crisp conversations are hosted in French datacenters, encrypted at rest and in transit
- Secure emails: OVH SMTP server with SPF, DKIM, and DMARC authentication
- Forms: transmission via HTTPS webhooks, no server-side database storage
- No user database: the site is static (SSG), containing no user account database
Organizational measures
- Access to prospect data restricted to authorized property hunters
- Team awareness of personal data protection issues
- Data breach notification procedure in accordance with Articles 33 and 34 GDPR (CNIL notification within 72 hours, affected individuals notified if high risk)
10. Protection of Minors
The homeselect.paris website and Home Select services are intended exclusively for adults (18 years and older) in the context of property acquisition projects. We do not knowingly collect personal data from minors. If we discover that a minor has provided us with personal data, we will delete it promptly.
11. Changes to This Policy
This privacy policy may be updated to reflect changes in our practices or applicable regulations. Any substantial changes will be published on this page with the update date. We encourage you to regularly review this page.
In the event of a significant change affecting your rights, we will notify you via a banner on the site or by email if we have your address.
Last updated: March 2026