REGS-PLATFORM-1.0 2026-10-12 Adopted text published for consultation while the service is being prepared. Customer use is not activated. The listed supplier reviews remain open; publication does not certify their completion or activate automatic deletion. ### Controller and scope Azione Digitale di Armando Femiano, VAT IT14566040961, Via Giuseppe Mazzini 2b, 20044 Arese (MI), Italy, is the controller for the processing described here. Contact: office@azionedigitale.com; +39 348 8602217, including for privacy requests. REGS is a professional platform for real-estate agencies. This notice covers service enquiries, agency representatives and authorised users. Each agency is the controller for its sellers, buyers and other CRM contacts; Azione Digitale processes those records on the agency's instructions. The agency supplies its own notice. We do not use agency contacts to market our services or another agency's services. ### Information, purposes and legal grounds We process names, business contact details, agency, role, language, account and authentication identifiers to provide and manage access. Article 6(1)(b) GDPR applies where the individual is the contracting party or requests pre-contractual steps. For an agency's staff and representatives, Article 6(1)(f) applies: our legitimate interest in administering the professional relationship and authorised access. Support requests, replies and relevant technical metadata are used to provide assistance and operational communications, on the same applicable contractual or legitimate-interest grounds. Do not include passwords, keys, health information or complete customer databases in support requests. IP addresses, timestamps, authentication events, browser/device information where available and operation metadata support security and abuse prevention, based on our legitimate interest in protecting the service and its users, subject to a balancing assessment. Specific legal duties rely on Article 6(1)(c). Logs are not intended for indiscriminate employee monitoring. Necessary administrative and contract details are used for managing the agreement and applicable legal duties; invoicing is outside the REGS product. Relevant evidence may be retained for establishing or defending claims under legitimate interests. This version does not introduce promotional newsletters by Azione Digitale. Service access does not require marketing consent or blanket consent to privacy processing. ### Sources and required information Information comes from you, the agency administrator inviting you, and your use of the service. Invitations identify the agency source. Minimum account and authorisation information is required for access; optional information can be omitted without affecting access. Refusing optional marketing does not prevent use of the service. ### Recipients and international transfers Authorised personnel and appointed providers receive only information needed for authentication, hosting, database, operational email, technical assistance and backups. The supplier register published with this notice identifies actual providers and purposes. Agency integrations operate within the agency's authorised scope, not through unrestricted access to personal accounts. Relevant information may be disclosed to professional advisers or authorities when necessary. We do not sell or publicly disclose personal data. Processing outside the EEA may occur through providers and their suppliers. The accompanying register must identify the actual countries and safeguards: an applicable adequacy decision or standard contractual clauses, with supplementary measures where necessary. You can request information and relevant safeguards at office@azionedigitale.com, subject only to necessary confidentiality redactions. Encryption alone is not a substitute for transfer safeguards. ### Retention Operational account records remain during the relationship and for up to 30 days for return and closure afterwards. Unconverted service enquiries remain for 12 months after the last substantive interaction; ordinary support tickets for 12 months after closure. Technical and access logs remain for up to 180 days, apart from isolated incident or dispute evidence. Accounting records remain for applicable statutory periods, normally ten years from the last entry under Article 2220 of the Italian Civil Code; longer tax requirements affect only relevant records. Minimum contractual evidence is restricted and separated from the live account for the applicable limitation period, ordinarily up to ten years after termination, not the entire account or CRM. Segregated backups may retain removed data for up to 180 days from the backup, without ordinary use. Deletion and objection instructions must be reapplied before restored systems resume automation. Documented legal holds apply only to necessary records and are reviewed. ### Your rights You may request access, correction, deletion, restriction and, where applicable, portability. You may object to legitimate-interest processing for reasons relating to your situation, subject to overriding legitimate grounds or legal claims. Direct-marketing objections are unconditional. Consent, if applicable, can be withdrawn without affecting earlier lawful processing. Contact office@azionedigitale.com. We respond within one month; complex requests may require up to two additional months, with reasons notified during the first month. Identity checks are proportionate; identity documents are not routinely required. You may complain to the Italian Garante, www.garanteprivacy.it, or the authority in your habitual residence, workplace or place of the alleged infringement, and seek judicial remedies. Requests concerning an agency's CRM records are referred to that agency with our technical assistance. ### Automation, cookies and updates We do not envisage solely automated decisions producing legal or similarly significant effects for platform users. Access and security checks may reject unauthorised access; support can investigate errors. The application uses necessary authentication, session and security technologies. This notice does not authorise optional advertising cookies. A separate institutional website hosting this notice may have different technologies and requires its own accurate cookie information. Material changes will be communicated through a new version and, where required, a new choice. Suppliers and verification status Supabase: Database, authentication and files. Database in Germany does not mean exclusively EU processing. Reserved-role audit and contract/transfer checks remain open. https://supabase.com/legal/customer-resources/data-processing-addendum Vercel: Application, APIs and workflows; data in transit and technical logs. Execution locations, access and applicable safeguards must be completed before customer use. https://vercel.com/legal/dpa Zernio: Optional Meta and WhatsApp bridge. Contractual chain, individual erasure and residual-copy handling remain under review. No Production customer connection is active. https://zernio.com/dpa Resend: Operational and authentication email; sending configured in Ireland, declared primary operations in the USA. DPA incorporation at signup verified; individual procedures and transfer assessment remain to be completed. https://resend.com/legal/dpa Google Workspace / Drive: Private business destination for encrypted backups. Addendum accepted by the owner; this does not prove exclusively EU processing or removal of all external copies. Calendar requires separate agency authorisation. https://cloud.google.com/terms/data-processing-addendum/ GitHub Actions: Build/test and technical backup job. The runner may read data before encryption: contractual coverage, workload, locations and residual copies require clarification before real data. https://github.com/customer-terms/github-data-protection-agreement OpenAI API: Optional AI assistance with minimised data. Contracting entity, endpoint, retention and safeguards require verification before real data; no Zero Data Retention or personal ChatGPT-account claim. https://openai.com/policies/data-processing-addendum/