Privacy notice

This notice sets out the nature, scope and purposes of the processing of personal data in connection with the use of this website and with contacting us. It is provided pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter the “GDPR”) and Italian Legislative Decree No 196 of 30 June 2003 (Personal Data Protection Code, hereinafter the “Privacy Code”) as currently in force, as amended in particular by Legislative Decree No 101 of 10 August 2018. The controller is established in South Tyrol; the data protection law in force in the Italian Republic therefore applies, consisting of the directly applicable GDPR and the national implementing provisions of the Privacy Code. There are no provisions of the Autonomous Province of Bolzano governing data protection in the private sector. Terms such as “personal data”, “processing”, “controller” and “processor” have the meaning given to them in Article 4 GDPR.

1. Controller

The controller within the meaning of Article 4(7) GDPR is:

Faistnauer Immobilien und Consulting, proprietor Peter Faistnauer
Rudolf Maria Kruckenhauserstraße 1 A, 39040 Freienfeld (Campo di Trens), BZ, Italy
VAT no. IT01738090214
Telephone: +39 338 421 2846
Email: info@faistnauer-immobilien.it, peter@faistnauer-immobilien.it
Certified email (PEC): peter.faistnauer@pec.sbb.it

2. Data protection officer

No data protection officer has been designated, as the conditions laid down in Article 37(1) GDPR are not met. Enquiries relating to data protection should be addressed to the contact details set out in section 1.

3. Processing operations, purposes and legal bases

3.1 Provision of the website and server log files

Each time the website is accessed, information transmitted by the browser of the accessing device is collected automatically (server log files), in particular the IP address, the date and time of access, the requested address (URL), the amount of data transferred, the HTTP status code, the previously visited page (referrer) and information on the browser and operating system (user agent).

This processing is carried out to provide the website technically, to ensure the security of the systems and to detect and prevent attacks and misuse. The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in the purposes stated above. The data are neither combined with other data sources nor used for advertising purposes.

The website is hosted by fill.IT, Julius-Durst-Straße 66, 39042 Brixen (Bressanone), BZ, Italy, acting as processor pursuant to Article 28 GDPR. The same provider operates the email mailboxes and delivers the enquiries sent via the website.

3.2 Content delivery network and protection against attacks (Cloudflare)

To accelerate delivery and to protect the website against overload and other attacks, the web server is preceded by the Cloudflare service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. All requests to the website are routed through Cloudflare servers, which process in particular the IP address, the date and time of access, the requested address and technical information on the browser and device. Cloudflare acts as processor pursuant to Article 28 GDPR.

The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in a secure, stable and fast provision of the website. As regards the transfer to the United States, see section 5.

3.3 Contact form, property enquiries and search requests

Where you contact us via the contact form or the enquiry form for a property, or place a search request, we process the data you provide, namely your name, email address, telephone number (optional), the type of enquiry, where applicable the property concerned or your search criteria, the content of your message and the language selected, together with the date and time of the enquiry and of your confirmation that you have taken note of this privacy notice.

The data are forwarded by email to the mailbox of Peter Faistnauer and are used exclusively to handle your request, in particular to reply to your enquiry, to advise you on the property concerned or on our services and, in the case of a search request, to inform you of suitable properties.

The legal basis is Article 6(1)(b) GDPR where your enquiry is aimed at the conclusion of a contract, in particular a brokerage agreement within the meaning of Articles 1754 et seq. of the Italian Civil Code, or serves to take steps at your request prior to entering into a contract. In all other cases the legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in responding appropriately to enquiries addressed to us. Your confirmation in the form that you have taken note of this privacy notice does not constitute consent within the meaning of Article 6(1)(a) GDPR.

To prevent automated submissions, a control field that is not visible to users and the time elapsed between opening the page and submitting the form are evaluated; in addition, the number of enquiries per unit of time is limited. No IP addresses or other identifiers are stored for this purpose. The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in the prevention of misuse.

3.4 Contact by email, PEC or telephone

Where you contact us by email, certified email (PEC) or telephone, we process the data communicated (in particular your name, contact details and the content of the communication) in order to handle your request. The legal bases set out in section 3.3 apply.

3.5 Display of property listings (onOffice)

The property listings displayed on the website are retrieved from the real estate software of onOffice GmbH, Charlottenburger Allee 5, 52068 Aachen, Germany, which we use to manage properties and the data of prospective buyers, tenants and clients. Property photographs are loaded directly from onOffice GmbH servers when the website is accessed; for technical reasons, the IP address of the accessing device is thereby transmitted to onOffice GmbH, which acts as processor pursuant to Article 28 GDPR. The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in an up-to-date and complete presentation of our property portfolio.

Where enquiries are recorded in this software for further handling, the legal bases set out in section 3.3 apply.

3.6 Processing in connection with a brokerage mandate or transaction

Where your enquiry results in a brokerage mandate, a viewing or a brokered transaction, we process the data required for the performance of the contract (Article 6(1)(b) GDPR) and for compliance with legal obligations (Article 6(1)(c) GDPR), in particular statutory retention obligations under commercial and tax law and the anti-money laundering obligations under Italian Legislative Decree No 231 of 21 November 2007. Where appropriate, you will be informed separately of such processing.

4. Recipients and categories of recipients

Within our organisation, only those persons who require your data to handle your request have access to it. Beyond that, personal data are disclosed only to the following recipients or categories of recipients:

• processors pursuant to Article 28 GDPR acting on our instructions: fill.IT (hosting, email), Cloudflare, Inc. (content delivery network, security services) and onOffice GmbH (real estate software, provision of property photographs);
• in the context of a specific transaction, the respective counterparty (owner or prospective buyer or tenant) and, upon conclusion of the contract, the notary executing the deed, in each case to the extent necessary for initiating or completing the transaction;
• public bodies, in particular tax authorities, courts and supervisory authorities, where there is a legal obligation to do so.

Personal data are not sold or made available to third parties for advertising purposes.

5. Transfers to third countries

Personal data are transferred to countries outside the European Economic Area solely in connection with the use of Cloudflare (section 3.2). Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; transfers to certified companies are covered by the adequacy decision of the European Commission of 10 July 2023 (Article 45 GDPR). In addition, Cloudflare has incorporated the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR) into its data processing terms.

6. Storage period

Personal data are stored only for as long as is necessary for the respective purposes or as required by statutory retention periods:

• enquiries submitted via the forms, by email, PEC or telephone: until your request has been dealt with conclusively; the data are then erased unless statutory retention obligations prevent this;
• search requests: until they have been fulfilled or until you withdraw them, which you may do at any time without formality;
• business correspondence relating to a concluded transaction: ten years (Article 2220 of the Italian Civil Code); records required under anti-money laundering legislation: ten years (Article 31 of Legislative Decree No 231/2007);
• server log files held by fill.IT and Cloudflare: for the limited period necessary to ensure security, after which they are erased or anonymised.

7. Obligation to provide data

The provision of personal data is neither a statutory nor a contractual requirement. However, the data marked as mandatory in the form (name, email address and message) are required in order to handle and respond to your enquiry; if they are not provided, your enquiry cannot be processed. Providing a telephone number is optional. The processing of server log data is technically indispensable for accessing the website.

8. Cookies and tracking

This website does not use cookies and does not store any information on users' devices, including in the local storage of the browser. No analytics, statistics, audience measurement or advertising services, social media plugins or embedded third-party content (such as maps or videos) are used. The fonts are loaded from our own server; no connection to third-party servers is established for this purpose.

The Cloudflare service referred to in section 3.2 may set strictly necessary technical cookies to protect against automated access (for example “__cf_bm”, valid for 30 minutes). These cookies serve exclusively the security of the website and, pursuant to Article 122(1) of the Privacy Code and the Guidelines of the Italian Data Protection Authority on cookies and other tracking tools (decision No 231 of 10 June 2021), do not require consent. A cookie banner is therefore not required.

9. Links to third-party services

The website contains links to third-party services, namely to Google Maps of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to show the location of our office, and to the websites of the professional associations FIAIP and Südtiroler Maklervereinigung. Content from these providers is not embedded in the website; data are transmitted to them only when you follow the respective link. From that point on, the respective provider is responsible for the processing and its privacy policy applies (for Google: policies.google.com/privacy).

10. Data security

We implement appropriate technical and organisational measures pursuant to Article 32 GDPR to protect personal data against accidental or intentional manipulation, loss, destruction and access by unauthorised persons. The website and the data entered in the forms are transmitted in encrypted form (TLS). These measures are adapted in line with technological developments.

11. Rights of the data subject

Subject to the conditions laid down by law, you have the following rights:

• the right of access to the personal data concerning you (Article 15 GDPR);
• the right to rectification of inaccurate and completion of incomplete data (Article 16 GDPR);
• the right to erasure (Article 17 GDPR);
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability (Article 20 GDPR);
• the right to object to processing (Article 21 GDPR, see section 12).

To exercise these rights, an informal communication to the contact details set out in section 1 is sufficient. We will respond without undue delay and in any event within one month of receipt of your request (Article 12(3) GDPR). Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm it (Article 12(6) GDPR).

Pursuant to Article 2-undecies of the Privacy Code, the exercise of these rights may be restricted where it could result in an actual and concrete prejudice to the interests referred to therein, in particular the interests protected under anti-money laundering legislation. Pursuant to Article 2-terdecies of the Privacy Code, the rights under Articles 15 to 22 GDPR relating to the personal data of deceased persons may be exercised by persons who have an interest of their own, who act to protect the data subject as his or her agent, or who act for family reasons deserving protection.

12. Right to object

13. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right pursuant to Article 77 GDPR and Articles 140-bis et seq. of the Privacy Code to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. For controllers established in South Tyrol, the competent supervisory authority is the Italian Data Protection Authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome (www.garanteprivacy.it); there is no provincial supervisory authority.

You may also bring proceedings before the ordinary courts (Article 79 GDPR, Article 152 of the Privacy Code). Pursuant to Article 140-bis of the Privacy Code, a complaint to the Garante and court proceedings concerning the same subject matter between the same parties are mutually exclusive.

14. Automated decision-making

No decision based solely on automated processing, including profiling, within the meaning of Article 22 GDPR takes place.

15. Changes to this privacy notice

We reserve the right to amend this privacy notice where there are changes in the law, in the content of the website or in the nature of the processing. The version published on this website at the relevant time shall prevail. The German and Italian versions are equally authentic; the English version is provided for information purposes only.

Last updated: October 2026