Privacy Policy

1. Identity and contact details of the data controller

The data controller is Michelangelo-S.r.l. with headquarters in Milan at Via Montenapoleone 18, VAT number 04407490962 PEC: michelangelosrl-@legalmail.it, REA:MI-1745470, hereinafter also”Company”. Since the Data Controller is established in Italian territory, no representative has been appointed.

2. Contact details of the data protection officer

The Data Controller has not appointed a data protection officer, but reserves the right to appoint him at a later stage by means of communication in the manner necessary and provided for this purpose.

3. Purposes of the processing and legal basis of the processing

Personal data will be processed for the following purposes:

1. If required, for contractual purposes and/or related to the execution of pre-contractual measures adopted at your specific request, as well as to fulfill any legal obligations related to these purposes, and in particular, to allow you to be contacted, if necessary, for the purpose of evaluating the possibility of buying a property, to conclude specific contracts aimed at establishing a right of priority over the purchase of a property limited in time, or to formulate a purchase proposal. In this case, the legal basis is the need to proceed with the processing for the purpose of the execution of the contract and/or for the management of pre-contractual relationships;
2. To send direct marketing communications, newsletters, advertising material, through traditional contact systems and automated computer systems, including commercial or promotional communications by email or SMS, or for market research and analysis. In this case, consent, expressed in accordance with this information, constitutes a legal basis;
3. For purposes related to related legal obligations if processing has been carried out for the purposes referred to in letter a). In this case, the legal basis is the legal obligation of the Data Controller to process such personal data in accordance with applicable national legislation.

4. Methods of expressing consent

Consent, where required, may be expressed by signing a computerized document, also through specific flagboxes.‍

5. Processing methods and logic

• In relation to personal data processed and stored for the purposes referred to in point a), number 3 of this information (contractual and pre-contractual purposes) and followed by number 3, point c) (legal purposes), the processing will take place using paper tools, automated logic and the use of CRM management software managed in the cloud, which will make it possible to better manage the fulfillment of contractual obligations;
• In relation to personal data processed for the purposes referred to in point b) number 3 of this information (marketing purposes), the processing will be carried out using software for sending commercial information;

6. Source from which personal data originate

Only the data provided in accordance with this information will be processed. Personal data from publicly accessible sources will not be processed.

7. Recipients and any categories of recipients of personal data

The recipients of personal data may be:

• Communications companies that carry out commercial communication activities on behalf of the Data Controller, if the relative consent has been expressed, which are qualified as data processors;
• Companies that offer information society services, including, in particular, those that offer hosting services;
• Companies that make software available in the cloud;
• Auditing firms;
• The Data Controller's partner companies.

8. Data categories

Personal data will be processed.

9. Data transfer

The Data Controller intends to transfer personal data to a third country or to an international organization. These subjects could be represented, by way of example, by:

• Communications companies that carry out communication activities on behalf of the Data Controller;
• Communication society service provider;
• Controlled and/or controlling organizations.

The transfer of personal data to these subjects, if established in a third country or an international organization, is carried out in the presence of an appropriateness decision of the European Commission, which has verified that the third country, the territory or one or more specific sectors within the third country, or the international organization in question guarantee an adequate level of protection of rights. In any case, the Data Controller - if he deems it appropriate anyway - reserves the right to conclude specific separate agreements that oblige these subjects to adopt adequate security measures, including organizational ones, aimed at offering appropriate guarantees regarding rights. The data may thus be transferred to the following countries: United States of America. To obtain a copy of these data or the place where they were made available, simply send the relevant request to the Data Controller, to the addresses in the epigraph.

10. Personal data retention period

• The personal data processed and stored for the purposes referred to in point a) number 3 of this information (contractual and pre-contractual purposes) are processed for a period of time not exceeding 10 years starting from the termination of the effects of the contract, in the event of its conclusion, and, in the case of mere pre-contractual negotiations, for a period not exceeding 10 years from the termination of negotiations;
• The personal data processed for the purposes referred to in point b) number 3 of this information (marketing purposes) are processed and stored until the relevant cancellation and/or revocation is requested by the interested party;
• The personal data processed and stored for the purposes referred to in point c) number 3 (fulfillment of legal obligations) are processed and stored for a period not exceeding 10 years starting from the termination of the effects of the contract, in the event of its conclusion, and, in the case of mere pre-contractual negotiations, for a period not exceeding 10 years from the termination of negotiations, without prejudice, in any case, to a different law.

11. Optional consent and consequences of non-consent

• In relation to personal data processed and stored for the purposes referred to in point a) number 3 of this information (contractual and pre-contractual purposes), the communication of personal data is a contractual obligation and a necessary requirement for carrying out pre-contractual negotiations and for the conclusion of the contract. The interested party has the right to provide personal data; in case of non-communication of such data, however, it will not be possible to conclude any contract or carry out any contractual negotiation;
• In relation to personal data processed for the purposes referred to in point b) number 3 of this information (marketing purposes), the communication of personal data is not a contractual obligation. You have the right to provide personal data; in case of non-communication of such data, however, it will not be possible to carry out any marketing activities;
• In relation to personal data processed for the purposes referred to in point c) number 3 of this information (legal obligations), the communication of personal data is a legal obligation. In this case, there is an obligation to provide personal data; in case of non-communication of such data, it will not be possible to conclude the contract.

12. Right to object

The interested party has the right to object in the following terms:

• The right to object at any time, for reasons related to your particular situation, to the processing of personal data concerning you pursuant to article 6, paragraph 1, letters e) or f) of the GDPR, including profiling based on these provisions. The Data Controller refrains from further processing personal data unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing that prevail over the interests, rights and freedoms of the interested party or for the establishment, exercise or defense of a right in court;
• If personal data are processed for direct marketing purposes, there is the right to object at any time to the processing of personal data concerning you carried out for these purposes, including profiling to the extent that it is connected to such direct marketing;
• If you object to processing for direct marketing purposes, personal data are no longer being processed for these purposes. It is specified that the interested party's right to object to the processing of their personal data for the above-mentioned purposes, can be exercised even if only in part, that is, by opposing, for example, only the sending of promotional communications carried out through automated and/or digital tools, or to the sending of paper communications;
• If personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89, paragraph 1 of the GDPR, the interested party, for reasons related to his particular situation, has the right to object to the processing of personal data concerning him, unless the processing is necessary for the performance of a task of public interest.

13. Other rights

The Data Controller also intends to inform of the existence of the following rights:

• Right of access: the interested party has the right to obtain confirmation from the Data Controller whether or not personal data concerning them is being processed and in this case, to obtain access to personal data and specific information, in accordance with art. 15 of the GDPR;
• Right to rectification: the interested party has the right to obtain from the Data Controller the correction of inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, even by providing a supplementary statement, in accordance with art. 16 of the GDPR;
• Right to delete data, including the right to withdraw consent: the interested party has the right to obtain from the Data Controller the cancellation of personal data concerning him without undue delay and the Data Controller has the obligation to delete personal data without undue delay, or to revoke his consent, if the reasons defined by art. 17 of the GDPR exist. With regard to the right to revocation, the interested party also has the right to withdraw consent at any time without affecting the lawfulness of the processing based on the consent given before the revocation;
• Right to restrict processing: the interested party has the right to obtain from the Data Controller the limitation of processing when the hypotheses defined by art. 18 of the GDPR are met;
• Right to data portability: the interested party has the right to receive in a structured format, commonly used and readable by an automatic device, the personal data concerning him provided to the Data Controller and has the right to transmit such data to another owner without hindrance by the Data Controller in the cases and under the conditions specified by art. 20 of the GDPR;
• The contractor's right to object to commercial communications: the contractor has the right to object at any time, free of charge, to the receipt of commercial communications.

14. Exercise of rights

Requests to exercise the rights indicated in this information, including, in particular, the right to cancellation and the right to revoke the consent given must be addressed directly to the Data Controller at the relevant email address. Alternatively, you can exercise your rights by sending relative communication by registered letter with return receipt to the address of the Data Controller.