Privacy Policy
What data we process when you use the service, why, for how long, and how you can exercise your rights.
This page is a translation for convenience. The Italian version is the legally binding text and prevails in case of any discrepancy.
This notice explains how we process the personal data of anyone who visits https://vicinalia.com, creates an account, or buys a report or subscription on Vicinalia. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Data Protection Code (Legislative Decree 196/2003).
Who is the data controller
The data controller is Vicinalia.com, with registered office at via Pietro Custodi, 3, 20136 Milano (MI).
- Ragione sociale
- Vicinalia.com
- Sede legale
- via Pietro Custodi, 3, 20136 Milano (MI)
- Partita IVA
- IT12538520961
- [email protected]
- Telefono
- 3474208123
- Privacy
- [email protected]
- Social
For any question about this notice or your data, write to [email protected].
No Data Protection Officer (DPO) has been appointed, as the type and volume of processing carried out does not make this mandatory.
What data we process
Account data
- name and email address;
- password, stored only in hashed form using a hashing function (we cannot read it);
- registration date and email verification status;
- if you enable two-factor authentication: the secret used to generate temporary codes and the recovery codes, stored encrypted;
- if you use a passkey: the public key associated with your device (the private key stays on your device);
- if you choose to register or sign in with Google or Microsoft: the name, email address and unique identifier the provider sends us, to link the sign-in to your account. We do not receive or store your Google or Microsoft password.
Searches and reports
- the addresses or cadastral identifiers you search for, and the municipality;
- the reports you create, with their content, and the PDF saved on the server in a private area;
- your report history in your personal area, the plan or access method used, the number of reports created in the month and in the subscription year, your renewal choice and the expiry notices sent.
Reports describe a property or a land parcel, not a person. The service does not process owners' names or other owner data, which is not open data. In some cases, however, an address linked to your account may relate to you directly (for example if you search for your own home): in that case we treat it as your personal data, with the same protections as any other data.
Address searches use our own database: the addresses you type are not sent to external geocoding services.
Payments and invoicing
- customer identifier assigned by Stripe;
- payment method type and last 4 digits;
- status of subscriptions and payments;
- invoicing details: name or company name, address, tax code or VAT number.
Full card details and other payment method details are entered directly on Stripe: we do not receive or store them.
Messages from the contact form
If you write to us using the form on the Contact page, we process:
- your name, email address, the topic you choose and the text of your message;
- the report code, if you add it;
- the language of the page you write from and, if you are signed in, the link to your account;
- an encrypted fingerprint of your IP address (not the address itself), to limit repeated submissions and block abuse;
- the date you sent it and whether we have replied.
Before sending, the form uses Cloudflare Turnstile, an automatic check that tells people apart from bots without profiling cookies. Your message is emailed to the person who handles the topic you chose, and we send a copy to the address you give us. We do not use this data to send you promotions.
Technical and security data
- server and application logs: IP address, date and time, page requested, user agent (browser type and operating system), any errors;
- request-limit counters per IP address, used to block abuse;
- if you are granted free access: plan, monthly limit, expiry date and history of grants and revocations.
Browsing data with your consent
Only if you consent through the cookie banner, we collect statistics and marketing data with Google Analytics 4, Google Ads and Meta Pixel. The events measured are: searches (type and outcome, municipality and province), report creation and download, registration and login, and views of the prices page. We do not send these services your email, name, full address, parcel details or report identifiers. Details are in the Cookie Policy.
Why we process data and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Creating and managing the account, secure access | Account data | Contract and pre-contractual measures (Art. 6.1.b GDPR) | Until account deletion, then up to 30 days in backups |
| Generating reports, storing them in your personal area, applying plan limits | Searches, reports, PDFs, counters | Contract (Art. 6.1.b) | While the account is active |
| Managing payments and subscriptions | Payment data | Contract (Art. 6.1.b) | 10 years from the transaction |
| Issuing invoices and keeping accounts | Invoicing and payment data | Legal obligation (Art. 6.1.c) | 10 years |
| Sending service emails | Name, email, report or subscription data | Contract (Art. 6.1.b) | As for the account |
| Managing free access granted to testers, partners or press | Account data, grant history | Contract (Art. 6.1.b) | For the lifetime of the account |
| Security, abuse and fraud prevention | Technical logs, per-IP counters | Legitimate interest (Art. 6.1.f) | 90 days, unless needed for an incident |
| Establishing, exercising or defending a legal claim | Data relevant to the case | Legitimate interest (Art. 6.1.f) | For the duration of the dispute and any appeal periods |
| Replying to messages from the contact form and other requests | Name, email, topic, message, report code, account if you are signed in | Pre-contractual measures and contract (Art. 6.1.b) for questions about the service; legitimate interest in replying (Art. 6.1.f) in other cases | 24 months from sending, then deleted automatically |
| Protecting the contact form from automated and repeated submissions | Turnstile check result, encrypted IP fingerprint, submission counters | Legitimate interest (Art. 6.1.f) | Counters: 24 hours; fingerprint: as for the message |
| Usage statistics via cookies | Browsing events, cookie identifiers | Consent (Art. 6.1.a) | As set by each service, see Cookie Policy |
| Marketing and campaign measurement | Browsing events, cookie identifiers | Consent (Art. 6.1.a) | As set by each service, see Cookie Policy |
The legitimate interest for security consists of protecting the service, users and data from unauthorised access, attacks and misuse. You can object to this processing as explained below.
What happens if you do not provide your data
Name, email and password are required to create an account. Payment and invoicing data are required to make a purchase. Without this data we cannot provide the service. Two-factor authentication and passkeys are optional. Consent to statistics and marketing cookies is optional: if you do not give it, the site works exactly the same.
Service emails and commercial communications
We only send you emails linked to the service: address verification, password reset, report notices, and communications about your subscription, renewals and payments. These emails cannot be turned off while your account is active, as they are needed to perform the contract.
We currently do not send newsletters or promotional messages. If we do so in future, it will only be with your consent, or, for services similar to ones you have already bought, to the email address you provided when purchasing, as allowed under Article 130(4) of the Italian Data Protection Code. In that second case you may object at any time, including with a single click in each message. We will update this notice before we start.
External services that only receive coordinates or technical data
For some report sections, our server sends public services only the geographic coordinates of the point, with no data about you:
- PVGIS, a service of the European Commission's Joint Research Centre (JRC), for solar data;
- the Revenue Agency's GeoPOI service, to identify the OMI valuation zone;
- AGCOM's broadband map, for network coverage.
The map on the property page loads background imagery from the OpenFreeMap service directly from your browser. OpenFreeMap receives your IP address and the map area you are viewing, as happens with any resource loaded from a website. It does not use cookies.
Who we share data with
We do not sell personal data and do not pass it to third parties for their own commercial purposes. We only share it with:
| Recipient | Role | What they do | Data |
|---|---|---|---|
| Hosting provider with servers in the European Union | Data processor | Hosts the site, database, PDFs and backups | All service data |
| Cloudflare, Inc. | Data processor | DNS, content delivery, protection against attack traffic, Turnstile check on registration, sign-in and the contact form | IP address, requests to the site, technical browser data for the check |
| Stripe Payments Europe, Limited | Processor for payment processing on our behalf; independent controller for its own legal, anti-money-laundering and fraud-prevention obligations | Payments and subscriptions | Payment data, email, name |
| Email delivery provider | Data processor | Delivery of service emails | Name, email, message content |
| Google Ireland Limited and Microsoft Ireland Operations Limited | Independent controller | Sign-in and registration with Google or Microsoft, only if you choose this option | Name, email, account identifier with the provider |
| Google Ireland Limited and Google LLC | Only with your consent: Tag Manager, Analytics and Ads | Statistics and campaign measurement | Browsing events, cookie identifiers, technical device data |
| Meta Platforms Ireland Limited | Only with your consent: Meta Pixel | Advertising campaign measurement | Browsing events, cookie identifiers, technical device data |
| Accountant and advisors | Processors or independent controllers, depending on the engagement | Accounting, tax, legal assistance | Invoicing data and data needed for the engagement |
| Public and judicial authorities | Independent controllers | Requests required by law | Data requested |
Our data processors act under a contract that requires them to use the data only on our instructions and with adequate security measures. You can ask for the up-to-date list of processors by writing to [email protected].
For processing where they act as independent controllers, the individual providers' own notices apply: Stripe, Google (and, for advertising and measurement services, Google Business Data Responsibility), Microsoft, Meta, Cloudflare.
Transfers outside the European Union
We keep service data on servers in the European Union. Google, Meta, Cloudflare and Stripe belong to groups based in the United States, so some data may be transferred to, or accessed from, the United States. These transfers take place:
- to companies certified under the EU-US Data Privacy Framework, based on the adequacy decision adopted by the European Commission on 10 July 2023;
- in other cases, based on the standard contractual clauses approved by the European Commission (Art. 46 GDPR), with any supplementary measures.
You can ask for information about the safeguards adopted by writing to [email protected].
How long we keep data
In summary:
- account: until you delete it or ask us to; backup copies are overwritten within 30 days;
- reports and PDFs: while the account is active; PDFs can be deleted and regenerated from the report content;
- payment and invoicing data: 10 years, as required by civil and tax law;
- messages from the contact form: 24 months from sending, then deleted automatically;
- technical logs: 90 days, unless needed to investigate a security incident or defend a legal claim;
- cookie choice: 182 giorni, after which we ask you again;
- free access and its history: for the lifetime of the account.
Once these periods expire, data is deleted or irreversibly anonymised.
Automated decisions and profiling
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. The calculation of plan limits, monthly and annual, is a simple count of reports. We do not carry out profiling without your consent: marketing cookies, which may be used to show you adverts on other sites, are only active if you accept them.
Minors
The service is reserved for adults. We do not knowingly collect data from anyone under 18. If we become aware that an account was created by a minor, we delete it.
Security
We use encrypted connections (HTTPS), hashed passwords, two-factor authentication and optional passkeys, encryption of access secrets, access to data restricted to authorised staff, backups, and request limits to block abuse. No system is 100% secure: in the event of a data breach that poses a risk to you, we will act as required by Articles 33 and 34 of the GDPR.
Your rights
Within the limits set by the GDPR, you have the right to:
- access: know whether we process your data and receive a copy of it (Art. 15);
- rectification: correct or complete your data (Art. 16);
- erasure: obtain deletion of your data, except what we must keep by law, such as invoices (Art. 17);
- restriction: ask for your data to be only stored, for example while we check a dispute (Art. 18);
- portability: receive, in a structured, machine-readable format, the data you provided to us that we process under contract or consent (Art. 20);
- objection: object to processing based on legitimate interest, for reasons linked to your particular situation, and at any time to direct marketing (Art. 21);
- withdrawal of consent: withdraw your consent at any time, without affecting processing already carried out; for cookies use the "Cookie preferences" link at the bottom of every page.
To exercise these rights, write to [email protected] or use the form on the Contact page with the topic "Privacy and personal data", giving the email address linked to your account. If you write from a different address, we may ask you to confirm your identity. We respond without undue delay and in any case within one month; in complex cases the deadline may be extended by a further two months, and we will tell you within the first month if that happens. The response is free of charge, except for manifestly unfounded or excessive requests.
To close your account, write to [email protected]: we delete the account, searches and reports, and keep only the invoicing data for the period required by law.
If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority or the supervisory authority of the EU country where you live or work, or go to court. The text of the GDPR is available on EUR-Lex.
Changes to this notice
We may update this notice when services, providers or the law change. The date of the last update is shown on this page. If the changes are significant, for example a new type of processing or a new category of recipient, we will tell you by email or with a notice in your personal area and, where necessary, ask for your renewed consent.
For the terms of use of the service, see the Terms of Service. For cookies, see the Cookie Policy.
Check an address
Enter the address: the report summarises risks, local prices, population, services and transport, with the source for every figure.
For example: Via Dante 7, Milan.