Privacy Policy

In compliance with the principle of transparency set forth in Art. 12 of Regulation (EU) 2016/679 (hereinafter 'GDPR'), please be advised that the Data Controller is McFrancis, a legal entity under Italian law with its registered office at Via Sandro Botticelli 58, Turin, Tax Code/VAT No. 12272120010. Any request concerning data protection may be formally addressed to the PEC address steven.di.francesca@pec.it or to the dedicated email address steven@mcfrancis.com.

The processing of personal data is guided by the principles of lawfulness, fairness, and transparency (Art. 5 GDPR) and is based on the following legal grounds (Art. 6 GDPR):

• Contractual Performance (Art. 6.1.b): Processing is a conditio sine qua non for the establishment and execution of the real estate brokerage relationship, the management of appointments, and the fulfillment of pre-contractual obligations.
• Compliance with Legal Obligations (Art. 6.1.c): Processing is required by mandatory regulations, including anti-money laundering legislation (Legislative Decree 231/2007) and tax and accounting obligations.
• Legitimate Interest (Art. 6.1.f): For the protection of corporate assets, fraud prevention, and the exercise of the right of defense in court.
• Consent (Art. 6.1.a): Exclusively for direct marketing activities and non-essential profiling, subject to free, specific, informed, and unambiguous consent, which is always revocable.

The Data Controller collects and processes, within the limits of the data minimization principle (Art. 5.1.c GDPR):

• Common Data: Personal details, telephone and electronic contact details, necessary for the identification of the contracting party.
• Economic and Financial Data: Information strictly necessary for the assessment of real estate capacity or requirements.
• Browsing Data: IP addresses, URIs, and technical parameters automatically acquired by internet communication protocols (see Cookie Policy).

Processing is carried out using IT and electronic tools suitable for ensuring security (Art. 32 GDPR) and confidentiality. Data will be stored for the period strictly necessary to achieve the purposes (storage limitation principle), and specifically:

• For the duration of the contractual relationship and, subsequently, for the ten-year ordinary statute of limitations (Art. 2946 of the Italian Civil Code) for civil and tax purposes.
• For 24 months for marketing purposes, unless consent is renewed.

Data will not be disseminated. It may be shared with third parties, appointed where necessary as Data Processors pursuant to Art. 28 of the GDPR (e.g., IT service providers, legal and tax consultants) or with Public Authorities in the exercise of their legitimate functions.

The Data Subject may exercise the rights set forth in Articles 15-22 of the GDPR (Access, Rectification, Erasure/Right to be Forgotten, Restriction, Portability, Objection) at any time by submitting a formal request to the Controller. This is without prejudice to the right to lodge a complaint with the Data Protection Authority (Art. 77 GDPR) if the processing is deemed to violate current legislation.

Providing data for contractual purposes is mandatory; failure to provide such data will make it impossible to proceed with the mediation relationship. Providing data for marketing purposes is optional, and withholding consent does not affect the use of the core services.

Personal data is stored on servers located within the European Union. Should it become necessary, for technical and operational reasons, to use entities located outside the European Economic Area (EEA), the transfer will take place in accordance with Chapter V of the GDPR, following the signing of Standard Contractual Clauses (SCC) or verification of Adequacy Decisions by the European Commission.

The Owner reserves the right to modify this privacy policy at any time by notifying Users on this page. Please check this page regularly, referring to the date of the last modification indicated at the bottom.

Data processing follows a 'Zero-Knowledge' security model (Zero-Knowledge Architecture). Personal data collected via the public interface (SAMI) is transmitted and stored in the secure management system (Janus II) exclusively in encrypted format. The process involves:

• Ingestion: Acquisition via secure HTTPS channel.
• Encryption: Immediate encryption using a hybrid protocol (AES-256 for the payload + RSA-4096 for the keys) before database persistence.
• Segregation: The hosting server acts as a mere repository for unintelligible data ('encrypted blobs'). Decryption is technically possible only for authorized personnel holding the specific private keys stored locally on company devices.

If personal data is not obtained directly from the data subject, the Controller shall inform the data subject, within a reasonable period and in any case no later than one month (or at the first useful contact), regarding: the sources from which the data originate, the categories of data being processed, the purposes and legal bases, the recipients, as well as the rights recognized by the GDPR.

The Data Controller adopts incident management procedures compliant with Articles 33–34 of the GDPR. In the event of a personal data breach, where the breach poses a risk to the rights and freedoms of natural persons, notification will be made to the Supervisory Authority within 72 hours and, if there is a high risk, communication to the data subjects. The process includes: containment, forensic analysis, impact assessment, corrective measures, and recording the event in the incident log.

For matters concerning personal data protection, the data subject may contact the Data Controller at steven@mcfrancis.com or via the PEC address steven.di.francesca@pec.it. If a Data Protection Officer (DPO) has been appointed, their contact details are published on this page. A dedicated channel is available for reporting security vulnerabilities or incidents.