Website privacy notice

Who is the controller?

The controller is ColivingLiguria S.r.l., tax/VAT number 01939660096, REA SV – 248967, registered at Via Strada Chiappella 21, 17014 Cairo Montenotte (SV), Italy. For information or to exercise your rights, write to colivingliguria@gmail.com or our certified email address colivingliguria@pec.it. You do not need an account or a signed Attachment D to contact us.

What does this page cover?

This notice covers browsing the website and, when available, personal accounts, private-area requests and Business applications. Describing an unavailable feature here does not activate it. The applicable notice must be made available before the form collects the relevant data.

This page is a draft, separate from Attachment D. Operational retention criteria and service safeguards must be completed before this version can accompany a new registration. It does not replace the notice applicable to processing that has already begun or alter previous choices.

A later stay, engagement, internship or other relationship may require further documents and information. Identity documents, health information, banking evidence and immigration documents require a dedicated workflow: do not enter them in general website fields.

What data do we collect?

Website visit. The hosting service receives technical information needed to deliver and protect pages, including the IP address, request and browser information. Your language choice is stored on your device; external maps, images and multimedia may connect to their providers.

Account and requests. Forms ask for first name, last name, email and, in the current form, phone number. They may collect your selected route, indicative stay duration, an optional referral code, the answers you provide and operations needed to manage the account. A declared phone number is not a verified contact.

Business application. We collect the organisation’s name, type, country and business contact, the contact person’s name and role, and the request purpose and description. Changes and operation receipts allow correction and follow-up. A personal account does not automatically verify powers to represent an organisation.

Choices and security. Notice versions acknowledged, optional consents and security events are distinct. Registration alone does not authorise publication of your profile or images.

Why do we use the data?

Account and personal request: to provide the service you request and take pre-contractual steps you ask for; Article 6(1)(b) applies within the data necessary for these activities.

Organisation contact: to handle the organisation’s contact and application. Its contract does not automatically make the contact person a party. The legitimate interest to assess is handling professional contacts and received requests under Article 6(1)(f), including necessity and balancing.

Operation and security: to deliver pages, verify access, prevent abuse and protect the service. The interest pursued is website and account security and continuity; processing must be necessary and proportionate, with the relevant assessment under Article 6(1)(f). Necessary access messages are not newsletters.

Optional promotional updates and research: only for the stated separate purpose, when the relevant service is available and consent is the appropriate basis, under Article 6(1)(a). You may refuse or withdraw each choice without losing the necessary account service.

Legal duties: where a duty applies, only the necessary data is processed to meet it under Article 6(1)(c). A later relationship has its own notice; registration alone does not extend processing to every future document or duty.

What does the checkbox mean?

“I have read the notice” records acknowledgement. It is not a signature, general consent or surrender of your rights. The registration checkbox documents presentation of the relevant version; it does not replace the legal basis for processing.

Optional consents require separate, specific, initially unchecked and withdrawable choices. The notice checkbox does not authorise publication of photographs or a profile. Truly anonymous data and personal-data processing before anonymisation are different: calling data “aggregate” does not make it anonymous.

Attachment D remains separate. Where the relationship requires it, it is a signable document containing its own statements and permissions. Acknowledging this page neither signs Attachment D nor replaces other contractual documents.

Must I provide everything?

Fields marked mandatory serve the relevant workflow: we cannot complete that operation without necessary data. The current form requires a phone number even when the access code uses email; its necessity and purpose must be clarified before this version is activated. Browsing alone does not require registration.

Optional fields and consents may be omitted or refused. Refusing marketing does not prevent access. Do not enter another person’s information unless necessary and you are entitled to provide it.

Who can access the data?

Data is accessible to authorised people who need it to handle the request, service or security, and technical providers within their service scope. Creating an account or submitting an application does not make your data public.

Cloudflare provides hosting and parts of the register infrastructure. Its public terms and DPA describe roles for the relevant services; their applicability and adoption for the specific account must be verified. Locating a database in the European Union does not establish that every provider operation occurs only within the EU.

Google is involved in Gmail and content such as Maps and YouTube; Instagram content involves Meta services. Opening or loading these resources may send technical data to their providers. External links and embedded content have different effects: embeds can connect directly from the page.

Access emails, once the service is active, must contain only the information needed for the message, such as a temporary code and its expiry, without complete profiles or sensitive documents. Consumer Gmail does not establish adoption of a Google Workspace DPA. The roles and agreements applicable to the services actually used remain part of completing this draft.

Can data leave the EEA?

Infrastructure and external content may involve processing outside the European Economic Area. We do not assume a database location or provider branding establishes that no transfer occurs.

Providers’ public terms describe mechanisms such as adequacy decisions and standard contractual clauses where relevant. The safeguards actually applicable to our services must still be identified for this version. You may ask the controller for information and copies of the relevant safeguards; a general provider page does not replace checking the specific transfer.

How long do we keep it?

Duration depends on data category and purpose. Data cannot be kept indefinitely merely because it remains technically present in a register. Complete operational periods and criteria for this version are still being defined: we do not claim closing an account immediately deletes every copy.

Temporary codes and sessions expire technically. That does not establish deletion of a registration, application, emails, logs or backups. A closed application, evidence of a choice and a document subject to a legal duty require distinct criteria.

Before this version is used for new registrations, determinable criteria must be stated for accounts, unsuccessful requests, logs, consents and backups: starting event, period or ending event, any applicable duty and treatment of copies. A proposed period must not be presented as an operational deletion process.

What rights do you retain?

You may request access, rectification, erasure and restriction, object where the conditions apply, obtain portability where provided for and withdraw optional consent. Withdrawal does not affect the lawfulness of consent-based processing before withdrawal. You may object to direct marketing at any time.

You may contact us without an account or after closing it. Your request does not require signing Attachment D. Do not attach sensitive documents to the initial message: if identification is needed, we will explain a proportionate method. Requests are handled under GDPR Article 12, normally within one month; any justified extension must be communicated within the applicable timeframe.

Account closure concerns access; erasure concerns the data and applicable legal exceptions. An export limited to your applications is not a search of all information the company may hold about you. You may complain to the Italian data protection authority (Garante) without contacting us first.

Third-party data and automated decisions

This page describes information you enter and technical visit data. If we receive personal data from others, relevant information about categories, sources and processing must also be provided within the timing and conditions of Article 14.

Software or automation alone does not establish a solely automated decision with legal or similarly significant effects. This draft does not assert that such decisions or profiling are present or absent: the actual scope must be checked before adoption. Submitting an application does not confer representation powers or guarantee acceptance of a relationship.

Version and related documents

This draft has its own identity. Previous acknowledgements remain linked to the text and version presented at the time; they are not renamed or converted into consent for new uses. Once adopted, the new notice must be available before relevant collection; substantive changes and new consents must be handled separately.

Signable Attachment D, email-service information and other specific notices remain separate documents. The opening summary helps you read the page and does not replace its details.