Legal information
Privacy notice — homacoop.it
This notice explains how HOMA processes the personal data of people who visit homacoop.it, submit a request through the website, express interest in a residence or submit a professional profile.
1. Data controller
The controller is HOMA Società Cooperativa per azioni, Via Orsini Ducas 8, 73100 Lecce (LE), Italy, tax code and VAT number 04579080757, email info@homacoop.it, certified email coop.ass@pec.it. The full identification details are set out on the Legal notice page.
2. Data Protection Officer
The Data Protection Officer (DPO) is Mario Nobile, who can be contacted at privacy@homacoop.it.
3. Data processed
Browsing and security data
The systems used to deliver the website and manage its forms may process the IP address, date and time of the request, requested page, browser or device type, technical outcome and request identifiers.
To protect the forms against abuse, the IP address is temporarily associated with a submission counter: the website accepts no more than five submissions within ten minutes from the same IP address. The data is deleted automatically when the counter expires, within a technical margin of a few minutes.
Data submitted through forms
Depending on the path chosen, HOMA may receive:
- first name and surname;
- email address and, if provided, telephone number;
- organisation, company, institution, university or role;
- for property proposals: the city of the property, its type, indicative size, condition and description;
- for student housing schemes: the city of the scheme, the number of beds planned, the funding programme or public call concerned, the stage of the project, the status of the public funding and the service plan of interest;
- for requests from universities, DSUs and institutions: the city of interest, the indicative number of people to accommodate and the starting period;
- housing need or residence of interest, with university, year of study and period for pre-registrations;
- professional area, city, LinkedIn profile link and personal introduction for “Work with us”;
- the content of the message and any other information entered voluntarily.
The forms do not accept attachments. The “Work with us” form must not be used to send CVs, identity documents, health data or other special categories of personal data. If a profile is of interest, HOMA will subsequently provide an appropriate channel.
Information not to enter into the forms
The forms on this website exist so that HOMA can get back to you, and they do not ask for information about health, disability, documented financial circumstances, household composition or other special categories of data. Please do not enter such information in the free-text fields: to flag a housing need or an accessibility requirement a brief indication is enough, and HOMA will look into it in the appropriate setting and with the safeguards it requires. Where such information is entered nonetheless, HOMA processes it only as far as handling the request requires and retains it for the period set out in section 10.
Aggregate statistics
On the public domain HOMA uses a self-hosted instance of Plausible Community Edition to obtain aggregate information about page views, general traffic sources, device type and approximate geographic area. The configuration uses neither cookies nor storage of information on the visitor's device. To distinguish visits, the tool computes a value derived from the IP address and the browser type through a non-reversible function, with a varying element renewed every day: the value is not retained beyond that day, is not linked to any stable identifier and does not allow HOMA to identify an individual or to reconstruct their journey over time. The IP address is not retained by the analytics tool.
Four interactions are also recorded, likewise in aggregate form:
- button clicks, for which only the destination is recorded: the internal path reached, or the name of the external website the button leads to;
- form submissions, for which only the type of form (for example a contact request or a job application) and the outcome — successful or not — are recorded: this tells us when a form stops working;
- referrals to the Cercoalloggio portal from the student residence pages and from the contact page, for which the city and the residence the link started from are recorded. This tells us whether that referral is useful to people looking for a room;
- the options chosen in the diagnostic on the subsidised student housing page, for which the field and the chosen option are recorded (for example the funding programme indicated): this tells us what kind of projects owners arrive with. The diagnostic answers pre-fill the matching fields of the form on the same page, remain editable and are sent together with the request.
The content entered into forms is not collected, nor are names, contact details or any other identifying data. HOMA does not use these events to link them to the requests it receives or to the people who sent them, does not cross-reference them with the archive of requests or with its email inboxes and has no tools that would allow it to do so. Download tracking is not enabled.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Deliver and protect the website, prevent abuse, diagnose errors and ensure system security | HOMA's legitimate interest in the security and proper operation of its systems, Article 6(1)(f) GDPR |
| Reply to contact requests, property proposals and enquiries about services, residences or the Housing Desk | steps taken at the data subject's request prior to entering into a contract, Article 6(1)(b) GDPR; for institutional or non-pre-contractual communications, legitimate interest in handling incoming communications, Article 6(1)(f) GDPR |
| Assess expressions of interest and residence pre-registrations | steps taken at the data subject's request prior to entering into a contract, Article 6(1)(b) GDPR |
| Assess an application received against open positions or positions about to open | steps taken at the candidate's request prior to entering into a contract, Article 6(1)(b) GDPR |
| Retain the professional profile for later opportunities, within the period set out in section 10 | HOMA's legitimate interest in holding a pool of applications for future needs, Article 6(1)(f) GDPR; the candidate may object at any time and the objection is acted on without delay |
| Record consultations and exports carried out on the internal archive of requests | HOMA's legitimate interest in data security and in demonstrating the measures adopted, Article 6(1)(f) GDPR in connection with Article 32 GDPR |
| Send the newsletter to people who have asked for it and keep the record of that request | the data subject's consent, Article 6(1)(a) GDPR, and Article 130 of the Italian Personal Data Protection Code; consent may be withdrawn at any time under Article 7(3) GDPR |
| Comply with legal obligations or requests from public authorities | legal obligation, Article 6(1)(c) GDPR |
| Measure the use of the website in aggregate form and improve its content and navigation | HOMA's legitimate interest in evaluating and improving the website through a self-hosted tool without cookies or persistent identifiers, Article 6(1)(f) GDPR |
| Establish, exercise or defend legal claims | HOMA's legitimate interest in protecting its rights, Article 6(1)(f) GDPR |
HOMA does not use data collected through the website's other forms to send the newsletter or any other unsolicited marketing communication: addresses received through those forms are not added to the newsletter list. Subscription to the newsletter takes place only through the dedicated form, at the data subject's own initiative, and that processing is described in section 13.
5. Provision of data
Fields marked as mandatory are required to identify and handle the request. Failure to provide them prevents submission or makes it impossible to reply. All other fields are optional.
Acknowledging the privacy notice is not consent: processing required to reply is based on the legal grounds described above.
6. Processing methods and no automated decision-making
Data is processed electronically and protected through measures appropriate to the nature of the processing. Requests submitted through the website are forwarded to email inboxes selected by HOMA according to the form type. The request is also recorded in an internal archive hosted on Amazon Web Services in the eu-north-1 region of the European Union. The archive holds the data entered in the form, the originating page, the language and the date of receipt; it does not hold the sender's IP address. Its purpose is to know which requests have been handled and which have not, and to apply the retention periods set out in section 10 automatically. It is accessible only to persons expressly authorised by HOMA, each of them limited to their own area of responsibility.
Within the archive, authorised persons record the handling status of the request, the person following it and any internal notes concerning its management. This information is processed for the purposes set out in section 4 and is subject to the same rights set out in section 11.
Traceability of access
The system separately records the consultations and exports carried out on the archive, indicating the authorised person, the time and the area of data concerned. That record concerns the activity of authorised persons and exists to ensure that data is consulted only by those entitled to do so.
Extracted lists
For specific management activities an authorised person may extract a list of requests from the archive. Lists extracted in this way are kept within HOMA's working tools and deleted within the period set out in section 10; the automatic deletion that applies to individual records in the archive does not apply to them.
Requests received before 31 August 2026
The internal archive has been in operation since 31 August 2026. Requests received before that date are held in the email inboxes only, under the periods that section 10 sets out for inboxes.
Acknowledgement of receipt
Anyone submitting a form automatically receives, at the email address provided, an acknowledgement of receipt containing a summary of the data entered. The acknowledgement is sent once only, for the same purpose for which the request was submitted, and contains no marketing communications.
Support tools
Authorised persons may use supporting software, including artificial intelligence tools on corporate accounts held by the cooperative, for internal activities of organising, summarising or searching the material received. Those tools are not used to take decisions on requests or applications, nor to assign scores or produce rankings. The providers are listed in section 7.
Requests and applications are reviewed by authorised people. HOMA does not make decisions based solely on automated processing that produce legal or similarly significant effects, and does not carry out profiling.
7. Recipients and service providers
Personal data may be processed, within the limits of their duties, by HOMA employees, worker-members and collaborators who have been authorised to process it.
Data may also be processed by providers supporting website operation, security, hosting, email delivery and receipt, analytics and technical maintenance. Where these providers process data on HOMA's behalf, they must be governed by an agreement under Article 28 GDPR.
The form workflow uses Amazon Web Services in the eu-north-1 region of the European Union: Lambda processes the request, SES sends email, DynamoDB applies rate limiting and holds the archive of requests, and CloudWatch stores technical logs. An email address that causes a bounce or complaint may be placed on the AWS account-level suppression list, shared with other HOMA services using the same account, solely to prevent further delivery attempts to invalid or disputed addresses.
HOMA uses artificial intelligence tools on corporate accounts held by the cooperative, provided by Google (Gemini, within Google Workspace), Anthropic (Claude) and OpenAI. Those tools may process data originating from requests received through the website where an authorised person uses them for internal support activities, for example to summarise or reorder a list exported from the archive. Personal accounts are not used. Where these providers process data on HOMA's behalf, they act as processors under Article 28 of the GDPR.
The newsletter is sent using Brevo, a service of Sendinblue, société par actions simplifiée, 9-17 rue Salneuve, 75017 Paris, registered with the Paris Trade and Companies Register under number 498 019 298. The provider receives the addresses of the people who subscribe and processes them as a processor under Article 28 of the GDPR, in accordance with the data processing agreement that forms Appendix 3 to its terms of service. The processing is described in section 13.
Data may be disclosed to advisers or authorities where required by law or necessary to protect a right. It is not publicly disclosed.
8. Third-party content and forms
The website may display locally hosted previews of content available on YouTube, Instagram, LinkedIn or CloudPano. A connection to the provider is made only when the user chooses to load that specific content. The provider may then receive technical data and use cookies or similar technologies under its own privacy notice. HOMA does not remember the user's choice and does not automatically enable other content from the same provider.
Some pages may link to Google Forms for calls or applications. The link does not send Google the data entered in HOMA's internal forms. When opening an external form, the user leaves homacoop.it; a specific privacy notice must be available in the form before submission.
9. Transfers outside the European Economic Area
The AWS services directly used by the forms are configured in the eu-north-1 region within the European Union.
The analytics instance is reachable at analytics.cercoalloggio.com, a subdomain attributable to HOMA and used to host it: naming it involves no disclosure of data to anyone other than HOMA. The instance is administered by HOMA and hosted on a server provided by OVH in the Netherlands, within the European Union: analytics data does not leave the European Economic Area.
Some of the artificial intelligence tools referred to in section 7 are provided by entities established in the United States. Where data originating from the website is processed using those tools, the transfer takes place in accordance with the safeguards provided for by Articles 45 and 46 of the GDPR: the provider's adherence to the EU-US Data Privacy Framework, where applicable, or standard contractual clauses approved by the European Commission.
Addresses subscribed to the newsletter are hosted, according to the list of sub-processors annexed to the data processing agreement of the provider named in section 7, on infrastructure located in France and Belgium, within the European Union. That same agreement provides that the service may at times involve processing outside the European Economic Area, where the provider, the companies of its group or its sub-processors operate: in that case the provider undertakes to ensure an adequate level of protection through standard contractual clauses and supplementary measures and, for transfers to the United States, on the basis of the EU-US Data Privacy Framework for as long as it remains valid.
When the user chooses to load a piece of content or to open a third-party form, it is the user's browser that connects directly to that provider. HOMA transmits no data before that choice is made and, in relation to such content, carries out no transfer of personal data: from the moment the content is loaded, processing takes place under the responsibility of the provider, as an independent controller, under its own privacy notice and its own safeguards, including for any processing outside the European Economic Area. Links to the providers' privacy notices are available on the Cookies and similar technologies page and can be reviewed before loading the content.
10. Retention
| Data | Retention period or criterion |
|---|---|
| General requests, property proposals and Housing Desk requests, in email inboxes | up to 24 months from the last relevant interaction |
| Residence enquiries and pre-registrations, in email inboxes | up to 24 months from the last relevant interaction |
| Professional expressions of interest sent through “Work with us”, in email inboxes | up to 12 months from receipt or the last interaction concerning the application |
| Requests recorded in the internal archive, other than job applications | 24 months from receipt. On expiry the record is deleted automatically |
| Job applications recorded in the internal archive | 12 months from receipt. On expiry the record is deleted automatically |
| Records of consultations and exports carried out on the archive | 24 months from the entry, with automatic deletion |
| Lists extracted from the archive | for as long as the activity they were extracted for requires and in any event no longer than 6 months from extraction |
| Archive backups | up to 35 days, through the point-in-time recovery feature of the service |
| IP address used for rate limiting | 10 minutes from submission, with automatic deletion within a technical margin of a few minutes |
| Technical logs containing IP addresses | 30 days, through a limited automatic retention period |
| Analytics data | for as long as required to analyse historical website performance and while relevant to that purpose, subject to periodic review |
| Addresses on the email suppression list | for as long as required to avoid delivery to invalid addresses or addresses that generated complaints, subject to periodic review |
| Addresses subscribed to the newsletter, in the sending provider's records | for as long as the subscription is active; after unsubscribing the address remains flagged as unsubscribed and is erased on request, to the contact details set out in section 11 |
| Technical records of newsletter sendings, held by the provider | 24 months, a period set by HOMA in the service configuration |
The period shown for the internal archive runs from receipt and does not restart: consulting a record and adding internal management notes do not affect the periods shown. Automatic deletion is carried out by the system within a few days of the period expiring. Requests received before 31 August 2026 are held in the email inboxes only, under the periods shown for inboxes. The periods relating to email inboxes are applied through periodic organisational reviews, at least every six months. If a request gives rise to a contract, dispute or legal obligation, the relevant data is moved to or retained in HOMA's ordinary systems under the retention rules applicable to that separate processing activity.
11. Data subject rights
Where provided by the GDPR, the data subject may request:
- access to personal data;
- rectification or updating;
- erasure;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interests, on grounds relating to their particular situation.
Requests may be sent to privacy@homacoop.it or, if preferred, to coop.ass@pec.it; the Data Protection Officer's contact details in section 2 may also be used. HOMA replies without undue delay and in any event within one month of receiving the request; that period may be extended by two months where the request is particularly complex or where requests are numerous, in which case the data subject is notified within the first month. Exercising these rights is free of charge. HOMA may request information strictly necessary to verify the applicant's identity.
Data subjects may also lodge a complaint with the Italian Data Protection Authority through www.garanteprivacy.it or seek a judicial remedy.
12. Version and updates
HOMA updates this notice when the website, processing activities or applicable law change. Each page shows its version number and the month of its latest update. HOMA keeps previous versions and provides a copy on request to the contact details set out in section 2. Where an update materially affects processing already under way, HOMA flags it at the top of the page for at least thirty days.
Previous versions of this page are available on request by writing to privacy@homacoop.it.
13. Newsletter
The HOMA newsletter gathers the news published on homacoop.it into a single message, sent as a rule every two weeks. It is published in Italian and subscription takes place on the Newsletter page; the English page refers to the Italian one and does not offer the form.
Only an email address is required in order to subscribe. The form also transmits two fixed values indicating Italian, which the provider uses to set the language of its own service messages, and an anti-abuse check field that is left empty. Name, role, organisation and other data are not requested, and the address is not used for any purpose other than sending the newsletter.
The processing is based on the data subject's consent, Article 6(1)(a) of the GDPR, and on Article 130 of the Italian Personal Data Protection Code. Consent may be withdrawn at any time under Article 7(3) of the GDPR, without the withdrawal affecting the lawfulness of messages sent before it.
How consent is given and how it is evidenced
Subscription is completed in two steps. After the form is submitted the address is not yet subscribed: the provider sends a message containing a confirmation link, and the subscription begins only when that link is clicked. Anyone who does not confirm receives no newsletter, and their address remains pending with the provider, where it generates no sending.
As evidence of consent the following are kept: the email address, the indication of the form the subscription came from, the attribute recording that confirmation took place, and the date the contact was created, which for anyone subscribing through the website is the date of the subscription; the contact history also keeps the events relating to the messages received. The IP address of the person subscribing is not recorded.
Message tracking and cookies
Newsletter messages contain a measurement element that reports the opening of the message, and the links they contain pass through the provider's domains, which records the click. Neither function can be switched off in the service used: they serve to know how many recipients read the digest and which news items they open, and they are used in aggregate form. The same mechanism applies to the subscription confirmation link, and the recording of that click is what evidences consent.
The subscription page installs no cookies: the form is a form that loads no script, stylesheet or font from the provider, and no data reaches the provider before submission. On submission the browser leaves homacoop.it and opens a page belonging to the provider, which may use its own cookies under its own privacy notice; from that page the user is returned to homacoop.it.
Unsubscribing, retention and rights
Every message carries an unsubscribe link at the end, which works with one click: the provider's page cancels the subscription immediately, and only afterwards asks for a reason as an optional question. Once unsubscribed, no further message is sent.
The address, however, is not deleted: it remains in the provider's records flagged as unsubscribed, and it is that flag which tells the system to stop writing to that address. The date the contact was created, the attribute recording the confirmation and the list membership remain with it, and the unsubscribe event stays in the contact history. Anyone who subscribes again starts receiving the newsletter because the flag is removed. To have the address erased from the provider's records it is enough to ask, at the contact details set out in section 11: HOMA carries it out without delay.
Technical records of the sendings are kept by the provider for 24 months, a period set by HOMA in the service configuration. It is the same period applied to requests received through the website and to the access log referred to in section 10, and it is the time within which HOMA must be able to demonstrate the consent of anyone recorded as subscribed.
The rights set out in section 11 apply to this processing too, through the same contact details and within the same time limits.