Privacy policy

This privacy policy explains how OBEO Résidences collects, uses and protects your personal data when you use the website https://www.obeo-residences.com.

1. Data controller

The data controller is OBEO Résidences, represented by its president Jérôme Waymel.

For any question about your personal data, please write to [email protected].

2. Data collected

We only collect data that you share with us voluntarily through the website's forms:

• Contact form
• Brochure request form
• Job application form (the "Apply" option of the contact form)
• Referral form
• Open days booking form
• Newsletter sign-up

The information gathered may include: surname, first name, email address, telephone number, postcode, the residence of interest, your relationship to the future resident, free-text message and, if you are writing on behalf of a relative, their first name, surname and age, the planned move-in date and the type of stay you have in mind.

If you apply for a job with us

The contact form includes an application section. On top of your contact details, it collects: the position you are looking for, your availability, how many years of experience you have in the senior sector, your latest qualification, the professional reference you may choose to give (name and telephone number of a former employer) and the free text where you describe what you would like to bring to our teams. This information is used solely to assess your application. It never joins any commercial file and is never used to market anything to you.

The form also offers to attach a CV. That file is emailed to our recruitment team as an attachment to your application message, so it genuinely reaches us with nothing further for you to do. It is not stored in our database and is kept only for as long as your application is being considered, two years at most if we do not take it further, like the rest of your application file (section 5).

If the attachment cannot be delivered (unsupported format, file too large, technical incident), your application still reaches us and the message states explicitly that a file came with it: we then contact you to obtain your CV. You can also email it to us directly at [email protected].

If you fill in a referral voucher

We collect your own contact details (first name, surname, email, telephone, postal address) and, that is the very principle of a referral, the full contact details of the person you are referring: first name, surname, email, telephone and postal address, together with the residence concerned. You confirm when submitting the form that you have obtained their agreement. That person has rights of their own over this data: section 7 is written entirely for them.

If you book a place at an open day

We collect your first name, surname, email and telephone number, the residence, the date and the time slot you would like, and how you heard about OBEO Résidences. The form finally asks you to pick a profile: senior, family carer or healthcare professional. That choice says something about your personal or family situation, and we do not treat it lightly: it is used only to prepare your visit and to hand you over to the right person on the day. It leads to no medical assessment, no profiling and no commercial segmentation.

Every enquiry sent from the website also records the sender's IP address alongside the form. It is never used for commercial purposes: it serves to keep submissions secure, to prevent automated sending and abuse, and to evidence a submission in the event of a dispute. This rests on the legitimate interest of OBEO Résidences in protecting its website, and the IP address is kept for as long as the enquiry it belongs to (see section 5).

The website also offers a chat assistant, Charlotte, where you type freely. What you write there follows a different path from the forms: section 8 describes it in full.

3. Purposes of processing

Your data is used to:

• Respond to your enquiry or visit request
• Send you the brochure or documents you requested
• Send you our newsletter when you sign up for it
• Arrange a meeting or a residence visit
• Organise your visit on an open day and prepare your welcome
• Manage referral follow-up
• Assess your application when you apply for a position in one of our residences
• Answer the questions you ask our chat assistant
• Improve our service and the quality of our welcome

4. Legal basis

Processing rests on two legal bases (article 6 of the GDPR):

• Your consent, given when you fill in a form
• The legitimate interest of OBEO Résidences in responding to your commercial enquiries and following up on the relationship
• Pre-contractual steps taken at your request when you apply for a job: assessing an application is part of the steps that precede a possible hire

5. Retention period

Your data is kept for three years from your last contact with OBEO Résidences (last enquiry, last exchange or last visit). After that period, it is deleted or anonymised, unless a longer statutory retention obligation applies (accounting, tenancy contract, etc.).

Job applications follow a shorter rule. If we do not take your application further, your file is kept for two years at most from our last exchange, in line with the CNIL's guidance on recruitment. It is deleted after that. If you would rather we deleted it sooner, just ask (section 11).

In short: two years for an unsuccessful application, three years for every other enquiry, and nothing at all for conversations with Charlotte, which we do not record (section 8).

6. Data recipients

Your data is intended solely for the internal teams of OBEO Résidences (commercial and operational) handling your enquiry. It is never sold or transferred to third parties for commercial or advertising purposes.

The website is hosted by Cloudflare, Inc. (global network with points of presence in the European Union). Form submissions are processed by a Cloudflare serverless function and then delivered through the e-mail provider Brevo (a French company with servers located in the European Union), which sends both our transactional messages and, if you have signed up for it, our newsletter: your email address is then recorded in the mailing list we keep there. Any transfer outside the European Union is governed by the Standard Contractual Clauses approved by the European Commission, providing an adequate level of protection in line with article 46 of the GDPR.

Enquiries sent from the website are also recorded in a database hosted by Cloudflare, so that none is lost if an email fails to go through. Only authorised OBEO Résidences staff can reach it, through a console protected by an administration token.

The content of conversations held with Charlotte, on the other hand, is sent to Cloudflare Workers AI, which runs the Llama 3.3 language model to write the answer. It is our only processor for that feature, and it is involved only for as long as it takes to produce the reply (section 8).

Finally, the tour videos shown on the website are hosted by YouTube. Google receives no data at all unless you click the play button yourself: see section 10.

7. Referrals: the rights of the person referred

A referral voucher hands us the contact details of someone who asked us for nothing and who, more often than not, has no idea their data has been passed on. The GDPR anticipates exactly this situation in article 14: where data has not been obtained from the person concerned, that person must be informed. This section is therefore written for them.

If a relative has named you as a referred person to OBEO Résidences:

• What we hold: your first name, surname, email address, telephone number and postal address, along with the residence the referral was made for.
• Where it came from: the person referring you, who confirmed they had your agreement before sending it to us.
• What it is used for: only to get back to you about that referral and to follow it up. Nothing else.
• How long: three years after our last exchange (section 5). These details are never sold or passed on.
• What you can do: every right described in sections 10 and 11 applies, including having your record deleted outright, without having to justify yourself or to tell the person who referred you.

One email to [email protected] is enough: we delete your details and confirm it to you.

8. Charlotte, the chat assistant

Charlotte answers your questions about the residences directly in a chat window. Here is exactly what happens when you use it.

• What is processed: the text you type in the window, and nothing else. No sign-up, no name and no email address are required to talk to Charlotte.
• Why: to produce the answer to your question and point you to the right person. No marketing, no profiling, no model training on our side.
• By whom: your messages are sent to Cloudflare Workers AI, our host's artificial intelligence service, which runs the Llama 3.3 language model to write the reply.
• For how long: we do not keep these conversations. They are recorded neither in our database nor in our emails. The thread stays in your browser's memory for the length of your visit and disappears as soon as you close or reload the page.
• The only thing that lingers, for a few minutes: a counter of how many messages have been sent, tied to your IP address, which lets us keep automated sending out. It clears itself after ten minutes and holds none of your messages.

One recommendation, and it matters: do not type sensitive information into that window. No health condition, no medical treatment, no level of independence, no financial situation, no bank details, no social security number, neither for yourself nor for a relative. Charlotte needs none of it to give you a useful answer. As soon as your question touches on a personal situation, the contact form or the residence's phone number is the right channel: that is what they are there for, and what you share through them is read only by our teams.

9. Cookies and trackers

Website audience measurement is handled by Cloudflare Web Analytics, a statistics tool designed to work without any tracker:

• No analytics cookie is placed
• No identifier, not even a technical one, is created to follow you
• No tracking from one website to another: your browsing is never pieced together
• No data shared with third parties (advertising, profiling)
• Statistics are aggregated at site level, never individual

This is precisely why the website displays no consent banner: the consent required by article 82 of the French Data Protection Act applies to writing or reading information on your device, which does not happen here for audience measurement purposes.

Two technical cookies may however be set by Cloudflare, our hosting provider, for security purposes: __cf_bm (telling human visitors from bots) and cf_clearance (remembering an anti-abuse check you have already passed). Both fall under the "strictly necessary for the service requested" exemption and serve no advertising or statistical purpose.

Finally, the website uses local storage strictly necessary to remember your display preferences, for example if you chose to hide Charlotte, our assistant. That information stays in your browser, is never sent to anyone and is likewise exempt from consent. No consent-requiring tracker is placed when a page loads: the only case where third-party cookies may appear is the video player, and only if you start it yourself (section 10).

10. Videos: nothing reaches YouTube until you click

Several pages of this website show tour videos of our residences. Those videos are hosted by YouTube (a Google service): we do not store them ourselves.

As long as you do not start playback, no data is sent to Google. The image you see where the video sits is a plain picture, downloaded once by us and served from our own website: at no point does your browser contact YouTube's servers, neither to display the page nor to display that image.

It is your click on the play button that loads the video player, and nothing else. At that precise moment, and not before, your browser connects to Google's servers, which then receive your IP address, the address of the website you are playing the video from and technical information about your browser; Google may also place its own cookies on your device. The player is set to privacy-enhanced mode (youtube-nocookie.com), which restricts the use of those cookies for advertising purposes without removing all of them. That processing is then Google's own, and its rules are described in its own privacy policy (policies.google.com/privacy).

In other words, you stay in control: not playing a video is enough for Google to learn nothing about your visit to this website.

11. Your rights

Under articles 15 to 22 of the GDPR, you have the following rights over your personal data:

• Right of access to the data we hold about you
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten), subject to conditions
• Right to portability of your data
• Right to object to processing, in particular for marketing purposes
• Right to restriction of processing

12. Exercising your rights

To exercise any of these rights, please send your request by email to [email protected], stating the purpose of your request. We commit to responding within a maximum of one month. Proof of identity may be requested in case of reasonable doubt.

13. Complaints to the CNIL

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL, the French data protection authority):

• By post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
• Online: cnil.fr/fr/plaintes

14. Security

OBEO Résidences puts in place appropriate technical and organisational measures to protect your data against loss, alteration, disclosure or unauthorised access: HTTPS connection, secure hosting and restricted access for authorised personnel only.

15. Changes to this policy

This privacy policy may be amended at any time to reflect legal, technical or organisational changes. The version that applies is the one published on the website at the date of your visit. We invite you to review it regularly.