Skip to content
Andrej Avi Real Estate

Privacy Policy

Last updated: 14 September 2026

1. Data Controller

The controller responsible for the processing of personal data within the meaning of Regulation (EU) 2016/679 ("GDPR") is:

Andrej Avi

Strada Magliano 15

50028 Barberino Tavarnelle (FI), Italy

Email: info@andrejavi-realestate.com

Telephone: +39 378 092 1911

2. Data processing when visiting this website

When you use this website, personal data is processed to the extent necessary to provide the website and ensure its functionality and security.

This may include the IP address, the date and time of access, the content requested, referrer information and technical details of the browser, operating system, device and connection used.

The processing serves to provide the website technically, to ensure its secure and uninterrupted operation and to detect and prevent attacks and abusive access.

Where processing is necessary to protect our legitimate interests, it is carried out on the basis of Art. 6(1)(f) GDPR.

3. Cloudflare

For technical infrastructure, delivery of the website and its protection we use services provided by Cloudflare, Inc., in particular Cloudflare Workers, Cloudflare Static Assets, Cloudflare KV and Cloudflare Zaraz.

Within these services, technical connection, request and security data may be processed. Where necessary, this includes information about connections to and access to our website.

Cloudflare Zaraz is also used to manage consent and to load certain third-party services in a controlled manner. Details are set out in Section 11.

Processing by Cloudflare is carried out on the basis of the applicable data protection agreements. Where personal data is transferred to third countries, the requirements of Art. 44 et seq. GDPR apply.

4. Sanity

We use Sanity to manage website content and to deliver images.

Images are delivered in part via the Sanity Image CDN at cdn.sanity.io. When images are retrieved, a connection to Sanity's servers may be established. Technical connection data, in particular the IP address of the requesting device, may be processed in this context.

The processing serves to deliver the content you have requested. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically reliable and performant delivery of image content.

5. Contact and property enquiries

If you contact us via a contact form or in connection with a property, we process the data you submit.

This may include:

  • First and last name
  • Email address
  • Telephone number, where provided
  • The subject and content of your message
  • Information relating to a property
  • Any other information you provide

In addition, technical details are transmitted when the form is submitted which you do not enter yourself:

  • the language version in which you completed the form
  • the page from which the form was submitted
  • the time at which the form was opened (to detect automated submissions)
  • the version identifier of the consent text you agreed to
  • for enquiries about a specific property, its reference, name and address on this website

The processing serves to handle your enquiry, to communicate with you and to prepare or perform a possible contractual or business relationship.

Where processing is necessary to take steps at your request prior to entering into a contract, it is carried out on the basis of Art. 6(1)(b) GDPR. Otherwise, Art. 6(1)(f) GDPR may apply.

6. Protection against spam and abuse

Our forms are protected against automated and abusive submissions by technical measures. These include a honeypot field, a minimum submission time check and a rate limit.

For rate limiting, the sender's IP address is processed. An HMAC-SHA-256 value is derived from the IP address using a secret key. This value is used as a technical key to detect and limit repeated or abusive form submissions.

In addition, we use Cloudflare Turnstile, a method for distinguishing human users from automated access. Turnstile is provided by Cloudflare, Inc. and loaded via the domain challenges.cloudflare.com. Technical characteristics of the browser and device used, as well as the IP address, are processed in this context. Turnstile sets cookies on the domain challenges.cloudflare.com for this purpose.

Turnstile is necessary to protect our forms against abusive use. The legal basis is Art. 6(1)(f) GDPR.

The data processed in this context is not used for advertising or analytics purposes.

7. Sending and receiving messages

We use Resend (Plus Five Five, Inc.) to send messages submitted through our contact forms.

The form data you submit is transmitted to Resend to the extent necessary for the transmission and delivery of the message.

Resend is used exclusively for server-side delivery of form messages. Your browser does not communicate directly with Resend through the form.

Incoming messages addressed to our domain are forwarded to our business mailbox via Cloudflare Email Routing. The mailbox provider processes the data contained in your message.

8. Identification under anti-money-laundering law

Real estate agents in Italy are required by law to identify their clients. The basis is Legislative Decree 231/2007, which applies to all agents alike.

When entering into a business relationship, we therefore collect the details from a valid identity document, the tax number and, in the case of companies, the details of the beneficial owner. This data serves solely the statutory identification obligation and is not used for any other purpose.

Provision of this data is required by law; without it we cannot accept the mandate. The legal basis is Art. 6(1)(c) GDPR. The records are retained for ten years from the end of the business relationship and deleted thereafter. In the cases provided for by law, they may be transmitted to the competent Italian authorities.

9. Cookies and other tracking technologies

This website uses cookies and comparable technologies.

Technically necessary cookies and comparable technologies may be used where they are strictly necessary for the transmission of a communication or for the provision of a service you have requested.

Cookies and other tracking technologies that are not technically necessary are used only with your prior consent.

The use of cookies and other tracking technologies in Italy is governed in particular by Art. 122 of Legislative Decree No. 196 of 30 June 2003 (Codice Privacy) and the relevant guidelines of the Garante per la protezione dei dati personali. Those requirements expressly cover tracking technologies other than cookies.

Consent must be freely given, specific, informed and unambiguous. You may withdraw or change your consent at any time with effect for the future. To do so, click the "Cookie Settings" link in the footer of any page.

10. Overview of cookies and storage technologies used

The following overview shows which cookies and comparable technologies are used on this website.

zaraz-consent — Stores your decision in the consent dialogue so that you are not asked again on every visit. Technically necessary. Duration: 1 year.

cf_zaraz_client — Set by the consent management system when the website loads and used to associate page views within a session. Duration: 1 year.

cfz_facebook-pixel — Enables the measurement of advertising campaigns. Set only if you have consented to the Marketing purpose. Duration: 1 year.

_zaraz___zarazConsentLanguage — Remembers the language in which the consent dialogue is displayed, so that the consent question is asked in the language of the page you are viewing. Stored in the browser's local storage, not as a cookie. Duration: until you delete it.

In addition, Cloudflare Turnstile sets cookies on the domain challenges.cloudflare.com when our forms are submitted. These serve solely to distinguish human users from automated access.

11. Cloudflare Zaraz and consent management

We use Cloudflare Zaraz to manage consent and to control certain third-party services.

Zaraz assigns services to specific processing purposes and activates them in accordance with your consent decision.

This website distinguishes between the purposes Analytics and Marketing. Analytics covers the evaluation of website use in order to improve content and user experience. Marketing covers the measurement of our marketing activities and their effect. Both purposes are set to declined by default and are activated only after you make an active choice.

Your consent decision is stored in the first-party cookie zaraz-consent.

Cloudflare Zaraz loads when the website is opened and sets the cookie cf_zaraz_client. In this context, technical information such as the URL accessed, the page title, referrer information, screen resolution and time zone is transmitted to Cloudflare. This occurs irrespective of your consent decision and serves the operation of the consent management system. The legal basis is Art. 6(1)(f) GDPR.

12. Google Analytics 4

We use Google Analytics 4 for the statistical analysis of the use of our website and to improve its content and functions.

Google Analytics is loaded server-side via Cloudflare Zaraz. Your browser does not establish a direct connection to Google. Event data is transmitted to Cloudflare and forwarded from there to Google.

Google Analytics does not set cookies on this website. Your IP address is not transmitted to Google.

The data processed includes information about page views, interactions and technical characteristics of the device used.

Google Consent Mode is used to transmit and apply your consent status. It includes the signals analytics_storage, ad_storage, ad_user_data and ad_personalization, which are set to "denied" until you make a choice.

Processing takes place exclusively after you have consented to the Analytics purpose, on the basis of Art. 6(1)(a) GDPR.

13. Meta Pixel

We use the Meta Pixel to measure and evaluate marketing and advertising campaigns and conversion events.

The pixel is loaded server-side via Cloudflare Zaraz. Your browser does not establish a direct connection to Meta. The first-party cookie cfz_facebook-pixel is set on your device.

The data processed and transmitted to Meta includes usage data, events, technical information and online identifiers.

Processing takes place exclusively after you have consented to the Marketing purpose, on the basis of Art. 6(1)(a) GDPR.

14. Meta Conversions API

We use the Meta Conversions API (CAPI) for the server-side transmission of selected event and conversion data.

The Conversions API is distinct from the browser-side processing carried out by the Meta Pixel. The data transmitted is limited to what is necessary for the respective function.

Unique event identifiers may be used to associate events technically. Personal identifiers are hashed before transmission in accordance with the technical requirements of the service.

Transmission takes place exclusively after you have consented to the Marketing purpose, on the basis of Art. 6(1)(a) GDPR.

15. Cloudflare Web Analytics

We use Cloudflare Web Analytics to analyse the technical use and performance of our website.

Cloudflare Web Analytics is loaded via Cloudflare Zaraz and exclusively after you have consented to the Analytics purpose. The service does not set cookies. Technical usage and performance data are processed.

The legal basis is Art. 6(1)(a) GDPR.

16. HubSpot CRM

We use HubSpot CRM to manage contacts, enquiries and business relationships.

Contact, communication and case data may be processed in this context to the extent necessary for the respective business purposes.

Data you submit through our contact forms is stored in HubSpot CRM for the further handling of your enquiry.

The use of the CRM is distinct from website tracking. Using HubSpot CRM does not activate any HubSpot tracking code on this website.

Where HubSpot processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

17. Legal bases

Personal data is processed on the basis of the applicable provisions of Art. 6(1) GDPR, in particular:

  • Art. 6(1)(a) GDPR — consent
  • Art. 6(1)(b) GDPR — contract and pre-contractual steps
  • Art. 6(1)(c) GDPR — legal obligation
  • Art. 6(1)(f) GDPR — legitimate interests

For cookies and other tracking technologies, the specific requirements of Italian law apply in addition, in particular Art. 122 Codice Privacy.

18. Recipients and processors

Where necessary for the respective purposes, personal data may be transmitted to or processed by the following service providers:

  • Cloudflare, Inc. — infrastructure, delivery, security, Turnstile, consent management, Web Analytics and forwarding of incoming email
  • the provider of our business mailbox — storage and retrieval of incoming messages
  • Sanity — content management and image delivery
  • Resend / Plus Five Five, Inc. — delivery of form messages
  • Google LLC — Google Analytics 4
  • Meta Platforms, Inc. — Meta Pixel and Meta Conversions API
  • HubSpot — CRM and contact management

Where legally required, processors are engaged under contract pursuant to Art. 28 GDPR.

In the context of identification under anti-money-laundering law, data may be transmitted to the competent Italian authorities.

19. International data transfers

Some service providers may process personal data outside the European Economic Area.

Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework. Transfers to these recipients are therefore covered by an adequacy decision of the European Commission pursuant to Art. 45 GDPR.

For Cloudflare, Inc., Sanity and Resend, the agreed safeguards pursuant to Art. 46 GDPR apply, in particular the European Commission's Standard Contractual Clauses.

20. Retention period

Personal data is stored only for as long as necessary for the respective purposes or as required by statutory retention obligations. The following periods apply in particular:

  • Enquiries submitted through our forms: until your enquiry has been dealt with. If no business relationship results, we delete the correspondence no later than twelve months after the last contact.
  • Data from identification under anti-money-laundering law: ten years from the end of the business relationship.
  • Records of completed transactions: ten years after the end of the financial year in which the transaction was concluded.
  • The technical key used to limit form submissions: one hour. No plain text is stored, only a value that cannot be reversed.
  • Cookies and storage technologies: the durations are set out in Section 10.

Once the purpose of processing no longer applies, the data is deleted unless there is a legal obligation to retain it.

21. Your rights

Subject to the statutory conditions, you have in particular the right to:

  • Access pursuant to Art. 15 GDPR
  • Rectification pursuant to Art. 16 GDPR
  • Erasure pursuant to Art. 17 GDPR
  • Restriction of processing pursuant to Art. 18 GDPR
  • Data portability pursuant to Art. 20 GDPR
  • Right to object pursuant to Art. 21 GDPR
  • Withdraw consent at any time with effect for the future

To exercise your rights, please contact info@andrejavi-realestate.com at any time.

Independently of this, you can withdraw or change your consent to the Analytics and Marketing purposes at any time via the "Cookie Settings" link in the footer of any page.

22. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The competent supervisory authority in Italy is:

Garante per la protezione dei dati personali

Piazza Venezia 11, 00187 Rome, Italy

23. Data security

We take appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, alteration and unauthorised disclosure.

These include encrypted data transmission, access restrictions and technical protective measures for the website, forms and infrastructure.

24. Changes to this privacy policy

This privacy policy may be amended if legal requirements, the website or the services used change.

The version published on this website at the relevant time applies.

Last updated: 14 September 2026