Tutti i documenti e le preferenze cookie: homekeyitalia.it/legale. Il file scaricabile è il testo italiano su cui è calcolata l’impronta conservata con ogni sottoscrizione.
Privacy Policy (Information on the Processing of Personal Data)
> Courtesy translation. The Italian version of this document is the > legally binding one. In case of any discrepancy, the Italian text prevails.
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
This Policy describes how HOMEKEY ITALIA S.R.L. (the "Controller") collects, uses, stores and protects the personal data of users (the "User" or "Users") who register with, access or use the digital service-intermediation platform, available on the web and through the "HomeKey Italia" mobile application (the "Platform"), including the integrated Telephony Service.
Personal data are processed in accordance with the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimisation, accuracy, integrity and confidentiality (Article 5 GDPR).
1. Data Controller, Data Processor and Contact Details
1.1 Data Controller
Under Article 4(7) GDPR, the controller — that is, the entity that determines the purposes and means of the processing of personal data — is:
- Name: HOMEKEY ITALIA S.R.L.
- Registered office: via Fuss n. 6, Strembo (TN), Italy
- Tax code / VAT number: 02850600228
- Privacy e-mail: privacy@homekeyitalia.it
- Certified e-mail (PEC): homekeyitalia@pec.it
1.2 Data Processor – Operator of the Platform
Under Articles 4(8) and 28 GDPR, HOMEKEY ITALIA S.R.L. relies on HOME KEY ITALIA FACTORY s.r.l., operator of the Platform under the Terms and Conditions, as data processor for the operational and technical management of the Platform. HOME KEY ITALIA FACTORY s.r.l. processes Users' personal data solely on the documented instructions of HOMEKEY ITALIA S.R.L. and may not process such data for its own purposes or for purposes other than those set by the Controller. The relationship between HOMEKEY ITALIA S.R.L. and HOME KEY ITALIA FACTORY s.r.l. is governed by a contract or other legal act under Article 28(3) GDPR, which sets out the subject matter, duration, nature and purpose of the processing, the type of data and categories of data subjects, and the obligations and rights of the Controller.
- Name: HOME KEY ITALIA FACTORY s.r.l.
- Registered office: via Fuss n. 6, Strembo (TN), Italy
- Tax code / VAT number: 02850610227
- Contact e-mail: assistenza@homekeyitalia.it
- Certified e-mail (PEC): homekeyitaliafactory@pec.it
Note for the User: regardless of the operational management of the Platform being entrusted to HOME KEY ITALIA FACTORY s.r.l., HOMEKEY ITALIA S.R.L. remains in any case the entity responsible for decisions on the processing of personal data and the User's sole point of contact for exercising the rights provided by the GDPR.
2. Categories of Personal Data Processed
The Platform collects and processes the following categories of personal data:
- Identity and Contact Data: first name, surname, date of birth, Italian tax code (codice fiscale), residential/domicile address, e-mail address, telephone number, login credentials (username and password).
- Identity Verification Data (KYC): a copy of a valid identity document for the purposes of identity verification and fraud prevention.
- Order and Transaction Tracking Data: order identifier, date and time of the transaction, type and description of the intermediated service, identity of the parties involved, amount, payment method, order status and the history of communications between users through the Platform's internal systems.
- Telephony Service Data: telephone numbers of the calling user and of the recipient, date and time of the call, call duration, technical identifiers of the telephone session (call SID), logs of calls made and received through the Platform. Calls may be recorded or monitored only with the express consent of the users involved, where provided for by the feature in use.
- Financial Data: information relating to bank accounts (IBAN), credit/debit cards or other payment methods, processed directly by the payment gateway appointed as external processor.
- Browsing Data and Online Identifiers: IP address, access log data, browser data, location data (where the User consents), other technical information recorded automatically.
- Cookies and Tracking Tools: for details, please refer to the Platform's Cookie Policy (https://homekeyitalia.it/legale/cookie).
3. Purposes, Legal Basis and Retention Periods
| Category of Data | Purpose | Legal Basis (Art. 6 GDPR) | Retention Period |
|---|---|---|---|
| Identity and Contact Data | Account registration and management; use of the intermediation services; customer support. | Point (b): performance of the contract. | Until the Account is closed or after 24 months of inactivity. |
| Copy of Identity Document | Identity verification (KYC); fraud prevention. | Point (b): performance of the contract. Point (f): legitimate interest in the security of the Platform. | Deleted within 72 hours of successful Account verification. |
| KYC Verification Metadata (document type, expiry date, verification transaction ID) | Evidence that the identification process took place; legal defence. | Point (c): legal obligation (where applicable). Point (f): legitimate interest in protecting rights in litigation. | 10 years from the closure of the Account (ordinary limitation period under Article 2946 of the Italian Civil Code). |
| Order and Transaction Tracking Data | Performance of the intermediation service; handling of complaints and disputes; legal defence. | Point (b): performance of the contract. Point (f): legitimate interest in handling disputes. | 10 years from the date the individual transaction was completed or cancelled (Article 2946 of the Italian Civil Code). Automatically extended until final resolution of any pending dispute. |
| Telephony Service Data (call logs, technical metadata) | Providing the service that puts users in contact; technical management of the service; handling of any disputes; legal defence. | Point (b): performance of the contract. Point (f): legitimate interest in handling disputes. | Technical logs: 12 months from the date of the call. Tracking data linked to transactions: 10 years from the related transaction (Article 2946 of the Italian Civil Code). |
| Financial and Invoicing Data | Payment processing; compliance with accounting and tax obligations. | Point (c): legal obligation (Article 2220 of the Italian Civil Code; tax legislation). | 10 years from the close of the relevant financial year. |
| Access and System Logs | Information security of the Platform; detection of anomalies. | Point (f): legitimate interest in network and information security. | 12 months from the date the individual event was recorded. |
| Sign-up Origin Data (landing page on the site, external referring site reduced to a category, click identifiers of advertising campaigns) | Measuring where registered users come from and reporting campaign outcomes (conversions) to advertising platforms, without third-party cookies. | Point (f): the Controller's legitimate interest in measuring the effectiveness of its own communication. | 24 months from the date of registration. |
| Contact Data (E-mail/Telephone) for Marketing | Sending newsletters and promotional communications. | Point (a): the data subject's express and revocable consent. | Until consent is withdrawn (opt-out link in every communication or through Account settings). |
4. Recipients of Personal Data
Personal data may be disclosed to the following categories of recipients, acting as processors appointed under Article 28 GDPR or as independent controllers:
- HOME KEY ITALIA FACTORY s.r.l.: technical and operational manager of the Platform, appointed processor under Article 28 GDPR, acting on the instructions of HOMEKEY ITALIA S.R.L.
- Twilio Inc.: provider of the Telephony Service integrated into the Platform (see section 5 for details on the transfer of data to the USA).
- IT and Cloud service providers: server hosting, software maintenance, databases, e-mail delivery services.
- Identity Verification (KYC) providers: third-party platforms responsible for checking the validity of documents.
- Credit Institutions and Payment Gateways: for processing financial flows.
- Professional Advisers: law, tax and audit firms, for professional assistance and the handling of disputes.
- Judicial Authorities, Law Enforcement and Public Bodies: to comply with binding orders and legal obligations.
The up-to-date list of processors appointed by HOMEKEY ITALIA S.R.L. is available upon written request to the Controller's privacy address.
5. Transfers of Data Outside the EU
5.1 Twilio Telephony Service: framework of the transfer
The Telephony Service integrated into the Platform is provided by Twilio Inc., a company incorporated under US law with registered office at 101 Spear Street, Suite 500, San Francisco, CA 94105, USA. The Twilio account is held by HOMEKEY ITALIA S.R.L., which acts as data exporter towards Twilio as data importer/processor for the data processed within the telephone service (call logs, technical metadata, users' telephone numbers).
Twilio processes personal data on the instructions of HOMEKEY ITALIA S.R.L. under a Data Processing Addendum (DPA) entered into pursuant to Article 28 GDPR.
5.2 Safeguards for the transfer outside the EU
Since Twilio is established in the United States, the transfer of data is subject to Chapter V GDPR (Articles 44 et seq.). The transfer takes place on the basis of the following appropriate safeguards under Article 46 GDPR:
- Standard Contractual Clauses (SCCs): Twilio applies the Standard Contractual Clauses approved by the European Commission for the transfer of personal data to third countries, supplemented where necessary by additional technical and organisational security measures, as required by the accountability principle and by the case law of the CJEU.
- EU-US Data Privacy Framework: where applicable, Twilio may rely on the adequacy decision on the EU-US Data Privacy Framework (adopted by the European Commission in July 2023), which recognises an adequate level of protection for transfers to US organisations certified under the Framework.
HOMEKEY ITALIA S.R.L., as data exporter, is required to verify on a case-by-case basis that the safeguards adopted are effectively complied with in practice, taking into account the specific features of the transfer, the legislation of the third country and any supplementary measures that may be needed.
The User may request a copy of the safeguards adopted for the transfer to Twilio by writing to the Controller's privacy address.
5.3 Other transfers
The User's data are stored primarily within the European Economic Area (EEA). Should technical or operational needs require any further transfer of data to non-EU countries, the Controller guarantees that such transfer will take place exclusively to countries deemed "adequate" by the European Commission under Article 45 GDPR, or subject to the signing of the Standard Contractual Clauses adopted by the European Commission under Article 46 GDPR, together with any supplementary security measures needed to ensure a level of protection essentially equivalent to that afforded within the EU.
6. Data Subject Rights and How to Exercise Them
At any time, the User may exercise vis-à-vis HOMEKEY ITALIA S.R.L. the rights set out in Articles 15 to 22 GDPR:
- Right of Access (Art. 15 GDPR): to obtain confirmation that processing is taking place and a copy of the personal data processed, with information on their origin, purposes, categories and recipients.
- Right to Rectification (Art. 16 GDPR): to request the correction or completion of inaccurate or incomplete data.
- Right to Erasure / to be Forgotten (Art. 17 GDPR): to request the permanent removal of one's data. This right cannot be exercised where retention is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
- Right to Restriction of Processing (Art. 18 GDPR): to request that processing be restricted while objections or checks are pending.
- Right to Data Portability (Art. 20 GDPR): to receive the data in a structured, commonly used and machine-readable format, and to request their transfer to another controller.
- Right to Object (Art. 21 GDPR): to object to processing based on the Controller's legitimate interest or for direct marketing purposes.
- Right to Withdraw Consent: to withdraw at any time the consent given for promotional purposes, without affecting the lawfulness of processing carried out before the withdrawal.
How and when we respond
Requests must be sent in writing to: privacy@homekeyitalia.it.
HOMEKEY ITALIA S.R.L. will respond within one month of receiving the request, extendable by a further two months in particularly complex cases, with a reasoned notice to the User within the first month. Exercising these rights is free of charge, except for manifestly unfounded or excessive requests (Article 12(5) GDPR).
Right to Lodge a Complaint
The User may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia n. 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of the EU Member State in which they reside or work.
7. Security of Processing
HOMEKEY ITALIA S.R.L. and HOME KEY ITALIA FACTORY s.r.l., within their respective roles, adopt appropriate technical and organisational measures under Article 32 GDPR to protect personal data against loss, destruction, unauthorised access, disclosure or alteration. Communications between the Platform and Twilio (call set-up, outcomes and metadata) are protected by encryption protocols in transit (HTTPS/TLS); the voice travels over the operators' telephone networks, as in any phone call. Copies of identity documents are protected by encryption during upload and temporary storage, and are automatically deleted within 72 hours of successful verification.
8. Updates to this Privacy Policy
This Policy is up to date as of the date indicated below. HOMEKEY ITALIA S.R.L. reserves the right to amend it at any time, including as a result of legislative or regulatory changes. Material changes will be communicated to Users through the Platform or by e-mail with reasonable notice before they take effect.
Data Controller: HOMEKEY ITALIA S.R.L. Last updated: 12 October 2026 (version 1.3: HOMEKEY ITALIA S.R.L. as controller, with HOME KEY ITALIA FACTORY s.r.l. as processor under Article 28; Telephony Service and transfer to Twilio; 1.2 of 26 September 2026: sign-up origin data in the table of section 3; 1.1 of 3 September 2026: the mobile application is published by HOMEKEY ITALIA S.R.L.)
Assistenza · Come funziona HomeKey
Come funziona · Assistenza · Termini · Privacy · Cookie
HomeKey Italia mette in contatto chi ha una casa in affitto breve e i Keeper, in tutta Italia
HOME KEY ITALIA FACTORY s.r.l. · Via Fuss n. 6, Strembo (TN) · C.F. e P.IVA 02850610227 · REA TN-254439 · capitale sociale EUR 10.000,00 i.v. · PEC homekeyitaliafactory@pec.it · assistenza@homekeyitalia.it