Privacy Policy

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

1. Data Controller
   Lotus Casa di Linda Melara, with registered office in Piazza Verdi 5/D — Finale Emilia (MO), email: linda@lotuscasa.it, phone: +39 331 780 2097, is the Data Controller of personal data collected through the website www.lotuscasa.it. If appointed, the contact details of the Data Protection Officer (DPO) or privacy contact person will be provided in this section.
2. Scope of Application
   This policy applies exclusively to the website www.lotuscasa.it and does not extend to third-party websites accessed via links.
3. Types of Data Processed
   The following data may be processed:

• Browsing data, such as IP address, technical logs, request time, requested URLs, browser and device information;
• Identification and contact data voluntarily provided by the user via forms, email, or phone;
• Data related to properties of interest or properties submitted for valuation or brokerage;
• Data necessary to manage appointment requests, visits, consultations, mortgage requests, applications, or newsletter subscriptions;
• User profile data optionally provided during registration, such as gender, date of birth, nationality, preferred communication language, and user type;
• PDF documents uploaded by the user in the reserved area for real estate documentation, stored privately on the server;
• Data received from Google in case of login via “Continue with Google” (name and email address), exclusively at the user’s initiative.

4. Purposes and Legal Bases
   Data are processed for:

• Enabling website navigation and proper technical functioning, based on the legitimate interest of the Controller;
• Responding to requests for information, appointments, visits, property valuations, or pre-contractual consultations, based on contractual or pre-contractual measures;
• Compliance with legal, administrative, tax, or security obligations;
• Sending promotional communications or newsletters only with freely given, specific, and revocable consent;
• Protecting the Controller’s rights in or out of court, where necessary, based on legitimate interest;
• Managing user account creation and maintenance, including saving searches and properties, based on contract execution or pre-contractual measures;
• Managing the upload and storage of documents related to real estate processes, based on contractual or pre-contractual measures.

5. Nature of Data Provision
   Providing data marked as required in forms is optional, but failure to provide them may prevent the Controller from responding or delivering the requested service. Providing data for marketing purposes is always optional and does not affect core services.
6. Processing Methods
   Data processing is carried out using electronic and manual tools, in accordance with principles of lawfulness, fairness, transparency, minimization, accuracy, integrity, and confidentiality. Appropriate technical and organizational measures are adopted to protect data from unauthorized access, loss, disclosure, alteration, or destruction.
7. Data Recipients
   Data may be processed by authorized personnel and by service providers supporting the website or the Controller’s activities, such as hosting providers, IT suppliers, website maintenance providers, email platforms, consultants, technical partners, and professionals, appointed where necessary as Data Processors under Article 28 GDPR. Data will not be disclosed.

• CRM platforms (such as HubSpot or Salesforce), if used, which receive contact request data and are appointed as Data Processors;
• Google LLC, as authentication provider, within the limits of its privacy policy (policies.google.com/privacy), only when the user chooses Google login.

8. Transfers Outside the EU
   Where technical providers involve data transfers outside the EEA, such transfers will comply with Articles 44 et seq. GDPR, including adequacy decisions or standard contractual clauses where applicable.
   In particular, Google LLC and any CRM platforms used are subject to the EU–US Data Privacy Framework adopted in July 2023.
9. Data Retention
   Data are retained only for as long as necessary:

• Technical browsing data: up to 7 days, unless required for security or legal investigations;
• Contact and pre-contractual requests: up to 12 months from the last relevant contact, after which identifying data are anonymized;
• Marketing data: until consent is withdrawn, with periodic checks;
• Legal or contractual data: as required by applicable law;
• Account data: for the duration of the account, deleted upon account deletion (requests remain anonymized as above);
• Uploaded documents: for the duration of the relationship; users may delete them at any time.

10. Data Subject Rights
    Data subjects may exercise their rights under Articles 15–22 GDPR, including access, rectification, erasure, restriction, objection, portability, and withdrawal of consent, by contacting linda@lotuscasa.it. They also have the right to lodge a complaint with the Data Protection Authority.
11. Unsolicited Applications
    If a CV is submitted, data will be processed solely for recruitment purposes. Users are advised not to include unnecessary sensitive data; any excess data will be deleted where possible.
12. Updates
    This policy may be updated at any time. The latest version is published on the website with the date of last update.