Your data, your choices.

The controller and how to contact us

The data controller is Davide Iaccarino, owner of Studio Iaccarino, Corso Italia 159, 80067 Sorrento (NA), Italy, VAT number 08206951215, REA NA 940334. For questions, consent withdrawals or data requests: info@studioiaccarino.eu; certified email davideiaccarino@pec.it; telephone +39 081 91 31796.

This notice covers the website, enquiries and the agency’s digital services. It supplements the contact-form notice of 15 September 2026, which remains available, without replacing notices specific to agency appointments, contracts and anti-money laundering obligations.

Enquiries, appointments and personal areas

We process the contact details you provide, enquiry content, properties and search criteria, language preferences, correspondence, appointments and information needed for your case. Data comes from you, your communications with the agency, or property portals through which you send the agency an enquiry. The CRM records the source of the enquiry.

Responding to an enquiry, arranging a viewing and providing the requested service are based on pre-contractual steps or a contract (GDPR Article 6(1)(b)); statutory obligations are based on Article 6(1)(c). Required fields are necessary to handle the enquiry. Acknowledging this notice is not marketing consent. Please do not send health data or unnecessary documents.

Restricted areas are accessible only to authorised users. Email codes, passkeys and optional Google sign-in verify access; for passkeys the website stores the public key, not the biometric data used on your device. Documents and updates are shared according to the case and access permissions.

For enquiries received from portals, we communicate the data source and this notice at first contact and in any event within one month of collection, unless you already have the information. Publication on the website alone does not document delivery to an individual. The studio records the channel, recipient, date, version and available evidence of delivery.

Communications and optional choices

Replies to your enquiry and appointment notifications are service communications. Commercial offers and promotional email updates require a separate, optional choice (GDPR Article 6(1)(a) and Article 130 of the Italian Privacy Code). WhatsApp use is distinct from marketing consent and is managed according to the channel and recorded preferences.

You can withdraw consent or object to communications by writing to info@studioiaccarino.eu, replying to the agency or using the unsubscribe link in property-offer emails. Withdrawal does not affect processing already lawfully carried out. Refusing marketing does not prevent assistance with your enquiry.

The consent register records the date, source, operator or collection channel, choice and available evidence, together with the relevant contact address or number where applicable. New website enquiries also record the notice version and collection page. A portal enquiry alone does not demonstrate promotional consent: the evidence and scope of the opt-in must be verified.

Providers, digital tools and recipients

Data is accessed by the agency’s authorised staff and, as necessary, technical providers. The infrastructure uses OpenAI Sites and Cloudflare for website delivery, storage and security. Resend handles service-related email sending; Google may be used for mail, calendar and sign-in; YCloud and WhatsApp/Meta for WhatsApp messages. Active configurations may vary according to the requested service.

For emails sent from send.studioiaccarino.eu, the check on 21 October 2026 found Resend open and click tracking disabled. The sending region is Ireland; according to the provider’s documentation, message content, metadata and logs are stored in the United States. Resend’s DPA is incorporated into its service terms and includes standard contractual clauses for transfers.

Internal features may use OpenAI to assist with document reading, translation, voice-note transcription and information organisation. Results require human review and do not decide whether offers are accepted, credit is granted or contracts are concluded. The CRM compares property features with search criteria to suggest matches: you may ask the agency to correct these criteria.

Internal AI assistance to organise information and prepare drafts is based on the studio’s legitimate interest in managing services accurately and efficiently (Article 6(1)(f) GDPR), with data minimisation and human review. Operations necessary for your specific request remain based on the contract or pre-contractual steps. Marketing and promotional profiling use the separate choices described above. You may object to AI assistance involving your data and request human handling; the studio assesses the objection and restricts processing where required. We do not use these tools to assign creditworthiness or infer sensitive data.

With a separate documented choice for promotional profiling (Article 6(1)(a) GDPR), the CRM may infer indicative preferences from requested properties: type, town, common features and price and floor-area ranges extended by 20% and 25% respectively. Without this choice, or after withdrawal, the inferred profile is not generated for matching. Portal WhatsApp marketing consent is not automatically extended to profiling. Criteria stated by the client remain available for the requested search. No result automatically decides credit, acceptance of offers or completion of contracts. You may withdraw, correct the criteria and request a search assisted by a person.

The AI voice receptionist is currently a restricted test service, not an active public telephone line. Tests may involve Vapi, OpenAI, ElevenLabs and audio transport providers, with specific information before recording. Public activation will require a dedicated assessment and notice.

Google Maps and Matterport tours are embedded in property listings and load automatically after your choice for each service. The components do not contact these providers before your choice. Google and Matterport receive connection data and may process device and usage information. You can refuse or withdraw without preventing access to the listing. WhatsApp and social buttons are external links.

Security and international transfers

Technical connection data and security logs are processed to protect the website, on the basis of the legitimate interest in preventing abuse (GDPR Article 6(1)(f)). The form uses temporary counters based on fingerprints of the network address and email; it does not store the plain IP address in the contact archive. Hosting services may separately process IP addresses and connection logs.

Providers may also process data outside the European Economic Area, including in the United States. Locating one component in Europe does not guarantee that all processing takes place in the EU. Transfers require the applicable safeguards under GDPR Articles 44 onwards, such as an applicable adequacy decision or standard contractual clauses with any necessary measures. You can ask the agency which safeguards apply to the service used and how to obtain a copy.

YCloud states that its primary servers are in Singapore, with possible further transfers for messaging. A provider’s registered address is not treated as the actual location of all data. You may obtain information from the controller on recipients and safeguards applicable to your processing. Enabling new features involving different providers or countries requires an updated notice and verification of the agreements.

Retention periods

The original form archive retains enquiries for up to 24 months after submission; expired entries are excluded from access and deleted at the next management or submission operation. Form anti-spam counters expire within 24 hours. Application authentication logs for personal areas are subject to cleanup after 90 days.

CRM contacts are reviewed 24 months after the last information received from the client; promotional messages do not restart the period. The review must be completed within 30 days. Promotional use is suspended when due, unless continued retention remains necessary and documented, with another review within a year. Emails, attachments and local copies are checked separately against the same enquiry deadline; the CRM does not automatically delete the mailbox. The studio deletes or anonymises data that is no longer needed in the relevant archives.

Case files follow separate periods: for anti-money laundering records subject to Article 31 of Legislative Decree 231/2007, 10 years from the event specified by law; for accounting records, 10 years from the last entry under Article 2220 of the Civil Code, subject to additional tax or litigation requirements. These periods do not apply indiscriminately to ordinary enquiries. Consent and objection evidence is limited to what is necessary to demonstrate lawfulness, protect rights and honour withdrawals, with annual review.

Management-system backups rotate after 30 days with a maximum of 30 copies. Deleting older copies requires a recent archive to pass a full readback and integrity check; the latest verified copy remains protected if a failure occurs and the exception must be resolved. Backups are not used for commercial communications. After restoration, deletions, withdrawals and restrictions recorded after the backup must be reapplied before ordinary use resumes.

Exercising your rights

Where applicable, you may obtain access, rectification, erasure, restriction and portability, withdraw consent and object to processing based on legitimate interests. You may object to marketing at any time. Write to info@studioiaccarino.eu: the agency checks your identity only when necessary and normally responds within one month, subject to the extensions allowed by the GDPR. You may complain to the Italian data protection authority (www.garanteprivacy.it) and seek a judicial remedy.