Legal information
Privacy notice — homacoop.it
This notice explains how HOMA processes the personal data of people who visit homacoop.it, submit a request through the website, express interest in a residence or submit a professional profile.
1. Data controller
The data controller is:
HOMA Società Cooperativa s.p.a. Via Orsini Ducas 8, 73100 Lecce (LE), Italy Italian tax code and VAT number 04579080757 REA LE-302857 Email: info@homacoop.it Certified email (PEC): coop.ass@pec.it
2. Data Protection Officer
The Data Protection Officer (DPO) is Mario Nobile, who can be contacted at privacy@homacoop.it.
3. Data processed
Browsing and security data
The systems used to deliver the website and manage its forms may process the IP address, date and time of the request, requested page, browser or device type, technical outcome and request identifiers.
To protect the forms against abuse, the IP address is temporarily associated with a submission counter. The website accepts no more than five submissions within ten minutes from the same IP address.
Data submitted through forms
Depending on the selected path, HOMA may receive:
- first and last name;
- email address and, if provided, telephone number;
- organisation, company, institution, university or professional role;
- city and essential information about a proposed property;
- housing need or residence of interest;
- university and year of study for certain pre-registration requests;
- professional area, city, LinkedIn profile link and personal introduction for “Work with us”;
- the message and any other information voluntarily provided.
The forms do not accept attachments. The “Work with us” form must not be used to send CVs, identity documents, health data or other special categories of personal data. If a profile is of interest, HOMA will subsequently provide an appropriate channel.
Aggregate statistics
On the public domain HOMA uses a self-hosted instance of Plausible Community Edition to obtain aggregate information about page views, general traffic sources, device type and approximate geographic area. The current configuration does not use cookies or persistent identifiers and does not track forms, downloads or outbound links.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Deliver and protect the website, prevent abuse, diagnose errors and ensure system security | HOMA's legitimate interest in the security and proper operation of its systems, Article 6(1)(f) GDPR |
| Reply to contact requests, property proposals and enquiries about services, residences or the Housing Desk | steps taken at the data subject's request prior to entering into a contract, Article 6(1)(b) GDPR; for institutional or non-pre-contractual communications, legitimate interest in handling incoming communications, Article 6(1)(f) GDPR |
| Assess expressions of interest and residence pre-registrations | steps taken at the data subject's request prior to entering into a contract, Article 6(1)(b) GDPR |
| Assess unsolicited professional profiles | steps taken at the candidate's request prior to entering into a contract, Article 6(1)(b) GDPR |
| Comply with legal obligations or requests from public authorities | legal obligation, Article 6(1)(c) GDPR |
| Measure the use of the website in aggregate form and improve its content and navigation | HOMA's legitimate interest in evaluating and improving the website through a self-hosted tool without cookies or persistent identifiers, Article 6(1)(f) GDPR |
| Establish, exercise or defend legal claims | HOMA's legitimate interest in protecting its rights, Article 6(1)(f) GDPR |
HOMA does not use data collected through the forms to send newsletters or unsolicited marketing communications. Any future marketing activity will be covered by separate information and, where required, a separate choice.
5. Provision of data
Fields marked as mandatory are required to identify and handle the request. Failure to provide them prevents submission or makes it impossible to reply. All other fields are optional.
Acknowledging the privacy notice is not consent: processing required to reply is based on the legal grounds described above.
6. Processing methods and no automated decision-making
Data is processed electronically and protected through measures appropriate to the nature of the processing. Requests submitted through the website are forwarded to email inboxes selected by HOMA according to the form type. No additional contact archive is created in DynamoDB.
Requests and applications are reviewed by authorised people. HOMA does not make decisions based solely on automated processing that produce legal or similarly significant effects, and does not carry out profiling.
7. Recipients and service providers
Personal data may be processed, within the limits of their duties, by HOMA employees, worker-members and collaborators who have been authorised to process it.
Data may also be processed by providers supporting website operation, security, hosting, email delivery and receipt, analytics and technical maintenance. Where these providers process data on HOMA's behalf, they must be governed by an agreement under Article 28 GDPR.
The form workflow uses Amazon Web Services in the eu-north-1 region of the European Union: Lambda processes the request, SES sends email, DynamoDB applies rate limiting and CloudWatch stores technical logs. An email address that causes a bounce or complaint may be placed on the AWS account-level suppression list, shared with other HOMA services using the same account, solely to prevent further delivery attempts to invalid or disputed addresses.
Data may be disclosed to advisers or authorities where required by law or necessary to protect a right. It is not publicly disclosed.
8. Third-party content and forms
The website may display locally hosted previews of content available on YouTube, Instagram, LinkedIn or CloudPano. A connection to the provider is made only when the user chooses to load that specific content. The provider may then receive technical data and use cookies or similar technologies under its own privacy notice. HOMA does not remember the user's choice and does not automatically enable other content from the same provider.
Some pages may link to Google Forms for calls or applications. The link does not send Google the data entered in HOMA's internal forms. When opening an external form, the user leaves homacoop.it; a specific privacy notice must be available in the form before submission.
9. Transfers outside the European Economic Area
The AWS services directly used by the forms are configured in the eu-north-1 region within the European Union.
The analytics.cercoalloggio.com statistics instance is administered by HOMA and hosted on a server provided by OVH in the Netherlands, within the European Union: analytics data does not leave the European Economic Area.
When the user chooses to open third-party content or a third-party form, the provider may process data outside the European Economic Area under its own terms and safeguards. The provider's privacy notice should be reviewed before loading or submitting the content.
10. Retention
| Data | Retention period or criterion |
|---|---|
| General requests, property proposals and Housing Desk requests | up to 24 months from the last relevant interaction |
| Residence enquiries and pre-registrations | up to 24 months from the last relevant interaction |
| Professional expressions of interest sent through “Work with us” | up to 12 months from receipt or the last interaction concerning the application |
| IP address used for rate limiting | approximately 11 minutes through automatic TTL |
| CloudWatch technical logs containing IP addresses | 30 days through automatic retention |
| Plausible analytics data | for as long as required to analyse historical website performance and while relevant to that purpose, subject to periodic review; this criterion will be updated once technical retention is defined |
| Addresses on the SES suppression list | for as long as required to avoid delivery to invalid addresses or addresses that generated complaints, subject to periodic review |
Email retention periods are applied through periodic organisational reviews of the relevant inboxes, at least every six months. If a request gives rise to a contract, dispute or legal obligation, the relevant data is moved to or retained in HOMA's ordinary systems under the retention rules applicable to that separate processing activity.
11. Data subject rights
Where provided by the GDPR, the data subject may request:
- access to personal data;
- rectification or updating;
- erasure;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interests, on grounds relating to their particular situation.
Requests may be sent to coop.ass@pec.it or to the DPO contact listed in section 2. HOMA may request information strictly necessary to verify the applicant's identity.
Data subjects may also lodge a complaint with the Italian Data Protection Authority through www.garanteprivacy.it or seek a judicial remedy.
12. Updates
HOMA may update this notice when the website, processing activities or applicable law changes. The published version shows the date of its latest update.