As part of its development, StarHope — an emerging French company at the crossroads of advanced technology and applied metaphysics — acts responsibly to protect the safety of its founder as well as that of French citizens.
Applied metaphysics is not only a research discipline: in this context, it manifests as heightened vigilance, deep analytical capacity, and concrete action.
It is within this framework that StarHope filed a formal complaint with the French Data Protection Authority (CNIL), via registered mail sent on December 3rd, 2025, to alert them of a potentially serious violation of GDPR rules caused by the official publications related to:
- company registrations (Greffes / RNE),
- trademark filings (INPI / BOPI),
- and associated public registers.
This alert is based on a simple yet alarming observation: the private home addresses of company founders are published by default, without explicit consent, without clarification, and sometimes even require payment to be hidden when an occultation is requested.
This case has been opened and registered by the CNIL since December 10th, 2025.
StarHope fully embraces its role as a whistleblower:
the company is proud to have detected this structural flaw, to have documented it thoroughly, and to contribute to safeguarding the personal data of the entire French entrepreneurial community.
This complaint should logically lead to:
- a formal investigation targeting the greffes, INPI, and associated publication circuits,
- a deep reform of public register dissemination mechanisms,
- a significant improvement in the protection of the personal data of thousands of already-exposed citizens.
In a world where personal data is becoming an increasingly real threat, StarHope hopes that the CNIL will treat this alert with the utmost seriousness — and that all concerned institutions will take responsibility to modernize and secure their administrative practices once and for all.
Below is the letter sent on 3 December by registered mail to the CNIL complaints department. Certain personal information has been deliberately redacted.
2 December 2025
Subject: Report – Systemic and non-compliant exposure of personal addresses via the INPI (BOPI) and the registries (RNE/Kbis)
Dear Sir or Madam,
I am submitting this complaint by post, in accordance with Article 77 of the GDPR and with your instructions, given the urgent and systemic nature of my request and the fact that the online complaint service does not allow me to register my submission nor to validate the actual date of dispatch of my prior approach to the relevant authority.
1. Preliminary step with the INPI (02/12/2025) — impossibility of using your online service
I contacted the INPI on this day (02/12/2025) by email in order to exercise my rights concerning the publication of my personal address.
Your online service “Mes démarches” normally requires a one-month waiting period before lodging a complaint (“You have written to us but have not yet received a reply”).
This one-month delay imposed by the teleservice has the effect of postponing the handling of a major collective risk, of which the present complaint is part.
Under these conditions, , postal submission constitutes the only effective way to exercise my right to lodge a complaint, in accordance with Article 77 of the GDPR.
2. Subject of the complaint: automatic publication of my home address by several public services
On the occasion :
- of my trademark filings with the INPI, and
- of the registration of my company with the commercial courts (RNE / Kbis),
I noted the automatic, public and non-minimised publication of my personal home address.
This publication appears:
- in the BOPI and in the files accessible via data.inpi.fr,
- in the RNE notices,
- in the third-party Kbis extracts, including those freely accessible by any third party, without prior authentication or any control of purpose.
No consent, no prior information, and no minimisation option or alternative was ever offered.
At the time of my trademark filings, I did not yet have access to a professional address that would have allowed me to substitute my personal address. This situation is extremely common among creators, self-employed workers and founders at the launch stage. However, this does not justify the public disclosure of my personal home address.
I have compiled all the elements in two distinct notes, attached to this letter, in order to clarify the two aspects of the issue:
1. Summary Note n°1: Company registration / RNE / Kbis / registries
→ disclosure of the personal address of company directors,
→ absence of minimisation despite the existence of a registered office address,
→ paid confidentiality service correcting a situation that should not occur.
2. Summary Note n°2: Trademark filings / INPI / BOPI
→ automatic publication of the applicant’s home address (same private individual),
→ absence of consent, minimisation or any alternative,
→ international, archived and widely replicated dissemination.
The two issues affect different populations, but arise from the same observation:
➡️ the publication of personal home addresses is systematic, unnecessary, not minimised, disproportionate and potentially contrary to the essential principles of the GDPR (Articles 5, 6, 13, 25, 32 and 17).
3. Serious, systemic and disproportionate risk (justifying an urgent processing)
This processing:
- links my private home address directly to my identity,
- is disseminated without restriction,,
- is indexed and accessible via search engines,
- provides no minimisation mechanism,,
- potentially exposes vulnerable persons (individuals filing a trademark, self-employed workers, isolated creators, company directors, etc.).
This issue goes far beyond my individual case:
it affects all applicants filing with the INPI and all registered company directors, representing potentially several hundreds of thousands of people.
Beyond the individual case, it constitutes a major collective risk , affecting:
- entrepreneurs,
- self-employed workers,
- individual trademark creators,
- women living alone,
- publicly exposed or media-visible persons,
- holders of intellectual property rights who work from home,
- and, more broadly, anyone carrying out an administrative procedure involving these registries.
Furthermore, the data published by the INPI and the commercial courts is automatically replicated by numerous third-party websites. This information is automatically scraped by platforms, including foreign ones, sometimes hosted outside the European Union, making any subsequent erasure or control impossible in practice.
4. Potentially breached GDPR articles
The practices described may contravene the following articles:
- Art. 5 : minimisation, proportionality, limitation, accuracy, confidentiality
- Art. 6 : absence of a clear legal basis for the publication of a personal home address
- Art. 13 : absence of prior information
- Art. 25 : privacy by design / by default not applied
- Art. 32 : absence of appropriate security measures
- Art. 17 : practical impossibility of exercising the right to erasure
- Art. 35 : apparent absence of a DPIA despite large-scale processing of sensitive data (home address)
5. Supporting documents enclosed
I enclose the following:
- Copy of the INPI’s reply dated 02/12/2025, following my phone call, redirecting me to a paid solution to anonymise my address, even though it was published without my consent. The attached document Dépôt d’acte occultation.pdf explains the procedure to follow, which ends with a payment request in order to process the submission.
- Copy of the email I sent to the INPI on 02/12/2025, in which I discovered that my personal address also appeared on trademark filings.
- Copies of INPI publications exposing my home address.
- Third-party Kbis extract exposing my home address.
- Details of the INPI fee required to anonymise my personal address.
- Copies of the two summary notes:
- Summary Note n°1 — Registries / RNE / Kbis
- Summary Note n°2 — Trademark filings / INPI
All supporting documents required under your instructions are enclosed with this letter.
6. Request
Given:
- the serious risk,,
- the systemic nature of the issue,,
- theabsence of any digital solution at the time of filing
- and the large-scale impact of these practices on individuals in France,
I request that your services open a compliance review without waiting for the one-month deadline normally imposed by your online reporting system, in particular regarding:
- the actual necessity of publishing personal addresses in these procedures,
- the absence of clear information at the time of filing,
- the absence of alternatives respecting the minimisation principle,
- the paid nature of certain corrective measures,
- the risks these practices expose the public to.
This processing appears to meet all the criteria of a high-risk situation that requires your intervention. I wish to clarify to your services that this letter is not intended to openly criticise public administrations, but to fulfil my duty as a citizen regarding the risks faced by the population, beyond my own personal safety.
I remain available for any further information.
Thank you for the attention given to this report and for your action in safeguarding the protection of personal data. I trust in the expertise of your services to ensure the protection of individuals’ rights and freedoms.
Please accept, Madam, Sir, the expression of my respectful greetings.
Gabrielle Gatien
Fondatrice & CEO — StarHope SAS