Privacy Policy

Joanne Barley, licensed real-estate agent registered with the Chamber of Commerce of Verbania (REA No. 194745), VAT IT02019120035, is the data controller under EU Regulation 2016/679 (GDPR). Address: Corso Zanitello 9, 28922 Verbania (VB), Italy Email: [email protected] Phone: +39 0323 503440 For full business credentials see our Legal Notice page.

1. Browsing the site Standard traffic data (IP address, page visited, user-agent, referrer). This data is processed in aggregated form by our analytics provider Plausible Analytics (see Providers), without cookies and without building individual profiles. 2. Contact forms When you fill in a contact form, property inquiry, or valuation request, we collect: first name, last name, email, phone (optional), message, language, and — for property-specific inquiries — the property identifier. Submissions are stored as documents in our content-management system Sanity (Norway, EEA). To rate-limit form abuse we store a cryptographic hash (SHA-256) of your IP address with a daily-rotating salt, for a maximum of 32 days. Your raw IP is never stored. Legal basis - Browsing and aggregated statistics: Art. 6(1)(f) GDPR — legitimate interest in understanding site usage in aggregate. - Contact forms: Art. 6(1)(b) GDPR — pre-contractual steps taken at your request.

The site is operated with the following providers: Nodion (Germany, EU) — hosting provider. Receives every HTTP request to the site and maintains standard access logs. Plausible Analytics (EU) — cookie-less aggregated analytics; no personally identifiable data collected. Sanity AS (Oslo, Norway, EEA) — content management system and image CDN. Holds the site's content and inquiry documents. Google Workspace (Google LLC, USA) — business email (Gmail) and delivery of notification emails generated by contact forms. Transfers to the United States are governed by the European Commission's Standard Contractual Clauses. See Google's Privacy Policy and the Google Cloud data processing addendum. TurboSMTP (Delivery Tech S.r.l., Italy) — transactional SMTP service used for certain automated sends (e.g. form notifications). Google Maps (Google LLC, USA) — used only on the Map page (/en/map). Loading Google Maps causes Google to set cookies. We are migrating to a cookie-less map solution (OpenStreetMap); until that migration ships, visiting the Map page transfers data to Google LLC in the USA. See Google's Privacy Policy. YouTube (Google LLC, USA) — property videos use a facade pattern: no data is sent to YouTube unless you click play. Only upon Play do YouTube's terms and privacy settings apply. Primary processing of your personal data (hosting, content, analytics) takes place within the EU/EEA. Transfers to the United States are limited to: Google Workspace (business email under Standard Contractual Clauses), Google Maps (when you visit the Map page), and YouTube (on voluntary user interaction).

- Inquiry documents: retained indefinitely as operational records. You may request deletion at any time (see Rights). - IP-address hash: 32 days, then automatically deleted. - Email correspondence: 2 years, or longer while a transaction is ongoing. - Plausible aggregated statistics: no personal data; retained per Plausible's own policy.

The site follows a cookieless-by-default approach for ordinary browsing: - Public pages (home, properties, agents, etc.): no cookies. - Map page: Google Maps currently sets cookies (temporarily — we are migrating to cookieless OpenStreetMap). - Property videos: YouTube only sets cookies if you click play. - "Diamonds" private-access area (via a personal invitation link): a single strictly-necessary first-party session cookie diamonds_session (httpOnly, Secure, SameSite=Strict, 24-hour lifetime, scope /diamonds) under the Art. 5(3) ePrivacy Directive exemption. For the full breakdown see the Cookies page.

TODO(counsel): attribution-cookie disclosure

We do not sell or share your personal data for marketing purposes. The technical providers listed above access data only to deliver their service (hosting, content management, email delivery) and are bound by data-processing agreements under Art. 28 GDPR. Data may be disclosed to competent authorities only under a legal obligation or substantiated legal request.

At any time you have the right to: - Access (Art. 15): confirmation of processing and a copy of your data. - Rectification (Art. 16): correction of inaccurate or incomplete data. - Erasure (Art. 17): deletion of your data, subject to legal retention obligations. - Restriction (Art. 18): temporary pause of processing. - Portability (Art. 20): receive your data in a structured, machine-readable format. - Objection (Art. 21): object to processing on legitimate grounds or to direct marketing. To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante, https://www.gpdp.it).

Under EU Regulation 524/2013 we inform you that the European Commission provides a platform for online dispute resolution: https://ec.europa.eu/consumers/odr

Data Controller Joanne Barley Corso Zanitello 9, 28922 Verbania (VB), Italy [email protected] +39 0323 503440 VAT: IT02019120035 · Chamber of Commerce Verbania · REA No. 194745 · FIAIP member