Privacy policy on the processing of personal data - Customers and potential customers

1. Information about the data controller and contact details

The Website is entirely managed by:

hereinafter referred to as “Data Controller”.

The Data Controller resides in Italy, and therefore no representative has been appointed.

2. Contact details of the Data Protection Officer

The Data Controller has not appointed a data protection officer.

3. Purpose and legal basis of the processing

Your personal data will be processed for the following purposes:

1. For contractual purposes and/or for purposes related to the execution of any pre-contractual measures requested by you, and fulfil any legal obligations related to such purposes, and in particular, so that you may be contacted in order to discuss the possibility of purchasing a property, to conclude specific contracts in order to establish a right of first refusal on the purchase of a property for a limited period of time, or to make a purchase offer. In this case, the legal basis of processing is the execution of the contract and/or the management of pre-contractual relationships;
2. To send direct marketing messages, newsletters, advertising material, through traditional and automated computer systems, including commercial or promotional messages sent by email or text message, or for purposes of research and market analysis. In this case, the legal basis of processing is your consent, expressed in accordance with this policy;
3. For purposes related to legal obligations if your personal data are processed for the purposes specified by point a). In this case, the legal basis of processing is the legal obligation of the Data Controller to process such personal data in accordance with the applicable national law.

4. How to express consent

When consent is required, this may be given by signing a document online, even through the use of flagboxes.

5. Processing method and logic applied to processing

• When your personal data is processed and retained for the purposes specified by point a), number 4 of this privacy policy (contractual and pre-contractual purposes) and point c) (legal purposes), your data will be processed in hard copy format, by automated means and the use of cloud-based CRM management software, which ensure proper fulfilment of contractual obligations;
• When your personal data is processed for the purposes specified by point b) number 4 of this policy (marketing purposes), your data will be processed with software used to forward commercial messages;

6. Source of the personal data 

Only data provided in accordance with this policy will be processed. Data from sources available to the public will not be processed.

7. Recipients and categories of recipients of personal data

The recipients of personal data may be:

• Communications companies that carry out commercial communication activities as data processors, on behalf of the Data Controller, where consent has been given;
• Companies that offer information society services, above all, companies that offer hosting services;
• Companies that provide cloud-based software;
• Auditing firms;
• Partner companies of the Data Controller.

8. Categories of data

Personal data will be processed.

9. Transfer of data

The Data Controller intends to transfer the personal data to a third country or an international organisation. The above may include for example:

• Communications companies that provide communications services on behalf of the Data Controller;
• Service providers of the communications company;
• Subsidiaries and/or parent companies.

The transfer of personal data to these subjects, if these are established in a Third Country or an international organization, is carried out in the presence of an adequacy decision of the European Commission, which has verified how the Third Country, region or one or more specific sectors in the third country, or the international organization in question guarantees an adequate level of protection of the data subject's rights. In any case, the Data Controller - if it deems this to be appropriate - reserves the right to conclude specific separate agreements which oblige such subjects to adopt adequate security measures, including organisational measures, aimed at providing appropriate guarantees regarding the data subject's rights. The data may thus be transferred to the following countries: United States of America. To obtain a copy of such data or the location where they have been made available, simply send a request to the Data Controller, c/o the above addresses

10. Period of retention of personal data 

• Personal data processed and retained for the purposes specified by point a) number 3 of this policy (contractual and pre-contractual purposes) are processed for a period of time not exceeding 10 years from termination of the effects of the contract, in the event of termination thereof, and, in the case of pre-contractual negotiations, for a period not exceeding 10 years from termination of negotiations;
• Personal data processed for the purposes specified by point b) number 3 of this policy (marketing purposes), are processed and retained until such time as the data subject requests the erasure thereof and/or revokes his/her consent to processing;
• Personal data processed and retained for the purposes specified by point c) number 3 (fulfilment of legal obligations) are processed and retained for a period not exceeding 10 years from termination of the effects of the contract, in the event of termination thereof, and, in the case of pre-contractual negotiations, for a period not exceeding 10 years from the termination of the negotiations, without prejudice, in any case, to any different law.

11. Optionality of giving consent and consequences of refusing consent

• When your personal data is processed and retained for the purposes specified by point a), number 3 of this privacy policy (contractual and pre-contractual purposes), providing your data is an obligation provided by contract and is necessary for the pre-contractual negotiations and to finalise the contract. The data subject has the right to decide whether or not to provide his/her personal data; should he or she refuse to do so, however, it will not be possible to finalise the contract or enter contractual negotiations;
• In the case of personal data processed for the purposes specified by point b) number 3 of this policy (marketing purposes), providing your personal data is not a contractual obligation. The data subject has the right to decide whether or not to provide his/her personal data; should he or she refuse to do so, however, it will not be possible to carry out marketing activities;
• In the case of personal data processed for the purposes specified by point c) number 3 of this policy (legal obligations), providing your personal data is a legal obligation. In this case, the data subject is required to provide his/her personal data; should he or she fail to do so, it will not be possible to finalise the contract.

12. Right to object

The data subject shall have the right to object on any of the following grounds:

• The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, pursuant to point (e) or (f) of Article 6(1), of the GDPR, including profiling based on those provisions. The Data Controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
• Where personal data is processed for direct marketing purposes, data subjects shall have the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling insofar as it is related to such direct marketing.
• If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. It is specified that the Data Subject's right to object to the processing of his or her personal data for the above purposes, may be exercised even in part, by objecting, for example, only to the forwarding of promotional messages through automated and/or digital means, or hard copy communications;
• Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, the data subject, on grounds relating to his/her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

13. Other rights

The Data Controller also informs the data subject that it has the following rights:

• Right of access: the data subject has the right to obtain from the Data Controller confirmation that personal data concerning him or her is or is not undergoing processing and in this case, to obtain access to the personal data and specific information, in compliance with article 15 GDPR;
• Right of rectification: the data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement, in accordance with article 16 of the GDPR;
• Right to erasure, including the right to withdraw consent: the data subject shall have the right to obtain from the Data Controller the erasure of personal data concerning him or her without undue delay and the Data Controller shall have the obligation to erase the personal data without undue delay, or withdraw his/her consent, where any of the grounds established by article 17 of the GDPR apply; As regards the right to withdraw consent, the data subject also has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent given before such withdrawal;
• Right to restriction of processing: the data subject shall have the right to obtain from the Data Controller the restriction of processing where one of the cases established by 18 of the GDPR apply;
• Right to data portability: the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Data Controller, in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another controller without hindrance from the data controller to which the personal data have been provided in the cases and under the conditions specified by article 20 of the GDPR;
• The Contracting Party's right to object to commercial communications: the contracting party has the right to object at any time, free of charge, to receive commercial communications.

14. Exercising your Rights

Requests to exercise the rights indicated by this policy, including, the right to erasure and the right to withdraw any consent given, should be addressed directly to the Data Controller at the email address provided. Alternatively, you may exercise your rights by sending a registered letter with return receipt to the address of the Data Controller