Privacy policy

Last updated: 6 October 2026

1. Data controller

This notice explains how Norton Tanzarella S.r.l. processes the personal data of people who visit nortontanzarella.com and use the website’s contact services.

The data controller is Norton Tanzarella S.r.l., with its registered address at Corso Vittorio Emanuele II 174, 72017 Ostuni (BR), Italy, VAT number 02653560744.

For information about the processing of personal data or to exercise your rights, please contact clientservices@nortontanzarella.com.

2. Personal data we collect

Depending on the form used, we may collect your first and last name, email address, telephone number, message subject and content, the property you are interested in, the location of a property submitted for valuation, and your preferences for viewings or appointments.

The property search questionnaire may collect further information about your requirements, including location, property type and features, budget, purchase arrangements and timing, and other preferences you provide.

We also record the date received, language, acknowledgement of this privacy notice and operational information needed to manage your enquiry, such as its reading status and the delivery outcome of email notifications.

Browsing the website involves the processing of technical data, including your IP address and information required to communicate with the server. Some data is used to protect the website and limit abusive submissions. Your IP address is not included in the enquiry record displayed in the backoffice.

Please provide only information relevant to your enquiry. Avoid including health information, identity documents or other particularly sensitive information in free-text fields.

3. Purposes and legal bases

We use personal data to:

• Respond to enquiries about properties, personalised searches, sales, valuations and appointments. This processing is necessary to take steps at your request before entering into a contract, under Article 6(1)(b) GDPR.

• Handle general correspondence that does not concern pre-contractual steps. This processing is based on the agency’s legitimate interest in handling correspondence received, under Article 6(1)(f) GDPR.

• Maintain the security and operation of the website and prevent spam and abuse. This processing is based on the legitimate interest in protecting our systems and users, under Article 6(1)(f) GDPR.

• Comply with applicable obligations and handle requests to exercise data protection rights, under Article 6(1)(c) GDPR.

Data collected through the forms is not used for newsletters or promotional campaigns. The privacy checkbox records acknowledgement of this notice and does not constitute marketing consent.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

4. Providing your data

Submitting an enquiry is optional. Fields marked as required are necessary to submit and handle your request; without them, the form cannot be submitted. Optional fields allow you to provide further details about your requirements.

You can browse the public pages without completing any forms.

5. Data handling and service providers

Enquiries are stored in the agency’s system and accessed by authorised personnel through the backoffice. Enquiries not identified as suspicious generate an email notification to the agency and a confirmation to the sender.

We use the following services for these activities:

• Hetzner, for hosting infrastructure and backups located in Nuremberg, Germany, under accounts held by the agency.

• Brevo, for transactional emails relating to enquiries.

• Google Workspace, for the agency’s email service, where copies of enquiries may be stored.

Operational access to contact records is restricted to the agency. Service providers process the information needed to provide their respective services in accordance with their applicable roles and agreements.

Enquiries are not published on the website, transferred to external CRM systems or exported to spreadsheets under the operating arrangements described here. Information may be disclosed to authorities where required by law.

6. Data retention

Enquiries collected through the website and their email copies managed by the agency are retained for 12 months from receipt. Reading or archiving an enquiry in the backoffice does not restart this period.

At the end of the retention period, they are deleted from active systems and agency-managed mailboxes in accordance with the deletion procedure adopted.

If an enquiry leads to an engagement or another professional relationship, processing connected with that relationship is explained in the relevant privacy notice, including the applicable retention periods.

Information used to limit abusive submissions is retained for the technical time windows required by those controls. Security logs and reports are retained for the period needed to detect, reconstruct and manage abuse or incidents and are not used for promotional purposes.

Deletion from active systems does not necessarily remove information simultaneously from every backup maintained by service providers. Residual copies follow the overwriting cycles and technical deletion periods of the services used and are not intended for routine access to contact records. Previously required deletions must be respected when restoring data.

7. External content and services

The website embeds YouTube videos, maps using OpenStreetMap resources, and reviews from Google, including reviewers’ images where available.

Loading these resources may disclose your IP address and other technical information to the relevant providers. Such content may load automatically on pages where it appears, independently of the preferences directly managed by this website.

Reviews may include the reviewer’s public name, review text and image available through the originating service.

Further information about these providers’ processing is available in their privacy notices:

Google: https://policies.google.com/privacy?hl=en

OpenStreetMap Foundation: https://osmfoundation.org/wiki/Privacy_Policy

The website also contains links to WhatsApp, social networks and external mapping services. Opening these links takes you to separate services governed by their own privacy notices.

Umami is disabled and is not used to collect browsing statistics. This does not exclude technical processing associated with the external content described above.

8. Data locations and international transfers

The main infrastructure is located in Germany. Email services and external content providers may also process data outside the European Economic Area.

Transfers subject to the GDPR must be covered by safeguards applicable to the recipient and service, such as an adequacy decision or Standard Contractual Clauses, together with any necessary supplementary measures.

To obtain information about the relevant recipients or information or a copy of the safeguards applicable to your data, please contact clientservices@nortontanzarella.com.

Provider terms are also available at:

Google Workspace: https://cloud.google.com/terms/data-processing-addendum/

Brevo: https://www.brevo.com/legal/termsofuse/

9. Your rights

Where provided by applicable law, you may request access to your personal data, rectification, erasure, restriction of processing and data portability.

You may object to processing based on legitimate interests on grounds relating to your particular situation.

Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.

Please send requests to clientservices@nortontanzarella.com.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali: https://www.garanteprivacy.it/.

10. Updates

We update this notice when the processing described changes. The date at the beginning identifies the version of the text.

Any new purposes will be accompanied by the required information and, where necessary, a request for consent.