legal.privacy_title

1. Data controller

The controller of the personal data collected through dvm-apartments.com, coliving.dvm-apartments.com, pay.dvm-apartments.com and the guest area /casa is:

No Data Protection Officer has been appointed, as it is not required. For any privacy request write to info@devivomanagement.com.

2. What data we collect

Depending on the service you use, we process:

• Information or availability requests (short stays, monthly rentals, DVM for Business): first and last name, email, phone, desired dates and length of stay, preferences (room or apartment, add-on services, visit), free text and, if you tell us, how you heard about us.
• Short-stay bookings: booking data (apartment, dates, guests, amounts), payment data handled by Stripe (we never see the full card number) and, for the legal obligations on guest registration, the identity-document data collected at self check-in.
• Monthly rentals (from 3 months): besides the request data, what is needed for the registered lease (identity document, Italian tax code, residence permit where applicable, employment or university enrolment supporting the temporary need), any deposit paid online, the contract, instalments and security deposit.
• Tenant portal (personal link): contract, due dates and payments, key handover, messages exchanged with the team (issues, extensions, notices). The link contains a private code: do not share it.
• Chat and assistant: messages you write to the team in the site chat and questions asked to the automated assistant. The assistant does not ask for personal data and we do not store the conversation; the text of your questions is sent to the language-model provider to generate the answer.
• Technical data: IP address, browser, device, pages visited and server logs, collected automatically for security and operation.
• Communications: emails and WhatsApp messages you choose to send us.

3. Purposes and legal bases

We process data to:

• answer requests and check availability (pre-contractual measures at your request, Art. 6.1.b GDPR);
• manage bookings, leases, deposits, instalments and support during the stay (performance of the contract, Art. 6.1.b);
• comply with legal obligations: guest registration with the police, contract registration, tax and accounting duties, tourist tax (Art. 6.1.c);
• protect our rights, prevent abuse and fraud and keep systems secure, including anti-spam filters on forms (legitimate interest, Art. 6.1.f);
• send promotional communications only with your consent, which you can withdraw at any time (Art. 6.1.a);
• run the website and remember your language (technical cookies, legitimate interest).

Providing the data marked as required in the forms is necessary to answer your request or conclude the contract; without them we cannot proceed. Marketing consent is always optional. The site is not intended for people under 18.

4. No automated decisions, no profiling

No request is accepted or rejected by an automated system: every availability, condition and contract is checked by a team member. We do no profiling and use no analytics tools or advertising pixels on our sites. Some internal processes (sorting incoming emails, operational reminders to the team) use artificial-intelligence tools as support: the outcome is always reviewed by a person and has no automatic legal effect on you.

5. Who we share data with

Data are processed by authorised De Vivo Management staff and by providers acting as processors or independent controllers, only as needed for the service:

• Hostinger — hosting of the websites and management system (data centres in the EU);
• Smartness / CiaoBooking — property-management and channel-manager software for bookings, calendars and self check-in; apartment photos are served from Amazon Web Services (Paris);
• Stripe — online card payments: deposits, instalments, extra services. Stripe processes card data as an independent controller under its own policy;
• Anthropic — provider of the language model behind the assistant and internal support tools; it receives only the text needed to generate the answer;
• Mapbox and Esri — interactive maps (they receive your IP address when the map loads); Google Fonts, unpkg and jsDelivr — fonts and technical libraries (they receive the IP when the file is requested);
• Telegram — internal channel through which the team is notified of a new request or message (name, unit requested, email or request reference);
• WhatsApp (Meta) — only if you choose to contact us via the WhatsApp button;
• partner platforms such as HousingAnywhere, Booking or Airbnb — they receive listing and availability data; your personal data reach us from them only if you book through those platforms;
• property owners (for the lease, limited to the necessary data), accountants and legal advisers, banks, and public authorities where required by law (police, tax agency, municipality for the tourist tax).

We do not sell personal data and do not pass them to third parties for their own marketing.

6. Transfers outside the European Economic Area

Some providers (Stripe, Anthropic, Telegram, Meta, Google) may process data in the United States or other non-EEA countries. Transfers rely on European Commission adequacy decisions (EU-US Data Privacy Framework, where the provider is certified) or on standard contractual clauses with the supplementary measures required. You can ask us for a copy of the safeguards applied.

7. How long we keep data

We keep data only as long as needed for the purposes above, then delete or anonymise them:

• information or availability requests with no follow-up: 12 months from the last contact;
• bookings, leases, deposits, instalments and accounting documents: for the duration of the relationship and the following 10 years required by tax and civil law;
• guest data reported to the police: as required by law;
• tenant-portal and chat messages: for the duration of the contract and 12 months after, unless a dispute is pending;
• technical and security logs: up to 12 months;
• marketing consent: until withdrawn.

8. Cookies

Our sites use only technical cookies, which need no consent and do not track you across sites:

• dvm_lang and colv_lang — remember your language (180 days);
• colv_csrf — protects forms from forged submissions (browser session);
• lead_tok — lets you find your conversation with the team in the site chat again;
• strictly necessary cookies of the Stripe payment system during checkout.

We use no profiling, analytics or advertising cookies, which is why we show no consent banner. You can still delete or block cookies in your browser settings: the site keeps working, but you will need to pick your language again.

9. How we protect data

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), management-system access protected by credentials and role-based permissions, signed forms against tampering, personal links with private codes never stored in clear text, separation between public sites and the management database, backups and access logs. Card data never pass through our servers.

10. Your rights

At any time you can exercise the rights under Articles 15-22 GDPR:

• access to your data and a copy;
• rectification of inaccurate or incomplete data;
• erasure, where no retention obligation applies;
• restriction of processing;
• objection, in particular to marketing;
• portability of the data you gave us;
• withdrawal of consent, without affecting previous processing;
• complaint to the Italian supervisory authority (Garante, www.garanteprivacy.it) or judicial remedy.

Write to info@devivomanagement.com or by certified email to devivomanagement@pec.it. We reply within 30 days and may ask you to confirm your identity.

11. Updates

This notice may be updated when services or rules change. The version in force is always the one published on this page, with the last-update date at the top. The Italian text is the binding one; translations are provided as a courtesy.