Section 1The data controller
1.1The data controller is Dhabia Amer-Ouali, sole proprietor, trading as DAO Partners, SIREN 918 515 909, 3 rue Thiergarten, 67000 Strasbourg, France, contact@dao-partners.com.
1.2The firm has not appointed a data protection officer. Any question about personal data goes to the address above.
Section 2The website
2.1The website dao-partners.com sets no cookies and uses no audience measurement or advertising tool.
2.2The hosting provider keeps technical connection logs, including IP address and timestamp, for security and service operation, under its own policy.
2.3Appointments for the scoping session are booked through Calendly. The data entered, first and last name, email, telephone, company, number of properties and chosen time slot, serves to organize and prepare the session. The processing rests on pre-contractual steps taken at the person's request.
2.4The qualification test and the assessment grid run in the browser, with nothing recorded. Only the request for the grid as a PDF sends the firm, through the website form hosted by Netlify, the name, email, company, number of properties and test result. This data serves to send the grid and to contact the person about their portfolio, with their consent, for no more than three years after the last exchange.
Section 3Professional contacts and business development
3.1The firm processes the professional contact details of executives and staff of short-term rental operators, management companies, agencies and owners of several properties: name, position, company, professional email and telephone, and the history of exchanges.
3.2This data comes from direct exchanges, trade shows, professional social networks, public sources and professional data providers. The processing rests on the firm's legitimate interest in offering its engagements to professionals of the sector. Every outreach message allows the recipient to object.
3.3Outreach emails are sent from the firm's mailbox, where applicable through the GMass service.
Section 4Clients under engagement
4.1To perform an engagement, the firm processes the professional contact details of the client's representatives, the economic and operational data of each property, aggregated data on team roles and working time, the content, score, date and source of public reviews, and the technical data needed to provide its tools.
4.2Preparing, performing and invoicing the engagement rest on the contract; accounting retention, on a legal obligation; the analysis of public reviews, on the firm's legitimate interest.
4.3The firm has no access to the client's accounting, bank accounts or channel management tools, apart from read-only access agreed in writing.
Section 5The corporate client acquisition tool
5.1The acquisition tool provided to clients under engagement contains professional data on company contacts: company name, position, name and professional contact details.
5.2This data comes from public registers, directories and professional data providers, never from addresses collected on public internet spaces. The firm informs the persons concerned within one month of obtaining their data or at first contact, under article 14 of the General Data Protection Regulation.
5.3A client who uses the tool acts as a separate data controller for its own outreach. It keeps an opt-out list and retains the data for no more than three years after the last contact.
Section 6Processors and transfers
6.1The firm relies on the following providers: Netlify for website hosting; Google Workspace for email, document storage and Google Meet video calls; Calendly for appointment booking; GMass for email sending; DocuSign for electronic signature.
6.2Some of these providers process data in the United States. Transfers rest on the safeguards of chapter V of the General Data Protection Regulation, an adequacy decision or standard contractual clauses.
6.3No data is sold or transferred to third parties.
Section 7Retention periods
7.1Professional contact data is kept for three years after the last exchange.
7.2Contract and invoicing data is kept for the duration of the engagement, then for the statutory period.
7.3Operational data needed for the monthly statements is kept until the limitation period expires.
7.4Public reviews are deleted or anonymized at the end of the engagement, unless needed as evidence.
7.5At the end of an engagement, the firm returns or deletes within thirty days the data it has no obligation to keep.
Section 8Your rights
8.1Every person has a right of access, rectification, erasure, restriction, objection and portability over their data, and the right to set instructions for their data after death.
8.2These rights are exercised by email at contact@dao-partners.com. The firm answers within one month. It may ask for proof of identity in case of reasonable doubt.
8.3Every person may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés, www.cnil.fr.
Section 9Security
9.1The firm applies measures suited to the risks: access control, strong authentication, encryption where available, backups, export limits and incident management.
9.2In case of a data breach, the firm applies articles 33 and 34 of the Regulation and informs the client concerned without undue delay.
Section 10Updates
10.1This policy may be updated. The date of the current edition appears at the top of the page.