Privacy
policy

Who processes your data

The data controller is KING D'HOME, trading as CRD Habitat, a SASU (simplified single-shareholder company) with a share capital of €100,000, registered under number 884 546 755 with the Antibes Trade and Companies Register (RCS), whose registered office is at 1119 Route de la Colle, 06570 Saint-Paul-de-Vence.

For any question about your data: contact@crdhabitat.com, or by post to the registered office, for the attention of the data controller.

Given the nature and volume of the processing carried out, the company is not required to appoint a data protection officer. Your requests are handled directly by the management.

The data we collect

What you entrust to us

The contact form asks for your name, your e-mail address, optionally your telephone number and a description of your project. These fields are enough for us to call you back and prepare a first conversation; we ask nothing more of you.

The message field is free text: what you put in it is entirely up to you. We ask you not to include sensitive information (health, opinions, beliefs, legal matters) or identity documents, which are of no use to us at this stage.

What the server records

Like any web server, the one hosting this site keeps a technical log of connections. It may contain your IP address, the date and time of the request, the page requested, the response code, and the browser and operating system type transmitted by your browser.

These logs are not used to analyse browsing behaviour. They serve to detect intrusion attempts and abuse, to diagnose incidents and to keep a record in the event of an attack.

Why, and on what basis

Each processing operation serves a specific purpose and rests on a legal basis provided for by the General Data Protection Regulation (GDPR).

None of these purposes includes commercial canvassing. Should we ever wish to send you a newsletter, your prior and separate consent would be sought, and you could withdraw it at any time.

Who has access to it

Your data is intended only for those who need it to handle your request: the management of CRD Habitat and the authorised staff who follow the projects.

The following also take part, as processors within the meaning of Article 28 of the GDPR and only to the extent required for their service:

• OVH SAS (2 rue Kellermann, 59100 Roubaix), which hosts the site, its technical logs and part of our e-mail mailboxes;
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), provider of the Gmail service we also use to receive and store our e-mails.

These providers are bound by a contract governing the confidentiality and security of the data. Under no circumstances may they use it for their own purposes.

Beyond these cases, your data is disclosed to no one, except on a lawful request from a competent judicial or administrative authority.

Cookies

A cookie is a small file placed on your device when you visit a site. Not all cookies are alike: some are used to track you, others only to make the service work.

What we do not set

This site sets no audience measurement, advertising, retargeting or social media cookies, and uses no third-party tracker: no resource is loaded from any domain other than our own.

What is set, strictly necessary

Only cookies strictly necessary for the operation and security of the site and the client area are used:

• session-id: session identifier, deleted when the browser is closed (two hours of inactivity at most);
• csrftoken: protects forms against forged submissions from another site (fourteen days);
• token: sign-in token for the client area, only once you are signed in (one hour, rolling);
• django_language: language preference (one year);
• temporary two-step verification cookies, only while signing in (one hour).

These cookies are used neither to identify you for commercial purposes nor to reconstruct your browsing.

Anti-abuse technical fingerprint

To protect the site against bots and attempted abuse (automated form submissions, brute-force attacks on the client area), your browser locally computes a technical fingerprint from non-identifying characteristics (browser, screen, time zone, etc.), using a library hosted on this site (ThumbmarkJS), without calling any third-party service. This fingerprint is associated with your session, kept in your browser's local storage so that it need not be recomputed on every page, and is used exclusively for security: rate limiting, temporary blocking in the event of abuse, and recognising your usual devices for the client area (a code is sent to you by e-mail when you sign in from a new device). It is neither passed on nor used for advertising or audience measurement purposes. Your IP address may be supplemented with an approximate geolocation (country, city) for the same security purposes, and kept in our technical logs for no more than twelve months.

Why there is no banner

Article 82 of the French Data Protection Act (loi Informatique et Libertés), which transposes the “ePrivacy” Directive, exempts from prior consent cookies that are strictly necessary to provide a service expressly requested by the user, as well as those intended for the security of the service. Since this site sets no others, no consent banner is shown to you.

How to control them

You can delete these cookies and the local storage at any time from your browser settings, usually under privacy and security. Blocking them or disabling JavaScript will, however, prevent forms from being sent and the client area from being accessed.

Resources loaded by the site

We have deliberately limited calls to external services. The fonts are hosted on our own server — no request is sent to Google Fonts. The same goes for the photographs and video. No map, no YouTube video and no Instagram content is embedded in the pages: links to these services are plain links, which are only activated if you click on them.

The site's stylesheets and scripts, including the compiled Tailwind CSS library and the technical fingerprint library, are served from our own server: no resource is loaded from a third-party content delivery network, so your browser transmits your IP address only to crdhabitat.com.

Hosting and transfers

The site and the data it processes are hosted by OVH SAS, a French company with its registered office in Roubaix. The servers used are located within the European Union.

The e-mails you send us pass through OVH and through the Gmail service, provided in Europe by Google Ireland Limited. As Google relies on a worldwide infrastructure, processing of these messages outside the European Union, notably in the United States, cannot be ruled out. Such transfers are governed by the safeguards provided for in Chapter V of the GDPR: the European Commission's adequacy decision on the EU – US Data Privacy Framework and, in addition, standard contractual clauses.

Apart from e-mail, no data is transferred outside the European Union. Wherever possible, we favour European providers.

Security

The site is served over HTTPS: the information you enter travels encrypted between your browser and the server.

Access to the requests we receive is restricted to authorised persons and protected by individual credentials. The site's software and components are kept up to date, and the technical logs allow abnormal access attempts to be detected.

As no system can guarantee absolute security, we undertake, in the event of a data breach likely to result in a high risk to your rights, to inform you and to notify the CNIL (the French data protection authority) under the conditions set out in Articles 33 and 34 of the GDPR.

Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over the data concerning you:

• Access: obtain confirmation that your data is being processed and receive a copy of it.
• Rectification: have inaccurate or incomplete information corrected.
• Erasure: request the deletion of your data, subject to our legal retention obligations.
• Restriction: request that processing be frozen while a dispute is examined.
• Objection: object, on grounds relating to your particular situation, to processing based on our legitimate interest.
• Portability: receive the data you have provided to us in a machine-readable format.
• Post-mortem instructions: decide what happens to your data after your death.

To exercise any of these rights, write to contact@crdhabitat.com or to the registered office. State the right you are invoking and give us the details needed to find your request. Where there is reasonable doubt about your identity, we may ask you for proof; it will be destroyed as soon as a reply has been given.

We reply within one month of receipt. This period may be extended by two months if the request is complex, in which case we will let you know.

Complaints to the CNIL

If, after contacting us, you believe that your rights are not being respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL, the French data protection authority):

• CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• www.cnil.fr

Minors

This site presents a professional activity aimed at adults and is not intended to collect information about minors. If you become aware that a minor has sent us data through the contact form, please report it to contact@crdhabitat.com: it will be deleted without delay.

Changes to this document

This policy may be amended to reflect changes to the site, our tools or the regulations. The date at the top of the page indicates the version in force; we invite you to check it from time to time.

Should a change substantially affect the processing of your data — for example the addition of an audience measurement tool — we would inform the persons concerned and, where required, seek their consent.