Skip to content
Andrej Avi Real Estate

Privacy Policy

Last updated: 31 August 2026

1. Data Controller

The controller responsible for the processing of personal data in connection with this website is:

Andrej Avi

Tuscany, Italy

Email: info@andrejavi-realestate.com

Telephone: +39 378 092 1911

2. Processing of Personal Data When Using the Website

Personal data may be processed when you use this website to the extent necessary to provide, operate and secure the website.

This may include, in particular, your IP address, the date and time of access, requested resources, referrer information and technical information relating to your browser, operating system, device and connection.

The processing serves in particular to provide the website, maintain its security and proper operation, and detect and prevent attacks, misuse and unauthorised access.

Where applicable, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in operating the website securely and reliably.

3. Cloudflare

We use services provided by Cloudflare, Inc. for our technical infrastructure, website delivery and security, including Cloudflare Workers, Cloudflare Static Assets, Cloudflare KV and Cloudflare Zaraz.

Technical connection, request and security data may be processed where necessary for these services.

Cloudflare Zaraz is also used for consent management and to control the activation of certain third-party services.

Processing by Cloudflare is subject to the applicable data protection agreements. Where personal data is transferred to third countries, the requirements of Articles 44 et seq. GDPR apply.

4. Sanity

We use Sanity for content management and image delivery.

Images may be delivered through the Sanity Image CDN, including cdn.sanity.io. When an image is requested, your browser may connect to Sanity’s servers, where technical connection data, including the requesting device’s IP address, may be processed.

This processing is carried out for the delivery of the requested content.

5. Contact and Property Enquiries

When you contact us through a contact form or in relation to a property, we process the information you provide.

This may include your name, email address, telephone number, message content, property information and other information provided in connection with your enquiry.

The information is processed to handle your enquiry, communicate with you and, where applicable, take steps towards or perform a contractual or business relationship.

Where necessary for pre-contractual measures requested by you, the legal basis is Article 6(1)(b) GDPR. In other cases, Article 6(1)(f) GDPR may apply.

6. Spam and Abuse Protection

Our forms use technical safeguards against automated and abusive submissions, including honeypot checks, minimum submission-time checks and rate limiting.

For rate limiting, the sender’s IP address is processed. An HMAC-SHA-256 value is generated from the IP address using a secret key and used as a technical key to detect and limit repeated or abusive submissions.

The information processed for these purposes is not used for advertising or analytics.

7. Resend

We use Resend (Plus Five Five, Inc.) to deliver messages submitted through our contact forms.

The information you provide is transmitted to Resend to the extent necessary to deliver the message.

Resend is used solely for server-side delivery of form messages. The form does not establish direct browser communication between your device and Resend.

8. Cookies and Other Tracking Technologies

Our website uses cookies and similar technologies.

Technically necessary cookies and similar technologies may be used where they are strictly necessary to transmit a communication or provide a service expressly requested by you.

Non-essential cookies and other tracking technologies are used only after the consent required under applicable law has been obtained.

In Italy, the use of cookies and other tracking technologies is governed in particular by Article 122 of Legislative Decree No. 196/2003 (Codice Privacy) and the relevant guidance issued by the Garante per la protezione dei dati personali. The Italian framework expressly covers tracking technologies beyond cookies.

Consent must be freely given, specific, informed and unambiguous. You may withdraw consent at any time with effect for the future and change your preferences through the available cookie settings.

9. Cloudflare Zaraz and Consent Management

We use Cloudflare Zaraz for consent management and to control certain third-party services.

Zaraz allows services to be assigned to specific purposes and activated according to the consent choice made by the user.

The relevant purposes for our website include Analytics and Marketing.

Consent preferences are stored using first-party technology. Cloudflare’s documentation provides for the assignment of tools to the relevant purposes so that the consent controls can be applied correctly.

10. Google Analytics 4

We use Google Analytics 4 to analyse the use of our website and improve its content and functionality.

Google Analytics is implemented through Cloudflare Zaraz and activated in accordance with the consent provided.

Depending on the configuration, information such as page views, interactions, technical device information and online identifiers may be processed. Cookies and similar technologies may also be used.

Google’s Consent Mode may be used to communicate and apply the relevant consent state. This includes signals such as analytics_storage, ad_storage, ad_user_data and ad_personalization.

Where consent is required, analytics processing is based on Article 6(1)(a) GDPR.

11. Meta Pixel

We use Meta Pixel to measure and analyse marketing and advertising campaigns and conversion events.

The Pixel is implemented through Cloudflare Zaraz and activated according to the consent provided.

Depending on the configuration, usage data, events, technical information and online identifiers may be processed and transmitted to Meta.

Where consent is required, processing for marketing purposes is based on Article 6(1)(a) GDPR.

12. Meta Conversions API

We may use the Meta Conversions API (CAPI) to transmit selected event and conversion data server-side.

The Conversions API is separate from the browser-based Meta Pixel. The data transmitted is limited to what is necessary for the relevant function.

Unique event identifiers may be used for technical event matching. Personal identifiers may be hashed before transmission in accordance with the service’s technical requirements.

Processing and transmission take place only where there is an applicable legal basis and the requirements relating to consent and purpose limitation are satisfied.

13. Cloudflare Web Analytics

We use Cloudflare Web Analytics to analyse the technical use and performance of our website.

Cloudflare describes Web Analytics as an analytics service that operates without conventional analytics cookies. Technical usage and performance information may nevertheless be processed.

14. HubSpot CRM

We use HubSpot CRM to manage contacts, enquiries and business relationships.

This may involve the processing of contact, communication and transaction-related information where necessary for the relevant business purpose.

CRM processing is separate from website tracking. The use of HubSpot CRM does not by itself activate HubSpot tracking code in the browser.

Where HubSpot processes personal data on our behalf, the processing is governed by an agreement pursuant to Article 28 GDPR.

15. Legal Bases

We process personal data on the basis of the applicable provisions of Article 6(1) GDPR, including:

  • Article 6(1)(a) GDPR – consent;
  • Article 6(1)(b) GDPR – contract and pre-contractual measures;
  • Article 6(1)(c) GDPR – legal obligation;
  • Article 6(1)(f) GDPR – legitimate interests.

For cookies and other tracking technologies, the additional requirements of Italian law, in particular Article 122 of the Codice Privacy, also apply.

16. Recipients and Processors

Where necessary for the purposes described above, personal data may be processed by or transferred to the following service providers:

  • Cloudflare, Inc. – infrastructure, delivery, security and consent management
  • Sanity – content management and image delivery
  • Resend / Plus Five Five, Inc. – delivery of form messages
  • Google – Google Analytics 4
  • Meta – Meta Pixel and Meta Conversions API
  • HubSpot – CRM and contact management

Where required by law, processors are engaged pursuant to Article 28 GDPR.

17. International Data Transfers

Certain service providers may process personal data outside the European Economic Area.

Where personal data is transferred to a third country, Articles 44 et seq. GDPR are complied with.

Depending on the circumstances, transfers may rely on an adequacy decision of the European Commission or appropriate safeguards such as the Standard Contractual Clauses under Article 46 GDPR.

18. Retention

Personal data is retained only for as long as necessary for the relevant purposes or as required by law.

The applicable retention period depends on the type of data, the purpose of processing and the legal requirements that apply.

Once the relevant purpose has ended, the data is deleted unless further retention is required by law.

19. Your Rights

Subject to applicable legal requirements, you have the right to:

  • access your personal data under Article 15 GDPR;
  • request rectification under Article 16 GDPR;
  • request erasure under Article 17 GDPR;
  • request restriction of processing under Article 18 GDPR;
  • request data portability under Article 20 GDPR;
  • object to processing under Article 21 GDPR;
  • withdraw consent with effect for the future.

You may exercise your rights by contacting info@andrejavi-realestate.com.

20. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority.

In Italy, the competent supervisory authority is in particular:

Garante per la protezione dei dati personali

Piazza Venezia 11, 00187 Rome, Italy

21. Data Security

We implement appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, alteration or unauthorised disclosure.

These measures include encrypted data transmission, access restrictions and technical safeguards for the website, forms and infrastructure.

22. Changes to this Privacy Policy

This Privacy Policy may be amended where applicable legal requirements, the website or the services we use change.

The version published on this website at the relevant time shall apply.

Last updated: 31 August 2026