Privacy Policy

Triad Consulting SAS is a company registered with the Paris Trade and Companies Register (RCS Paris) under SIREN 107 682 726, with registered office at 229 rue Saint-Honoré, 75001 Paris, France (“we”, “us”, “our”). We operate the website act-3.fr, an online booking platform for luxury apartments in Paris, offered for short-term rental by their owners.

We are the data controller for the personal information we collect about you. For any privacy-related enquiries, please contact us at privacy@act-3.fr.

We collect the following categories of personal data:

• Identity data: title, first name, last name, date of birth, nationality.
• Contact data: email address, phone number.
• Booking data: check-in and check-out dates, number of guests, apartment selected, add-ons chosen.
• Payment data: processed securely by Stripe Inc. We do not store your full card number, expiry date or CVV on our servers. If you choose to save your card for future bookings, a tokenised reference is stored by Stripe under PCI DSS Level 1 compliance.
• Technical data: IP address, browser type, device information and pages visited, recorded in our hosting provider’s technical logs to keep the website running and secure. We do not use any tracking cookies or audience measurement tools (see section 9).
• Communication data: any messages you send us via our contact form, by email or via the built-in chat. Chat messages exchanged through our booking pages are stored via the Guesty conversation system.
• Referral data: if you take part in our referral programme, we record the use of your referral link and the associated discount applied.

We use your personal data for the following purposes:

• To process and manage your booking, including creating it in our booking management system (Guesty), and to pass it on to the Owner of the property booked.
• To process payments securely via Stripe.
• To send you booking confirmations and pre-arrival information.
• To respond to your enquiries and provide customer support.
• To comply with legal obligations (e.g. tax reporting, local regulations).
• To keep the website running and secure, and to improve our services.
• To provide multilingual support by translating content via DeepL (text is sent to DeepL servers for translation and cached).
• To manage the referral programme and apply the associated discounts.

We process your personal data on the following legal bases:

• Contract: processing necessary to perform the booking services contract entered into with you.
• Legitimate interests: improving our services, fraud prevention, marketing to existing customers.
• Legal obligation: compliance with applicable laws and regulations.
• Consent: where you have opted in to receive marketing communications.

We share your personal data with the following recipients, solely to deliver our services:

• The Owner of the property booked - performance of the rental (guests’ identity, dates and details of the stay).
• Stripe Inc. - payment processing.
• Guesty Inc. - property and booking management, check-in form processing and guest chat conversations.
• Resend Inc. - transactional email delivery.
• Vercel Inc. - website hosting.
• Upstash Inc. - data caching and storage infrastructure (Redis).
• DeepL SE - automated translation of listing descriptions and interface content. Text is sent to DeepL servers; no personal data is included in translation requests.

We do not sell your personal data to any third party. We may disclose your data if required by law or to protect our legal rights.

Some of our service providers are based outside the European Union (EU) and the European Economic Area (EEA). Where personal data is transferred outside the EU / EEA, we ensure that appropriate safeguards are in place in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), including the Standard Contractual Clauses approved by the European Commission.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected. Booking data is retained for 6 years after your stay for accounting and legal compliance purposes. You may request earlier deletion where no legal obligation requires us to retain it.

Under applicable data protection laws, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure of your data (“right to be forgotten”).
• Restrict or object to the processing of your data.
• Request portability of your data in a structured format.
• Withdraw your consent at any time (where processing is based on consent).

To exercise any of these rights, please contact us at privacy@act-3.fr. We will respond within 30 days.

You also have the right to lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL, www.cnil.fr), the French supervisory authority.

Our website uses the following cookies:

• Session cookie: a strictly necessary cookie to maintain your session (e.g. language preference, authentication state). This cookie is essential for the website to function and cannot be disabled.
• No tracking cookies: we do not currently use any third-party tracking, audience measurement or advertising cookies.

We may introduce analytics cookies in the future, in which case we will update this policy and request your consent where required by law. You can manage your cookie preferences through your browser settings at any time.

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS/TLS), secure payment processing via Stripe, and access controls for our internal systems.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “last updated” date. We encourage you to review this page periodically.

For any questions about this Privacy Policy or our data practices, please contact:

Triad Consulting SAS
229 rue Saint-Honoré, 75001 Paris, France
RCS Paris 107 682 726
Email: privacy@act-3.fr