Privacy Policy

1. Data Controller

The data controller is:

• HOME SELECT - VOTRE CHASSEUR IMMOBILIER
• SAS (Simplified Joint-Stock Company) with a share capital of 1 000,00 €
• 60 rue François 1er, 75008 Paris, France
• SIRET: 531 223 931 00068 / Trade Register (RCS): Paris 531 223 931
• Email: contact@homeselect.paris
• Phone: 01 78 76 78 10
• Legal representative: Caroline Mascla, President
• Professional license: CPI 7501 2018 000 028 939, issued by the CCI Paris Île-de-France

Home Select has not appointed a Data Protection Officer (DPO) as defined by Article 37 of the GDPR (the company does not process data on a large scale under Article 37-1). For any questions regarding your personal data, contact the data controller directly at contact@homeselect.paris.

2. Data Collected

We only collect data necessary for the purposes described below, in accordance with the data minimization principle (Article 5-1-c GDPR).

2.1 Via contact forms and appointment scheduling

• First and last name
• Email address
• Phone number
• Property project type (purchase, rental, sale)
• Preferred arrondissements or municipalities
• Approximate budget
• Desired surface area and number of rooms
• Availability and appointment slots
• Timezone (for expatriate clients)
• Free-form message

This data is transmitted securely (HTTPS) to our internal sales follow-up tool (a CRM application hosted at hub.homeselect.paris) and emailed to our hunters in order to handle your request. It is not resold.

2.2 Via site navigation (with your consent)

• IP address (used by Google Analytics 4 to derive an approximate location; GA4 does not log the full IP address)
• Pages visited and navigation paths
• Visit duration and bounce rate
• Traffic source (search engine, direct link, social network)
• Browser type, operating system, and screen resolution
• Approximate geographic location (city level, no precise address)

This data is collected only if you have accepted analytics cookies via the consent banner.

2.3 Via the referral form (someone else's data)

The form on our referral page lets a client recommend someone they know. We collect, about the referrer: first and last name, email and phone number. About the person referred: first and last name, email and, where the referrer provides it, phone number.

The referred person's data therefore does not come from them, but from the referrer, who confirms in the form that they informed them beforehand. In accordance with Article 14 GDPR, we inform that person of the processing as soon as we first contact them, stating the source of their data (the referrer, by name), the purpose (to contact them about a property project), the legal basis (our legitimate interest in following up a recommendation) and their rights, including the right to object at any time. Their details are stored in our CRM application (hub.homeselect.paris) and emailed to our hunters. They are erased without delay if the person objects and, failing any follow-up, within the prospect retention period set out in point 4.

2.4 Data we do not collect

Home Select never collects: banking details, social security numbers, health data, political opinions, religious beliefs, ethnic origins, sexual orientation, or biometric data. We do not carry out any automated profiling within the meaning of Article 22 GDPR.

3. Processing Purposes and Legal Basis

Each data processing activity relies on an identified legal basis under Article 6 GDPR:

4. Retention Period

In accordance with the storage limitation principle (Article 5-1-e GDPR), your data is retained for the following periods:

After these periods, data is deleted or irreversibly anonymised.

5. Data Recipients and Processors

Your data may be shared with the following categories of recipients, in strict compliance with our contractual obligations and the GDPR:

5.1 Processors hosting data in France / EU

5.2 Processors with regulated EU transfer

5.3 Other recipients

• Home Select property hunters: our 16 hunters, as commercial agents, access prospect contact data in the context of their search mandate
• Competent authorities: in case of legal obligation (tax authorities, Tracfin, judicial authorities)

Your data is never sold, rented, or exchanged with third parties for commercial or advertising purposes.

6. Transfers Outside the EU

Some of our technical processors are located in the United States. These transfers are governed by the following mechanisms, in accordance with Chapter V of the GDPR:

• EU-U.S. Data Privacy Framework (DPF): Vercel, Google, and Microsoft are certified under the DPF (European Commission adequacy decision of July 10, 2023)
• Standard Contractual Clauses (SCCs): standard contractual clauses adopted by the European Commission (Implementing Decision 2021/914 of June 4, 2021) are incorporated into our processing agreements, in addition to the DPF for Vercel, Google and Microsoft, and as the primary safeguard for Supabase and ClickGuard (which are not DPF-certified)

Processors without EU transfer: OVH SAS (France) and Brevo / Sendinblue SA (France) host data within the European Union. No transfer outside the EU occurs for these providers.

7. Your Rights

Under Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): obtain confirmation of whether your data is being processed and receive a copy, together with the information specified in Article 15-1 (purposes, categories, recipients, retention periods)
• Right to rectification (Art. 16 GDPR): correct inaccurate data or complete incomplete data
• Right to erasure (Art. 17 GDPR): request deletion of your data when processing is no longer necessary, you withdraw consent, or you exercise your right to object
• Right to restriction (Art. 18 GDPR): obtain restriction of processing while data accuracy is being verified or in case of objection
• Right to portability (Art. 20 GDPR): receive your data in a structured, commonly used, machine-readable format (CSV, JSON), and transmit it to another data controller
• Right to object (Art. 21 GDPR): object at any time to processing based on legitimate interest, for reasons relating to your particular situation
• Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7-3 GDPR)

How to exercise your rights

Send your request by email to contact@homeselect.paris or by registered mail to:

Home Select, Data Protection
60 rue François 1er, 75008 Paris, France

We may ask you to verify your identity (copy of ID document) in accordance with Article 12-6 GDPR. We will respond within one month of receiving the request. This period may be extended by two additional months in case of complexity or high number of requests (Article 12-3 GDPR), in which case you will be informed.

Complaint to the CNIL

If you believe your data processing is not GDPR-compliant, you may file a complaint with the French Data Protection Authority (CNIL):

• Address: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
• Online: www.cnil.fr/fr/plaintes
• Phone: +33 1 53 73 22 22

8. Cookies and Trackers

In accordance with Article 82 of the French Data Protection Act and CNIL guidelines of September 17, 2020, homeselect.paris uses cookies subject to your prior consent.

Principle

No analytics or advertising cookies are set before you have expressed your choice via the consent banner, with the exception of the legitimate-interest trackers described below. Your choice is stored for 13 months. You can change or withdraw your preferences at any time via the "Cookies" button in the footer.

Technical cookies (consent exempt)

• hs-cookie-consent / hs-consent (1st party): store your consent choice (localStorage and cookie, 13 months). Exempt under Article 82(2) (strictly necessary for the requested service).

Analytics cookies (consent required)

Google Analytics 4 (Google LLC, Mountain View, CA, USA)

• _ga: anonymous user identifier (duration: 2 years)
• _ga_*: session state persistence (duration: 2 years)
• Purpose: audience measurement (visitors, page views, traffic sources). GA4 does not log the full IP address.
• Google Privacy Policy: policies.google.com/privacy
• Opt-out: Google Analytics browser opt-out add-on

Advertising cookies (consent required)

Set only if you accept the "Advertising" category of the consent banner, mainly on our campaign pages (landing pages):

• Google Ads (Google LLC): _gcl_* / _gac_*, conversion measurement and remarketing (up to 90 days)
• Meta Pixel (Meta Platforms Ireland): _fbp / _fbc, conversion measurement and Facebook / Instagram advertising audiences (up to 90 days)
• Microsoft Advertising / Bing UET (Microsoft Corp.): MUID, _uet*, Bing conversion measurement (up to 13 months)

Trackers loaded for all visitors (legitimate interest)

Two trackers load regardless of your consent choice, because they serve website improvement and fraud prevention, not advertising targeting. You may object at any time for reasons relating to your particular situation (Article 21 GDPR, see Section 7: Your Rights).

Microsoft Clarity (Microsoft Corporation, Redmond, WA, USA)

• _clck: user identifier (duration: 1 year)
• _clsk: session identifier (duration: 1 day)
• Purpose: behavioural analytics (heatmaps, scroll maps, anonymised session recordings) serving website improvement
• Microsoft Privacy Policy: privacy.microsoft.com

ClickGuard (United States)

• Technical identifier for advertising click-fraud detection (pulse.clickguard.com script)
• Purpose: protecting our advertising campaigns against fraudulent and automated clicks

9. Data Security

In accordance with Article 32 GDPR, Home Select implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk:

Technical measures

• Encryption in transit: HTTPS protocol (TLS 1.3) across the entire site, SSL certificate issued and managed by Vercel
• Secure hosting: Vercel infrastructure SOC 2 Type II certified, with 24/7 monitoring and multi-region redundancy
• Secure emails: OVH SMTP server with SPF, DKIM, and DMARC authentication
• Forms: transmission via HTTPS webhooks, no server-side database storage
• Website and client area kept separate: the homeselect.paris website is static and contains no account database. Accounts and case data live exclusively in the hub.homeselect.paris client area, on a database hosted in the European Union, with per-user isolation enforced at database level.

Organizational measures

• Access to prospect data restricted to authorized property hunters
• Team awareness of personal data protection issues
• Data breach notification procedure in accordance with Articles 33 and 34 GDPR (CNIL notification within 72 hours, affected individuals notified if high risk)

These measures, how to verify them from the outside and our anti wire-fraud rules are set out in full on the Data security and protection page.

10. Protection of Minors

The homeselect.paris website and Home Select services are intended exclusively for adults (18 years and older) in the context of property acquisition projects. We do not knowingly collect personal data from minors. If we discover that a minor has provided us with personal data, we will delete it promptly.

11. Changes to This Policy

This privacy policy may be updated to reflect changes in our practices or applicable regulations. Any substantial changes will be published on this page with the update date. We encourage you to regularly review this page.

In the event of a significant change affecting your rights, we will notify you via a banner on the site or by email if we have your address.

12. Data Collection via Social Media Advertising

As part of our advertising campaigns on social media platforms (including Meta/Facebook and Instagram), we collect personal data through lead forms integrated into these advertising platforms.

12.1 Data Collected

• Full name
• Email address
• Phone number
• Investment budget ($1M+)
• Preferred neighborhoods in Paris

12.2 Purpose

This data is collected to assist you in your real estate search and provide personalized investment consulting for property acquisitions in Paris.

12.3 Retention Period

Data collected through advertising campaigns is retained for a maximum of 3 years from the date of collection, in accordance with CNIL recommendations.

12.4 Partners and Processors

Data is processed by Meta (Facebook/Instagram) as a joint controller for advertising delivery. These transfers are carried out in compliance with the EU-U.S. Data Privacy Framework (DPF), ensuring an adequate level of protection for your personal data.

12.5 Exercising Your Rights

You may request access to, rectification of, or deletion of your data collected through our advertising campaigns at any time by contacting us at: contact@homeselect.paris.

13. The Home Select Mobile App

Home Select publishes a mobile app, available on the App Store and Google Play, which gives you access to your client area. That same area is accessible from a browser, at hub.homeselect.paris. This section supplements the previous ones: the principles, your rights (section 7) and the retention periods (section 4) apply in the same way.

13.1 How an Account Is Created

There is no public sign-up. Your account is created by your property hunter, in your name, when we start working together. You log in with a one-time code sent to your email address, or with a password.

13.2 Data Processed in the App

• Your identity and contact details: title, last name, first name, email address, phone number, country of residence.
• Your project: budget, arrondissements and areas searched, floor area, number of rooms, specific criteria, financing method.
• What you write: your messages with your property hunter, including voice messages, your questions about a property, and your personal notes. Your personal notes are private: your property hunter has no access to them.
• Your reactions to the properties presented: the ones you keep, the ones you rule out, the ratings you give them.
• The files you upload: proof of identity, proof of financing, any document relevant to your file, as well as photos and attachments in a conversation. A single file may not exceed 25 MB.
• Your financing assumptions, if you use the Finances area: down payment, interest rate, term, household income, existing loans. These are used solely to display your own simulations, on your own screens. They are not shown to any of our property hunters.
• A technical notification identifier, if you agree to be notified. It designates your device and not your person, and tells us nothing about you.
• How you use the app: pages opened, clicks, time spent, errors encountered.

13.3 Permissions Requested by the App

No permission is mandatory. Each one is requested at the moment it is needed, and you can withdraw it at any time in your phone settings.

• Notifications: to let you know that a property has been presented to you, or that your property hunter has replied.
• Camera and photo library: to attach a photo or a document to your file or to a conversation.
• Microphone: to record a voice message in a conversation.

The app never requests access to your location, your contacts, your calendar or your health data.

13.4 What the App Does Not Do

It contains no advertising and no in-app purchases. It sets no advertising tracker and does not follow you from one app or site to another: we carry out no tracking within the meaning of Apple's App Tracking Transparency framework, and the app will therefore never ask you for that permission. Your data is neither sold nor rented.

13.5 Usage Measurement in the App

To understand where the journey gets stuck and to fix it, we record a usage log of the client area: page opened, click, time spent, error encountered. This log is attached to your account, it is retained for thirteen months at most, and it rests on our legitimate interest in improving the service (Article 6-1-f GDPR). You may object to it at any time by writing to contact@homeselect.paris.

13.6 Where Your Data Is Hosted

Client area data, including the documents you upload, is stored in our Supabase database, on servers located in the European Union. Exchanges are encrypted in transit (HTTPS/TLS). Your documents are held in private storage, accessible only through a temporary signed link valid for ten minutes. The database applies per-user isolation: one account cannot technically read another account's file.

13.7 Retention Periods Specific to the App

• Content of your file (messages, notes, reactions, documents): the duration of the mandate, then five years, like other client data (section 4).
• Documents you upload: you can delete them yourself at any time from the app. Otherwise, they follow the period above.
• Notification identifier: until you disable notifications or uninstall the app. An identifier that becomes invalid is deleted automatically.
• Usage log: thirteen months at most.

13.8 Deleting Your Account and Your Data

Write to contact@homeselect.paris. We have a dedicated tool that deletes your file, your exchanges, your notes, your documents, your notification identifiers and your contact record at our email providers. Only the records the law requires us to keep are retained, in particular the register of mandates required by the Hoguet Act and contractual documents (section 4). You receive written confirmation once the erasure has been carried out.