Privacy policy

Who processes your data

The data controller is the agency Barbara Caria, ditta individuale, with registered office at Centro Commerciale Monte Moro int. 6, Abbiadori, 07021 Arzachena, VAT number IT02748630908, REA number SS-201655, which publishes this website, www.barbaracaria.it.

For any questions regarding this privacy policy, and to exercise your rights, you can write to info@barbaracaria.it or call +39 0789 96296.

What data the agency processes, and where it comes from

Website forms. There are three: contact enquiries, property enquiries from its page, and the owner form. They request your name and an email address; depending on the form, also a telephone number, the dates and number of guests for a rental, and a message. If you reach the contact form from a service page, the message opens with the name of that service, which you can change. Your name and email address are necessary to reply to you, and without them the request cannot be sent. All other fields are optional.

Together with your enquiry, the agency records the language of the page, the page from which it was submitted, the property if you write from its page, the website from which you write, the time of sending along with confirmation that you have read this privacy policy, and your browser type, which helps distinguish a genuine request from an automated submission. The network address of your device is not recorded: while the server remains active, an irreversible digital footprint is retained in memory, used solely to count requests over the last 10 minutes and prevent abuse.

Direct contact. If you write to the agency by email or on WhatsApp, or if you call the agency, the agency processes the details you provide at that time: your name, contact details, and the substance of your enquiry.

Cookie choices. When you respond to the cookie banner, the site records your choice together with a random identifier generated by your browser, the version of the cookie policy, the time, the language, the page, and the browser type. Your network address is not recorded. The cookie policy describes this in full.

Those selling or letting a property through the agency. Anyone entrusting the sale or rental of a property to the agency provides their contact details, the property details, and the information required for the instruction and contract.

Anti money laundering. The agency carries out real estate brokerage activities, and anti money laundering legislation includes it among obliged entities under Article 3, paragraph 5, letter e of Italian Legislative Decree 231/2007. For sales, and for rentals with a monthly rent of at least 10,000 euros, it must identify its clients, verify their details, and retain them. These details are required by law: without them, the agency cannot proceed with the transaction.

Services. If you request a catalogue service from the agency, the agency processes the details necessary to organise it: the dates, the location, and what you require.

Special categories of data. The agency does not ask you for data concerning health, religious beliefs or other special categories (Article 9 of the Regulation). If you choose to disclose one for a service, for example an allergy for the chef or a mobility requirement for a transfer, the agency uses it solely for that service, shares it only with the person providing it, and only with your explicit consent.

Why it processes data, and on what legal basis

• To respond to your enquiries and prepare an offer: these are precontractual measures taken at your request under Article 6, paragraph 1, letter b of Regulation (EU) 2016/679, the GDPR. The box you tick in the form confirms that you have read this privacy policy.
• For the sale or rental instruction, the contract, and any requested services: this constitutes the performance of a contract to which you are party under the same letter b.
• For identification and verification required by anti money laundering legislation, and for tax and accounting obligations: this is a legal obligation under letter c.
• For the security of the website and forms, including supplier technical logs: this is the legitimate interest of the agency in maintaining a functioning service free from abuse under letter f. You may object to this processing at any time.
• For analytics and marketing: solely with your consent, granted and withdrawn via the cookie banner under letter a.
• For special categories of data that you communicate for a service: solely with your explicit consent under Article 9, paragraph 2, letter a.
• For the record of choices on cookies: to be able to demonstrate consent, as required by Article 7, paragraph 1 of the Regulation (point c).

Who receives the data

Enquiries are read by the agency, together with those who collaborate with the agency for the part they require. To operate the site, the agency relies on suppliers who process data on its behalf, bound by a contract (Article 28 of the Regulation):

• Vercel Inc., Covina, California, United States: hosts the website. It delivers pages via its content delivery network, with points of presence worldwide; enquiries submitted through forms and cookie choices are processed in its European Union data centre in Paris. To deliver pages, it receives the network address of your device, as does any web hosting service, and retains technical logs in accordance with its terms.
• Supabase Pte. Ltd., Singapore: the database and documents. Data is stored in the Paris region, France.
• Plus Five Five, Inc., San Francisco, United States, via the Resend service: emails sent to you by the agency management system. This service is not yet active. Once activated, delivery details, namely recipient, subject, and outcome, will be retained in the United States.
• CartoDB Inc. (CARTO), New York, United States: map images on property pages. To deliver them, it receives the network address of your device, the referring page, and the browser type.

Only if you give consent via the cookie banner do the following recipients receive data collected through their tools, according to their own terms:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Analytics, the Google Ads tag, and Google Tag Manager.
• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland: Meta Pixel.

The website also uses Google Search Console, which displays how pages appear in Google searches: it does not receive data from website visitors.

If you choose to write on WhatsApp, the conversation passes through WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, subject to its terms.

When negotiations lead to a contract, details necessary to complete it are shared with participating parties, such as the counterparty and the notary. If you request a service, the professional or supplier providing it receives the relevant details. The agency only discloses data to public authorities when required by law. Data is never sold or disseminated.

Data outside the European Economic Area

Some of these suppliers process data in the United States, and Supabase also in Singapore. Every transfer is based on a safeguard provided for by the Regulation: Vercel, Plus Five Five (Resend), CARTO, Google LLC and Meta Platforms, Inc. adhere to the Data Privacy Framework between the European Union and the United States; Vercel, Supabase, Plus Five Five and CARTO also apply the standard contractual clauses approved by the European Commission. WhatsApp Ireland Limited indicates in its privacy policy the safeguards it uses: adequacy decisions, Data Privacy Framework and standard contractual clauses. A copy of the safeguards may be requested by writing to info@barbaracaria.it.

How long data is retained

• Form enquiries and resulting correspondence: 24 months from the last contact. Thereafter, the agency deletes them or renders them anonymous.
• Data and documents collected for anti money laundering compliance: 10 years from the end of the business relationship or transaction, as required by Article 31, paragraph 3 of Italian Legislative Decree 231/2007.
• Contracts, invoices, and accounting records: 10 years, as required by Article 2220 of the Italian Civil Code.
• Special categories of data communicated for a service: for the duration of that service.
• The record of choices regarding cookies: 5 years, the statutory limitation period for administrative penalties under Article 28 of Italian Law 689/1981, to demonstrate consent throughout the period in which compliance may be reviewed.
• Technical logs of providers: for the period specified in their terms. CARTO retains the network address with its final octet removed for 30 days.
• Cookies and other browser storage: for the durations set out in the cookie policy.

Your rights

You may ask at any time to see the data concerning you and obtain a copy of them, to rectify them, to erase them, to restrict their processing, and to receive them in a format readable by a machine to take them elsewhere (Articles 15 to 20 of the Regulation). You may object to processing based on legitimate interest (Article 21). Consent may be withdrawn whenever you wish, and withdrawal does not affect what took place before: for cookies, simply use the Cookie preferences link at the bottom of each page.

To exercise any right, write to info@barbaracaria.it. The agency will respond within one month; if the request is complex, this period may be extended by a further two months, of which you will be informed within the first month.

If you believe that the processing of your data violates the Regulation, you may lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it, or with the supervisory authority of the European Union country in which you live or work.

Automated decision making

The agency does not make decisions concerning you based solely on automated processing, and does not carry out profiling.

Minors

The website and forms are intended for adults. If the agency discovers that it has received personal data of a minor without parental consent, it deletes that data.

Cookies and similar technologies

What the website stores in your browser, and what requires your consent, is detailed in the cookie policy, linked at the bottom of every page.

Amendments to this policy

The agency updates this privacy policy whenever website services, providers, or statutory obligations change. The version currently in force is always available on this page. Last revised: 30 September 2026.