Privacy notice
Information under articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
Data controller
SRI Group BV (VAT BE1037052239) · Legal form: private limited company (besloten vennootschap, BV) under Belgian law · Registered office: Korte Gasthuisstraat 18/301, 2000 Antwerpen, Belgium · Company number (CBE): BE 1037.052.239 · Register of legal entities: Register of Legal Entities (RPR) Antwerp, Antwerp division · Email: [email protected]
For any privacy question, email us at the address above. We have not appointed a data protection officer (it is not required for our activity).
What we process, why and for how long
Search and preview
- Data and purpose: the address you type or the point you choose on the map, to find the parcel and show you the preview. We record for which point a preview was requested and when, with your account if you are logged in; never your IP address.
- Legal basis: pre-contractual steps at your request and our legitimate interest in knowing which previews lead to an order (art. 6(1)(b) and (f) GDPR).
- Retention: one year.
Order, confirmation and delivery
- Data and purpose: the location and parcel of the order, the dossier, your name and email (which you enter on Stripe’s page), the language, and the VAT number if you give one: to prepare and deliver the dossier, send you the order confirmation and tell you if something goes wrong.
- Legal basis: performance of the contract (art. 6(1)(b) GDPR).
- Retention: the dossier for the twelve months of access; the order data for the Belgian accounting retention period, seven years.
Accounting and proof of the contract
- Data and purpose: order and payment data (never card details), the text of the two boxes you ticked with date and time and the version of the terms: for accounting and to prove consent to immediate supply.
- Legal basis: a legal obligation (Belgian accounting) and our legitimate interest in being able to prove the contract (art. 6(1)(c) and (f) GDPR).
- Retention: seven years.
Account
- Data and purpose: if you create one: email, name and the details you add, an encrypted form of the password, the properties you view while logged in and your last login: to find your dossiers again.
- Legal basis: the contract for the account feature you request (art. 6(1)(b) GDPR).
- Retention: as long as you have the account; an unconfirmed account is deleted after seven days. To delete your account, email us: we delete it within thirty days, except the order data the law requires us to keep.
Withdrawal, complaints and error reports
- Data and purpose: what you write in the withdrawal form, in a complaint or with ‘Report an error’: to reply and to improve the dossier.
- Legal basis: a legal obligation (withdrawal and complaints) and our legitimate interest (error reports) (art. 6(1)(c) and (f) GDPR).
- Retention: seven years for withdrawal and complaints; error reports as long as we keep the dossier.
Security and technical logs
- Data and purpose: the hosting logs requests to the server (date, time, page, IP address, browser) for security and to find errors. The content of forms does not go into the logs.
- Legal basis: our legitimate interest in protecting the service (art. 6(1)(f) GDPR); the interest prevails because the data stay technical, short-lived and are not used to profile you.
- Retention: at most thirty days.
‘Use my location’
It is an optional feature. First your browser asks whether the site may use your location. If you agree, the exact location of your device goes only to our server, in the body of the request (never in the page address, so not in the logs), which looks up the nearest house number and does not keep it. It does not go to Google or anyone else. If you then open the preview of that point, the point becomes the location you chose and we treat it like a typed address (see ‘Search and preview’): its position is in the address of the preview page.
Who processes the data and where it goes
- Railway Corporation (United States): hosting of the site and of the service that prepares the dossiers, on servers in the European Union (Netherlands). Processor.
- Neon Inc. (United States): the database, on servers in the European Union (Germany). Processor.
- Resend Inc. (United States): sending the emails (confirmation, dossier, account), without open and click tracking. Processor.
- Stripe Payments Europe Ltd (Ireland): the payment. For the payment it is our processor; for fraud prevention and its own legal obligations (anti-money laundering, accounting) it is an independent controller, under its own privacy notice (stripe.com/privacy).
- OpenStreetMap Foundation (United Kingdom): the map tiles of the dossier and of the sample dossier. Your browser requests them directly from the OpenStreetMap Foundation, which receives your IP address and the tile coordinates: these show the area you are looking at, so in practice the area of the property. It does not receive the dossier link. The United Kingdom has an adequacy decision of the European Commission, renewed in December 2025.
- Agenzia delle Entrate, ISPRA and the European Environment Agency: in the dossier your browser loads the layers of their maps directly from their servers, with your IP address and the map area; they are independent controllers of their services.
- Chatterlab: the chat assistant on the information pages (not in the order). What you type goes to Chatterlab, which answers with a language model: do not type data you do not want to share.
Railway, Neon and Resend are based in the United States: the data are stored in the European Union, but access from the United States (for example for support) is a transfer, covered by the European Commission’s standard contractual clauses in their data processing agreements. We do not sell data and do not use it for advertising.
Cookies
Without your choice we use only technical cookies: ‘taal’ if you choose a language (one year) and the session if you log in to your account (thirty days or until you log out).
We use no statistics cookies.
Advertising: none. In Italy we use no advertising cookies or pixels (neither Google Ads nor Meta) and do not profile visitors.
Your rights
You can request access, rectification, erasure, restriction and portability of your data, object to processing based on legitimate interest and withdraw a consent at any time, without effect on the past, by emailing us. We reply within one month. You can lodge a complaint with the Italian Garante per la protezione dei dati personali (garanteprivacy.it) or the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be), the lead authority for our registered office.
The dossier contains no data on the owners or occupants of the property, and we take no automated decisions about you.
Updated on