1. Data controller
The data controller is Immobiliare Etna, with its registered office at {{agency_registered_address}}, hereinafter the “Agency”.
This notice, provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR), concerns the website https://demo.domusify.net/ and explains how the personal data of people who visit it, contact the Agency or submit a property are processed.
For information and to exercise your rights, you can write to {{agency_privacy_email}}.
2. Data processed
Browsing and security
During your visit, the following may be processed: IP address, date and time of requests, pages and resources requested, browser and device information, request outcomes and technical signals necessary to prevent spam, abuse and unauthorised access.
The website also uses cookies and other technical tools necessary for its operation. Optional statistical tools are described in section 5 and in the Cookie policy.
Contact enquiries
When you complete a form, we process the data you enter: name, email address, telephone number, message and reason for contacting us, according to the fields provided in the form. If the enquiry relates to a listing, we also process the property reference needed to put it into context.
Please do not include health data, identity documents or personal information that is not necessary for your enquiry in your message. If you provide other people’s data, make sure you are lawfully entitled to do so.
Property information and photographs
To present properties, descriptions, locations and photographs supplied by owners or collected by the Agency in the course of its activities may be processed. This content may include personal data where it enables a person to be identified, even indirectly.
Any estate agency relationship, collection of documents and related compliance requirements are also covered by the notices provided by the Agency in connection with those activities.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to enquiries about properties, appointments, the sale or letting of a property and services requested by the data subject | Taking steps at the data subject’s request prior to entering into a contract, Article 6(1)(b) GDPR |
| Handling general communications unrelated to a pre-contractual relationship | The Agency’s legitimate interest in responding to communications received, Article 6(1)(f) GDPR |
| Operating and protecting the website, preventing spam and abuse and diagnosing malfunctions | Legitimate interest in service continuity and security, Article 6(1)(f) GDPR |
| Measuring website usage with Google Analytics 4 | Consent, Article 6(1)(a) GDPR, and consent to the use of tracking tools where required |
| Loading the embedded Google Maps map and disclosing the necessary data to the provider | Consent, Article 6(1)(a) GDPR, and consent to optional tools pursuant to Article 122 of Italian Legislative Decree 196/2003 |
| Measuring email opens and clicks, only where enabled with specific consent | Separate consent, Article 6(1)(a) GDPR, and consent to tracking tools where required |
| Publishing and preparing content relating to properties covered by an agency instruction, where it contains client data necessary for the service | Performance of a contract, Article 6(1)(b) GDPR |
| Complying with legal obligations | Legal obligation, Article 6(1)(c) GDPR |
| Establishing, exercising or defending a legal claim | Legitimate interest in protecting the Agency’s rights, Article 6(1)(f) GDPR |
Enquiry data are not used for newsletters or promotional campaigns. No decisions based solely on automated processing are made that produce legal or similarly significant effects on an individual.
4. How enquiries are handled
The forms send the enquiry by email to the Agency and/or the associates responsible for handling it. A copy containing the full enquiry is sent to the email address provided by the user.
The website does not store enquiries in a contact database or lead archive. This does not mean that the data are not retained: the message is processed by the sending service and remains in the recipients’ mailboxes, according to the criteria set out in section 9. Technical data relating to delivery and security may also be retained.
Fields marked as mandatory are necessary to submit and handle the enquiry. Without them, the form cannot be submitted or the Agency may be unable to respond. Other data are optional. Submitting the form does not subscribe you to commercial communications.
Elastic Email’s standard settings provide for measuring opens and clicks through pixels and tracked links. Where used, this measurement links information about interactions with the message to the recipient and is subject to specific, optional consent, separate from consent for GA4 and Google Maps. Withholding consent does not prevent the handling of the enquiry or the sending of service emails, which must take place without such tracking. Consent can be withdrawn by contacting the Agency, without affecting the lawfulness of previous processing. The absence of a choice does not constitute consent, regardless of the provider’s settings. Technical data necessary for delivery and security remain distinct. See the Elastic Email documentation.
5. Statistics with Google Analytics 4
The website uses Google Analytics 4 only after you have given consent, to understand how pages are used and obtain statistics such as visits, views, traffic sources and general characteristics of the devices used.
Analytics may process online identifiers, device information and browsing events. Presenting aggregated reports does not mean that all data originally collected are anonymous.
The service is technically managed by SFV S.R.L. through an Analytics property shared across the platform’s websites. The Agency receives only aggregated reports relating to its own website in its dashboard. Other agencies cannot view them. SFV processes these data to provide the statistical service on behalf of the agencies, without reusing them for its own independent purposes.
Advertising features, Google Signals and features that recognise visitors across different agencies’ websites are not enabled. Data entered in contact forms are not transmitted to Analytics.
If you refuse, Analytics is not activated and the website remains usable. You can change or withdraw consent through “Cookie preferences”, available on the website. Withdrawal does not affect the lawfulness of previous processing.
For information on how cookies work, their duration and how to manage preferences, see the Cookie policy. For Google’s practices, see the Google Privacy policy.
6. Providers and recipients
Data are accessible to the Agency’s authorised staff and associates, within the scope of their respective duties, and to the providers needed to deliver the services.
SFV S.R.L., with its registered office at Via Terra di Santa Lucia 56, 95030 Mascalucia (CT), tax code/VAT number 05881360878, provides and manages the platform on behalf of the Agency as a data processor for the activities entrusted to it. The relationship is governed by a data processing agreement.
| Service | Function and data concerned |
|---|---|
| Cloudflare | Content delivery and traffic protection; connection data and technical security signals |
| DigitalOcean | Website and database hosting; data necessary for the platform’s operation |
| Amazon Web Services — S3 | Image storage and delivery; uploaded content and technical request data |
| Elastic Email | Sending emails; recipients’ addresses, message content and delivery data; any open and click data only under the conditions in section 4 |
| Google Analytics 4 | Optional statistical traffic analysis, under the conditions in section 5 |
| Google Search Console | Viewing reports on the website’s presence and traffic from Google Search; does not in itself involve installing an Analytics tag in the browser |
| Google Cloud reCAPTCHA | Protecting the public forms from automated submissions; verification token, technical browser and connection data such as IP address and user agent, and the hostname of the website |
| Nominatim — OpenStreetMap Foundation | Converting property addresses into geographical coordinates; addresses searched and technical data on the connection to the service |
| OpenStreetMap | Displaying maps; coordinates of the area displayed and, where loading takes place directly from the browser, IP address and technical request data |
| Google Maps, as an alternative to OpenStreetMap | Embedded map, only after consent to the Functional category; connection and device data and interactions with the map, as well as any identifiers described in the Cookie policy |
| Black Forest Labs — FLUX | Processing photographs selected by the Agency and the related instructions, as set out in section 7 |
| The Agency’s email provider | Receiving and retaining email enquiries in the mailboxes of the designated recipients |
Providers act as processors or sub-processors for processing carried out on behalf of the Agency, or as independent controllers for activities they carry out under their own responsibility. Their respective roles depend on the service and the applicable contractual relationships.
For Google Maps, the embedded content remains blocked until consent is given to the Functional category, which is independent of the Statistics category. Refusal does not prevent you from viewing listings or contacting the Agency. Consent can be withdrawn through “Cookie preferences”. Google also processes the data received under its own responsibility, in accordance with its own notice and the terms applicable to controller-to-controller relationships.
For Google Cloud reCAPTCHA, Google receives the technical browser and connection signals needed to tell human requests apart from automated ones; the check does not depend on the optional consent categories. Google processes this data on behalf of the Agency, as a processor, under the Google Cloud data processing terms. The cookie the verification may need is _GRECAPTCHA, described in the Cookie policy.
Data may also be disclosed to advisers or authorities where necessary to comply with legal obligations or protect rights. Form data are not published. Listing content intended for publication is, however, accessible to visitors and may be indexed by search engines.
7. AI processing of photographs
The Agency may use FLUX, provided by Black Forest Labs through its direct API, to edit property photographs, for example to improve brightness or remove visible clutter.
The service receives the selected photograph and editing instructions. It does not receive contact enquiry data for this purpose and is not used to profile visitors.
Use is intended for property images, excluding people and unnecessary personal elements. Before sending images, the Agency must check the content and remove or obscure any documents, faces, personal photographs and other unnecessary identifying elements.
BFL’s standard API terms provide that images, instructions and outputs may also be used by the provider to develop and improve its services and to train models. No blanket exclusion of such uses is therefore stated: BFL’s privacy policy provides for the possibility of objecting to use for training by contacting the provider, and the data subject may contact the Agency for assistance with the request.
For processing that BFL carries out as an independent controller, its notice identifies BFL GmbH, Germany, as the controller for data subjects in the European Economic Area, the United Kingdom and Switzerland, and sets out the legal bases, retention criteria and mechanisms for any international transfers. See the BFL API terms for the European Union and the Black Forest Labs privacy policy.
8. Processing locations and international transfers
The hosting, database and image storage infrastructure is configured in European regions. This configuration does not rule out processing or access from countries outside the European Economic Area through individual providers, their networks or support services.
The platform’s providers transfer data using the mechanisms applicable to each recipient, including the EU–US framework where the recipient is certified and the transfer falls within the scope of the certification and the applicable adequacy decision. The contractual documents of Cloudflare, DigitalOcean, AWS and Google for processing services govern their respective transfers; for other providers, the notices and agreements applicable to the services listed in section 6 are relevant. Consent to statistics does not replace the safeguards necessary for a transfer.
Where processing involves an international transfer, the requirements laid down by the GDPR are applied, such as an applicable adequacy decision or standard contractual clauses and, where necessary, supplementary measures. You can request information and a copy of the relevant safeguards by writing to the contact specified in section 1.
9. Retention
Data are retained for as long as necessary for the specific purpose, according to these criteria:
| Category | Period or criterion |
|---|---|
| Enquiries and correspondence | Until the enquiry and any agreed follow-up have been handled and closed; if a contractual relationship arises, the necessary data are subject to the periods applicable to that relationship. Completed enquiries are deleted when they are no longer needed for ongoing responses, appointments or follow-up, subject to the legal obligations and requirements for protecting rights set out below |
| Data subject to legal obligations | For the periods laid down by the rules applicable to the documentation concerned |
| Data necessary for disputes | Limited to what is necessary to handle the dispute and for the periods applicable to protecting the right concerned |
| Security, application and sending logs | For the operational period necessary to diagnose errors, identify unauthorised access and manage incidents, subject to targeted retention necessary to investigate incidents or protect rights |
| Analytics data and imported reports | Two months for data subject to the relevant GA4 setting; for the duration of service provision for aggregated reports, including those imported into the dashboard |
| Any email open and click data | For as long as necessary to measure interactions with the message; upon withdrawal, tracking stops and identifying data are deleted or anonymised, except where necessary to document consent or protect rights |
| Records of privacy choices | For the period necessary to demonstrate compliance with choices and applicable obligations, taking account of the relevant time limits for any disputes; separate from the preference stored on the device |
| Listing images and content | For the period necessary to publish the listing and manage the agency instruction, according to the removal procedures adopted by the Agency when the instruction ends, subject to obligations or documented requirements for protecting rights |
| Backup copies | Overwritten or deleted according to the technical backup replacement cycle; used for recovery and service continuity |
For GA4, expired data are deleted through monthly processing. If the reset-on-new-activity option is enabled, the retention period for the user identifier restarts with new events: the two months therefore do not constitute an absolute limit running from the first visit. This reset concerns user-level data, not the retention period of all historical events. See the GA4 data retention documentation.
The durations of cookies and other tools on the device are stated in the Cookie policy. Cookie duration does not necessarily match data retention on servers.
10. External links
The website may contain links to WhatsApp, social networks or other websites chosen by the Agency. These are simple links: if you follow them, the destination services process data according to their own notices. Please consult them before using those services.
11. Your rights
Where provided for by the GDPR, you can request access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation and withdraw any consent given.
Send requests to {{agency_privacy_email}}. The Agency responds without undue delay and in any event within one month of receipt. Taking account of the complexity and number of requests, this period may be extended by a further two months, with notice to you within the first month explaining the reasons. Where there are reasonable doubts about your identity, the Agency may request the additional information necessary to verify it.
You can lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority, and seek a judicial remedy.
12. Updates
This notice may be updated to reflect changes to services or processing activities. Updates are published on this page. Where necessary, further information is provided or fresh consent is requested.
Last updated: 16 September 2026