Privacy Policy

The controller of the processing of personal data is casaperstudenti.it.

For any privacy-related request you can write to privacy@casaperstudenti.it.

No Data Protection Officer (DPO) has been appointed, as this is not mandatory.

Depending on how the platform is used, we may process identity and contact data such as first name, last name, email, phone number and address.

We process registration and account data, including credentials, any company details for property managers, preferences, and search and booking history.

We process listing data, namely the information about the property published by landlords.

Payment data is handled directly by Stripe: casaperstudenti.it does not store full payment card details, but may process transaction-related data such as amount, status and identifier.

We process browsing data such as IP address, browser and device type, technical logs, and data collected through cookies, as described in the Cookie Policy.

Finally, we process communications, namely the content of messages exchanged through the platform or sent to support.

As a rule, the provision of special categories of data under Article 9 GDPR is not required; users are asked not to enter such data in free-text fields.

We process data for registration, account management and the provision of the platform's services, on the basis of the performance of a contract under Article 6.1.b GDPR.

We process data to manage payments and fees through Stripe, on the basis of the performance of a contract under Article 6.1.b GDPR.

We process data for tax, accounting and legal obligations, on the basis of a legal obligation under Article 6.1.c GDPR.

We process data for the security of the platform and the prevention of fraud and abuse, on the basis of legitimate interest under Article 6.1.f GDPR.

We process data to provide support and handle user requests, on the basis of the performance of a contract and of legitimate interest.

We process data to send marketing communications, on the basis of consent under Article 6.1.a GDPR, which can be withdrawn at any time.

We process data through non-technical and profiling cookies on the basis of consent, as set out in the Cookie Policy.

Providing the data necessary to deliver the service is mandatory and refusal prevents use of the platform; providing data for marketing purposes is optional.

Data is processed using electronic and telematic tools, with technical and organisational measures adequate to ensure its security, confidentiality and integrity and to prevent unauthorised access, loss or destruction, pursuant to Article 32 GDPR.

Data may be disclosed to Stripe (Stripe Payments Europe Ltd.) as the provider of payment services.

Data may be disclosed to IT, hosting, cloud and email service providers acting as data processors.

Data may be disclosed to landlords, students and service providers, limited to the data needed to conclude and perform the rental or the service: for example, the landlord receives the data of the student who books.

Data may be disclosed to advisors, professionals and providers, such as the accountant, for contractual and legal obligations.

Data may be disclosed to public authorities where required by law.

Parties processing data on behalf of the controller are appointed as data processors pursuant to Article 28 GDPR, and the updated list is available on request.

Data is not disseminated nor sold to third parties for their own purposes.

Some providers, for example technology providers or Stripe, may process data outside the European Economic Area.

In such cases the transfer takes place in compliance with Articles 44 et seq. of the GDPR, through adequacy decisions of the European Commission or Standard Contractual Clauses (SCC) and appropriate supplementary safeguards.

Account data is retained for the duration of the relationship and until the account is deleted.

Contractual and transaction data is retained for 10 years, in view of civil-law and tax obligations.

Marketing data is retained until consent is withdrawn or, in any case, for a maximum of 24 months from the last contact.

Technical and security logs are retained for a period of between 6 and 12 months.

Cookies are retained as set out in the Cookie Policy.

At the end of the indicated periods, data is deleted or anonymised.

As a data subject, the user may exercise at any time the rights provided for in Articles 15-22 of the GDPR.

The user has the right of access to their data, the right to rectification of inaccurate data and the right to erasure, that is the right to be forgotten.

The user has the right to restriction of processing, to data portability and to object to processing based on legitimate interest or for marketing purposes.

The user may withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Requests may be sent to privacy@casaperstudenti.it and the controller replies within 30 days.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

casaperstudenti.it does not carry out automated decision-making or profiling producing legal effects that significantly affect users within the meaning of Article 22 GDPR, except as may be described and permitted in the Cookie Policy.

The use of cookies and similar technologies is described in the Cookie Policy, which forms an integral part of this notice and is reachable from the site footer.

This notice may be updated, and the current version is always published on casaperstudenti.it with an indication of the date of the last update.

The data controller is casaperstudenti.it.

For requests concerning privacy, cookies and the exercise of your rights you can write to privacy@casaperstudenti.it.

The European Commission's ODR platform for online dispute resolution also remains available where relevant.