Privacy notice — homacoop.it

What changes in this version: in section 3, the requests recorded by staff may also come from the property listing portals on which HOMA advertises. In version 1.22 of 31 October 2026: in sections 3 and 6, the form for the press and other professional enquiries asks what the enquiry is about and, for a Cercoalloggio listing or accommodation, the city: in that case the request goes to the mailbox of the local office for that city. In version 1.21 of 26 October 2026: in section 3, the property owners' form asks for the telephone number and leaves the email address optional.

This notice explains how HOMA processes the personal data of people who visit homacoop.it, submit a request through the website, express interest in a residence or submit a professional profile.

1. Data controller

The controller is HOMA Società Cooperativa per azioni, Via Orsini Ducas 8, 73100 Lecce (LE), Italy, tax code and VAT number 04579080757, email info@homacoop.it, certified email coop.ass@pec.it. The full identification details are set out on the Legal notice page.

2. Data Protection Officer

The Data Protection Officer (DPO) is Mario Nobile, attorney-at-law, who can be contacted at privacy@homacoop.it.

3. Data processed

Browsing and security data

The systems used to deliver the website and manage its forms may process the IP address, date and time of the request, requested page, browser or device type, technical outcome and request identifiers.

To protect the forms against abuse, the IP address is temporarily associated with a submission counter: the website accepts no more than five submissions within ten minutes from the same IP address. The data is deleted automatically when the counter expires, within a technical margin of a few minutes.

Data submitted through forms

Depending on the path chosen, HOMA may receive:

• first name and surname;
• email address and telephone number, depending on the form: the email address is usually required and the telephone number optional; in the property owners' form the telephone number is required and the email address is optional;
• organisation, company, institution, university or role;
• for property proposals: the project category (student housing, apartments, affordable housing), the city of the property, its type, indicative size, condition, the plan requested and description;
• for student housing schemes: the city of the scheme, the number of beds planned, the funding programme or public call concerned, the stage of the project, the status of the public funding and the service plan of interest;
• for requests from universities, DSUs and institutions: the city of interest, the indicative number of people to accommodate and the starting period;
• for proposals, partnerships and projects: whether the person is writing on their own behalf or on behalf of a company or an organisation and, for the company or organisation, its exact name and VAT number;
• for the press and other professional enquiries: the subject of the enquiry and, for a Cercoalloggio listing or accommodation, the city of the listing or accommodation;
• housing need or residence of interest, with university, year of study and period for pre-registrations;
• professional area, city, LinkedIn profile link, personal introduction and, if given, where the job ad was seen for “Work with us”;
• the content of the message and any other information entered voluntarily.

The forms do not accept attachments. The “Work with us” form must not be used to send CVs, identity documents, health data or other special categories of personal data. If a profile is of interest, HOMA will subsequently provide an appropriate channel.

Requests received through other channels

When a person contacts HOMA by phone, by direct email, through the staff of local offices, at an event or through the property listing portals on which HOMA advertises (such as Immobiliare.it, Idealista and Subito) to propose a property or a project, ask for a service or raise a complaint, authorised persons may record the request in the internal archive described in section 6, with the same data the person would have entered in the corresponding form on the site. The channel through which the request arrived and the authorised person who entered it are recorded with it. The person who made the request is referred to this notice at the first available contact.

Contacts from the lead forms of our ads on Facebook and Instagram

When a person fills in the contact form of a HOMA or Cercoalloggio ad on Facebook or Instagram, HOMA receives the data the person wrote in the form: usually first and last name, email, phone, city and the answers to the questions of the form, for example whether they are looking for accommodation or offering a property for rent. Together with these data HOMA receives the name of the page, the campaign, the ad and the form and the date of submission. Every day the archive system reads these contacts from Meta, read-only, and records them in the internal archive described in section 6 as requests to be handled, in order to reply to the person; a contact read more than once remains a single record, and a person who filled in more than one form is flagged without merging their requests. HOMA does not use these contacts for the newsletter and writes nothing on Facebook or Instagram. The form is collected on the platform of Meta Platforms Ireland Limited, which makes the contacts available to HOMA for ninety days: for the data the person provides to Meta as a user, Meta's privacy policy and terms apply.

Requests through an AI assistant

When active, the website also offers a technical connection (an “MCP” server) through which an artificial intelligence assistant chosen by the person (for example Claude, ChatGPT or Gemini) can read the public pages on residences, calls for applications and job positions and send a contact request on the person's behalf. The request contains the same data as the form on the contact page, listed above, and is processed for the same purposes, on the same legal bases and for the same retention periods; who receives it within HOMA is decided by the website, as for the form. Before sending, the assistant must show the person a summary of the data and obtain their confirmation. The connection does not collect applications, CVs or attachments: applications are made on the website pages.

To protect the connection from abuse HOMA does not store the IP address: it computes a fingerprint valid for one day only, linked to counters that are deleted automatically within 48 hours (at most three requests per hour and six per day for each fingerprint). Technical logs do not record the content of requests.

The AI assistant is chosen and used by the person: its provider processes what the person writes to it under its own privacy notice, as an independent controller, and does not act on behalf of HOMA. HOMA only receives the request sent with the person's confirmation.

Information not to enter into the forms

The forms on this website exist so that HOMA can get back to you, and they do not ask for information about health, disability, documented financial circumstances, household composition or other special categories of data. Please do not enter such information in the free-text fields: to flag a housing need or an accessibility requirement a brief indication is enough, and HOMA will look into it in the appropriate setting and with the safeguards it requires. Where such information is entered nonetheless, HOMA processes it only as far as handling the request requires and retains it for the period set out in section 10.

Aggregate statistics

On the public domain HOMA uses a self-hosted instance of Plausible Community Edition to obtain aggregate information about page views, general traffic sources, device type and approximate geographic area. The configuration uses neither cookies nor storage of information on the visitor's device. To distinguish visits, the tool computes a value derived from the IP address and the browser type through a non-reversible function, with a varying element renewed every day: the value is not retained beyond that day, is not linked to any stable identifier and does not allow HOMA to identify an individual or to reconstruct their journey over time. The IP address is not retained by the analytics tool.

Four interactions are also recorded, likewise in aggregate form:

• button clicks, for which only the destination is recorded: the internal path reached, or the name of the external website the button leads to;
• form submissions, for which only the type of form (for example a contact request or a job application) and the outcome — successful or not — are recorded: this tells us when a form stops working;
• referrals to the Cercoalloggio portal from the student residence pages and from the contact page, for which the city and the residence the link started from are recorded. This tells us whether that referral is useful to people looking for a room;
• the options chosen in the diagnostic on the subsidised student housing page, for which the field and the chosen option are recorded (for example the funding programme indicated): this tells us what kind of projects owners arrive with. The diagnostic answers pre-fill the matching fields of the form on the same page, remain editable and are sent together with the request.

The content entered into forms is not collected, nor are names, contact details or any other identifying data. HOMA does not use these events to link them to the requests it receives or to the people who sent them, does not cross-reference them with the archive of requests or with its email inboxes and has no tools that would allow it to do so. Download tracking is not enabled.

Campaign measurement tools, only with consent

Only if you accept them in the banner, the website loads tools from Meta Platforms Ireland Limited, LinkedIn Ireland Unlimited Company and Google Ireland Limited to measure the results of HOMA's advertising campaigns. Your browser sends to each provider you accepted the address of the page visited (to Meta and LinkedIn with the parameters after the "?", to Google without them), the IP address, technical data about the browser and device, the provider's cookies present in the browser and only the events listed on the Cookies and similar technologies page, section 6: page view, contact sent with only its topic, click on "Apply" on a residence page, click on "Subscribe" to the newsletter and referral to Cercoalloggio. Providers do not receive the data you write in forms, nor your name, email or phone number, not even in encrypted form. The address of a residence page identifies the residence visited.

These tools are never loaded on the pages of open positions and job applications, in the residence application procedure (which asks about disability) or in the reserved area: sending an application, for a job or for a residence, is not communicated to providers. They are not used to show personalised advertisements or to build audiences of people who visited the website.

4. Purposes and legal bases

HOMA does not use data collected through the website's other forms to send the newsletter or any other unsolicited marketing communication: addresses received through those forms are not added to the newsletter list. Subscription to the newsletter takes place only through the dedicated form, at the data subject's own initiative, and that processing is described in section 13.

5. Provision of data

Fields marked as mandatory are required to identify and handle the request. Failure to provide them prevents submission or makes it impossible to reply. All other fields are optional.

Acknowledging the privacy notice is not consent: processing required to reply is based on the legal grounds described above.

Consent to the campaign measurement tools is optional: whoever rejects them, or closes the banner with the X, uses the website in the same way and without any consequence.

6. Processing methods and no automated decision-making

Data is processed electronically and protected through measures appropriate to the nature of the processing. Requests submitted through the website are forwarded to email inboxes selected by HOMA according to the form type. A request about a Cercoalloggio listing or accommodation is sent to the mailbox of the local office for the city given in the form, chosen from a list defined by HOMA, with the customer service mailbox in copy; if the city has no local office, it is sent to the customer service mailbox only. The request is also recorded in an internal archive hosted on Amazon Web Services in the eu-north-1 region of the European Union. The archive holds the data entered in the form, the originating page, the language and the date of receipt; it does not hold the sender's IP address. Its purpose is to know which requests have been handled and which have not, and to apply the retention periods set out in section 10 automatically. It is accessible only to persons expressly authorised by HOMA, each of them limited to their own area of responsibility.

Within the archive, authorised persons record the handling status of the request, the person following it and any internal notes concerning its management. This information is processed for the purposes set out in section 4 and is subject to the same rights set out in section 11.

A request received by phone or through other channels is recorded by an authorised person and from then on is handled like a request received through the site, with the same retention periods set out in section 10.

When a request concerns a city where the service is followed by a local office, or needs the involvement of a HOMA department (for example administration, for the return of a deposit), the authorised person may forward it to the mailbox of that office or department, chosen from a list defined by HOMA; the same request may be forwarded to several mailboxes on the list in a single sending. Forwarding does not change the request and is recorded with the person who made it, the time and the receiving mailboxes.

When a request reaches an internal area that is not competent to handle it, for example because a request type other than the corresponding one was chosen in the form, the authorised person may assign it to the competent area. The request is sent to that area's mailboxes and from then on it is accessed by the persons authorised for that area. The assignment does not change the data submitted and is recorded with the person who made it, the time, the area of origin, the receiving area and the reason. When the same person sends more than one request for the same need, including through different forms, the repeated requests may be linked to a main request: none is deleted for this reason, and the link is recorded. Assignments and links do not extend the retention periods set out in section 10.

Traceability of access

The system separately records the consultations, entries, forwards and exports carried out on the archive, indicating the authorised person, the time and the area of data concerned. That record concerns the activity of authorised persons and exists to ensure that data is consulted only by those entitled to do so.

Extracted lists

For specific management activities an authorised person may extract a list of requests from the archive. Lists extracted in this way are kept within HOMA's working tools and deleted within the period set out in section 10; the automatic deletion that applies to individual records in the archive does not apply to them.

Requests received before 31 August 2026

The internal archive has been in operation since 31 August 2026. Requests received before that date are held in the email inboxes only, under the periods that section 10 sets out for inboxes.

Acknowledgement of receipt

Anyone submitting a form automatically receives, at the email address provided, an acknowledgement of receipt containing a summary of the data entered. The acknowledgement is sent once only, for the same purpose for which the request was submitted, and contains no marketing communications.

Support tools

Authorised persons may use supporting software, including artificial intelligence tools on corporate accounts held by the cooperative, for internal activities of organising, summarising or searching the material received. Those tools are not used to take decisions on requests or applications, nor to assign scores or produce rankings. The providers are listed in section 7.

Requests and applications are reviewed by authorised people. HOMA does not make decisions based solely on automated processing that produce legal or similarly significant effects, and does not carry out profiling.

7. Recipients and service providers

Personal data may be processed, within the limits of their duties, by HOMA employees, worker-members and collaborators who have been authorised to process it.

Data may also be processed by providers supporting website operation, security, hosting, email delivery and receipt, analytics and technical maintenance. Where these providers process data on HOMA's behalf, they must be governed by an agreement under Article 28 GDPR.

The form workflow uses Amazon Web Services in the eu-north-1 region of the European Union: Lambda processes the request, SES sends email, DynamoDB applies rate limiting and holds the archive of requests, and CloudWatch stores technical logs. An email address that causes a bounce or complaint may be placed on the AWS account-level suppression list, shared with other HOMA services using the same account, solely to prevent further delivery attempts to invalid or disputed addresses.

HOMA uses artificial intelligence tools on corporate accounts held by the cooperative, provided by Google (Gemini, within Google Workspace), Anthropic (Claude) and OpenAI. Those tools may process data originating from requests received through the website where an authorised person uses them for internal support activities, for example to summarise or reorder a list exported from the archive. Personal accounts are not used. Where these providers process data on HOMA's behalf, they must be governed by an agreement under Article 28 of the GDPR.

The newsletter is sent using Brevo, a service of Sendinblue, société par actions simplifiée, 9-17 rue Salneuve, 75017 Paris, registered with the Paris Trade and Companies Register under number 498 019 298. The provider receives the addresses of the people who subscribe and processes them as a processor under Article 28 of the GDPR, in accordance with the data processing agreement that forms Appendix 3 to its terms of service. The processing is described in section 13.

Campaign measurement tools. If you accept the tools described in section 3, the visit data is collected in your browser and sent to Meta Platforms Ireland Limited, LinkedIn Ireland Unlimited Company and Google Ireland Limited, each for the tool you accepted. Google Ireland Limited and LinkedIn Ireland Unlimited Company process the data they receive as independent controllers, under their own privacy notices. For the collection and transmission of data from the website to Meta Platforms Ireland Limited, HOMA and Meta are joint controllers under Article 26 GDPR, according to the agreement Meta applies to businesses using its tools (Controller Addendum); for subsequent processing Meta processes the data as an independent controller. Rights relating to the collection and transmission can be exercised with HOMA or with Meta. HOMA is the controller of the choice of tools, of their configuration and of the events sent.

Data may be disclosed to advisers or authorities where required by law or necessary to protect a right. It is not publicly disclosed.

8. Third-party content and forms

Some pages of the website contain virtual tours, videos or posts hosted by CloudPano, YouTube, Instagram or LinkedIn, which load when the page opens. From that moment the browser connects to the provider, and to the services the provider uses inside its own content, which may receive the IP address and other technical data and use cookies or similar technologies as independent controllers, under their own privacy notices. The providers' domains and the links to their privacy notices are in the cookie policy, section 4.

Some pages may link to Google Forms for calls or applications. The link does not send Google the data entered in HOMA's internal forms. When opening an external form, the user leaves homacoop.it; a specific privacy notice must be available in the form before submission.

9. Transfers outside the European Economic Area

The AWS services directly used by the forms are configured in the eu-north-1 region within the European Union.

The analytics instance is reachable at analytics.cercoalloggio.com, a subdomain attributable to HOMA and used to host it: naming it involves no disclosure of data to anyone other than HOMA. The instance is administered by HOMA and hosted on a server provided by OVH in the Netherlands, within the European Union: analytics data does not leave the European Economic Area.

Some of the artificial intelligence tools referred to in section 7 are provided by entities established in the United States. Where data originating from the website is processed using those tools, the transfer takes place in accordance with the safeguards provided for by Articles 45 and 46 of the GDPR: the provider's adherence to the EU-US Data Privacy Framework, where applicable, or standard contractual clauses approved by the European Commission.

Addresses subscribed to the newsletter are hosted, according to the list of sub-processors annexed to the data processing agreement of the provider named in section 7, on infrastructure located in France and Belgium, within the European Union. That same agreement provides that the service may at times involve processing outside the European Economic Area, where the provider, the companies of its group or its sub-processors operate: in that case HOMA relies on the standard contractual clauses approved by the European Commission contained in that agreement and on the supplementary measures it provides for; for transfers to the United States the provider's adherence to the EU-US Data Privacy Framework is also relevant, where applicable and verified.

If accepted, the campaign measurement tools described in section 3 involve the transfer of visit data from the Irish companies listed in section 7 to their parent companies in the United States (Meta Platforms, Inc., LinkedIn Corporation, Google LLC). The transfer is based on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, Article 45 GDPR, in which the three companies participate; HOMA verifies their participation on the official list.

When the user opens a page that contains content from a third-party provider (section 8), or opens a third-party form, it is the user's browser that connects directly to that provider. HOMA transmits no data to the provider and, in relation to such content, carries out no transfer of personal data: from the moment the content is loaded, processing takes place under the responsibility of the provider, as an independent controller, under its own privacy notice and its own safeguards, including for any processing outside the European Economic Area. Links to the providers' privacy notices are available on the Cookies and similar technologies page (section 4).

10. Retention

The periods in this table concern data. The duration of the cookies written by the campaign measurement tools, that is, how long they stay in the browser, is a different matter and is shown for each cookie on the Cookies and similar technologies page, section 6.

The period shown for the internal archive runs from receipt and does not restart (for contacts from ad lead forms, from the date the person submitted the form): consulting a record and adding internal management notes do not affect the periods shown. Automatic deletion is carried out by the system within a few days of the period expiring. Requests received before 31 August 2026 are held in the email inboxes only, under the periods shown for inboxes. The periods relating to email inboxes are applied through periodic organisational reviews, at least every six months. If a request gives rise to a contract, dispute or legal obligation, the relevant data is moved to or retained in HOMA's ordinary systems under the retention rules applicable to that separate processing activity.

11. Data subject rights

Where provided by the GDPR, the data subject may request:

• access to personal data;
• rectification or updating;
• erasure;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests, on grounds relating to their particular situation.

Requests may be sent to privacy@homacoop.it or, if preferred, to coop.ass@pec.it; the Data Protection Officer's contact details in section 2 may also be used. HOMA replies without undue delay and in any event within one month of receiving the request; that period may be extended by two months where the request is particularly complex or where requests are numerous, in which case the data subject is notified within the first month. Exercising these rights is free of charge. HOMA may request information strictly necessary to verify the applicant's identity.

Consent to the campaign measurement tools can be withdrawn at any time from Cookie preferences, at the bottom of every page of the website, with the same number of steps needed to give it; withdrawal removes the tools and the cookies written on the homacoop.it domain, as described on the Cookies and similar technologies page, section 8. For the data that providers process as independent controllers, rights can also be exercised directly with them, at the contact details given in their privacy notices.

Data subjects may also lodge a complaint with the Italian Data Protection Authority through www.garanteprivacy.it or seek a judicial remedy.

12. Version and updates

HOMA updates this notice when the website, processing activities or applicable law change. Each page shows its version number and the month of its latest update. HOMA keeps previous versions and provides a copy on request to the contact details set out in section 2. Where an update materially affects processing already under way, HOMA flags it at the top of the page for at least thirty days.

Previous versions of this page are available on request by writing to privacy@homacoop.it.

13. Newsletter

The HOMA newsletter gathers the news published on homacoop.it into a single message, sent as a rule every two weeks. It is published in Italian and subscription takes place on the Newsletter page; the English page refers to the Italian one and does not offer the form. The subscription page, the confirmation message and the unsubscribe page are in Italian. Anyone who would rather receive this information in English may request it at privacy@homacoop.it before subscribing.

Only an email address is required in order to subscribe. The form also transmits two fixed values indicating Italian, which the provider uses to set the language of its own service messages, and an anti-abuse check field that is left empty. Name, role, organisation and other data are not requested, and the address is not used for any purpose other than sending the newsletter.

The processing is based on the data subject's consent, Article 6(1)(a) of the GDPR, and on Article 130 of the Italian Personal Data Protection Code. Consent may be withdrawn at any time under Article 7(3) of the GDPR, without the withdrawal affecting the lawfulness of messages sent before it.

How consent is given and how it is evidenced

Subscription is completed in two steps. After the form is submitted the address is not yet subscribed: the provider sends a message containing a confirmation link, and the subscription begins only when that link is clicked. Anyone who does not confirm receives no newsletter, and their address remains pending with the provider, where it generates no sending.

As evidence of consent the following are kept: the email address, the indication of the form the subscription came from, the attribute recording that confirmation took place, and the date the contact was created, which for anyone subscribing through the website is the date of the subscription; the contact history also keeps the events relating to the messages received. The IP address of the person subscribing is not recorded.

Message tracking and cookies

Newsletter messages contain a measurement element that reports the opening of the message, and the links they contain pass through the provider's domains, which records the click. Neither function can be switched off in the service used: they serve to know how many recipients read the digest and which news items they open, and they are used in aggregate form. The same mechanism applies to the subscription confirmation link, and the recording of that click is what evidences consent.

The subscription page installs no cookies: the form is a form that loads no script, stylesheet or font from the provider, and no data reaches the provider before submission. On submission the browser leaves homacoop.it and opens a page belonging to the provider, which may use its own cookies under its own privacy notice; from that page the user is returned to homacoop.it.

If you accepted the campaign measurement tools described in section 3, the click on the "Subscribe" button is communicated to the providers you accepted as a measurement event, without the email address: it is only the click, not the completed subscription, which the website does not see.

Unsubscribing, retention and rights

Every issue of the newsletter carries an unsubscribe link at the end, which works with one click: the provider's page cancels the subscription immediately, and only afterwards asks for a reason as an optional question. Once unsubscribed, no further message is sent.

The welcome message, which the system sends once to anyone who has just confirmed their subscription, is a service message and not an issue of the newsletter: for that reason it does not carry the unsubscribe link, and instead states in words where that link is — at the end of every issue — together with the address privacy@homacoop.it, which may be used for any request concerning one's own data, including unsubscription.

Some email programs display an unsubscribe button of their own next to the sender's name. On a service message such as the welcome message, that button acts on the provider's technical channel and blocks the sender address: it is not equivalent to unsubscribing from the newsletter, which is obtained through the link at the end of every issue or by writing to the contact details set out in section 11.

The address, however, is not deleted: it remains in the provider's records flagged as unsubscribed, and it is that flag which tells the system to stop writing to that address. On unsubscribing, the address is also removed from the newsletter list. The date the contact was created and the attribute recording the confirmation remain with it, and the contact history keeps both the unsubscribe event and the removal from the list. Anyone who subscribes again starts receiving the newsletter, because the form places them back on the list and the flag is removed. To have the address erased from the provider's records it is enough to ask, at the contact details set out in section 11: HOMA carries it out without delay.

Technical records of the sendings — the openings and clicks described above — are kept by the provider for 24 months, a period set by HOMA in the service configuration. It is the same period applied to requests received through the website and to the access log referred to in section 10, and it is justified by the aggregate measurement of the messages.

The rights set out in section 11 apply to this processing too, through the same contact details and within the same time limits.