Last updated: 13 November 2026

This policy explains what personal data we collect when you browse the 17.45 website and use its forms, why we use it and how you can exercise your rights. It is drawn up in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the amended French Data Protection Act of 6 January 1978.

1. Data controller

The data controller is GROUPE HEXAGONE, a French SARL with share capital of €544,040, registered with the Paris Trade and Companies Register under number 842 703 142 (SIRET 842 703 142 00013, VAT number FR87842703142), whose registered office is at 45 rue des Dames, 75017 Paris, France (hereinafter “17.45” or “we”).

For any question about your data: contact@le17-45.fr, or by post to the address above.

When your request concerns a specific restaurant in the network (booking, private hire, quote, pre-order, job application), it is passed on to the company that operates that restaurant. That company processes it on its own behalf, as data controller, under the conditions described in this policy.

2. Data collected, purposes and legal bases

We only collect the data needed for each purpose:

Contact, franchise, brochure and catering quote requests: last name, first name, email, phone number, company or city where relevant, content of your message. Purpose: answering and following up on your request. Legal basis: pre-contractual steps taken at your request, or our legitimate interest in responding to enquiries.
Table bookings, group bookings and private hire: identity, contact details, restaurant, date, time, number of guests and any comments you choose to add. Purpose: managing the booking and sending confirmations and reminders. Legal basis: performance of a contract. If you tell us about an allergy or dietary requirement, this information is used solely to adapt your welcome, with your explicit consent.
Quotes, deposits, pre-orders and cancellations (customer area): identity, contact details, details of the service, payment status. Purpose: preparing and delivering the service, collecting deposits, keeping accounts. Legal bases: performance of a contract and compliance with our legal obligations.
Job applications: identity, contact details, position and restaurant applied for, CV in PDF format and content of your message. Purpose: reviewing your application and organising recruitment. Legal basis: pre-contractual steps taken at your request.
Newsletter: email address. Purpose: sending you our news and offers. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in every email.
Website security: technical data (IP address, browser, connection logs, Google reCAPTCHA signals). Purpose: preventing spam, abuse and fraud, and keeping the site running properly. Legal basis: our legitimate interest.
Audience measurement and marketing: cookie identifiers, pages viewed, interactions and browsing data. Purpose: understanding how the site is used and measuring the effectiveness of our campaigns. Legal basis: your consent (see section 6).

Mandatory fields are marked on each form: without them, we cannot process your request. Please do not send us sensitive data that is not needed for your request. No decision producing legal effects concerning you is based solely on automated processing.

3. Recipients

Your data is accessible only to authorised staff at 17.45 and, depending on your request, at the restaurant concerned. It may also be processed on our behalf and on our instructions by our service providers (processors):

OVHcloud (France): hosting of the website and data;
Stripe: secure payment of deposits and pre-orders. Your card details are entered directly with Stripe: we never have access to them;
Zelty: the restaurants’ point-of-sale software and the online ordering module embedded in the site;
Google: reCAPTCHA (form protection) and, with your consent, Google Analytics 4;
Meta (Facebook, Instagram) and LinkedIn: advertising pixels, only with your consent;
Metricool: site audience measurement, only with your consent;
Sentry: technical monitoring of site errors.
our email service providers (confirmations, replies to your requests, newsletter).

Your data is never sold or passed on to third parties for commercial purposes. It may be disclosed to administrative or judicial authorities where required by law.

4. Transfers outside the European Union

Some providers (notably Google, Meta, LinkedIn, Metricool, Sentry and Stripe) may transfer data outside the European Economic Area, in particular to the United States. These transfers are covered by appropriate safeguards: the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) for certified companies, or standard contractual clauses adopted by the European Commission.

5. Retention periods

Contact, franchise and brochure requests and quotes not accepted: 3 years from the last exchange;
Bookings: for the duration of the service, then 3 years from your last booking;
Accepted quotes, invoices and accounting records: 10 years, in accordance with the French Commercial Code;
Unsuccessful job applications: 2 years from the last contact, unless you ask for earlier deletion;
Newsletter: until you unsubscribe, or after 3 years without any interaction from you;
Technical security logs: 1 year maximum;
Cookies and trackers requiring consent: 13 months maximum, except LinkedIn cookies, which last from 1 day to 2 years depending on the cookie; related audience measurement data: 25 months maximum.

At the end of these periods, data is deleted or anonymised.

6. Cookies and trackers

On your first visit, a banner lets you accept, refuse or customise non-essential cookies. Refusing is as easy as accepting, and you can change your choice at any time using the “Cookie settings” link at the bottom of every page.

Essential (always on): storing your cookie choice, display preferences (for example animations already seen), form security with Google reCAPTCHA. As they are strictly necessary for the site to work, they do not require your consent.
Audience measurement (with your consent): Google Analytics 4 and Metricool. No audience measurement script is loaded until you have given your consent.
Marketing (with your consent): Meta pixel (Facebook, Instagram) and LinkedIn Insight tag, to measure the effectiveness of our ads and show you relevant content on these platforms. If you withdraw your consent, these scripts are disabled and their cookies deleted.

Some embedded content (YouTube videos in our news, the Zelty online ordering module) and links to our social networks are also subject to their publishers’ privacy policies when you interact with them.

7. Your rights

You have the right to access, rectify, erase, restrict and port your data, and the right to object, in particular to direct marketing, at any time and without giving a reason. You can withdraw your consent at any time, without affecting processing carried out beforehand. You may also set instructions regarding what happens to your data after your death.

To exercise these rights, write to us at contact@le17-45.fr or by post to GROUPE HEXAGONE, 45 rue des Dames, 75017 Paris, France, stating the purpose of your request. We will reply within one month, which may be extended by two months for complex requests. If we have reasonable doubts about your identity, we may ask you for proof.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (www.cnil.fr), or with the supervisory authority of your country of residence.

8. Security

We implement appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS), access restricted to authorised staff, anti-spam protection on forms and payments handled by a PCI-DSS certified provider.

9. Minors

This site is intended for adults. Children under 15 must not send us personal data without the consent of their legal guardian.

10. Changes to this policy

This policy may change to reflect legal developments or changes to our services. The date of the last update is shown at the top of this page. In the event of a significant change, we will inform you by appropriate means.