Privacy notice

PURSUANT TO ARTICLES 13 AND 14 OF THE (EU) REGULATION 2016/679

ON THE PROCESSING OF PERSONAL DATA

This privacy notice is provided in compliance with the legislation on the protection of natural persons with regard to the processing of personal data set forth in (EU) Regulation 2016/679 ("Regulation" or "GDPR") and Prelios Agency S.p.A. ("Prelios"), having its registered office in Via Valtellina, 15/17, Milan, is hereby informing you about the processing of your personal data. The present notice and the regulations applicable to it may change over time. Prelios reserves the right to amend the policy itself and, therefore, we suggest you periodically consult this page.

1. DEFINITIONS

The meaning of some of the terms used in this Notice is given in order to facilitate understanding:

1. Data Protection Officer: the Data Protection Officer appointed by the Data Controller pursuant to Article 37 GDPR.
2. Personal Data: such is any information concerning an identified or identifiable natural person ("Data Subject"); an identifiable person is any natural person who can be identified, directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more characteristic elements of his or her physical, physiological, genetic, mental, economic, cultural or social identity.
3. Delegated parties: real estate agents, brokers or other parties appointed by Prelios Agency S.p.A. to collect Data as part of the management of real estate mediations and leases.
4. Prelios Group: the business group to which Prelios Agency S.p.A. belongs.
5. Data Subject: the natural person whose Personal Data are processed by Prelios Agency S.p.A.
6. Processing: means any operation or set of operations, performed with or without the aid of automated processes and applied to Personal Data or sets of Personal Data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, erasure or destruction.
7. Data Processor: is the natural or legal person, public authority, service or other body that processes Personal Data on behalf of the Data Controller.
8. Data Controller: Prelios Agency S.p.A. which determines the purposes and means of the processing of the Personal Data of the Data Subject.

2. SOURCE AND TYPE OF DATA PROCESSED

The Personal Data are communicated to Prelios directly by the Data Subjects for whom Prelios has received a real estate brokerage assignment and/or a proposal for the purchase or sale of real estate and/or a proposal relating to the rental of one or more properties (hereinafter the "Assignment") or collected through the Delegated Parties working with the Data Controller. The Personal Data to be collected and processed by the Data Controller are Identification and Contact Data of the Data Subject such as, but not limited to:

• first name, last name, social security number, copy of identity card, telephone number and e-mail address.

3. PURPOSES OF THE PROCESSING

Prelios informs that the Personal Data are processed, in compliance with provisions provided for Data Protection, for the following purposes:

1. management of the activities inherent to the execution of the Assignment;
2. detection of the degree of customer satisfaction, as a result of the service rendered;
3. market surveys and statistical processing;
4. promotion of services and offers within the real estate sector through e-mails, newsletters and re-contact calls;
5. performance of regulatory obligations arising from anti-money laundering regulations in the case of an assignment having as its object the purchase and sale of real estate and/or the rental of real estate limited only to transactions for which the monthly fee is equal to or greater than 10,000 euros, in addition to compliance with any other legal obligation or administrative measure;
6. defense of the Controller's rights and interest, in or out of court, if necessary.

We hereby clarify as of now that, within the scope of the Assignment we may receive inbound calls from users who are interested in the offers to buy and/or sell and/or rent and/or conduct real estate published on the portals and websites of Prelios and our business partners.

In this case, the Data will be processed exclusively to follow up on the requests of users who show interest in the services offered and will be managed in accordance with the provisions of the Regulations, based on the contractual and pre-contractual relationship established with the Data Subject.

4. LEGAL BASES OF THE PROCESSING

The legal bases for the Processing of Personal Data are as follows:

1. with respect to the purpose referred to in Art. 3, (a): the need to proceed with the Processing for the purpose of contract execution and/or for the management of pre-contractual relationships.
2. With respect to the purposes referred to in Article 3 (b): the Processing of Data is carried out on the basis of the legitimate interest of the Data Controller to improve the offer to the user and the quality of its service.
3. With regard to statistical processing (c), the Data is anonymized by the Data Controller and cannot be traced back to the individual, while the Data collected for market survey activity is based on the consent of the Data Subject.
4. With respect to statistical processing (c), the Data is anonymized by the Data Controller and cannot be traced back to the individual, while the Data collected for market survey activity is based on the consent of the Data Subject.
5. With respect to the purpose of Article 3 (d), the Data is processed based on the consent of the Data Subject to receive marketing communications. Please note that in the event that the Data Subject has benefited from certain services of the Data Controller, the Contact Data could be used to offer services similar to those already rendered by the Data Controller, based on Prelios' legitimate interest in keeping its users updated about its services and the news offered.
6. With reference to the purposes set forth in point 3 (e): Processing is carried out on the basis of compliance with legal obligations imposed by the law.
7. The collection and management of Data for the purposes referred to in point 3, (f) is the legitimate interest for the defense of the rights and interests of the Data Controller in judicial or extrajudicial.

5. NATURE OF THE PROVISION AND METHODS OF DATA PROCESSING

The provision of the Personal Data referred to in point 3, (a) is necessary to enable the execution of the Assignment given to Prelios and for the fulfillment of the obligations imposed by the law. Failure to provide the Data entails the impossibility of pursuing the previously indicated purposes. With reference to the purposes referred to in point 3, (c) and (d), failure to provide Data does not affect the performance of the Assignment given to Prelios. For each of the purposes referred to in point 3, the Processing is carried out by means of computer, telematic and manual tools, with logics strictly related to the purposes themselves and, in any case, in such a way as to ensure the protection, confidentiality and security of the Data Subject's Personal Data.

6. DATA RETENTION PERIOD

Personal Data are stored by the Data Controller, also through third parties to whom they have been disclosed pursuant to the following paragraph until the Data Subject requests their deletion and, in any case, for as long as necessary to fulfill the purposes set forth in point 3 of this policy, in compliance with the terms set forth in the applicable regulations on the subject, as well as in accordance with the law for the preservation of corporate documents and legal obligations such as the requirements of current anti-money laundering regulations.

With reference to inbound phone calls, we may store Data related to the recordings of some phone calls received in order to assess the quality of the service rendered by our operators. Please note as of now that we will inform the user of the possibility of being recorded.

7. RECIPIENTS OF THE PROCESSING

Within Prelios, the individuals who may have access to the Data are the employees and collaborators duly authorized by the Data Controller to carry out such Processing operations, as well as the System Administrators. In order to carry out some of the activities related to the Processing, and always for the purposes set out in point 3, Prelios may disclose the Data Subject's personal information to companies that are part of the Prelios Group, to the owners or lessors of the real estate properties that are the subject of the Assignment given to Prelios or to external suppliers, who operate in the real estate sector and collaborate with Prelios, as autonomous "Data Controllers", unless they have been designated by Prelios as "Data Processors" of the processing operations of their specific competence. For the handling of inbound calls, we may use external providers duly appointed as Data Processors pursuant to Article 28 GDPR.

8. DATA TRANSFER ACTIVITIES

The management and storage of the Data is performed on physical archives and on servers of the Data Controller and/or third-party companies appointed as Data Processors. The servers are located in Italy and within the European Union. Personal Data are not subject to transfer outside the European Union ("extra EEA").

It is in any case understood that the Data Controller, should it become necessary, will have the right to move the location of the archives and servers to Italy and/or the European Union and/or countries outside the EEA. In this case, the Data Controller assures as of now that the transfer of the Data outside the EEA will take place in compliance with the applicable legal provisions by entering, if necessary, into agreements that guarantee an adequate level of protection and/or by adopting the standard contractual clauses provided by the European Commission.

9. DATA SUBJECTS’ RIGHTS

Pursuant to the Regulations, the Data Subject has the right to:

1. with respect to the processing of your Personal Data, you have the right to:
2. obtain confirmation of the processing of Personal Data by the Data Controller and request a copy thereof;
3. request the updating, integration, rectification of Personal Data that the Data Subject considers to be incorrect or incomplete;
4. request for the erasure of Personal Data or limit the manner in which it is used;
5. withdraw consent, request anonymization or request blocking of the processing of Personal Data (to the extent that the processing is based on consent);
6. receive a copy of your Personal Data provided in a structured, commonly used format and transmit the same to a third party (to the extent that the Legal Basis is consent or a contract);
7. object to the processing of your personal data by the Controller;
8. data portability, i.e. to receive a copy of your personal data processed on the basis of your consent and to obtain the transmission of your personal data to another Data Controller, if technically feasible;
9. request from the Controller the communication of all recipients of the Personal Data Processing concerning him/her;
10. file a complaint with the Data Protection Authority or appeal to the judicial authority. To access their Personal Data, in particular to obtain at any time confirmation of the existence or non-existence of the same and to know their content, origin, geographical location, as well as to request a copy.

10. METHODS OF EXERCISING RIGHTS

To exercise the rights referred to in Section 8, the Data Subject may contact the Data Controller or the Data Protection Officer by writing to:

• e-mail: privacy@prelios.com or
• registered mail with return receipt:

"Privacy" header
Prelios Agency S.p.A.
Via Valtellina, 15/17
20159, Milan (MI)

The time limit for responding to the Data Subject is thirty days, extendable up to three months in cases of particular complexity; in such cases, the Data Controller shall provide at least one interlocutory communication to the Data Subject within the thirty-day period.

The exercise of rights is, in principle, free of charge; the Data Controller reserves the right to ask for a fee in the event of manifestly unfounded or excessive requests (including repetitive ones), also in light of any indications that may be provided by the Data Protection Authority.

11. LODGE A COMPLIANT TO THE DATA PROTECTION AUTHORITY

The Data Subject has the right to lodge a complaint with the Data Protection Authority, which can be contacted at https://www.garanteprivacy.it/.

LIST OF BUSINESS PARTNERS AND COMPANIES OF PRELIOS