Privacy Policy

This is a courtesy translation. The legally binding version of this document is the Italian one, available at Privacy Policy.

Data controller

Gate Real Estate Innovation S.r.l. Società Benefit, with registered office at Viale Regina Margherita 33, 09124 Cagliari (CA), Italy (hereinafter also the “Controller”), processes your personal data in compliance with the applicable legislation and adopts measures proportionate to the risks of the processing.

For any request concerning your personal data you can write to [email protected].

Data Protection Officer (DPO)

The Controller has appointed Colin & Partners S.r.l. as external DPO, reachable at [email protected], by certified email at [email protected] or on +39 0572 78166.

Purposes of the processing and legal bases

Your personal data are processed for the following purposes, each with its own legal basis.

Browsing and site security

Data processed: browsing data (e.g. IP address, technical logs), necessary for the operation and security of the site.
Legal basis: the Controller’s legitimate interest (Art. 6(1)(f) GDPR) in delivering and protecting the service.

Usage statistics

Google Analytics 4 (Google Ireland Ltd. and Google LLC): measures use of the site through cookies. It is activated only with your consent (Art. 6(1)(a) GDPR).

Profiling and personalisation

Data processed: a pseudonymous identifier (gat_vid) and the browsing data associated with it, used to build a profile, assess your interest in GATEREI’s services and personalise communications and content accordingly.
Legal basis: your consent (Art. 6(1)(a) GDPR), given freely, specifically and granularly through the cookie banner. Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Managing and evidencing privacy preferences

Data processed: a random anti-duplication key; the pseudonymous identifier gat_vid where you accept profiling; the version of the privacy notice; the categories chosen; the type of action (granting, refusal or change); the page and the site of origin; the device and server date and time. IP address and User-Agent are not intentionally stored in the preference record.
Purpose: to apply your choices and retain evidence of them for accountability purposes, including evidence of a refusal, a change or a withdrawal.
Legal basis: compliance with the obligation to demonstrate consent (Art. 6(1)(c), read with Arts. 5(2) and 7(1) GDPR) and the Controller’s legitimate interest in documenting refusals and withdrawals and in managing preferences correctly (Art. 6(1)(f) GDPR).

Forms covered: contact, request for a space in a hub, talent collaboration enquiry, network registration, document request and newsletter sign-up.
Data processed: first name, last name, email address, telephone number, company and role, your answers to the form’s questions and any free text you write, the document requested where applicable, the consent version where consent is required, the date and time, the anti-duplication key and the outcome of the request. Not every form asks for all of this: each one collects only the fields it needs. Please do not enter special category data (Art. 9 GDPR) in free-text fields — we do not need it.
Legal basis: performance of the service you have requested, or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR); for sending the newsletter, your consent (Art. 6(1)(a)), which you can withdraw at any time; and any legal obligations (Art. 6(1)(c)). For forms other than the newsletter we do not ask for your consent: the basis is the service you asked for, and the essential information is shown next to the form itself at the point of collection.

Cookies and tracking technologies

Details of the cookies used, of how long they last and of how to give or withdraw consent are in the Cookie Policy. You can review your choices at any time from the “Manage cookies” panel.

Recipients of the data

Your personal data are not disseminated or disclosed to unspecified parties. They may be processed, for the purposes set out above and only as far as necessary, by the following categories of recipient, acting as processors or as independent controllers:

OctoLabs di Salvatore Balestrino, the external consultant engaged to develop and run the website, the infrastructure and Orkestra, the contact and form management platform; any processing on behalf of the Controller is conditional on prior appointment as processor under Art. 28 GDPR;
Scaleway S.A.S., provider of the primary dedicated server in the Paris DC-2 datacentre, France, and its authorised sub-processors;
Cloudflare, Inc., provider of DNS, proxy/CDN and security services, and its authorised sub-processors;
Google, solely for Google Analytics 4 statistics and only where you have given consent;
public authorities and administrations, where required by a legal obligation.

An up-to-date list of processors is available on request by writing to [email protected].

Transfers of data outside the European Union

Application data are as a rule stored within the European Economic Area. Site traffic nevertheless passes through Cloudflare’s global network for technical and security purposes; this may entail processing or access from countries outside the EEA, including the United States. For covered US transfers, Cloudflare, Inc. adheres to the EU-U.S. Data Privacy Framework; where necessary, the European Commission’s standard contractual clauses and supplementary measures also apply. This technical processing may take place regardless of your statistics or profiling preferences.

The use of Google Analytics may entail a transfer to the United States: Google LLC adheres to the EU-U.S. Data Privacy Framework for as long as that certification remains applicable. GA4 processing takes place only with your consent to statistics.

Profiling and automated decision-making

The profiling described above is intended to personalise communications and to assess interest in our services. It does not involve decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). You can object to profiling at any time by withdrawing consent from the “Manage cookies” panel or by writing to [email protected].

How long we keep your data

Browsing and security: application logs for 30 days and security logs for 180 days; system administrators’ access logs are kept for at least 6 months, as required by the applicable measure. Data may be kept for longer where necessary to investigate an incident, comply with a legal obligation or defend a legal claim.
Statistics (Google Analytics): the relevant cookies last up to 13 months.
Profiling: the pseudonymous gat_vid cookie lasts up to 6 months; events and the profile held on Orkestra are kept for 12 months from the last event. Withdrawal stops collection and starts deletion in accordance with the Controller’s procedure.
Evidence of privacy preferences: 24 months per record, plus any further period needed to handle an ongoing dispute.
Forms (contact, requests for spaces and collaboration, registrations, document requests): 24 months, unless a contractual relationship or a legal obligation with a different term arises.
Newsletter: until you unsubscribe; afterwards only the minimum information needed to prevent further mailings is kept, and evidence of consent or withdrawal is retained for 24 months.

Data are held in computer and electronic archives and processed by means of IT procedures by specifically authorised and trained internal staff, with appropriate security measures that the Controller reviews and updates periodically.

Your rights

At any time, free of charge and without particular formalities, you can:

obtain confirmation of the processing and access your personal data, and learn their origin, the purposes, the recipients and the retention period;
obtain the rectification of inaccurate data or the completion of incomplete data;
obtain the erasure of your data in the cases provided for by law;
obtain the restriction of processing in certain circumstances;
obtain the portability of data processed with your consent or on the basis of a contract, by automated means;
withdraw your consent at any time, for processing that relies on it (see below);
object to processing based on legitimate interest.

The Controller replies without undue delay and in any case within one month of receiving the request, a period that may be extended by two months where the request is particularly complex. To exercise your rights, write to [email protected].

For processing based on consent (statistics, profiling, newsletter) you can withdraw it at any time, as easily as you gave it: from the “Manage cookies” panel for cookies and profiling, or by writing to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before it.

Objecting to processing

On grounds relating to your particular situation, you can object at any time to the processing of your personal data based on legitimate interest, by writing to the Controller at [email protected]. You have the right to have your data erased where no overriding legitimate grounds exist.

Complaint to the supervisory authority

Without prejudice to any other administrative or judicial remedy, you may lodge a complaint with the competent supervisory authority — in Italy the Garante per la protezione dei dati personali — if you consider that the processing of your data infringes Regulation (EU) 2016/679.

For the use of cookies on this site, see the Cookie Policy.