IT
ENPrivacy Policy – Direttiva Casa S.r.l. | ClouCasa®
PRIVACY POLICY
Version 2.4 · Last updated:
Information on the processing of personal data
under Articles 12, 13 and 14 of Regulation (EU) 2016/679 («GDPR») and Italian Legislative Decree 196/2003 («Privacy Code»), as amended
Version details
| Website | www.cloucasa.it | ||
|---|---|---|---|
| Data controller | Direttiva Casa S.r.l. | ||
| Version | 2.3 | ||
| Last updated | 21 October 2026 | ||
| Effective date | Upon publication on the Website | ||
| 2.4 | 21/10/2026 | 14:32 | Accessibility preferences saved in the browser |
Contents
- Introduction
- 1. Who processes your data and how to contact us
- 2. Scope and data sources
- 3. Data that may be processed
- 4. Processing purposes and retention
- 5. Cookies and tracking tools
- 6. Newsletter subscriptions and withdrawal
- 7. Galileo, reading and voice questions
- 8. Recipients and external services
- 9. Processing locations and transfers
- 10. Testimonials, photographs and listings
- 11. Security and data breaches
- 12. Your rights and how to exercise them
- 13. Minors and other people’s data
- 14. Updates and further information
Introduction
This notice explains how Direttiva Casa S.r.l., operating under the ClouCasa® trademark, processes personal data connected with browsing the Website, enquiries received and the features described below.
Data are processed according to the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation and security. Use the contents list to go directly to the topic that interests you.
1. Who processes your data and how to contact us
| Data controller | Direttiva Casa S.r.l. |
|---|---|
| Trademark | ClouCasa® |
| VAT number | 14157691008 |
| Registered office | Via Maria Barbara Tosatti 31, 00137 Rome, Italy |
| Legal representative | Maria Ippoliti, acting in the company’s name and on its behalf |
| Official PEC address | direttiva.casa@legalmail.it |
| Email for privacy requests | info@cloucasa.it |
The company is the data controller. Maria Ippoliti acts as its legal representative and does not thereby become an independent controller in her personal capacity.
You can use the PEC or email address above for questions and requests about your data. You do not need a PEC account to exercise your rights. You may also write to the registered office. Information about a Data Protection Officer, if appointed, will be made available on this page.
2. Scope and data sources
This notice covers browsing the Website, enquiries, appointments, viewings, valuations, contact by email, PEC, telephone and messaging, and requests concerning newsletters and data protection rights.
Data may come directly from you or, where relevant to the requested activity and lawfully permitted, from property portals, counterparties, other brokers, appointed professionals and public registers.
If data are not collected directly from you, the information required by Article 14 GDPR is provided within a reasonable period and in any event within one month of collection. If data are used to communicate with you, information is provided no later than the first contact; if disclosure to another recipient is envisaged, no later than the first disclosure. The earliest applicable deadline applies, subject to the exemptions in Article 14(5).
Relevant specific notices are provided for brokerage mandates, offers, contracts, anti-money-laundering customer due diligence and further services. Job applications are covered by the dedicated notice available on the Careers page.
3. Data that may be processed
Depending on the channel and request, data may include:
- identification and contact details, message content and availability for appointments;
- information about the property or service of interest and documents needed for the request;
- email addresses and communications concerning newsletter requests, consent and withdrawal;
- technical data needed for communications and security, such as IP address, request date and time, requested resources and browser information available to the systems used;
- privacy requests and information needed to verify the applicant’s identity or authority;
- text typed or dictated when using Galileo, as explained in section 7.
Please do not send health data, particularly confidential information, identity documents, bank details or third-party data unless necessary and requested through an appropriate channel. Special categories of data under Article 9 GDPR and criminal conviction or offence data are processed only where the specific legal requirements are met, not merely because they were provided voluntarily.
4. Processing purposes and retention
| Purpose | Legal basis | Retention and criteria |
|---|---|---|
| Responding to enquiries and arranging appointments, viewings and valuations | Article 6(1)(b) GDPR for requested pre-contractual steps; Article 6(1)(f) for non-contractual correspondence, in relation to the interest in handling and documenting responses | For handling the request and relevant follow-up. Once the enquiry is concluded, further retention is limited to information needed for legal obligations or the protection of rights |
| Operating and protecting the Website | Article 6(1)(f) GDPR: service availability and security | For the time required for technical and security purposes, according to the retention cycles of the services used; an incident may require targeted retention of evidence to manage it and protect rights |
| Handling newsletter requests and sending informational and promotional communications | Article 6(1)(a) GDPR and Article 130 of the Privacy Code: consent | Requests are retained to handle and document them. The address is used for communications until withdrawal or the service ends. Any retention of evidence of consent is limited to demonstrating its validity and protecting rights |
| Meeting contractual and legal obligations | Article 6(1)(b) and (c) GDPR | For the relationship and the periods applying to individual documents under civil, tax and anti-money-laundering law, as explained in specific notices |
| Handling privacy requests | Article 6(1)(c) GDPR and, for documenting their handling, Article 6(1)(f) | For handling the request and retaining documentation needed to demonstrate the response, taking account of time limits applicable to disputes |
| Establishing, exercising or defending a right | Article 6(1)(f) GDPR; where necessary and applicable, Article 9(2)(f) | For handling the complaint or dispute and the relevant limitation and appeal periods |
Retention is assessed according to purpose, necessity, whether a relationship remains open and applicable obligations. Once the reasons for retention end, data are erased or anonymised. Backup management must account for technical overwrite cycles and the need to prevent restoration of data that may no longer be used.
Providing the data necessary for your request enables us to deal with it; without this information we may be unable to respond or arrange the service. Newsletter consent is optional and refusing it does not affect other services.
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.
5. Cookies and tracking tools
Opinions on page usefulness
You may voluntarily indicate whether a page was helpful and, after a negative answer, select an optional reason. No name, email address or free-text message is requested. The feedback database records the page, answer, optional reason, date and a hash of a random receipt used to prevent duplicate submissions of the same answer. A page-specific receipt is kept in sessionStorage in your browser tab; it is not used to identify you across pages or for advertising. Results are available only to authorised agency staff and may be included in an internal weekly email summary. Technical service logs, where present, are separate from this feedback database.
The pages prepared by ClouCasa® do not include advertising profiling tools or behavioural analytics tags such as Google Analytics or Meta Pixel. This notice therefore does not describe a consent panel for advertising tools the Website does not use.
Any cookies or identifiers strictly necessary for operation, security or requested functions are distinct from optional tracking. The characteristics of tools actually used by the hosting service must be considered alongside this notice.
When you change the accessibility settings, your choices about text size, spacing, contrast, typeface, highlighted links and reduced motion are saved in this browser’s localStorage. The accessibility panel does not transmit these preferences to ClouCasa or third parties and does not use them for advertising. The preferences are used across the Website on the same browser and remain until you choose “Reset settings” or clear the Website data in your browser. If browser storage is unavailable, the controls still work on the open page.
If non-essential tools requiring consent are introduced, this notice will be updated and those tools will be activated only after the User’s choice, with options to refuse and withdraw consent.
Links to external websites do not themselves embed those services’ tracking tools in ClouCasa® pages. If you open a link, the conditions of the service you choose to visit also apply.
6. Newsletter subscriptions and withdrawal
You can subscribe to the ClouCasa® newsletter through the form managed using Brevo. On the Website, the external form loads only when you choose to open it; a link also lets you open it in a new tab. Opening it communicates technical connection data, such as your IP address and browser information, to Brevo.
Enter your email address and give consent using the dedicated checkbox. You will receive an email containing a confirmation link: your subscription to the list is completed after you click that link (double opt-in). The newsletter and form are currently in Italian.
Brevo is the service used to collect subscriptions, manage the list and send communications. Processing covers your email address, consent, and the technical information and subscription and confirmation events recorded by the service. For information about the provider’s processing, see the Brevo Privacy Policy. General provisions on recipients and any transfers are set out in sections 8 and 9 of this notice.
Consent is optional and covers ClouCasa® informational and promotional communications. You can withdraw it using the unsubscribe link in newsletters or by writing to privacy@cloucasa.it. Withdrawal does not affect the lawfulness of earlier processing. The minimum information necessary to respect your objection and prevent further messages may be retained. Retention criteria are set out in section 4.
For the complete terms on subscription, consent, retention, withdrawal and any optional profiling, read the newsletter privacy notice.
7. Galileo, reading and voice questions
Galileo helps you consult Website content. In its current configuration, it selects prepared answers based on words in your question; it does not send questions to a generative model to produce answers.
Typed text is processed in your browser. The assistant’s code does not send it to ClouCasa® or save a question history in your browser or a Website database.
The microphone starts only when you choose the relevant function and authorise your browser. Speech recognition uses browser features: depending on the browser and service, audio may be sent to external servers for transcription. ClouCasa® does not record audio through the assistant’s code. You can check the transcript before submitting the question to Galileo and stop the microphone.
Reading aloud also uses voices available through the browser or operating system. Some may depend on remote services; processing by those providers is described in their own privacy notices.
You can use text without activating the microphone or reading aloud. Do not include confidential information or unnecessary personal data in questions. Microphone permissions can be managed in browser settings.
8. Recipients and external services
As necessary to handle enquiries, data may be processed by the company’s authorised persons and providers of IT, hosting, email and PEC services, and by professionals, other brokers and counterparties involved in the requested service.
Providers processing data on the company’s behalf must be identified and governed as processors under Article 28 GDPR where applicable. Parties independently determining purposes and means act as independent controllers. You may request information about recipient categories and providers through the privacy contacts.
Data may be disclosed to competent authorities where legally required or necessary to protect a right. They are not sold or made available to third parties for their independent promotional campaigns.
When you contact ClouCasa® through an external service such as WhatsApp, or open a social network, map or linked website, the provider also processes data under its own notice. Direttiva Casa S.r.l. remains responsible for its own processing to handle the contact and for its obligations; linking to an external service does not exclude them.
9. Processing locations and transfers
The Website’s availability online does not mean all data are processed exclusively in Italy or the European Economic Area. Locations also depend on hosting and email providers and browser features used.
Any transfers by the Controller outside the European Economic Area must comply with Chapter V GDPR through an applicable adequacy decision or other statutory safeguards where necessary. You may request information about the countries concerned, relevant safeguards and how to obtain a copy.
10. Testimonials, photographs and listings
Information provided in private enquiries is not intended for publication. Separately, the Website may publish testimonials, names or initials, photographs and other personal content where an appropriate lawful basis exists, respecting the authorised scope and data minimisation.
Property listings and images should avoid unnecessary disclosure of data about owners, occupiers or third parties. Anyone who believes content exposes their data without a valid basis may report it, identifying the URL and relevant details. The report will be examined to assess appropriate action.
Using a first name and surname initial does not, by itself, guarantee anonymity. The criteria for collecting and presenting testimonials are described on the Reviews notes page.
11. Security and data breaches
The Controller must adopt technical and organisational measures appropriate to the risk under Article 32 GDPR. Security includes management of access, credentials, providers and documents, not only Website operation. No system can guarantee the complete absence of risk.
A personal data breach triggers the GDPR duties of assessment and documentation and, where the conditions apply, notification to the Authority within 72 hours of becoming aware of it where feasible, and communication to Data Subjects without undue delay where there is a high risk.
12. Your rights and how to exercise them
In the cases and within the limits provided by law, you can:
- obtain access to and a copy of your data, rectification or completion;
- request erasure or restriction of processing;
- receive data in a structured format and request portability where applicable;
- object to processing based on legitimate interests and, without giving reasons, to direct marketing;
- withdraw consent without affecting the lawfulness of previous processing;
- not be subject to decisions based solely on automated processing in the cases covered by Article 22 GDPR.
The features described do not make automated decisions producing legal or similarly significant effects. Galileo provides guidance about content; it does not decide on mandates, purchases, finance or job applications.
Send requests to info@cloucasa.it or the PEC address direttiva.casa@legalmail.it. You may also write to the registered office. Requests received through other channels will be examined, and clarification may be requested where necessary. Additional identity-verification information will be requested only when necessary, for example where there are reasonable doubts about the applicant’s identity.
A response is provided without undue delay and normally within one month. This may be extended by a further two months in the cases allowed by Article 12 GDPR, with reasons communicated within the first month. If a request is not granted, reasons and available remedies will be explained. Exercising rights is free, subject to the statutory exceptions for manifestly unfounded or excessive requests.
Statutory restrictions remain applicable, including those concerning anti-money-laundering duties and legal claims where the relevant conditions apply. Article 2-terdecies of the Privacy Code applies to deceased persons’ data.
You may complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, or the competent supervisory authority under Article 77 GDPR, and seek a judicial remedy. You do not have to contact us first to exercise these remedies.
13. Minors and other people’s data
The Website’s property services are directed at adults. If a request involves minors’ data, the situation must be assessed with the person holding parental responsibility or guardianship and according to the legal requirements.
If you provide other people’s data, send only what is necessary and what you are entitled to share. The company remains responsible for verifying the conditions for its own processing and providing the required information; these duties are not transferred entirely to the sender.
14. Updates and further information
This page states its version and last revision date and time in the Europe/Rome time zone. The timestamp does not change on each visit. Substantial changes are communicated appropriately, and new consent is requested where necessary.
| Version | Date | Time | Description |
|---|---|---|---|
| 1.0 | Not available | Not available | Previous version |
| 2.0 | 16/10/2026 | 10:56 | Revision of scope, contacts, retention, newsletter, Galileo and published content |
| 2.1 | 16/10/2026 | 20:39 | Brevo form integration and double opt-in subscriptions |
| 2.3 | 18/10/2026 | 20:10 | Dedicated newsletter privacy notice and updated withdrawal contact |
Specific notices supplement this page for the processing they cover. For rights in texts, images and the trademark, consult the Copyright and content use page. This notice does not limit mandatory statutory rights.
Privacy Policy – Direttiva Casa S.r.l. | ClouCasa® – Version 2.3 – Last updated: 18 October 2026, 20:10 (Europe/Rome, CEST, UTC+02:00).