Privacy Policy
ItalianoPreview revision — approval required before publication. Verified technical information is distinguished from the outstanding confirmations listed below. This version does not certify the compliance of external services.
1. Controller and scope
The controller identified for this website and the initial stage of the ‘Is It Working?’ journey is Ghys David e C. SAS, VAT ID IT01989810989. Email: d.ghys@edilfin.com; telephone: +39 348 313 3210; certified email (PEC): salocase@pec.it.
The journey is initially managed by the SAS. Edilfin becomes involved when a concrete real estate brokerage engagement arises; it is not identified as an automatic recipient of every questionnaire response. Before any data is passed on, its legal entity, role, purposes and applicable notice must be clarified. The address of offices open to clients is not the SAS's registered office.
2. Data and contact channels
To respond to an enquiry, we may process the contact details and information you choose to provide, including information about a property and its sale. For Tally, the actual questionnaire fields determine the data collected: the complete list and any collection of partial responses must be checked in the controller's account.
Requests to the website and external services may involve IP addresses, browser information, pages visited and technical information. Do not provide documents or particularly sensitive information unless requested and necessary.
3. Purposes and legal bases
Voluntary contacts are used to answer enquiries and, at the individual's request, take pre-contractual steps (Article 6(1)(b) GDPR). The questionnaire is intended to assess the sale situation and provide the requested feedback; its legal basis, any additional processing and subsequent contact arrangements must be confirmed before publication.
Optional Google Maps loading relies on consent to external content (Article 6(1)(a) GDPR). Article 6(1)(c) GDPR applies to tax and accounting obligations arising from a professional relationship where applicable. Lovable’s integrated Analytics remains active for traffic statistics and visit sources, including campaigns. According to its official documentation, it does not build individual profiles or follow people across separate visits. The GDPR legal basis for technical data must be confirmed; absence of cookies alone does not establish anonymity or exemption from all privacy obligations.
Visiting the website, completing a questionnaire or sending a message does not in itself constitute marketing consent. No active newsletter forms or automatic guide delivery were found on the website; the guide can be read without subscribing. Any further promotional communication requires an appropriate legal basis and separate information; activities outside the website need confirmation.
4. Tally questionnaire
The journey buttons open https://tally.so/r/aO94Vb on Tally's external website; the questionnaire is not embedded. Visiting the landing page alone does not load Tally. After the link is followed, the service may process technical data and, depending on its configuration, information entered in the form.
Tally states that form data is stored in Europe and encrypted in transit and at rest; it identifies the form creator as controller of response data and Tally as processor. Professional users accept its data processing agreement (DPA) with the terms on account creation, without a separate signature. The creator sets the retention period. Confirm that the account and applicable terms cover the SAS, check access and integrations, and make this notice available in the questionnaire before collection. Provider statements do not certify an individual account’s configuration.
5. Other services and recipients
WhatsApp: a wa.me link opens a chat with optional prefilled text; the website does not automatically send the message. Calendly: appointment buttons open the external service and include parameters identifying the website as the source. Email and telephone use the service selected by the visitor.
Google Maps: the iframe is created only after external-content consent or a click on ‘Load the map’. Once loaded, Google receives browser requests and may use its own technologies. An external Google Maps link is separate from consent to the iframe.
The website is hosted on Lovable and uses its integrated Analytics. Official documentation describes statistics for visits, page views, duration, sources, country and device type, without Analytics cookies or browser storage. Each visit has a separate random identifier and is not linked to later visits. The script and collection endpoint are on the website’s domain, and Lovable collects the data itself rather than sending it to an external analytics service. A same-domain endpoint does not exclude processing by the hosting provider.
Responding to enquiries may involve authorised people and technical providers; legal obligations may require disclosures to authorities. The actual provider list, access to Tally responses, privacy roles and agreements must be completed. Social links open external websites; their respective service notices also apply.
6. Retention and security
Data must be retained only as long as necessary for the relevant purposes and obligations, with restricted access and risk-appropriate safeguards. The previous 24-month contact retention period has not been substantiated and is not presented as a verified period.
Deletion periods must be defined for Tally responses, contacts, appointments, hosting logs and measurements, including copies and backups. Contractual and tax records follow the obligations applicable to the specific relationship. The local map preference is explained in the Cookie Policy.
7. International transfers
An absolute statement that no data leaves the EU would be inappropriate: external services and infrastructure may involve providers or access in other countries. The location of an observed network or server alone does not establish where all processing takes place.
Calendly states that user and invitee data are stored in US data centres managed by Google Cloud and AWS, and that its DPA includes standard contractual clauses. Tally’s stated European storage concerns form data and does not establish the absence of transfers for every subprocessor or integration. Confirm the terms applicable to the SAS and Chapter V GDPR safeguards for the services used, including recipients, countries and how to obtain copies; a separate signature is not presumed necessary where the agreement is already included in the terms.
8. Optional disclosure and automated assessments
Browsing does not require you to complete Tally, use WhatsApp, book an appointment or load the map. Information necessary to answer a request may be required to provide that response; mandatory Tally fields and the consequences of not completing them must be explained in the form.
The journey presents an automated assessment for general guidance. It has not been verified whether any solely automated decisions producing legal or similarly significant effects within Article 22 GDPR take place. The logic, any profiling and its consequences must be checked; no unverified absence is asserted.
9. Rights and complaints
Where the GDPR provides, you may request access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and object to processing (Article 21). You may withdraw consent without affecting the lawfulness of earlier processing. Conditions and exceptions depend on the legal basis and applicable obligations.
To exercise your rights, contact d.ghys@edilfin.com or salocase@pec.it. You may lodge a complaint with the Italian Garante per la protezione dei dati personali or the competent supervisory authority.
10. Confirmations required before publication
Check corporate details and whether the private registered-office address must be disclosed; confirm any appointed DPO and contact details. Verify Tally fields, required responses, partial responses, logic and notice; the legal basis of the journey and follow-up contact; retention and deletion periods.
Complete Edilfin's legal entity and role; identities, roles, contracts and access arrangements for questionnaire, booking, messaging and hosting providers; transfer countries and safeguards. Verify actual public-domain cookies and measurements, their legal basis and whether additional consent is necessary. This is a revision awaiting approval, not a certified final notice.
Preview revision date: 8 November 2026