Privacy policy and our approach to data security

Last updated : 08/09/2026

This privacy policy sets out how the personal data of users of the website is collected, used, retained and protected, in accordance with the General Data Protection Regulation (GDPR) and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties.

1. Data controller

The data controller is:

David Dakak, sole trader (entrepreneur individuel)
Trading name: CONQUEROR
Registered with the Reims Trade and Companies Register under number 917 557 241
SIRET: 917 557 241 00051
NAF/APE code: 6312Z
Email: contact@colocationsparis.com

The website is not required to appoint a data protection officer. Any question relating to the processing of personal data may be sent to the address above.

2. Important information regarding cohabitation-related details

The information requested on this website is intended solely to facilitate contact between users seeking or offering shared accommodation, and to improve compatibility in shared living arrangements.

It serves to describe the organisation of the accommodation, the living environment and cohabitation preferences, in the context of shared accommodation involving a common daily life.

This information is optional. Every user remains free to leave each of these fields blank, a neutral value being offered in each case.

It does not in any way constitute a criterion of exclusion, selection or refusal of access to accommodation. Every user remains free to publish a listing and to contact, or not to contact, another user, in compliance with the non-discrimination rules laid down by law and set out in Article 17 of the Terms of Use.

The platform acts exclusively as a technical intermediary putting users in contact with one another and does not take part in private exchanges between users.

3. Data collected, purposes and legal bases

3.1 Account creation and management

Data: name, email address, telephone number, password.

Purpose: identification of the user, account management, access to the features of the website.

Legal basis: performance of the contract formed by acceptance of the Terms of Use.

3.2 Publication of listings

Data: content of the listing, photographs, location of the accommodation, optional cohabitation-related details.

Purpose: publication of the listing on the platform in French and in English, and putting users in contact with one another.

Legal basis: performance of the contract.

3.3 Internal messaging

Data: content of messages exchanged between users, time stamp.

Purpose: enabling communication between members and, where applicable, the handling of a report.

Legal basis: performance of the contract.

3.4 Promotion of listings on the website’s channels

Data: text and photographs of the listing, excluding any personal contact details.

Purpose: increasing the visibility of the listing by publishing it on the website’s Facebook page and group, its YouTube channel, its other social media, as well as on third-party groups, pages or platforms dedicated to housing.

Legal basis: licence to publish granted by the advertiser under Article 6 of the Terms of Use, as part of the performance of the contract. The advertiser’s personal contact details (email, telephone) are never published on these channels: interested persons are directed to the listing on the website. The advertiser may at any time request the withdrawal of such publications by writing to contact@colocationsparis.com; withdrawal is carried out within 48 hours.

3.5 Fraud prevention and moderation

Data: IP address recorded upon registration, upon acceptance of the Terms of Use and upon submission of a listing; telephone number and email address; listing submission history; reports received; technical data collected by the reCAPTCHA service when forms are submitted.

Purposes: prior review of listings, action against fake listings and attempted fraud, handling of reports, protection of forms against automated submissions and protection of the website against attacks.

To these ends, the platform carries out the following processing operations:

cross-referencing of accounts sharing an identical IP address, telephone number or email domain, in order to detect the creation of multiple accounts by the same person;
detection of listings with near-identical content submitted from different accounts;
maintenance of a list of email addresses, telephone numbers and IP addresses blocked following established instances of fraud, and recording of the corresponding registration attempts;
retention of evidence of acceptance of the Terms of Use at the time of registration and of listing submission.

These operations do not result in any automated decision: they flag matches which the data controller reviews personally before any measure is taken.

Legal basis: the legitimate interest of the data controller in ensuring the security of the service and protecting its users against housing fraud. As regards the retention of evidence of acceptance of the terms, performance of the contract.

3.6 Audience measurement and cookies

Data: cookie identifiers, IP address, pages viewed, browsing data.

Purpose: audience measurement and analysis of the use of the website, under the conditions set out in Article 6.

Legal basis: the user’s consent, obtained through the cookie management module.

3.7 Paid services and invoicing

Data: identity of the purchaser, nature and price of the service purchased, date of the transaction.

Purpose: performance of the paid promotion services provided for in Article 5 of the Terms of Use, and the preparation and retention of accounting records.

Legal basis: performance of the contract for the supply of the service, and legal obligation as regards the retention of accounting records.

Bank details are at no time collected, stored or accessible by the platform, under the conditions set out in Article 7.

4. Retention periods

User account: 3 years from the last login.
Listing: 12 months from its expiry, so that it may be republished.
Internal messages: 24 months from the date they are sent.
Accounting records and invoicing data: 10 years, in accordance with applicable accounting obligations.
IP addresses (registration, acceptance of the terms, listing submission): 12 months, after which they are automatically erased by a daily task.
Evidence of acceptance of the Terms of Use (excluding the IP address): for the lifetime of the account.
Reports and moderation data: 12 months from the handling of the report, or until the end of proceedings in the event of a dispute.
Identifiers on the block list and the log of the associated attempts: retained for as long as the blocking measure is necessary to protect the service.
Cookies: for the periods indicated in Article 6, and a maximum of 13 months for consent itself.

The erasure of IP addresses is automated. For the other categories, the deletion of data that has reached the end of its retention period is subject to a periodic review, carried out at least once a year.

Data may be retained beyond these periods where such retention is necessary for the establishment, exercise or defence of legal claims, and only for as long as is necessary for that purpose.

5. Recipients of the data and transfers outside the European Union

Personal data is neither sold, assigned nor rented to third parties. It is accessible to the data controller and to the following technical providers, acting as processors or joint controllers:

Hostinger International Ltd (Cyprus, European Union): hosting of the website and storage of the data.
Cloudflare, Inc.: delivery of the website, protection against attacks and filtering of automated access. This service processes visitors’ IP addresses and involves a transfer of data to the United States.
Google Ireland Limited and Google LLC: reCAPTCHA service, used to verify that a form is completed by a person and not by an automated program. This processing involves a transfer of data to the United States.
Google Ireland Limited and Google LLC: audience measurement through Google Analytics 4, subject to the user’s consent. This processing involves a transfer of data to the United States.
Cybot A/S (Cookiebot by Usercentrics): management of cookie consent and retention of evidence of that consent.
Payment providers (notably PayPal): processing of payments relating to paid services.
Meta Platforms and Google (YouTube): promotional publication of listings on the website’s communication channels, under the conditions set out in Article 3.4. This processing involves a transfer of data to the United States.
Meta Platforms: authentication through a Facebook account, where the user chooses that option, under the conditions set out in Article 10.

The transfers to the United States referred to above are governed by the mechanisms provided for in Chapter V of the GDPR, and in particular by the EU–US Data Privacy Framework for certified organisations, or by the European Commission’s standard contractual clauses.

Data may also be disclosed to the competent administrative or judicial authorities where required by law.

6. Cookies

6.1 Consent management

The website uses the Cookiebot consent management solution. Cookies that are not strictly necessary are placed only after the user’s express consent, given by category.

Refusing is as simple as accepting: non-necessary categories are disabled by default, and the banner offers, at the same level, the options of refusing, accepting selectively and accepting all.

Users may review and change their choice at any time by clicking the cookie management icon shown at the bottom left of every page of the website. Consent may therefore be withdrawn as easily as it is given, in accordance with Article 7.3 of the GDPR.

6.2 Cookie categories

Necessary cookies. These enable the website to function, navigation between pages, access to secure areas, the protection of forms and the retention of the choice expressed regarding cookies. They do not require consent:

cf_clearance (Cloudflare): confirms that a security check has been successfully passed and avoids repeating it on every page. Duration: 1 year.
PHPSESSID: identifies the browsing session. Duration: the length of the session.
CookieConsent (Cookiebot): stores the choice expressed regarding cookies and retains evidence of it.
client_utc_time: records the visitor’s time difference so that dates and times are displayed correctly. Duration: the length of the session.
rl_lang_front: stores the display language, which is required for the bilingual operation of the website. Duration: 11 days.
rc::a and rc::c (Google reCAPTCHA): distinguish a human visitor from an automated program when the registration, contact, advertiser contact and listing recommendation forms are submitted.

Preference cookies. These store display choices that improve browsing comfort without being essential. They require the user’s consent:

viewedNews: stores the news items already viewed so that they are not shown again. Duration: 364 days.
mf_usernavbar_popup_showed: records that a location selector has already been displayed on locality pages. Duration: 30 days.

Statistics cookies. These make it possible to measure the website’s audience and to understand how visitors use it. They are not anonymous: they rely on an identifier making it possible to recognise a visitor from one visit to the next. They require the user’s consent:

_ga (Google Analytics 4): transmission to Google of data relating to the visitor’s device and behaviour. Duration: 2 years.
_ga_# (Google Analytics 4): same purpose, for the website’s measurement property. Duration: 2 years.

Advertising cookies. The website uses no advertising or targeting cookies.

Cookies subject to consent are placed only after the corresponding category has been accepted. The complete and up-to-date list of the cookies actually placed, together with their provider, purpose and duration, is accessible at any time from the cookie management module, under the « Details » tab.

7. Payments

Where a payment is made on the website, bank details are processed exclusively by secure third-party payment providers.

The platform at no time stores bank details and never has access to them. Only the data necessary for invoicing, listed in Article 3.7, is retained by the data controller.

8. Geolocation

While browsing the website, the IP address may be used to estimate the user’s approximate location. This information makes it possible, in particular, to display nearby listings, to use maps and to personalise certain searches.

No precise real-time geolocation is carried out without the user’s express agreement.

9. Service-related notifications

Use of the website entails receiving notifications necessary for the operation of the service, such as listing confirmations, account-related messages and expiry reminders.

These notifications form part of the performance of the contract and do not constitute marketing. They are sent by email and cannot be disabled individually. It is possible to stop receiving them by deleting one’s account from the personal area.

10. Logging in via Facebook

Users may choose to log in using their Facebook account. In that case, certain information is transmitted by Meta Platforms, in particular the name and the email address.

This data is used solely to create or connect the user account and to facilitate authentication. No data is published on Facebook without the user’s consent.

This processing is based on the user’s consent, the user being free to choose this method of logging in; registration by email address remains available.

11. Data security

All reasonable technical and organisational measures are implemented in order to protect personal data against any unauthorised access, loss, alteration or disclosure, in particular the encryption of communications, the restriction of administrative access and hosting with a professional provider.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of the data subjects, the data controller carries out the notifications provided for in Articles 33 and 34 of the GDPR.

12. Users’ rights

In accordance with the GDPR, every user has the following rights:

the right of access to their data;
the right to rectification;
the right to erasure;
the right to restriction of processing;
the right to object;
the right to data portability;
the right to withdraw consent at any time, where the processing is based on consent;
the right not to be subject to a decision based solely on automated processing.

These rights may be exercised through the website’s contact form or at contact@colocationsparis.com. A response is provided within one month of receipt of the request, which may be extended by two months in the case of a complex request. Proof of identity may be requested where there is reasonable doubt as to the identity of the person making the request.

A user who considers, after having contacted the data controller, that their rights have not been respected may lodge a complaint with the French data protection authority:

CNIL
3 place de Fontenoy
TSA 80715
75334 Paris Cedex 07
www.cnil.fr

13. Deletion of data

Users may request the deletion of their personal data at any time, either by deleting their account from their personal area, or by sending a request to contact@colocationsparis.com.

Deletion of the account entails the deletion of the associated listings and the withdrawal of their promotional publications. Data whose retention is required by law, in particular accounting records, is retained for the applicable statutory period.

14. Changes to this policy

This privacy policy may be amended in order to remain compliant with applicable legislation or to reflect a change in the service. The applicable version is the one published on the website at the time of consultation, the date of the last update appearing at the top of this document.

In the event of a substantial change to the purposes of the processing, registered users are informed by email.