CONDO SAS · TRANSPARENCY
Privacy and cookie notice
Updated 14 October 2026
This notice is provided under articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and article 122 of the Italian Privacy Code (Legislative Decree 196/2003). It applies to visitors of condosrl.it and to anyone who writes to us through the contact form, registers for the members’ area or signs the confidentiality agreement (NDA) online.
1. Data controller
The controller is CONDO SAS, registered office Via Francesco d’Assisi 55, 61032 Fano (PU), Italy.
For any request about your data you can contact us on WhatsApp to our contact person Dott. Federico Api or by post to CONDO SAS, Via Francesco d’Assisi 55, 61032 Fano (PU), Italy.
We have not appointed a data protection officer (DPO): it is not required for the processing we carry out (art. 37 GDPR).
2. What data we process, why and on which legal basis
We only process the data needed for the purposes below. The legal bases are: performance of a contract or of pre-contractual steps taken at your request (art. 6(1)(b) GDPR), compliance with legal obligations (art. 6(1)(c)) and our legitimate interest in securing the service and protecting our rights (art. 6(1)(f)). We do not use data for marketing or profiling.
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form (intercom) | Name, e-mail, message; optional: firm, role, number of buildings managed | Reply to your request, arrange a presentation | Pre-contractual steps at your request (6(1)(b)) | 24 months from receipt, then deleted automatically |
| Members’ area registration and account | Name, e-mail, password stored only as a hash, NDA status and submission/review dates | Create and manage the account, check access to private content | Contract / pre-contractual steps (6(1)(b)) | Until the account is deleted, at your request at any time or by us once it is no longer needed (reviewed at least every 24 months) |
| Sign in with Google (optional) | Name, verified e-mail and Google account identifier | Register or authenticate without a separate password | Contract / pre-contractual steps (6(1)(b)) | Same as the account |
| Online NDA signing | Form details (name, firm, tax code or VAT number, role, certified e-mail, place), signature mark (drawn image or typed name), one-time code sent by e-mail (stored only as a hash for 10 minutes), IP address, browser (user agent), verification and signing date and time, access code and SHA-256 hashes of the document, recorded in the signature certificate attached to the PDF; alternatively, the signed PDF you upload | Conclude and document the confidentiality agreement, enable access to private content, send you a copy of the signed document | Contract (6(1)(b)); evidence of the agreement and protection of rights (6(1)(f)) | For the duration of the agreement and 10 years after it ends (ordinary limitation period, art. 2946 Italian Civil Code) |
| Security and administrative records | Record of administrative actions (approvals, rejections, deactivations, with author and date), abuse counters based on IP address or on a hash of the e-mail, server technical logs without identifying data | Protect the service from abuse and unauthorised access, demonstrate that operations were carried out correctly | Legitimate interest in security (6(1)(f)); duty to apply appropriate security measures (6(1)(c), art. 32 GDPR) | Counters: up to 24 hours; administrative record: for the life of the related account or NDA; hosting logs: for the few days set by the provider |
| Technical cookie condo.sid | Random session identifier | Protect forms from forged requests (CSRF) and keep you signed in to the members’ area | Legitimate interest in operating the site securely (6(1)(f)); strictly necessary cookie (art. 122 Italian Privacy Code) | 7 days, renewed on each use |
Providing data is optional, but required fields are necessary to reply, create the account or sign the NDA: without them we cannot handle your request. Please do not enter unnecessary data in the forms, especially health data or other special categories.
We may also retain or disclose data where required by law or by an authority (art. 6(1)(c)) and to establish, exercise or defend legal claims (art. 6(1)(f)), for no longer than necessary.
3. Electronic signature of the NDA
The online NDA is signed with a simple electronic signature (art. 20 of the Italian Digital Administration Code, Legislative Decree 82/2005, and art. 25 of Regulation (EU) 910/2014, eIDAS): you draw or type your signature and confirm it with a one-time code sent to your e-mail. The signed PDF includes a certificate with the signing details and is stored with SHA-256 hashes that allow its integrity to be verified.
After signing we e-mail you a copy of the signed PDF, and you can download it at any time from the members’ area while your account is active.
4. Who receives the data
Data is processed by authorised and instructed CONDO SAS staff (art. 29 GDPR) and by the providers that help us run the service, appointed as processors (art. 28 GDPR):
- Vercel Inc. (USA) — website hosting, server execution and storage of private files (signed NDAs); server functions run in the Frankfurt (EU) region.
- Neon Inc. (USA) — PostgreSQL database hosted in the EU Frankfurt region.
- Our e-mail (SMTP) service provider — delivery of the service’s e-mails (signing codes, copy of the NDA, internal notifications to CONDO SAS contacts).
If you choose Sign in with Google, Google LLC (and Google Ireland Ltd in the EU) processes your account data as an independent controller under its own privacy policy: CONDO SAS only receives your name, verified e-mail and account identifier, never your password, and does not access Gmail or Drive.
If you write to us on WhatsApp, the service is provided by WhatsApp Ireland Ltd as an independent controller under its privacy policy.
Data is never published or sold. It may be disclosed to public authorities only where required by law.
5. Transfers outside the European Economic Area
Our database and server functions are located in the EU, but some providers are based in the United States and may access data (for example for support or security). Such transfers rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Decision (EU) 2023/1795), for certified providers, and/or on the Standard Contractual Clauses approved by Decision (EU) 2021/914, with the supplementary measures applied by the providers (such as encryption in transit and at rest). You can ask us for a copy of the safeguards.
6. How long we keep data
- Contact form requests: 24 months, then deleted automatically.
- Members’ area account: until deletion, at your request at any time or by us once it is no longer needed (reviewed at least every 24 months).
- Signed NDA and signature certificate: for the duration of the agreement and 10 years after it ends (art. 2946 Italian Civil Code), even if the account is closed earlier.
- Signing code (OTP): 10 minutes, only as a hash; code abuse counters: 24 hours.
- Session (condo.sid cookie): 7 days from last use.
Deactivating an account blocks access but does not delete data: write to us to request deletion. When the periods above end, data is deleted or anonymised.
7. Your rights
Within the limits of articles 15–22 GDPR you may at any time request:
- access to your data and a copy of it (art. 15);
- rectification of inaccurate or incomplete data (art. 16);
- erasure (art. 17), except for data we must keep, such as the signed NDA for the period stated above;
- restriction of processing (art. 18);
- portability of the data you provided, in a structured, machine-readable format (art. 20);
- to object to processing based on legitimate interest, on grounds relating to your particular situation (art. 21).
To exercise your rights contact us on WhatsApp to our contact person Dott. Federico Api or by post to CONDO SAS, Via Francesco d’Assisi 55, 61032 Fano (PU), Italy. We reply without undue delay and in any case within one month (art. 12 GDPR); we may ask you to confirm your identity.
If you believe the processing infringes the GDPR you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (art. 77 GDPR, garanteprivacy.it), or with the supervisory authority of the EU country where you live or work, or take legal action.
8. No automated decisions
We do not take decisions based solely on automated processing, including profiling (art. 22 GDPR): access to the members’ area is always approved by a person at CONDO SAS.
The service is intended for adult professionals (property managers, firms and industry operators) and not for anyone under 18.
9. Security
The site only uses encrypted connections (HTTPS). Passwords are stored exclusively as a hash (bcrypt) and signing codes as an HMAC hash; access to private documents is limited to enabled users and authorised staff.
10. Cookies and browser storage
The site uses a single first-party technical cookie. We use no analytics, advertising or profiling cookies or tools, and no third-party content that sets cookies: consent is therefore not required (art. 122 Italian Privacy Code and the Garante’s cookie guidelines of 10 June 2021).
| Name | Type | Purpose | Duration | Properties |
|---|---|---|---|---|
| condo.sid | First-party technical cookie (condosrl.it) | Created on your first visit to protect forms from forged requests (CSRF token); after sign-in it keeps your members’ area session | 7 days, renewed on each use | HttpOnly, Secure, SameSite=Lax; holds only a random identifier |
| condo.cookie-notice.v1 | Browser local storage (localStorage), never sent to the server | Remembers that you closed the cookie and privacy notice | 6 months | Holds only an expiry date, no personal data |
You can delete cookies and local storage in your browser settings; without the condo.sid cookie forms cannot be sent and the members’ area cannot be used. External services you open from the site (WhatsApp, Google) apply their own policies.
11. Changes
We may update this notice, for example for new features or legal changes. The date of the last update is shown at the top; significant changes are announced on the site.