Privacy policy

The data controller is Kevin DUSAPIN EI (Cheezpa), 61 avenue Jean Jaurès, 69190 Saint-Fons, France (SIRET 849 138 151 00014). For any question or to exercise your rights, use the contact form.

No data protection officer (DPO) has been appointed.

Contact us · See also the legal notice

• Account: first name, e-mail address and password (stored in an irreversible encrypted form). In “My account” you can also provide your name, gender, postal address (street, postcode, city), age range, your newsletter choice and your investor profile. A referral code is generated for you, and your sponsor's code is recorded where applicable.
• Your content: the simulations, sale projects, borrowing capacity calculations, search sites and settings that you save in your account.
• Payments and subscriptions: payment is processed by Stripe. Rabbit-immo does not receive or keep your card number. We keep the order reference, the product, the amount, the date, your subscription and your Stripe customer identifier.
• Contact form: your message, its subject and your e-mail address. For visitors who are not logged in, the form is protected by Google reCAPTCHA.
• Audience measurement: Google Analytics on the one hand, and an in-house tool on the other that records events (page viewed, device type, approximate country, city and region deduced from the IP address, rounded coordinates, browser language and time zone, referring site, truncated IP address with the last octet masked for IPv4, and a random identifier stored in your browser). These events are linked to your account when you are logged in.
• Technical data: site activity logs (actions and errors, which may contain your name or identifier), log of e-mails sent (recipient, subject and content), password reset tokens, and the IP address processed by our servers and by the host.
• Ad analysis by artificial intelligence: if you use this feature, the text of the ad you submit is sent to OpenAI to extract the relevant information. An ad may contain a professional's name or contact details: do not submit unnecessary personal data.
• Cadastre module: no personal data about you is recorded. Your IP address is used temporarily to limit the number of municipalities loaded per hour, and the addresses you search for are forwarded by our servers to the Base Adresse Nationale. The sales displayed (DVF) are public DGFiP data, with no personal identity (see the legal notice).
• Urban planning and PLU module: no personal data about you is recorded. The address you enter in the search is forwarded by our servers to the Géoplateforme (IGN) geocoder. Base maps, zoning layers and parcels are loaded directly by your browser from the Géoplateforme (IGN) and, depending on the base map you choose, from OpenStreetMap, which then receive your IP address. Urban planning document and zoning lookups (API Carto / Géoportail de l'urbanisme) are made by our servers, without sending any personal data.

• Creating and managing your account, providing the simulators and saving your projects: performance of the contract (terms and conditions).
• Processing payments, managing subscriptions and credits, issuing and keeping invoices: performance of the contract and legal obligation (accounting).
• Answering your messages: legitimate interest and pre-contractual measures.
• Sending the newsletter: according to the choice you made in your account, which you can change at any time.
• Securing the site, preventing abuse and limiting quotas (visitors, Cadastre module): legitimate interest.
• Measuring audience to understand how the site is used and improve it (Google Analytics and in-house tool).
• Personalising the simulators using your investor profile. This personalisation involves no automated decision producing legal effects concerning you.

We do not sell your data and do not pass it on to third parties for commercial purposes. Technical providers nevertheless take part in running the site:

• OVH: site hosting and e-mail sending server.
• Stripe: online payment (name, first name, e-mail address, amount).
• Google: Analytics (audience measurement), reCAPTCHA (contact form), Google Fonts (fonts) and Gmail, where contact form messages are forwarded.
• OpenAI: ad analysis by artificial intelligence, only when you use this feature.
• ip-api.com: approximate location (country, city) deduced from the IP address for statistics; the full IP address is sent to it.
• SchoolMaker: training platform, which receives your e-mail address to create your access when you buy training content.
• OpenStreetMap, IGN (Géoplateforme), Base Adresse Nationale and geo.api.gouv.fr: base maps, routes, address and municipality search. Base maps and routes are loaded directly by your browser, which gives them your IP address.
• jsDelivr, unpkg, cdnjs and Font Awesome: display libraries used by the site. Their servers receive your IP address when your browser loads them.

Some of these providers (notably Google, Stripe and OpenAI) are located outside the European Union or may transfer data there. These transfers rely on the mechanisms provided for by the GDPR (adequacy decision, standard contractual clauses) that these providers state they apply.

The site uses cookies needed for it to work and audience measurement trackers.

The site also uses your browser's local storage: a random identifier for the in-house measurement tool (with no expiry date), your display preferences (accessibility, currency) and temporary simulation data, for example before logging in. Google reCAPTCHA may set its own cookies on the contact form.

You can delete or block cookies and clear local storage at any time from your browser settings. The site remains usable, but some preferences (language, currency) will not be remembered.

• Account and saved content: as long as your account exists, then until you ask for deletion.
• Orders and invoices: for the legal retention period of accounting records.
• Contact form messages: for as long as needed to handle your request and keep a record of it.
• Activity logs of informational type: 15 days. Other logs (errors, sensitive operations) and audience measurement events are kept for security, diagnosis and analysis; you can ask for them to be erased.
• Temporary data: approximate location deduced from the IP address, 24 hours; Cadastre module limit per IP address, 1 hour; cookies, as per the table above.

You have the right of access, rectification, erasure, restriction of processing, objection and portability of your data, as well as the right to withdraw your consent where processing is based on it.

You can edit most of your information yourself in “My account”, including your newsletter choice. For other requests, including deletion of your account and data, write to us through the contact form stating your account e-mail address. We may ask for proof of identity if in doubt. We reply within one month. Contact us

Erasure may be limited where the law requires certain data to be kept (for example invoices). If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the CNIL (cnil.fr).

The site is served over HTTPS, passwords are stored in an irreversible encrypted form and access to the administration is restricted and protected. As no system is completely infallible, we cannot however guarantee absolute security.

This section concerns the directory shown on the “Real estate professionals” and “Properties for sale” pages. It mainly covers businesses, but may concern natural persons (sole traders, commercial agents, etc.) whose public professional data then constitute personal data.

Purposes

• Informing users by means of a directory of professionals and useful resources.
• Checking the accessibility of links and the public administrative status of the listed professionals.
• Handling correction or removal requests.
• Managing relations with the listed professionals.
• Processing listing requests submitted by the professionals themselves.

Data processed

• Trade name, public professional contact details, website, municipality and area of operation, public administrative status (for example business active or ceased).
• Business identifier (SIREN / SIRET) where one exists: it is used for checks and to avoid duplicates, and it is not displayed publicly.
• We do not collect the identity of company officers, nor data that is masked or only partially disclosed in public registers.

Sources

Professionals’ official websites, professional directories, public registers (including the public “Recherche d’entreprises” API), open datasets, the OpenStreetMap database (© OpenStreetMap contributors, ODbL licence: business name, website, town and activity only, never a phone number, e-mail address or person’s name), the Overture Maps Foundation “Places” dataset (CDLA-Permissive-2.0, Apache-2.0 or CC0 licence depending on the provider; same data only) and information that professionals send us.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR): informing users by means of a reliable, checked directory. You have a right to object: if you object, the entry is removed (see “Your rights and how to exercise them” below).

Recipients

The Rabbit-immo team and the technical providers needed to run the site, in particular the host (see section 4). The public data of an entry is visible to any visitor of the site.

Transfers outside the European Union

No transfer outside the European Union is specifically planned for this processing, unless otherwise stated in the Hosting section of the legal notice and in section 4 of this policy.

Retention periods

• Check history: 24 months.
• Reports: 12 months after they are handled.
• Removed entry: permanently deleted 3 months after removal; until then it is no longer displayed but can be restored (for example if it was removed by mistake).
• Raw import data: 12 months.
• Internal prospecting notes: 3 years.
• Exclusion list (trade name, origin of the exclusion and non-reversible fingerprints): 3 years from the exclusion.
• Listing requests: deleted 72 hours after submission if the email address is not confirmed; otherwise, the email address is erased as soon as the decision is sent and the request is deleted 12 months after the decision.

Your rights and how to exercise them

You can exercise your rights of access, rectification, objection, erasure and restriction of processing, and request the correction or removal of your entry, using the correction or removal form, or the contact form. We reply within one month.

Request a correction or removal of your entry · Contact us

Exclusion list

Any person or business whose entry is removed, at their request or by internal decision, is added to an exclusion list to ensure that they are no longer listed (neither imported nor published again). This list keeps non-reversible fingerprints (computed from the website domain, the business identifier or the name and municipality), the trade name of the excluded entity and the origin of the exclusion (request from the person or internal decision). No contact details are kept in it. This data is kept for 3 years from the exclusion.

Websites that stay unreachable

Links are checked automatically. When a professional's website stays unreachable for more than 30 days (at least three consecutive failures: network error, page or domain not found; a website that only refuses robots is not concerned), its entry is removed from the directory without being deleted or added to the exclusion list: it can be restored until its permanent deletion (3 months after removal), in particular if the website responds again. Its place may then be given automatically to another professional of the same activity and territory, chosen among businesses already listed in our sources but not yet published, whose website has just been checked as reachable, through a neutral and reproducible draw. Each such removal and publication is logged and shown to our team, which can reverse it.

Public listing and commercial prospecting

Displaying an entry in the public directory is separate from any commercial prospecting. Any prospecting of a professional is a separate processing operation, subject to its own rules, in particular the right to object to it at any time.

Correction or removal form

The form collects the type of request, your capacity, your name (optional), your email address and your message. Your IP address is kept only as a non-reversible fingerprint, used to limit abuse. For visitors who are not logged in, the form is protected by Google reCAPTCHA (see section 4). This data is kept for 12 months after the request is handled.

Listing request by a professional

A professional can request a listing for their business themselves ("Are you a professional?" link under each category). The form collects the trade name, the legal form of the business, the category and specialties, the territories and municipality where it is established, the website, an optional short description, an optional SIRET or SIREN number (never displayed) and an email address. Legal basis: the consent of the professional (Article 6(1)(a) GDPR), which can be withdrawn at any time (the listing is then removed). The email address is only used to confirm the request (link valid for 72 hours) and to give notice of the decision; it is never published and it is erased as soon as the decision is sent. The IP address is only kept as a non-reversible fingerprint, to limit abuse; for visitors who are not logged in, the form is protected by Google reCAPTCHA (see section 4). The name of a sole proprietorship, which may identify a person, is only published with the explicit consent of the professional and after review. An accepted request gives no display priority: the number of professionals displayed per row remains limited to 7 and the listing is displayed when a place becomes available.

We may update this policy, for example when new features appear. The date of the last update is shown at the top of the page.