Privacy policy

Last updated: 29 October 2026.

The purpose of this privacy policy is to inform you of how Appart-One collects, uses and protects your personal data when you use the https://www.appart-one.com website, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

1. Data controller

The controller responsible for processing personal data is Zenao Appartements (SAS, a French simplified joint-stock company with a share capital of 10 000 €, RCS Paris 814 499 331, registered office: 231 rue Saint-Honoré, 75001 Paris), the company that operates the Appart-One brand, represented by its president, the company OBEO Asset Management.

For any question relating to your personal data, or to exercise your rights (section 9), write to communication@appart-one.com.

2. What we process, why, and for how long

Each processing operation is set out below with the data concerned, its purpose, its legal basis (Article 6 of the GDPR) and its retention period. We only collect what each of them needs.

Requests sent through a form

Contact, long-stay, seminar and business travel forms.

• Data: what you type in (surname, first name, email, phone number, desired residence and dates, number of guests, company, job title and address for professional enquiries, your message, how you heard about us…), together with the page you are writing from and the language of the site. Fields marked with an asterisk (*) are needed for us to reply; the others are optional.
• Purpose: to answer your request, send you an offer or a quote, and prepare or follow up your stay.
• Legal basis: steps taken at your request prior to entering into a contract, or the performance of your booking (Article 6(1)(b)). For a request unrelated to a stay (partnership, general question), our legitimate interest in replying to you (Article 6(1)(f)).
• Retention: three years from the date the request is sent. Deletion is automatic: a daily check erases requests older than three years. The notification emails received by our teams are a copy of the request: how long they are kept depends on the mailbox rules applied by our teams. If your request leads to a contract, the relevant data is kept for the duration of the contract and then for the related legal obligations (accounting in particular).

Site security and abuse prevention

• Data: the IP address a form is sent from, stored together with the request; a counter of the number of requests (form submission, message to the assistant, rate search on the Book page) tied to your IP address, which holds none of your messages.
• Purpose: to filter out automated submissions and abuse, and to keep proof of a submission should a dispute arise. The IP address is used neither for prospecting nor for audience measurement.
• Legal basis: our legitimate interest in securing the site (Article 6(1)(f)).
• Retention: the IP address follows the retention of the request (three years); the counter clears itself after ten minutes.

Country requests are sent from

• Data: the country the request is sent from, as a two-letter code that our host infers from the connection. We do not ask you for it, and it cannot be used to locate you.
• Purpose: to know which regions our residences actually reach, and nothing else.
• Legal basis: our legitimate interest in knowing where our guests come from (Article 6(1)(f)).
• Retention: that of the request it belongs to (three years).

Newsletter "Élise's good deals"

• Data: your email address and the language of the site; as with any request, the sign-up date, IP address and country are recorded.
• Purpose: to send you our offers and stay ideas, once a month at most.
• Legal basis: your consent (Article 6(1)(a)), given when you sign up. You can withdraw it at any time, without giving a reason: through the unsubscribe link included in every email, or by writing to communication@appart-one.com.
• Retention: your address stays on the mailing list until you unsubscribe. The record of your sign-up is kept for three years, as proof of your consent, and then deleted automatically.

Chat assistant

• Data: the text you type in the chat window, and nothing else; an anti-abuse counter tied to your IP address.
• Purpose: to answer your questions and point you to the right person.
• Legal basis: our legitimate interest in giving you quick information (Article 6(1)(f)).
• Retention: conversations are not kept; the counter clears itself after ten minutes. Details are in section 6.

Audience measurement

• Data: technical information read in your browser (page viewed, referring page, loading time, device type), with no cookie and no persistent identifier.
• Purpose: to produce aggregated visitor statistics, for our sole use.
• Legal basis: our legitimate interest in knowing how the site is used (Article 6(1)(f)); reading information in your browser is exempt from consent under Article 82 of the French Data Protection Act (section 7).
• Retention: only aggregated statistics, which cannot identify you, are made available to us.

Location maps

• Data: your IP address, which your browser sends to OpenFreeMap (tiles.openfreemap.org, OpenStreetMap data) when a map is displayed: this is technically unavoidable in order to receive the map tiles.
• Purpose: to show you where the residences are.
• Legal basis: our legitimate interest in presenting our addresses (Article 6(1)(f)).
• Retention: we receive and keep nothing from this exchange. The map display library itself is served from our own servers: no other third-party service is involved.

Online booking

To display rates and availability, the site queries the MisterBooking booking engine (Septeo Hospitality), sending it only the dates and number of guests you choose: no personal data. Booking and payment then take place on the MisterBooking engine (secure-direct-hotel-booking.com): the data you enter there is processed under that provider's responsibility and in accordance with its own privacy policy.

3. Optional health-related information: reduced-mobility access

The long-stay form offers a "Reduced-mobility access" box. Ticking it may reveal a health-related need, which is sensitive data (Article 9 of the GDPR). This box is therefore optional: you provide this information on your own initiative, and your request is handled in the same way without it.

By ticking it, you expressly agree that this information may be used for one purpose only: allocating you suitable accommodation (Article 9(2)(a) of the GDPR). It is used for nothing else, it is kept with your request (three years), and you can withdraw your agreement and ask us to delete it at any time by writing to communication@appart-one.com. There is no need to give any medical detail in the free-text fields: the box is enough.

4. Recipients and processors

Your requests are read by Appart-One's authorised staff: they arrive in our general inbox, with a copy to the residence concerned; newsletter sign-ups are notified to our communications team. Your data is never sold or transferred to third parties for commercial or advertising purposes.

We use the following service providers, which process data on our behalf and on our instructions (processors):

• Cloudflare, Inc. (United States): hosting and delivery of the site, the requests database (Western Europe region), the anti-abuse counter, the chat assistant (Cloudflare Workers AI, Llama 3.3 language model) and audience measurement (Cloudflare Web Analytics).
• Brevo (a French company): delivery of the notification emails for your requests and management of the newsletter mailing list.
• Microsoft (Microsoft 365): our teams' email, where the notifications of your requests arrive.
• Ts8r Studio: the technical provider that designs and maintains the site on our behalf.

Two third-party services operate outside this relationship: OpenFreeMap, which your browser contacts directly to display the maps, and MisterBooking (Septeo Hospitality), on whose site booking and payment take place (section 2).

5. Transfers outside the European Union

The requests database is hosted in Western Europe. Cloudflare and Microsoft are, however, American companies whose services may involve processing of, or access to, data from the United States. These transfers are governed by the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to which these companies state that they adhere, and, where applicable, by the standard contractual clauses adopted by the European Commission (Article 46 of the GDPR).

6. The chat assistant

A chat assistant, Charlotte, answers your questions about the aparthotels directly in a chat window. Here is exactly what happens when you use it.

This assistant is a program, not a person. You are talking to an artificial intelligence, never to a member of our team, and none of its answers commits our teams the way an adviser would. This is shown in the chat window itself, before your first message and then below the input field, in accordance with Article 50 of the European Artificial Intelligence Act (Regulation (EU) 2024/1689), applicable since 2 August 2026. For any question that matters (a rate, availability, an ongoing booking), contact our team: the contact form is available directly from the window ("Contact the team" link), and each residence's direct line is shown on its page.

• What is processed: the text you type in the window, and nothing else. No sign-up, no name and no email address are required to chat.
• Why: to produce the answer to your question and point you to the right person. No marketing, no profiling, no model training on our side.
• By whom: your messages are sent to Cloudflare Workers AI, our host's artificial intelligence service, which runs the Llama 3.3 language model to write the reply. It is our only processor for that feature, and it is involved only for as long as it takes to produce the reply.
• For how long: we do not keep these conversations. They are recorded neither in our database nor in our emails. The thread stays in your browser's memory for the length of your visit and disappears as soon as you close or reload the page.
• The only thing that lingers, for a few minutes: a counter of how many messages have been sent, tied to your IP address, which lets us keep automated sending out. It clears itself after ten minutes and holds none of your messages.

One recommendation, and it matters: do not type sensitive information into that window. No bank details, no card number, no identity document, no health information, no confidential detail about your company or your travel plans. The assistant needs none of it to give you a useful answer. As soon as your question touches on a named booking or on your personal situation, the contact form or the phone is the right channel: that is what they are there for, and what you share through them is read only by our teams.

7. Cookies, trackers and audience measurement

The site itself sets no cookies: no advertising, no tracking and no audience measurement cookies.

Audience measurement relies on Cloudflare Web Analytics. Its script creates no cookie and no persistent identifier, but it does read some technical information in your browser (page viewed, referring page, loading performance). It produces aggregated statistics, for our sole use, with no cross-site tracking and no combination with other data, and no data is sold or used for advertising purposes.

This reading falls under the consent exemption provided by Article 82 of the French Data Protection Act for audience measurement that is strictly necessary for the operation of the site, as accepted by the CNIL in its guidelines on cookies and other trackers. That is why, and within those limits, the site displays no consent banner. You can nevertheless object to this measurement by blocking the static.cloudflareinsights.com script (for example with a content blocker): the site works normally without it.

The site also uses strictly necessary local storage for your display preferences: if you choose not to show the chat assistant again, your browser remembers that choice until you turn the assistant back on or clear the site's data; the state of the welcome bubble is only remembered for the length of your visit. This information stays in your browser, is never sent to us and is exempt from consent.

Finally, Cloudflare, which hosts and protects the site, may set technical security cookies (__cf_bm, cf_clearance) used to tell human visitors from bots and to filter attacks. Being strictly necessary to deliver the service you request, they too fall under the consent exemption.

8. Your rights

In accordance with Articles 15 to 22 of the GDPR and the French Data Protection Act, you have the following rights over your personal data:

• Right of access: to know whether we process data concerning you and to obtain a copy of it
• Right to rectification of inaccurate or incomplete data
• Right to erasure (right to be forgotten), under the conditions laid down by the GDPR
• Right to restriction of processing
• Right to object to processing based on our legitimate interest, on grounds relating to your particular situation, and at any time to marketing
• Right to data portability for the data you have provided to us, where processing is based on your consent or on pre-contractual steps
• Right to withdraw your consent at any time (newsletter, reduced-mobility information), without affecting the processing carried out before the withdrawal
• Right to set guidelines on what happens to your data after your death (Article 85 of the French Data Protection Act)
• Right to lodge a complaint with the CNIL (section 10)

No decision concerning you is taken solely on the basis of automated processing, and no profiling is carried out.

9. Exercising your rights

To exercise any of these rights, write to communication@appart-one.com, or by post to Zenao Appartements, 231 rue Saint-Honoré, 75001 Paris, France, specifying the subject of your request. We reply within one month of receiving it. This period may be extended by two months if the request is complex or if we receive a large number of requests: in that case we will let you know within the first month. Proof of identity may only be requested where there is reasonable doubt about your identity.

10. Complaint to the CNIL

If, after contacting us, you believe that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL, Commission Nationale de l'Informatique et des Libertés):

• By post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• Online: cnil.fr/fr/plaintes

11. Security

Appart-One implements appropriate technical and organisational measures to protect your data against loss, alteration, disclosure or unauthorised access: HTTPS connection, secure hosting, access restricted to authorised persons.

12. Changes to the policy

This privacy policy may be amended at any time to reflect legal, technical or organisational developments. The applicable version is the one published on the site on the date of your visit; its last update date is shown at the top of the page. We invite you to consult it regularly.