At STUDAPART, respecting your privacy and protecting your personal data are our priority.
This privacy policy (hereinafter the “ Privacy Policy ”) aims to inform you, as a Tenant or Owner, about the processing of your personal data in connection with the use of the website https://www.studapart.com/fr (the “ Website ”) and the STUDAPART platform accessible at http://reservation.studapart.com (the “ Platform ”) in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “ GDPR ”) and Law No. 78-17 of 6 January 1978 relating to information technology, data files and civil liberties in its latest version in force (together the “ Applicable Regulations ”).
This Privacy Policy does not describe how your data is collected and processed via cookies and other tracking technologies (“ Cookies ”) on the Site and the Platform. For more information, please see our Cookie Policy (at the bottom of the document).
It is specified that the terms Tenant and Owner have the same meaning as given to them in the General Terms and Conditions of Use of the Platform.
1. Who is the data controller?
During your browsing and/or registration on our Platform or more generally in the context of the management of our contractual relationship with you, the data controller within the meaning of Article 4, paragraph 1, point 7 of the GDPR is the company STUDAPART, a simplified joint-stock company, registered with the RCS of Paris under number 790 562 813 and whose registered office is located at 251 Rue Saint-Martin – 75003 Paris (“ We ”, “ Us ”, “ Our ”).
However , when our services are used by partner institutions (third-party platforms, establishments, etc.) to distribute rental offers on their websites and networks, we can collect and process personal data on their behalf. Our partner institutions are therefore responsible for data processing, and we act as a data processor within the meaning of Article 28 of the GDPR.
2. What data do we collect?
Personal data is data that allows an individual to be identified directly or by cross-referencing with other data.
Personal data is any information that can be used to identify an individual, either directly or by combining it with other data. Depending on the service requested, we collect personal data that falls into the following categories:
### Identification data:
From the Tenant and their guarantor:
- Title, surname, first name (required)
- Telephone number (required)
- Email address (required)
- Postal address
- Date of birth
- Photocopy of identity card, passport or residence permit
- Copy of student card or school certificate
- Scholarship certificate (if applicable)
- data on your current accommodation expectations/searches with us (search criteria, location preferences, budget, entry and exit dates, length of stay, type of accommodation sought, desired amenities)
From the Owner:
- Title, surname, first name
- E-mail address
- Phone number
- data relating to your accommodation and rental conditions (property address, type of accommodation, surface area, number of rooms, amenities, rental conditions, photos of the accommodation)
### Data relating to your professional life and/or that of your guarantor:
- Company/employer name
- Position/function held
- Sector of activity
- Type of employment contract (permanent, fixed-term, internship, etc.)
- Employment start date
- Proof of employment (attestations, work certificates)
- CV (if provided)
### Economic and financial data of the Tenant and/or the guarantor:
- Amount of net income
- Amount of family allowances
- Amount of other income (with description)
- Type of accommodation (owner/tenant)
- Amount of loan repayments (if homeowner)
- Date of acquisition of the property (if owner)
- Rent amount
- Bank account details and bank account information
- Payslips (3 most recent)
- Tax forms (tax assessment notices)
- Rent receipts
- Proof of residence
- Bank guarantee certificates
- Data relating to your bank cards (for payments)
### Connection data:
- Connection logs (date, time, IP address)
- Encrypted passwords
- Connection history
If you choose to log in using a third-party authentication service (e.g., Google or Facebook): certain data, such as your name and email address, may be retrieved from that service. By choosing this option, you agree that the service may share this data with us. We do not collect your third-party account password.
### Navigation data:
- IP address
- Pages viewed
- Date and time of connection
- Browser used and version
- Operating system
- User Agent
- Unique user identifier
- Geolocation data (if permitted)
- Cookies and similar technologies
- Session data
- Referrer (original page)
- UTM data (source, campaign, medium)
### Communication data:
- Messages exchanged via our messaging platform
- Content of conversations (with automatic translation into French, English and Chinese)
- Files attached to messages
- History of communications
- Message metadata (date, time, participants)
### Contact details:
- Any information you wish to provide us as part of your contact request
- Contact messages via our forms
- Communication preferences (SMS marketing, emails)
### Profile data and preferences:
- Housing search preferences
- Configured alerts
- Research history
- Filtering criteria used
- Scoring and evaluation data
3. Details on the processing of your personal data
Purposes | Legal basis | Shelf life |
Providing our services to connect property owners and tenants looking for accommodation, available on our Website and Platform via your account | Implementation of Our General Terms of Use (Art. 6, para. 1, letter b) GDPR) | When you create an account: your data is kept for the entire duration of your account. If your account remains inactive for 3 years, your personal data will be deleted if we do not receive a response from you to our reactivation email. In addition, your data may be archived for evidentiary purposes for a period of 5 years. |
Ensuring the monitoring of the contractual relationship with our clients | Implementation of Our General Terms of Use (Art. 6, para. 1, letter b) GDPR) | Personal data is kept for the entire duration of the contractual relationship. In addition, your data (with the exception of your bank details) is archived for evidentiary purposes for a period of 5 years. Regarding your bank card details, they are kept by our payment service provider for the entire duration of your browsing and access to the Platform. The data relating to the visual cryptogram or CVV2, written on your bank card, is not stored. |
To analyze your use of the services, understand your expectations and improve the features offered (in particular by analyzing exchanges or by developing navigation and audience statistics for the Site and the Platform) | Our legitimate interest in improving our services (Art. 6, para. 1, letter f) GDPR) | Personal data is kept for 3 years. Once anonymized, your data is no longer considered personal data because re-identification is impossible. |
Preventing circumvention of the Platform, protecting against and combating online fraud, protecting users and ensuring the integrity of our services (including, if necessary, through the analysis of communications exchanged on the messaging system) | Implementation of Our General Terms and Conditions of Use | Personal data is retained for the duration of the contractual relationship. As part of our efforts to combat fraud and circumvention, evidence of breaches of the General Terms and Conditions of Use may be archived for a period of 5 years for evidentiary purposes. |
Manage your reviews of our services | Our legitimate interest in collecting your feedback on our services (Art. 6, para. 1, letter f) GDPR) | 2 years from the date of publication of the notice. |
Create a prospect file | Our legitimate interest in developing and promoting our business (Art. 6, para. 1, letter f) GDPR) | Your data is kept for a period of 3 years from your last contact with us. |
Sending newsletters, solicitations and promotional messages by email | For customers: our legitimate interest in building customer loyalty and informing our customers of our latest news (Art. 6, para. 1, letter f) GDPR) For prospective clients:
| The data is kept for a maximum of 3 years from your last contact with us or, if you are a professional, until you withdraw your consent. |
Responding to your requests for information, contact and/or demonstration via a third-party tool (Intercom) | The execution of pre-contractual measures taken at your request (Art. 6, para. 1, letter b) GDPR) | The data is kept for a period of 3 years from your last contact. |
Retain information and administrative documents related to our business | We comply with our legal and regulatory obligations (Art. 6, para. 1, letter c) GDPR) | Invoices are archived for a period of 10 years. If you are a professional: Data relating to your contract and elements relating to the signing of the contract are kept for 5 years. If you are an individual: Data relating to your contract and elements relating to the signing of the contract are kept for 10 years from the conclusion of the contract. |
Organize competitions | Performance of the contract (i.e., the rules of the competition previously accepted before participating) (Art. 6, para. 1, letter b) GDPR) | The data is kept for the entire duration of the games or promotional operations and may be archived for 5 years for evidentiary purposes. |
Responding to requests from individuals to exercise their rights | We comply with our legal and regulatory obligations (Art. 6, para. 1, letter c) GDPR) | If we ask you for proof of identity: we only keep it for the time necessary to verify your identity. Once the verification is complete, the document is deleted. As a professional, if you exercise your right to object to receiving marketing communications: we retain this information for 3 years. |
4. Who are the recipients of your data?
The following will have access to your personal data:
(i) The staff of our company and of the parent company HousingAnywhere BV;
(ii) Our subcontractors within the meaning of Art. 28 GDPR: hosting provider, newsletter sending provider, audience measurement and analysis provider, email provider, secure payment provider, generative artificial intelligence tool and predictive statistics tool (in particular to analyze Platform usage data in order to optimize the management of accommodation availability and rental periods as well as to guarantee the security of the platform and prevent and avoid fraud), billing tool, customer relationship management tool (in particular to provide technical support), internal project management tool, cookie management tool, sales prospecting tool, external consultants;
(iii) Our partners acting as independent data controllers. We disclaim all responsibility for the processing of personal data carried out by our partners and invite you to consult their terms of use and privacy policy;
(iiii) To any authority legally empowered to know about it, in particular judicial, police or administrative authorities, if they request it.
5. Is your data likely to be transferred outside the European Union?
Your data is retained and stored for the entire duration of the processing on Google's servers, located in the European Union.
As part of the tools we use (see the article on recipients regarding our subcontractors), your data may be transferred outside the European Union. The transfer of your data in this context is secured using the following tools:
either the data is transferred to a country which has been the subject of an adequacy decision by the European Commission, in accordance with Article 45 of the GDPR: in this case, that country ensures a level of protection deemed sufficient and adequate to the provisions of the GDPR;
either the data is transferred to a country whose level of data protection has not been recognized as adequate under the GDPR: in this case, these transfers are based on appropriate safeguards as indicated in Article 46 of the GDPR, adapted to each provider, including, but not limited to, the conclusion of standard contractual clauses approved by the European Commission, the application of binding corporate rules or under an approved certification mechanism;
either the data is transferred on the basis of one of the appropriate safeguards described in Chapter V of the GDPR.
You can obtain a copy of the tools enabling the transfer of your data outside the European Union by contacting us using the contact details provided in the article "What are your rights over your data?" below.
6. What are your rights regarding your data?
You have the following rights regarding your personal data:
Right to information : this is precisely why we have drafted this Privacy Policy. This right is provided for in Articles 13 and 14 of the GDPR.
Right of access : you have the right to access all of your personal data at any time, pursuant to Article 15 of the GDPR.
Right to rectification : You have the right to rectify your inaccurate, incomplete or outdated personal data at any time in accordance with Article 16 of the GDPR.
Right to restriction : you have the right to obtain restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR.
Right to erasure : you have the right to demand that your personal data be erased, and to prohibit any future collection of it for the reasons set out in Article 17 of the GDPR.
Right to define guidelines regarding the retention, erasure and communication of your personal data after your death.
Right to withdraw your consent at any time : For purposes based on consent, Article 7 of the GDPR states that you may withdraw your consent at any time. This withdrawal will not affect the lawfulness of the processing carried out before the withdrawal.
Right to data portability : subject to certain conditions specified in Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a standard machine-readable format and to request its transfer to the recipient of your choice.
Right to object : Under Article 21 of the GDPR, you have the right to object to the processing of your personal data. Please note, however, that we may continue to process your data despite this objection, for legitimate reasons or to defend our legal claims.
You can exercise these rights by writing to us at the following address:
By email: DPO@studapart.com
By mail: STUDAPART, 251 Rue Saint-Martin – 75003 PARIS
We may ask you at that time to provide us with additional information if there is reasonable doubt, or even any document that could prove your identity if the doubt persists.
We will respond within a maximum of one month from the date of receipt of your request. This period may, however, be extended by two months due to the complexity and number of requests received. In this case, we will inform you within one month of receiving the request, specifying the reasons for this extension.
For any question or request that has remained unsuccessful, you have the right to lodge a complaint with the competent supervisory authority, in France, the Commission Nationale de l'Informatique et des Libertés (“CNIL”), located at 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.
7. Modifications
We may modify this Privacy Policy at any time, particularly to comply with any regulatory, legal, editorial, or technical developments. These modifications will apply from the effective date of the revised version. You are therefore encouraged to regularly review the latest version of this policy. Nevertheless, we will inform you of any significant changes to this Privacy Policy.
Effective date: May 18, 2026.