Privacy notice

Last updated: 6 October 2026. This notice explains how Disvelcantieri S.r.l. processes personal data collected through the website, contact channels, applications and private areas.

Data controller

Disvelcantieri S.r.l., Contrada Chillino 1/A, 73010 Arnesano (LE), Italy, VAT No. 05312860751. Privacy enquiries: disvelcantieri@hotmail.com.

Data processed

Depending on the service, we process identity, tax and contact data; protected credentials and session data; professional and business information; property, project, consumption, utility and title information; land registry data; financial information required to assess incentives, including ISEE value and number of dependent children; quotations, contracts, billing, communications and activity history; documents, photographs and uploaded files. We also process technical and security data, including hashed IP addresses, session identifiers and expiry times, browser information, logs and file metadata.

Purposes and legal bases

Data is used to answer enquiries, carry out preliminary checks, assess applications, prepare quotations, perform contracts and services, operate private areas and document archives, comply with administrative, tax and legal obligations, prevent abuse and protect the company’s systems and rights. Depending on the circumstances, processing is based on pre-contractual steps or contract, legal obligations, legitimate interests in security and business protection, or consent where a specific purpose requires it. If mandatory data is not provided, the relevant request or service cannot be handled.

Analytics, demographics and interests

Only with consent, Google Analytics 4 measures use of the website in aggregate form. A separate choice may enable Google Signals for aggregate age-bracket and interest reports. The legal basis is consent, which may be withdrawn at any time. Personalised advertising is disabled and Disvelcantieri does not receive named visitor profiles from Google. The provider is Google Ireland Limited; further details are available in the Cookie notice.

Private areas and technical providers

The portal uses dedicated authentication, API and database services. The session is maintained by a protected technical cookie that page scripts cannot read and lasts no longer than 12 hours; passwords are stored only with cryptographic hashing and are never visible in plain text to Disvelcantieri. The website also uses hosting, network delivery and security, email and technical support providers, which are bound by the controller’s instructions when acting on its behalf.

Recipients and international transfers

Where necessary, data may be shared with authorised personnel, technical providers, advisers and professionals, partners involved in service delivery, public authorities and other parties required by law. We do not sell personal data. Where a provider involves a transfer outside the European Economic Area, the transfer is carried out in accordance with Chapter V of Regulation (EU) 2016/679 and the applicable safeguards.

Retention and security

Data is retained for the period required by the stated purposes, for the duration of the account or relationship and for subsequent statutory or legal-defence periods. Sessions expire after 12 hours and may be revoked earlier; Analytics cookies last no longer than approximately thirteen months and service data follows the retention configured for the property. Measures include access controls, separated permissions, transport encryption, password and token hashing, rate limits and administrative audit records.

Your rights

Where provided by Regulation (EU) 2016/679, you may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent without affecting earlier processing. You may also lodge a complaint with the Italian data protection authority.

Operational activities, signatures and company vehicles

For authorised staff, the operational areas process planned shifts, clock-in and clock-out times, the reason for an early departure, assigned tasks, work reports with description, times and up to six photographs, material requests, use of company vehicles (number plate, mileage, collection and return) and damage or fault reports with up to three photographs. Photographs are re-encoded to remove location metadata before storage.

Some operational declarations are confirmed with a finger-drawn signature on the device: we keep the stroke data, the exact text of the declaration, its author, the server time and an integrity fingerprint, to record what was declared in a tamper-evident way. The stroke is not a qualified electronic signature and is not used for biometric identification. Signatures and declarations can be viewed only by their author and by the business owner; condominium managers see verified work for their own buildings, without the employee’s identity, internal instructions, shifts or signatures.

Geographic location is not collected: location during shifts and at clock-in is disabled. Any future activation will be preceded by a specific notice and by the steps required by employment law, and will never cover time outside shifts. Device notifications, where allowed, report operational events relevant to your role.

Verification of condominium managers

Anyone requesting access to the Condominium Managers area provides identity, tax, contact and office details, the number of buildings managed and a copy of an identity document. The document is used solely to verify the request, is kept in a private archive with its integrity fingerprint and can be viewed only by the business owner. Approval applies to the document actually examined; rejected requests and their document may be deleted. Approval does not assign buildings automatically: each manager sees only those linked to their account.

Optional assistant and dictation

When enabled, the assistant processes your question and a limited summary of data your account may access through OpenAI, the AI service provider; requests are sent with the option that disables storing responses for later retrieval. At the owner’s request the same provider may be used to prepare material lists and for an advisory check of draft invoices, limited to lines, amounts and whether a recipient is set: contact details, tax codes and addresses are not sent in dedicated fields, but descriptions written by users may contain them. The assistant does not execute actions automatically: proposals must be reviewed and confirmed according to your role, and fiscal issuance remains subject to human approval.

Dictation is optional and the microphone starts only when you choose. In the iPhone and Android apps, speech recognition runs on the device where supported, and audio is not sent to Disvelcantieri or OpenAI. On the website, in manual dictation mode and after a separate confirmation, audio (up to one minute) is sent to OpenAI to obtain text that you can correct before use; the server uses a temporary file and does not archive audio in project records. Do not record other people, passwords, health information or unnecessary personal data: all operations remain available without a microphone. Provider processing conditions and any transfers outside the European Economic Area are distinct from retention of Disvel records, and exclusively European processing is not guaranteed; see the provider’s API data information. No biometric identification, background listening or automated employee assessment is intended.

Optional turn-based conversation requires an explicit start and separate consent: on the website each recorded phrase is automatically sent to OpenAI for transcription; on iPhone recognition remains local where supported and only text is sent. Previous turns are included within a short context limit and are not stored by the device to resume a later session. The microphone is off during the synthetic reply and reopens for the next turn. The session stops on request, navigation or backgrounding, on error, after at most eight exchanges, or when a proposal is ready for review. Operational confirmations and any signatures remain separate from the conversation.