Privacy Policy

The controller of the processing of personal data is Pippo Junior Ballo, via torquato tasso 78, 90144, palermo.

For any privacy-related request you can write to privacy@casaperstudenti.it.

No Data Protection Officer (DPO) has been appointed, as this is not mandatory.

Depending on how the platform is used, we may process identity and contact data such as first name, last name, email, phone number and address.

We process registration and account data, including credentials, any company details for property managers, preferences, and search and booking history.

We process listing data, namely the information about the property published by landlords.

Payment data is handled directly by Stripe: casaperstudenti.it does not store full payment card details, but may process transaction-related data such as amount, status and identifier.

We process browsing data such as IP address, browser and device type, technical logs, and data collected through cookies, as described in the Cookie Policy.

Finally, we process communications, namely the content of messages exchanged through the platform or sent to support.

To conclude a rental contract through the platform, we process the parties' details entered in the contract (including date and place of birth, residence and tax code or VAT number), the photos of identity documents uploaded by the parties, the electronic signature drawn on screen and the technical data of the signature: date and time, IP address, browser and device type (user agent) and a cryptographic fingerprint (hash) of the signed document. To confirm the signature we send a one-time code by email and, if the service is active, by text message to the phone number provided; the code expires after 10 minutes.

To receive payments, landlords and property managers provide their identity data and bank details (IBAN) directly to Stripe, in the payment activation procedure; home service companies may enter their IBAN and VAT number in their profile.

If you use the virtual assistant in your personal area, we process the questions you write and the replies generated. Conversations are not saved on our systems, but they are sent to the artificial intelligence provider listed in section 5 to generate the reply: please do not include personal data about yourself or other people.

As a rule, the provision of special categories of data under Article 9 GDPR is not required; users are asked not to enter such data in free-text fields.

We process data for registration, account management and the provision of the platform's services, on the basis of the performance of a contract under Article 6.1.b GDPR.

We process data to manage payments and fees through Stripe, on the basis of the performance of a contract under Article 6.1.b GDPR.

We process data for tax, accounting and legal obligations, on the basis of a legal obligation under Article 6.1.c GDPR. For landlords, property managers and service companies this includes the annual report to the Italian Revenue Agency required by the DAC7 rules (Legislative Decree 32/2023): identity, tax code, address, amounts received through the platform and fees, kept for 10 years.

We process data for the security of the platform and the prevention of fraud and abuse, on the basis of legitimate interest under Article 6.1.f GDPR.

We process contract data, identity documents and signatures to draw up and conclude the rental requested by the parties, on the basis of the performance of a contract under Article 6.1.b GDPR; the technical data of the signature (IP, user agent, date and time, document fingerprint) and the one-time code are used to guarantee the authenticity of the signature and to be able to prove it in case of dispute, on the basis of legitimate interest under Article 6.1.f GDPR.

We process the questions asked to the virtual assistant to answer requests for information on how to use the platform, on the basis of the performance of a contract under Article 6.1.b GDPR; using the assistant is optional.

We process data to provide support and handle user requests, on the basis of the performance of a contract and of legitimate interest.

We process data to send marketing communications, on the basis of consent under Article 6.1.a GDPR, which can be withdrawn at any time.

We process data through non-technical and profiling cookies on the basis of consent, as set out in the Cookie Policy.

Providing the data necessary to deliver the service is mandatory and refusal prevents use of the platform; providing data for marketing purposes is optional.

Data is processed using electronic and telematic tools, with technical and organisational measures adequate to ensure its security, confidentiality and integrity and to prevent unauthorised access, loss or destruction, pursuant to Article 32 GDPR.

Data may be disclosed to Stripe (Stripe Payments Europe Ltd.) as the provider of payment services.

Data may be disclosed to IT, hosting, cloud and email service providers acting as data processors. In particular: Vercel Inc. (website hosting and, only with your consent, visit statistics), Supabase Inc. (database and storage of uploaded files), Resend (sending emails), Twilio Inc. (sending text messages with the signature code, if the service is active) and Anthropic PBC (artificial intelligence service of the virtual assistant, which only receives the text of conversations with the assistant). Only with your consent to the Marketing cookie category, Meta Platforms Ireland Ltd. receives non-identifying browsing data through the Meta Pixel, to measure our advertising campaigns (see Cookie Policy).

To show listings on the map, property addresses and university names are sent from our server to the Nominatim geocoding service of the OpenStreetMap Foundation, which converts them into coordinates; it does not receive data about users browsing the site.

Data may be disclosed to landlords, students and service providers, limited to the data needed to conclude and perform the rental or the service: for example, the landlord receives the data of the student who books.

For home services, the company sees the city and postal code of the request; the client's street address and phone number are shown to it only after it accepts the booking and for up to 30 days after completion, never for declined or cancelled requests.

Data may be disclosed to advisors, professionals and providers, such as the accountant, for contractual and legal obligations.

Data may be disclosed to public authorities where required by law.

Parties processing data on behalf of the controller are appointed as data processors pursuant to Article 28 GDPR, and the updated list is available on request.

Data is not disseminated nor sold to third parties for their own purposes.

Some providers, for example technology providers or Stripe, may process data outside the European Economic Area. In particular, Vercel, Supabase, Resend, Twilio and Anthropic are companies based in the United States and may process data in the United States.

In such cases the transfer takes place in compliance with Articles 44 et seq. of the GDPR, through adequacy decisions of the European Commission (for the United States, the EU-U.S. Data Privacy Framework, for providers certified under it) or Standard Contractual Clauses (SCC) and appropriate supplementary safeguards.

Account data is retained for the duration of the relationship and until the account is deleted.

Contractual and transaction data is retained for 10 years, in view of civil-law and tax obligations.

Marketing data is retained until consent is withdrawn or, in any case, for a maximum of 24 months from the last contact.

Photos of identity documents uploaded to sign a contract are deleted 12 months after the contract ends, or 90 days after cancellation if the contract was never signed. The contract text, the parties' details and the signatures are kept for the statutory retention period stated above.

The one-time signature code is deleted as soon as it is used and in any case stops working after 10 minutes. Uploaded files that are not confirmed (for example an interrupted upload) are deleted within 48 hours.

Technical error logs are retained for 12 months; the log of operations carried out by the platform's administrators (for example moderation, verifications and deletions) for 24 months, for security purposes and to protect legal rights.

Notifications in the personal area that have already been read are deleted after 12 months.

Cookies are retained as set out in the Cookie Policy.

At the end of the indicated periods, data is deleted or anonymised.

As a data subject, the user may exercise at any time the rights provided for in Articles 15-22 of the GDPR.

The user has the right of access to their data, the right to rectification of inaccurate data and the right to erasure, that is the right to be forgotten.

The user has the right to restriction of processing, to data portability and to object to processing based on legitimate interest or for marketing purposes.

The user may withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Requests may be sent to privacy@casaperstudenti.it and the controller replies within 30 days.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

casaperstudenti.it does not carry out automated decision-making or profiling producing legal effects that significantly affect users within the meaning of Article 22 GDPR, except as may be described and permitted in the Cookie Policy.

The use of cookies and similar technologies is described in the Cookie Policy, which forms an integral part of this notice and is reachable from the site footer.

This notice may be updated, and the current version is always published on casaperstudenti.it with an indication of the date of the last update.

The data controller is Pippo Junior Ballo, via torquato tasso 78, 90144, palermo.

For requests concerning privacy, cookies and the exercise of your rights you can write to privacy@casaperstudenti.it.