This policy explains which personal data the Vetrina Immobiliare website processes and how, under Regulation (EU) 2016/679 (GDPR).

Data controller

The controller is the site operator. Contact: vetrinaimmobiliare.app@outlook.com. (Insert the controller's name/company and address here.)

What data we process

• Account data: username, agency name, role (owner/staff).
• Sign-in security: password (stored encrypted, never in clear text), two-step verification (2FA) secret and backup codes (encrypted).
• Access log: date and time of successful sign-ins and failed attempts, IP address and approximate location derived from the IP (city/region/country), for security purposes.
• Anonymous visit statistics: page visited, device type, referring site, country and a non-reversible technical identifier that changes daily (used only to count unique visitors). We use no tracking cookies and no third-party analytics, and the IP address is not stored for statistics.

Property photos and PDFs are NOT uploaded to the server: they stay and are processed only in the user's browser.

Purposes and legal basis

• Providing the restricted area and the display editor — legal basis: performance of the service (Art. 6(1)(b) GDPR).
• Ensuring sign-in security (access log, IP, location, detection of unauthorised attempts) — legal basis: legitimate interest in protecting the service (Art. 6(1)(f) GDPR).

Recipients and transfers

• Hosting: the site is hosted on Netlify, which processes data as a processor and may store it on servers including in the United States.
• IP geolocation: only the IP address is sent to the ip-api.com service to derive the approximate location.

Retention

Account data is kept as long as the account is active. The access log keeps the most recent events (in limited form) and is rotated automatically.

Your rights

You may request access, rectification, erasure, restriction, objection and portability of your data, and lodge a complaint with the competent supervisory authority. To exercise these rights, write to vetrinaimmobiliare.app@outlook.com.

Security measures

Encrypted passwords (bcrypt), two-step verification (2FA), encrypted connection (HTTPS), CSRF protection, attempt limiting and account lockout, protected session cookies.

For full compliance (e.g. data processing agreements with agencies, appointment of processors, assessments), review by a professional is recommended.

Last updated: 7/30/2026. Informational document; it does not replace legal advice.