Privacy notice

Who is responsible

SYNAPTICA CONSULTING DI GIUSTACCHINI MICHELE, Ditta individuale · Sole proprietorship, VAT IT04696650987, Via Benaco 103, 25080 Puegnago del Garda (BS), Italy, is the controller for website enquiries, service administration and website security. Contact michele.g@synapticacnsltg.com for privacy questions or to exercise your rights.

This notice covers data you provide to Demand Locator. Rental requests collected from social platforms are described separately in the public-source data notice. A customer contract determines the parties’ roles for any commissioned monitoring.

What we collect and why

The enquiry form asks for your name, work email, company, role, city/country and target area. Portfolio context is optional. We record your request reference, submission time, privacy-notice version and acknowledgement, followed by authorised operator notes and request status. Do not include tenant identities, financial documents or sensitive personal information in free text.

We use these details to assess coverage, prepare the requested analysis and contact you about it. The basis is steps at your request before a contract where you are the prospective contracting party; for employees or representatives of a business, our legitimate interest in handling the business enquiry. We use necessary security records to protect the service and investigate misuse, on the basis of our legitimate interest in security. Where a legal duty applies, we process the minimum required to meet it.

Required fields allow us to understand and respond to your request. Without them we cannot process the form. Optional context can be left blank. The acknowledgement is not consent to marketing. We do not add form submitters to a newsletter or sell their enquiry details.

Recipients and transfers

Only authorised operators can access the request workspace. Website hosting is provided by Vercel; request storage and operator authentication by Supabase; transactional email by Resend. Cloudflare provides domain registration and DNS. The subprocessors page describes their roles and links to their terms.

The application database is configured in EU Central (Frankfurt); the marketing API executes in Frankfurt. A European region does not mean every support, delivery, network log or backup operation stays in the EEA. Provider processing may involve other countries. Applicable processor agreements and, where required, adequacy decisions or standard contractual clauses must govern such processing. Contact us for information about safeguards relevant to your request.

New-request notifications contain only a reference and workspace link, not the form contents or requester email. A sign-in email to an operator contains a single-use authentication link. Personal correspondence you subsequently exchange with an operator is separate from the form database.

Retention by system

Active form requests and notes: 30 days from submission, removed by the next hourly cleanup run. An enquiry that becomes a contract is handled under the agreed service and legally required business-record retention; it is not silently kept indefinitely in the enquiry queue.

First-party event records: 30 days. They contain an event name, page variant and time, without a visitor ID or form values. Rate-limit buckets: short-lived keyed hashes, expiring within two minutes and cleared by cleanup. Operator sessions: no more than one hour, with a 15-minute inactivity limit. Application audit records: 90 days, without form contents, email addresses or raw tokens.

Mailbox correspondence, provider delivery/security logs and provider backups have separate retention controls. The 30-day database period is not a promise that every provider copy disappears on day 30. For deletion requests we assess those systems too, record any lawful restriction and ensure a restored backup is reconciled with the deletion register before reuse. Contact us for the applicable provider retention details; backup and mailbox retention are not represented here as independently verified.

Your rights

Write to the privacy contact with the request reference where available. You may request access, correction, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. You can ask us to stop request-related follow-up. We verify identity proportionately before disclosure or deletion; do not send identity documents unless we explain why they are necessary.

We aim to respond within one month, subject to the applicable rules for complex requests. You may complain to the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it), or the competent authority where you live or work. Contacting us first is not a prerequisite.

Cookies, automation and changes

The public landing does not use advertising cookies, a visitor identifier or behavioural profiling. Technical operator-session cookies are used only for authenticated access. See the cookies page for details.

Submitting the form does not trigger an automated decision with legal or similarly significant effects. Coverage and reports are reviewed by a person. Each revised notice receives a dated version; the version acknowledged with a request is preserved in its record. Archived versions are available from this page.