Privacy Policy

Stefano Quadri — Address: Via Czestochowa, 11 — 60025 Loreto (AN) — email: [email protected].

NAMAI is used by real estate agencies that are customers ("Agency", "Customer") to manage their business. In this relationship:

• the Agency is the data controller for the data of its own clients, contacts and negotiations, which it enters and manages independently on the platform;
• Stefano Quadri acts as data processor for such data, under a Data Processing Agreement entered into with the Agency, and as independent controller for data relating to the account, billing and use of the Service by the Agency's users.

The following categories of data may be processed as part of the Service:

• Account data and Agency users: first name, last name, email, telephone, role, login credentials, activity logs;
• Agency client records: identification and contact details of buyers, sellers, landlords and tenants (first name, last name, address, telephone, email, tax code, property search preferences);
• Property data: address, floor plans, technical features, photos, value, cadastral data and ownership data;
• Digitised documents, including identity documents: identity cards, driving licences, passports, tax codes and other documents uploaded by the Agency for identity verification (KYC) and to comply with the anti-money laundering obligations that Italian Legislative Decree 231/2007 imposes on real estate brokers;
• Technical data: IP address, system logs, device and browser information, technical cookies (see the Cookies section).

Identity documents and related data are processed solely on behalf of and on the instructions of the controlling Agency, which is responsible for collecting them lawfully and for verifying the consent or the applicable legal basis with its clients.

• Provision of the Service (management of records, properties, documents and platform features): performance of the contract with the Agency (Art. 6.1.b GDPR);
• Anti-money laundering compliance and document retention: legal obligation (Art. 6.1.c GDPR), in relation to the sector regulations applicable to real estate brokerage;
• Security, fraud prevention and continuity of the Service: legitimate interest of Stefano Quadri (Art. 6.1.f GDPR);
• Customer support and service communications: performance of the contract and legitimate interest;
• Commercial and marketing communications (optional): consent of the data subject (Art. 6.1.a GDPR), which may be withdrawn at any time.

Data is processed electronically, with technical and organisational measures appropriate to ensure its confidentiality, integrity and availability, including: encryption of data in transit and at rest, role-based access control, audit logs of operations on sensitive data and identity documents, periodic backups and logical segregation of data between the different customer Agencies.

Data is retained for the duration of the contractual relationship with the Agency and, afterwards, for the period needed to comply with legal obligations (including document retention obligations under anti-money laundering rules) or to establish or defend a right in court. At the end of the contractual relationship, on the instructions of the controlling Agency, the data is deleted or returned as provided by the Data Processing Agreement.

Data may be disclosed to third-party suppliers acting as sub-processors (e.g. cloud hosting, email delivery services, customer support tools), appointed under a specific agreement and subject to equivalent confidentiality and security obligations. Any transfers of data to countries outside the EEA only take place to suppliers that guarantee an adequate level of protection, through Standard Contractual Clauses approved by the European Commission or another suitable instrument under Chapter V of the GDPR.

Personal data, including user data obtained from Google services (see section 8), is not sold and is not shared with third parties for advertising, profiling or data brokering purposes. The only recipients of the data are:

• the controlling Agency, which accesses the data entered by its users according to the roles and permissions it configures;
• the sub-processors strictly necessary to provide the Service, contractually bound to process the data only on behalf of Stefano Quadri and within the limits of the instructions received. In particular, the infrastructure (servers, database and document storage) is hosted on VPS servers provided by OVH SAS (OVHcloud), a company based in France, in the Strasbourg datacentre (France), within the European Union. The list of OVHcloud sub-processors is available at this address; the list of Stefano Quadri's sub-processors is available on request from [email protected];
• Cloudflare, Inc. (and its European affiliate Cloudflare Germany GmbH), which provides network and security services (DNS management, proxy and protection from malicious traffic, TLS certificates, management of custom domains for showcase websites and Turnstile anti-spam verification on contact forms). For these services, browsing data (e.g. IP address, request headers) and transmitted content pass through the Cloudflare network, which may also process them in countries outside the EEA, on the basis of the adequacy decision of the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses provided for by Cloudflare's Data Processing Addendum;
• Google, limited to the data exchange needed for the integration the user has chosen to activate to work;
• the competent authorities, where disclosure is required by law or by an order of the authority.

The user may optionally connect their Google account to NAMAI to synchronise calendar appointments. The connection is made via OAuth 2.0 and can be revoked at any time.

• Data we access: authorisation to access the user's Google Calendar (scope https://www.googleapis.com/auth/calendar). NAMAI uses this access solely to create, update and delete, in the user's primary calendar, the events generated by NAMAI appointments. We do not read, import or store the other events in the user's Google calendar.
• Data sent to Google: title, notes, start and end date and time of the appointment.
• Data stored by NAMAI: the access and refresh tokens issued by Google and the identifier of the event created, needed to keep the synchronisation running. The tokens are stored in the Service database and are deleted at the user's request or when the relationship with the Agency ends.
• Sharing: data obtained through Google APIs is not transferred, sold or disclosed to third parties, unless this is necessary to provide or improve the calendar features visible to the user (including through the sub-processors indicated in section 7), to comply with applicable law, or as part of corporate transactions with prior notice to the user. It is not used to train generalised artificial intelligence models or for advertising, and it is not read by humans except with explicit consent, for security needs or to comply with legal obligations.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The user can revoke access at any time from their Google account settings (myaccount.google.com/permissions) or by writing to [email protected].

Within the limits and under the conditions set by Articles 15-22 of the GDPR, the data subject has the right to obtain access to their data, rectification, erasure, restriction of processing and data portability, and to object to processing, as well as to withdraw at any time any consent given. For data processed by Stefano Quadri as processor on behalf of the Agency, requests should be addressed directly to the controlling Agency; Stefano Quadri cooperates with the Agency to respond within the legal time limits. For data processed by Stefano Quadri as independent controller, requests can be sent to [email protected]. It is also possible to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.gpdp.it).

The Service uses technical cookies needed for the platform to work (e.g. management of the authentication session, language and theme preferences). No third-party profiling cookies are used without explicit consent. The list of cookies used is provided in the Cookie Policy; for further details, please contact [email protected].

Stefano Quadri may periodically update this policy to reflect regulatory or functional changes to the Service. The date of the last update is shown at the top of the document. In the event of substantial changes, users will be informed through the Service or by email.

For any request relating to the processing of personal data, please write to [email protected].