Sign in Register
  1. Home
  2. Privacy

Privacy

Personal data processing information

Last updated: 5 October 2026 — Version 1.1

1. Introduction

Pursuant to Regulation (EU) 2016/679 (hereinafter “GDPR”) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (Personal Data Protection Code), the Data Controller wishes to provide the user (hereinafter “Data Subject”) with the following information on the processing of their personal data collected through this portal and its related services.

2. Data Controller

The Data Controller is:

  • Controller: Michele Palmieri (owner of the Relinx service)
  • Registered office: Via Enrico Fermi 6, 34074 Monfalcone (GO), Italy
  • VAT number: IT01274610318 — Tax code: PLMMHL79R13G916B
  • Email for privacy requests: info@relinx.it
  • Data Protection Officer (DPO): not appointed

3. Types of data processed

The following categories of personal data may be collected through the portal:

  • Identification data: first name, surname, tax code (if necessary for entering into contracts).
  • Contact data: email address, telephone number, residential or domicile address.
  • Property data: in the case of a valuation or sale request, data relating to the property (address, features, any cadastral and energy documentation).
  • Preference data: type of property sought, geographical area, budget, specific needs.
  • Browsing data: IP address, session data, access logs (see also section 9 - Cookies).
  • Consent data: record of the consents given to processing (IP, date and time, content of the consent) for audit purposes pursuant to Art. 7 GDPR.

4. Purposes of processing and legal bases

The data are processed for the following purposes, each based on the relevant legal basis:

  1. Provision of the requested service (e.g. property valuation, request for information on a listing, user area registration): performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).
  2. Compliance with legal obligations (tax, anti-money laundering, document retention): legal obligation (Art. 6.1.c GDPR).
  3. Security of the portal and prevention of abuse (log analysis, protection against attacks): legitimate interest of the Data Controller (Art. 6.1.f GDPR).
  4. Sending commercial and promotional communications (newsletters, alerts on new properties matching saved searches): explicit consent (Art. 6.1.a GDPR), revocable at any time.
  5. Aggregated statistical analysis of portal usage to improve its features: consent (Art. 6.1.a GDPR and Art. 122 of the Italian Privacy Code), given through the cookie banner and revocable at any time; without consent no analytics tool is activated.

The provision of data is optional, but necessary for the purposes set out in points 1, 2 and 3. Failure to provide the data may make it impossible to provide the requested service. The data referred to in points 4 and 5 are optional and may be withdrawn at any time.

5. Methods of processing

Data are processed using computer and telematic tools, with logic strictly related to the stated purposes, and with the adoption of technical and organisational measures appropriate to ensure the security, confidentiality and integrity of the data (Art. 32 GDPR), including:

  • encryption in transit (HTTPS) for all communications between the user's browser and the server;
  • session cookies protected with the Secure, HttpOnly and SameSite=Lax flags;
  • role-based access control (authentication, separation of agency compartments);
  • periodic backups of the database and uploaded files;
  • access logs and change tracking for audit purposes.

6. Recipients of the data

Personal data are processed by the Data Controller's internal staff (agents, administrators, technical staff), duly instructed. They may also be disclosed to the following parties, appointed as Data Processors pursuant to Art. 28 GDPR where applicable:

  • hosting and cloud service provider (VPS server);
  • provider of the transactional email delivery service;
  • Google Ireland Limited, for the Google Analytics 4 statistics service, activated only with prior consent to analytics cookies (anonymised IP address, no advertising profiling);
  • Google Ireland Limited, for Google Maps (satellite and street view), loaded only with prior consent to the «Preferences» cookie category (without consent the Esri/ArcGIS maps are used);
  • map providers (Esri/ArcGIS tiles and, for the 3D view, OpenFreeMap), which receive the visitor's IP address as needed to serve the map tiles;
  • application error monitoring service providers (e.g. Sentry), in compliance with PII anonymisation criteria;
  • real estate portals for the publication of listings (e.g. Immobiliare.it, Idealista), limited to the data strictly necessary for publication;
  • professionals and consultants (accountants, lawyers) for compliance with legal obligations;
  • judicial authorities and public administrations, where required by law.

No data is transferred outside the EU without adequate safeguards as provided for by Chapter V of the GDPR. In relation to Google Analytics, data may also be processed by Google in the United States on the basis of the EU-US Data Privacy Framework or standard contractual clauses.

7. Data retention

Personal data are kept for the time strictly necessary to pursue the stated purposes, and in particular:

  • data relating to concluded contracts: 10 years from the end of the relationship, to comply with civil and tax obligations;
  • data relating to information requests that did not lead to a contract: 24 months from the date of the last interaction;
  • consent data and marketing logs: for the entire duration of the consent given and for a further 24 months after withdrawal, for evidentiary purposes pursuant to Art. 7.1 GDPR;
  • browsing data and application logs: 12 months, unless longer retention is needed for IT security purposes.
  • statistical data collected with Google Analytics (with consent only): 14 months.

At the end of the indicated periods, the data will be deleted or irreversibly anonymised.

8. Rights of the data subject

In accordance with Articles 15-22 of the GDPR, the Data Subject has the right to:

  • Access to their data and to obtain a copy (Art. 15);
  • Rectification of inaccurate or incomplete data (Art. 16);
  • Erasure of data in the cases provided for by Art. 17 (“right to be forgotten”);
  • Restriction of processing in the cases provided for by Art. 18;
  • Portability of data in a structured, machine-readable format (Art. 20);
  • Objection to processing for marketing purposes at any time (Art. 21), or to processing based on legitimate interest;
  • Withdrawal of consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal (Art. 7.3);
  • Complaint to the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it) or another competent supervisory authority.

To exercise these rights, the Data Subject may write to the email address indicated in point 2. The reply will be provided within the time limits set by Art. 12 GDPR (within one month, extendable by two further months in complex cases).

The portal uses technical cookies strictly necessary for the operation of the service and, only with prior consent, statistical analysis cookies (Google Analytics 4). For details on the cookies used, their purposes and how to manage them, please refer to the cookie policy.

10. Google data (Gmail and Google Calendar)

Relinx allows professional users (real estate agents and agencies) to connect, only if they choose to, their own Google account in order to use their Gmail mailbox and Google Calendar from within the CRM. This section describes how we process the data obtained through the Google APIs.

Section added on 3 October 2026; the controller indicated in point 2 was updated on the same date.

Which data and which permissions

  • Email address and Google account identifier (openid and email permissions): to recognise which account is connected.
  • Gmail (https://mail.google.com/ permission): reading, sending and organising the messages of the connected mailbox (senders, recipients, subject, text and attachments) within the CRM. We synchronise the inbox only: initially the last 14 days (up to 100 messages), then new messages; an older message is imported only if the user searches for or opens it.
  • Google Calendar (https://www.googleapis.com/auth/calendar permission): reading, creating and editing events of the connected calendar, in order to synchronise them with the CRM agenda.

How we use them

  • Displaying and sending email within the CRM and linking it to the agency's contacts, properties and requests.
  • Displaying and updating appointments and activities on the connected calendar.
  • We do not use Google data for advertising, profiling or to sell information to third parties.
  • We do not use Google data to develop, improve or train general-purpose artificial intelligence or machine learning models.
  • The service's technical staff access Google data only for support requested by the user, for security reasons or where required by law.

Where they are stored and how they are protected

  • A copy of the synchronised messages and events is kept in the CRM database, hosted on a server in the European Union managed by the Data Controller.
  • Google access tokens are encrypted in the database and are never visible in clear text to users.
  • The connected mail is visible only to the user who connected it and, for the agency's shared mailboxes, to the agency users authorised by their assigned role.
  • Encrypted communications (HTTPS) and role-based access control.

Sharing

We do not sell or transfer Google data. They are accessible only to the technical providers necessary for the service (hosting), bound by confidentiality and data processing agreements, and to authorities where required by law.

Revocation and deletion

  • The user can disconnect the account at any time from Settings → Mailboxes and from the CRM calendar settings.
  • The user can also revoke access from the Google page myaccount.google.com/permissions.
  • Disconnecting deletes the access tokens. Upon the user's request, sent to the email address indicated in point 2, we also delete the copies of the messages, attachments and events already synchronised.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Relinx's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Changes to this policy

The Data Controller reserves the right to update this notice to reflect regulatory, organisational or technological changes. The Data Subject is invited to consult this page periodically; in the event of substantial changes, adequate information will be provided.

Version 1.1 — 5 October 2026