Privacy Policy
Preamble
As part of its activities, Les Résidences Yvelines Essonne collects and processes personal data about you, whether you are a tenant, a housing applicant, or a user of our website. Concerned about individuals’ rights and committed to transparency, Les Résidences Yvelines Essonne has implemented this policy to describe the processing activities, their purposes, and the means available for you to exercise your rights.
Article 1 — Purpose of the Privacy Policy
This policy complies with the GDPR (EU 2016/679) and the French Data Protection Act No. 78-17. It aims to provide concise, transparent, understandable, and easily accessible information about the data processing carried out by Les Résidences Yvelines Essonne.
Article 2 — Data Protection Officer
Data Protection Officer (DPO)
Les Résidences Yvelines Essonne
Direction de la conformité — Délégué à la protection des données (DPO)
18 Boulevard du Midi, 78200 Mantes-la-Jolie
Email: dpo@lesresidences.fr
The DPO advises, informs, and monitors compliance with personal data regulations.
Article 3 — Definitions
Personal Data: any information relating to an identified or identifiable natural person.
Data Controller: the legal entity that determines the purposes and means of processing (Les Résidences Yvelines Essonne).
Data Subjects: tenants, applicants, prospects, and website visitors.
Processor: a legal entity processing data on behalf of the controller.
Processing: any operation performed on data (collection, recording, consultation, use, modification, dissemination, storage, deletion, etc.).
Article 4 — General Principles
- Purpose Limitation: data is collected for specific and legitimate purposes.
- Lawfulness, Fairness, Transparency: individuals are informed, and a suitable legal basis is applied.
- Data Minimization: only the necessary data is collected.
- Accuracy: data must be accurate and kept up to date.
- Storage Limitation: data is retained only as long as necessary, then deleted or anonymized.
- Integrity and Confidentiality: appropriate security measures are applied.
Article 5 — Data Controller and Processor
As a Data Controller, Les Résidences Yvelines Essonne complies with the GDPR and the French Data Protection Act, implementing appropriate technical and organizational measures (Art. 32 GDPR). When acting as a Processor, it processes data according to the client’s written instructions (Art. 28 GDPR).
Article 6 — Processing of Your Personal Data
Purposes, Categories of Data, Legal Basis, and Retention Periods
Housing Allocation and Management
| Purpose | Data Categories | Legal Basis | Retention Period |
|---|---|---|---|
| Review of applications and property allocation | Identity, contact details, personal and professional life, income, supporting documents | Consent | Until request removal from the registration system (1 year) or until housing allocation |
| Management of disputes and pre-litigation | Identity, personal and professional life, contractual and financial data relevant to the dispute | Legitimate interest | Pre-litigation: until amicable settlement or 5 years (civil limitation). Litigation: until enforcement of a final judgment. |
| Regulatory and satisfaction surveys (SLS/OPS) | Data required for each survey | Legal obligation (SLS/OPS) — Legitimate interest (satisfaction) | SLS: 1 year, then archived for 4 years. OPS: 2 years, then archived for 2 years. Satisfaction surveys: anonymized after 2 months. |
| Lease management | Tenant file, banking information, contractual and accounting elements | Contract performance | Tenant file: 5 years after the end of the contract. Accounting documents: 10 years from their date of issue. |
Website & Tenant Portal
| Purpose | Data Collected | Legal Basis | Retention Period |
|---|---|---|---|
| Cookies | Connection and browsing data | Legitimate interest (necessary cookies) / Consent (optional cookies) | 13 months |
| Contact form | Identity, contact details, message content | Consent | Informational request: 1 year from last contact. Commercial request: 3 years. Client: 5 years after contract end. |
| Job applications | Identity, personal and professional life | Consent | Until recruitment closes, unless consent is withdrawn earlier. |
| Online account management (Tenant Portal) | Username, password, account data | Legitimate interest | Deactivation 3–6 months after tenant departure (extendable in case of disputes). |
General purposes by legal basis
- Contract: management of housing applications, lease drafting and annexes, invoicing, payment notices.
- Legal obligations: regulatory surveys, cooperation with administrative and judicial authorities.
- Legitimate interest: communication with processors, dispute management, surveys and organizational needs.
- Consent: communications, tailored offers, browsing analysis (non-essential cookies).
Processed personal data
Identity and contact information, documents and supporting evidence, banking, financial and economic data, family and professional situation, payment and balance information, tenant-portal credentials, cookies.
Fields marked with an asterisk in forms are mandatory. Without them, the requested service cannot be provided.
Retention periods
Durations depend on operational needs, contractual requirements, supervisory authorities’ recommendations, and legal obligations. After these periods, data is deleted or anonymized. Archiving may occur where necessary (legal obligations, fraud prevention, dispute management).
Article 7 — Sharing Your Personal Data with Third Parties
Data is shared only with authorized internal personnel and legally authorized third parties: local authorities, social security institutions, judicial/police authorities, bailiffs, etc.
External providers may handle, for example: hosting and maintenance of software and the tenant portal, payment services and banking partnerships, intercom management. Their GDPR compliance is verified. Only the information necessary to perform the service is provided.
Apart from our subsidiaries APILOGIS and LLI for homeownership services, no data is shared without your consent, except where required for contract performance or public-interest missions. We do not sell your data.
Article 8 — Your Rights Regarding Your Data
You have the following rights: access, rectification, erasure, restriction, objection, and portability.
Exercise your rights by contacting the DPO by mail (18 Boulevard du Midi, 78200 Mantes-la-Jolie) or by email: dpo@lesresidences.fr. Please include a signed copy of a valid ID and your reply address. You will receive a response within one month (extendable by two months in case of complex or multiple requests).
You may also define instructions regarding your data after death (Law No. 2016-1321 of October 7, 2016). For more information: www.cnil.fr. You may file a complaint with the CNIL, although we encourage you to contact us first.
