Privacy policy

Data controller

The data controller is Andrea Padoan, who personally provides the pre-visit analysis service described on this site. Contact details for any privacy matter are given at the foot of this page.

What data I collect

I collect only the data needed to carry out the engagement. I do not ask you for your ID document: I have no use for it.

• Contact details: first and last name, email, country of residence, and your number if you message me on WhatsApp.
• Property details: the listing link and the questions you set me.
• Payment data: amount, date and outcome. Your card or account details never reach me — PayPal handles those directly.
• Messages exchanged in the client area.

Why I process it, and on what legal basis

Each processing operation has a specific legal basis:

• Performance of the contract (art. 6.1.b GDPR): running the engagement, collecting the documentation the agency makes available, delivering your report, taking payment.
• Legal obligation (Art. 6(1)(c) GDPR): retaining accounting and tax records for the periods Italian law requires.
• Legitimate interest (Art. 6(1)(f) GDPR): defending a legal claim, should that become necessary.
• Consent (Art. 6(1)(a) GDPR): only for submitting the engagement request form. You can withdraw it at any time.

Who I share data with

I do not sell or trade your data. It is processed on my behalf, as processors, only by the technical providers the service needs to run:

• Supabase — database, authentication and document storage.
• Vercel — website hosting.
• PayPal — payment collection, acting as its own controller for payment data.
• Resend — sending service emails.

Transfers outside the European Union

The infrastructure is configured on servers in the European Union. Some providers are companies established in the United States and may process data outside the EU; where that happens, the transfer relies on the Standard Contractual Clauses approved by the European Commission.

How long I keep it

The minimum necessary, and no longer:

• Property documents, report and messages: 24 months after the case closes, so I can re-send the material if you lose it.
• Accounting and tax records: 10 years, as Italian law requires.
• Engagement requests that did not proceed: 12 months.

Your rights

You can exercise the rights under Articles 15 to 22 GDPR at any time:

• Access your data and receive a copy.
• Have inaccurate data corrected.
• Request erasure, where I am not under a legal duty to retain it.
• Request restriction of processing, or object to it.
• Receive your data in a machine-readable format and move it elsewhere.
• Withdraw consent, without affecting the lawfulness of processing already carried out.
• Lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, if you believe the processing breaches the GDPR.

No profiling

I do not profile you, I make no automated decisions about you, and I do not use your data for advertising. The site carries no analytics tools and no advertising pixels.

How to exercise your rights

For any request concerning your data, including erasure and access, write to andrea.padoan@gmail.com