title: "Privacy policy" description: "What data we collect, why, who we share it with, and how to have it deleted." updated: 2026-09-26
This policy explains how UNIPV Affitto Studenti processes the personal data of people using affittostudentipavia.com, under Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
Data controller
The data controller is [TO BE COMPLETED: legal entity name], registered at [TO BE COMPLETED: registered address], VAT number [TO BE COMPLETED: VAT number].
For anything concerning your data, write to [TO BE COMPLETED: contact email].
We have not appointed a Data Protection Officer because the conditions of Article 37 GDPR do not apply to us.
What data we process
Data you give us.
- Account: email address, name or display name, preferred language. If you sign in with Google, we receive your email and profile name from Google.
- Listings: title, description, price, area, photos, property features, plus the phone number and contact name used to reach you.
- "Room wanted" requests and flatmate profiles: budget, areas, dates, faculty, language, living preferences and habits you choose to state.
- Contact form and partner applications: name, email, phone if you enter one, and the content of your message.
- Private Group: joining happens on WhatsApp, so the data we receive is what is in the conversation — phone number, display name, whatever you tell us about your search, and the screenshot of your payment receipt. We keep the receipt for accounting obligations and the number to know who is an active member.
Data collected automatically.
- Minimal technical data needed to run the service: IP address (which we store only as a non-reversible hash), browser type, pages visited.
- Technical cookies and, only with your consent, statistics tools. Details are in the cookie policy.
Data we do not process. We do not ask for and do not want special categories of data (Article 9 GDPR): health, sexual orientation, religious or political beliefs, trade union membership. If you volunteer them in a listing or message, we remove them.
Why we process data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account | Performance of a contract, Art. 6.1.b |
| Publishing listings and showing them to users | Performance of a contract, Art. 6.1.b |
| Connecting seekers and providers via WhatsApp | Performance of a contract, Art. 6.1.b |
| Moderating content and preventing scams and abuse | Legitimate interest, Art. 6.1.f |
| Handling the Private Group payment and receipts | Contract and legal obligations, Arts. 6.1.b and 6.1.c |
| Sending service emails (listing approved, expiring, saved-search alerts) | Performance of a contract, Art. 6.1.b |
| Replying to messages sent through the forms | Legitimate interest, Art. 6.1.f |
| Website usage statistics | Consent, Art. 6.1.a |
| Security, rate limiting, anti-bot protection | Legitimate interest, Art. 6.1.f |
| Meeting tax and accounting obligations | Legal obligation, Art. 6.1.c |
Fields marked as required in the forms are necessary: without them we cannot provide the service. Everything else is optional.
One point we want to be clear about
Your phone number is never published in the page text or in the source code. When somebody presses the WhatsApp button on your listing, the link is built by our server at that moment and the person is redirected to WhatsApp. This keeps automated phone-number harvesters away.
In the same way, the exact address of a property is never published: on the map we show only the area, with a point shifted a few hundred metres from the real location.
Who we share data with
We rely on providers who process data on our behalf as processors under Article 28 GDPR:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication, photo storage | European Union |
| Vercel | Hosting and content delivery | European Union / United States |
| Resend | Sending service emails | European Union / United States |
| Cloudflare | Anti-bot protection on forms | European Union / United States |
For transfers to third countries we rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU–US Data Privacy Framework adequacy decision.
For the Private Group there is no payment provider between us and you: the fee is paid directly to us, outside the site. We do not process card or bank account data; from that step we keep only the screenshot of the receipt you send and your phone number, for accounting obligations and to know who is an active member.
We do not sell your data and we do not pass it to third parties for marketing.
Other users see only what you choose to publish: the content of your listings and your display name. Your phone number reaches only the person who opens the WhatsApp conversation from your listing.
How long we keep data
| Data | Retention |
|---|---|
| Account and profile | While the account is active, then 30 days from a deletion request |
| Published listings | 30 days after expiry or removal, then deleted |
| Requests and flatmate profiles | 12 months from the last update |
| Messages sent through forms | 24 months |
| Payment data and tax documents | 10 years, by law |
| Technical logs and IP hashes | 12 months |
| Reports and moderation decisions | 24 months |
Your rights
At any time you can:
- request access to your data and obtain a copy (Art. 15);
- request rectification if it is inaccurate or incomplete (Art. 16);
- request erasure (Art. 17);
- request restriction of processing (Art. 18);
- receive your data in a readable format and move it elsewhere — portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing already carried out (Art. 7.3).
From your account area you can download your data and delete your account yourself, without writing to us. Alternatively write to [TO BE COMPLETED: contact email]: we respond within one month.
If you believe the processing breaches the GDPR you may lodge a complaint with the Italian data protection authority (garanteprivacy.it) or go to court.
Minors
The service is for adults. We do not knowingly collect data from anyone under 16. If we discover we have, we delete the account.
Automated decisions
We do not carry out profiling or fully automated decision-making producing legal effects on people. Listings are moderated by people.
Changes
If we change this policy we update the date at the bottom and, for significant changes, notify account holders by email.