Privacy policy

At Lazazu, your privacy matters to us. This policy explains what personal data we collect when you visit www.lazazu.com or get in touch with us, how we use it, and what rights you have.

We process your data in accordance with the EU General Data Protection Regulation (GDPR) and France’s Loi Informatique et Libertés, supervised by the CNIL (Commission Nationale de l’Informatique et des Libertés).

The data controller – the company responsible for how your personal data is used – is:

Lazazu France

For all privacy-related queries, please contact us at hello@lazazu.com

We collect only what we need. The sections below set out the categories of data we process, our reason for doing so, and the legal basis we rely on under GDPR.

Name, email address, phone number

  • Why we collect it: To respond to your enquiry and discuss co-ownership opportunities with you
  • Legal basis: Legitimate interest / Consent

Property preferences and search criteria

  • Why we collect it: To match you with suitable homes and compatible co-owners
  • Legal basis: Legitimate interest

Scheduling data (via Calendly)

  • Why we collect it: To arrange and manage consultation calls
  • Legal basis: Legitimate interest

Contact form and CRM data (via HubSpot)

  • Why we collect it: To manage communications and track your journey with us
  • Legal basis: Legitimate interest / Consent

Newsletter and marketing preferences (via MailChimp)

  • Why we collect it: To send property alerts and company news to subscribers
  • Legal basis: Consent

IP address, device type, browser

  • Why we collect it: Website security, fraud prevention, and analytics
  • Legal basis: Legitimate interest / Consent

Behavioural and usage data (pages visited, clicks, session duration)

  • Why we collect it: To understand how our site is used and improve the user experience
  • Legal basis: Consent

Ad interaction and conversion data

  • Why we collect it: To measure the effectiveness of our advertising campaigns
  • Legal basis: Consent

We never collect special category data (such as financial or identity documents) through our website.

  • Directly from you, when you complete a form, book a call, sign up for our newsletter, or contact us by email
  • Automatically, through cookies and tracking technologies when you browse our website – see Section 8 for full details
  • Through third-party tools we use to run our business (listed in Sections 6 and 8)

We must have a lawful basis under GDPR to process your personal data. We rely on four:

  • Consent – for marketing communications, newsletters, and all non-essential cookies (analytics, advertising, and behaviour tracking). You can withdraw consent at any time without affecting anything done beforehand.
  • Legitimate interests – for handling enquiries, managing business relationships, and keeping our website secure. We have assessed that our use of data in these ways does not override your rights or freedoms.
  • Contractual necessity – if you enter into a co-ownership arrangement with us, we process data as necessary to fulfil our obligations under that relationship.
  • Legal obligation – where we are required to retain or disclose data under applicable law.

  • Enquiry and contact data: up to 3 years from your last interaction with us, unless you become a client
  • Client and co-ownership data: up to 10 years after the end of the contractual relationship, in line with French legal requirements
  • Newsletter and marketing data: until you unsubscribe or request deletion
  • Analytics and behavioural tracking data: up to 13 months, in line with CNIL guidelines
  • Cookie consent records (CookieYes): up to 12 months

We do not sell your data. We share it only with the trusted service providers listed below, who help us operate our website and business. All providers are bound by data processing agreements and are required to handle your data securely and only for the purposes we specify.

  • HubSpot Inc. – CRM, contact management, and email tracking
  • Google LLC – Analytics (Google Analytics) and advertising (Google Ads)
  • Meta Platforms Ireland Ltd. – Advertising and conversion tracking (Meta Pixel)
  • Hotjar Ltd. – Behavioural analytics and UX research
  • Calendly LLC – Call scheduling
  • CookieYes Ltd. – Cookie consent management

We may also disclose personal data if required to do so by law or by a competent authority, or to protect our legal rights.

Several of our service providers are based in the United States, which means your data may be transferred outside the European Economic Area (EEA). This applies specifically to:

  • Google LLC (Google Analytics, Google Ads) – US
  • Meta Platforms (Meta Pixel) – US
  • HubSpot Inc. – US
  • Hotjar Ltd. – Malta (EU), with some US sub-processors
  • Calendly LLC – US

The United States does not have a general adequacy decision from the European Commission (except for companies certified under the EU–US Data Privacy Framework). Where that framework applies, transfers are covered accordingly. For other transfers, we rely on the European Commission’s Standard Contractual Clauses (SCCs) as the legal safeguard.

What are cookies?

Cookies are small text files placed on your device when you visit a website. We also use similar technologies such as pixels and tracking scripts. Together, these allow us to make the site work, measure its performance, and – with your consent – show you relevant advertising.

Consent and your choices

When you first visit our site, CookieYes will ask for your consent before placing any non-essential cookies. You can accept all, reject all, or choose by category. You can update your preferences at any time by clicking the cookie settings link in our website footer.

In line with CNIL requirements, refusing cookies is as easy as accepting them. Refusing non-essential cookies will not affect your ability to browse our site.

Cookies we use

Google Analytics

  • Purpose: Measure website traffic and visitor behaviour
  • Data collected: IP address (anonymised), device type, browser, pages visited, session duration
  • Transfer: US – SCCs
  • Legal basis: Consent

Google Ads

  • Purpose: Measure ad performance; remarketing to past visitors
  • Data collected: IP address, device, browser, browsing behaviour, ad interaction data
  • Transfer: US – SCCs
  • Legal basis: Consent

Meta Pixel (Facebook/Instagram)

  • Purpose: Track ad conversions; build custom audiences for advertising
  • Data collected: IP address, device data, browser, pages visited, ad interaction data
  • Transfer: US – SCCs
  • Legal basis: Consent

Hotjar

  • Purpose: Understand how visitors navigate the site (heatmaps, session recordings)
  • Data collected: IP address (anonymised), mouse movements, clicks, scroll depth, device/browser data
  • Transfer: US – SCCs
  • Legal basis: Consent

HubSpot

  • Purpose: CRM: manage enquiries, track email opens and form interactions
  • Data collected:Name, email, phone, IP address, form submissions, email engagement data
  • Transfer: US – SCCs
  • Legal basis: Consent / Legitimate interest

CookieYes

  • Purpose: Manage cookie consent and store your preferences
  • Data collected: Consent status, timestamp, IP address
  • Transfer: EU
  • Legal basis: Legal obligation

WordPress

  • Purpose: Core website functionality
  • Data collected: Session cookies, login state (admin only)
  • Transfer: EU
  • Legal basis: Essential

IP addresses collected by Google Analytics and Hotjar are anonymised before storage. We do not use these tools to identify you personally.

Under GDPR, you have the following rights regarding your personal data:

  • Right of access – request a copy of the data we hold about you
  • Right to rectification – ask us to correct inaccurate or incomplete data
  • Right to erasure – ask us to delete your data where we have no legal obligation to retain it
  • Right to restriction – ask us to pause processing your data in certain circumstances
  • Right to object – object to processing based on legitimate interests, or to direct marketing at any time
  • Right to data portability – receive your data in a structured, machine-readable format
  • Right to withdraw consent – at any time, for any processing based on consent, without penalty

 

To exercise any of these rights, email us at hello@lazazu.com. We will respond within one month. There is no charge.

If you are unhappy with our response, you have the right to file a complaint with the CNIL:

 

CNIL – 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

Website: www.cnil.fr

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include encrypted connections (HTTPS), restricted internal access to personal data, and contractual security obligations on all third-party processors.

In the event of a data breach that poses a risk to your rights, we will notify the CNIL within 72 hours and inform affected individuals where required by law.

Our website and services are intended for adults. We do not knowingly collect data from minors, and will delete any such data immediately if brought to our attention.

We update this Privacy Policy when our practices change or when required by law. The “Last updated” date at the top of this page always reflects the current version. We encourage you to review it periodically.

We are happy to help with any questions about your privacy or this policy:

 

Lazazu France