Privacy policy

Data Controller: Gemma Immobiliare Sas
Registered Address: Via Rima 2, 22016 Tremezzina-Lenno (CO), Italy
Company Registration No.: REA 271522
Broker Role Numbers: CCIAA 1366 / LR CCIAA 1006
Email: gemma@gemmaimmobiliare.com
Data Protection Lead: gemma@gemmaimmobiliare.com

This privacy notice explains how we process your personal data, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where relevant, we also consider the EU GDPR when processing personal data of EU-based individuals.


Your Rights under UK Data Protection Law

As a data subject, you have the following rights:

  • Right to be informed – about how your data is used (through this notice);

  • Right of access – to the personal data we hold about you;

  • Right to rectification – of inaccurate or incomplete personal data;

  • Right to erasure – where data is no longer necessary or consent is withdrawn;

  • Right to restrict processing – under certain circumstances;

  • Right to data portability – to receive your data in a usable format;

  • Right to object – to processing based on legitimate interests or for direct marketing;

  • Rights related to automated decision-making – to not be subject to decisions based solely on automated processing.

To exercise these rights, please contact gemma@gemmaimmobiliare.com with the subject line “Subject Access Request”. We may require proof of identity to proceed.


Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Consent (where freely given);

  • Performance of a contract (e.g., property-related services);

  • Legal obligation (e.g., anti-money laundering);

  • Vital interests (e.g., fraud prevention);

  • Public interest;

  • Legitimate interests (e.g., marketing to clients).

Where we rely on legitimate interests, we always balance our interests against your rights and freedoms.


Categories of Data We Process

  • Identity Data: name, date of birth, gender

  • Contact Data: address, email, phone

  • Financial Data: payment details

  • Transaction Data: purchase and payment history

  • Technical Data: IP address, browser, device

  • Usage Data: website behaviour

  • Marketing Data: preferences and engagement

We do not process special categories of personal data (e.g. health, religion) or data relating to criminal convictions.


How We Collect Your Data

  • Directly from you: when you contact us or use our services.

  • Indirectly: via referrals or analytics.

  • Third parties: where permitted by law or with your consent.


Purposes of Processing

Purpose Data Involved Legal Basis
B2B Marketing Identity, Contact Legitimate Interest
Analytics Technical, Usage Legitimate Interest
Fraud Prevention Identity, Transaction Vital Interest
Contact Forms / Emails Identity, Contact Legitimate Interest
Consumer Marketing Identity, Contact, Marketing Legitimate Interest
Call Recording Identity, Contact Legitimate Interest

Automated Decision-Making & Profiling

We do not carry out any profiling or automated decision-making that produces legal or similarly significant effects on you.


Data Retention

  • Personal data used under contract: kept for 6 years.

  • Personal data used under consent: until consent is withdrawn.

  • Personal data under legitimate interest: reviewed every 12 months.

  • Some client-related data (e.g., name, contact) may be retained longer to facilitate returning services.


International Data Transfers

We may use third-party IT providers or processors located outside the UK (e.g., EU or USA). In these cases, we ensure data transfers are safeguarded through:

  • Adequacy decisions (e.g., EU);

  • Standard Contractual Clauses (SCCs);

  • Appropriate technical and organisational measures.


Third Parties with Whom We Share Data

We share personal data only when necessary with trusted third parties such as:

  • Service providers (e.g. hosting, CRM);

  • Regulatory authorities (e.g. HMRC, in case of legal obligations);

  • Courier/postal services (for document delivery);

  • Payment providers;

  • Professional advisers (accountants, lawyers, etc.).

We ensure all processors act in compliance with data protection laws and under strict confidentiality obligations.


Complaints

If you believe your data has been mishandled, you may:

  • Contact us directly at gemma@gemmaimmobiliare.com;

  • File a complaint with the Information Commissioner’s Office (ICO):

    • Website: www.ico.org.uk

    • Telephone: 0303 123 1113

    • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF


Updates

This policy may be updated from time to time. The latest version will always be available on our website or by request.