Privacy Policy
Last updated: September 24, 2026
This privacy notice describes how Case di Roma Group S.r.l. processes the personal data of users who visit the website gruppomatteoni.it, use its contact forms, or interact with the features available on the website.
This notice is provided pursuant to art. 13 of Regulation (EU) 2016/679 (“GDPR”) and the applicable Italian legislation on the protection of personal data.
1. Data Controller
The Data Controller is Case di Roma Group S.r.l., VAT No. and Tax ID 17409541004, with registered office at Via Cassia 496, 00189 Rome, Italy.
For any request relating to the processing of personal data or to the exercise of the rights provided for by the GDPR, you may write to info@gruppomatteoni.it.
Case di Roma Group S.r.l. acts as the Data Controller with regard to the management of this website and its contact channels. Where a request specifically concerns services, activities, or relationships attributable to another company of Gruppo Matteoni, the data may be disclosed to the company concerned to the extent necessary to handle the request. Where that company subsequently processes the data for its own purposes, it will act as an independent data controller and will provide, where necessary, the relevant privacy notice.
2. Personal data processed
While the website is being used, the following categories of personal data may be processed.
Data provided voluntarily by the user. Depending on the form or the request, these may include first and last name, the user’s company or organization, professional role, email address, telephone number, subject and content of the message, and any other information that the user chooses to provide.
Data relating to the subscription to Insights updates. Only the email address is required to subscribe. The date and time of the subscription and of its confirmation, the language and the page of the site from which it was made, and the text of the notice displayed at that time are also recorded, in order to document the consent given.
The website forms are not intended for the collection of special categories of personal data referred to in art. 9 GDPR or of data relating to criminal convictions and offenses referred to in art. 10 GDPR. Users are therefore asked not to transmit information of this nature unless strictly necessary and specifically requested.
Browsing data and technical data. The IT systems and software used to run the website may collect, in the course of their normal operation, information such as IP address, date and time of the request, resource requested, outcome of the request, browser and device information, technical identifiers, and other data necessary for the operation, security, and diagnostics of the website.
Cookies and similar technologies. The website may use cookies, local storage, and similar technologies. The way they are used, their purposes, their retention periods, and how they can be managed are described in the Cookie Policy.
The personal data processed through the website are obtained directly from the data subject or from the device used for browsing. Any further data obtained, at a later stage, in the context of specific commercial, corporate, professional, or partnership relationships will be covered, where necessary, by a specific or supplementary privacy notice.
3. Purposes of processing and legal bases
Personal data are processed exclusively for specified, explicit, and legitimate purposes and on the basis of one of the conditions of lawfulness laid down in art. 6 GDPR.
Handling of contact requests and discussions with users. The data are used to respond to requests for information, requests relating to the Group’s services, professional or commercial proposals, meeting requests, and expressions of interest in possible forms of collaboration or partnership.
Where the request is made by the data subject with a view to the possible establishment of a relationship to which he or she will be a party, the legal basis is the taking of steps at the request of the data subject prior to entering into a contract, pursuant to art. 6(1)(b) GDPR.
Where the discussion concerns a company, an organization, or a professional activity represented by the data subject, or is of an institutional or professional nature and is not directly aimed at concluding a contract with the natural person concerned, the processing is based on the legitimate interest of the Data Controller in managing its institutional, professional, and commercial relationships, pursuant to art. 6(1)(f) GDPR.
Technical management, security, and prevention of abuse. Technical and browsing data may be processed to ensure the proper functioning of the website, safeguard the security of systems and information, prevent unlawful or fraudulent use, detect anomalies and incidents, and protect the IT infrastructure of the Data Controller. The legal basis is the legitimate interest of the Data Controller in the security and integrity of its systems, pursuant to art. 6(1)(f) GDPR.
Compliance with legal obligations. The data may be processed where necessary to comply with obligations laid down by laws, regulations, orders of the competent authorities, or other legal obligations to which the Data Controller is subject. The legal basis is art. 6(1)(c) GDPR.
Establishment, exercise, or defense of rights. Where necessary, the data may be retained and used to establish, exercise, or defend a right of the Data Controller or of third parties in judicial or out-of-court proceedings. The legal basis is the legitimate interest of the Data Controller in protecting its rights, pursuant to art. 6(1)(f) GDPR.
Cookies and non-essential features. The use of cookies or similar technologies that are not strictly necessary takes place exclusively in the cases and in the manner described in the Cookie Policy and, where required by the applicable legislation, on the basis of the user’s consent pursuant to art. 6(1)(a) GDPR. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
Sending of Insights updates. The email address provided through the “Stay up to date” form is used exclusively to send the data subject new analyses from Insights and the service communications relating to the subscription. The subscription takes effect only after it is confirmed through the link in the email sent to the address provided. The legal basis is the data subject’s consent, given by subscribing, pursuant to art. 6(1)(a) GDPR and, where applicable, art. 130 of Italian Legislative Decree no. 196 of June 30, 2003. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal, by using the unsubscribe link included in every message or by writing to info@gruppomatteoni.it.
Simply sending a request through the website does not result in automatic subscription to newsletters, mailing lists, or periodic promotional communications.
4. Mandatory and optional data
The provision of the data marked as mandatory in the forms is necessary to enable the Data Controller to receive and handle the request. Failure to provide such data may make it impossible to submit the form or to provide a response.
The provision of the data indicated as optional, such as the telephone number where it is not requested as a mandatory field, is voluntary, and failure to communicate them does not prevent the request from being sent.
Subscribing to Insights updates is optional. Failure to provide the email address, or the subsequent withdrawal of consent, only makes it impossible to receive the updates, with no consequence for browsing the site or for the handling of other requests.
Acknowledgment of this Privacy Policy does not constitute consent to processing where the processing is based on a different legal basis provided for by the GDPR.
5. Retention periods
Personal data are retained for no longer than is necessary for the purposes for which they were collected, in accordance with the criteria of proportionality and data minimization.
Data relating to contact requests and to commercial, institutional, or professional discussions that do not lead to the establishment of a relationship are retained, as a rule, for 24 months from the last meaningful contact with the data subject or with the organization he or she represents, unless it is necessary to retain them for a further period due to negotiations that are still genuinely ongoing, legal obligations, or specific needs to protect rights.
Data relating to the subscription to Insights updates are retained until consent is withdrawn or the subscription is canceled. Thereafter the email address is no longer used for sending; only the information necessary to document the consent given and its withdrawal may be retained for the time necessary to demonstrate the lawfulness of the processing and to protect the rights of the Data Controller, in compliance with the applicable limitation periods.
The technical and security logs of the website are retained, as a rule, for a period not exceeding 30 days, unless longer retention is necessary to investigate security incidents, anomalies, or unlawful or abusive activities, or to protect the rights of the Data Controller or of third parties.
Where the request gives rise to a contractual, corporate, professional, or other type of relationship, the data relating to the relationship will be retained for the time necessary to manage it and, thereafter, for the periods required by the applicable legislation. The data and documents necessary to comply with civil-law, administrative, accounting, and tax obligations may, in particular, be retained for 10 years, without prejudice to any longer periods provided for by law.
In the event of a dispute or of a concrete need to establish, exercise, or defend a right, the strictly necessary data may be retained for the time required to manage the related activity and until its final conclusion, taking into account the applicable limitation and forfeiture periods.
The retention periods for cookies and similar technologies are indicated separately in the Cookie Policy.
6. Processing methods and security
Processing is carried out by electronic means and, where necessary, in paper form, in accordance with the principles of lawfulness, fairness, transparency, data minimization, and storage limitation.
Case di Roma Group S.r.l. adopts technical and organizational measures appropriate to the risk in order to protect personal data from loss, destruction, alteration, unauthorized disclosure or access and to ensure the confidentiality, integrity, and availability of systems and information.
Access to personal data is limited to persons who actually need it to perform their duties and who are appropriately authorized or contractually bound.
7. Data recipients
Personal data may be processed by the authorized staff and contractors of the Data Controller and, to the extent necessary for the purposes indicated, disclosed to external parties.
Such parties may include providers of hosting and IT infrastructure, cloud and email services, IT support and maintenance, cybersecurity, website management and development, backup and archiving, consent management, and any statistical tools used; consultants and professionals who assist the Data Controller in legal, tax, administrative, corporate, or technical matters; banks and other parties involved in the performance of any relationships or transactions; Gruppo Matteoni companies, where disclosure is necessary to handle a request attributable to them; public authorities, supervisory authorities, and other parties to whom disclosure is required by a provision of law or by an order of a competent authority.
Suppliers that process personal data on behalf of Case di Roma Group S.r.l. are appointed, where applicable, as processors pursuant to art. 28 GDPR. Other recipients may act as independent data controllers in accordance with the rules applicable to them.
Personal data are not subject to indiscriminate dissemination.
8. Transfers to third countries
The Data Controller gives preference, where possible, to suppliers and infrastructures that allow data to be processed within the European Economic Area.
However, the use of some technology providers or their subcontractors may involve the transfer of personal data to, or access to personal data from, countries located outside the European Economic Area.
In such cases, the transfer takes place in compliance with Chapter V of the GDPR and, depending on the specific case, on the basis of an adequacy decision of the European Commission, the standard contractual clauses approved by the European Commission, or another transfer mechanism recognized by the applicable legislation, with appropriate supplementary measures adopted where necessary.
The data subject may request information on any transfers carried out and on the related safeguards by writing to info@gruppomatteoni.it.
9. Cookies and third-party content and services
The website uses cookies and similar technologies as described in the Cookie Policy.
Cookies and tools strictly necessary for the operation of the website and for the storage of technically necessary settings may be used without consent within the limits permitted by the applicable legislation.
Subject to the user’s consent, the website may use non-necessary tools for statistics and performance, analysis of the browsing experience (including, where activated, heatmaps and session recording), conversion measurement, marketing/remarketing, and the loading of external content. The up-to-date list of the tools actually active, their providers, and the available preferences can be consulted at any time via “Cookie preferences.”
Embedded content provided by third parties, such as Google Maps or similar services, may involve the communication of technical data to the relevant provider. Where such services are not strictly necessary, they are loaded only after the user has made the relevant choice as indicated in the Cookie Policy; a preference already expressed may allow automatic loading on subsequent visits.
Links to external websites take the user outside the Gruppo Matteoni domain. Processing carried out on third-party websites is governed by the privacy notices of the respective operators.
10. Rights of the data subject
In the cases and under the conditions provided for by the GDPR, the data subject may exercise the right to obtain access to his or her personal data, their rectification, erasure, restriction of processing, and, where applicable, data portability.
Where processing is based on the legitimate interest of the Data Controller, the data subject may also object to the processing on grounds relating to his or her particular situation pursuant to art. 21 GDPR.
Where processing is based on consent, the data subject may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise their rights or to request clarification on the processing of personal data, data subjects may write to info@gruppomatteoni.it.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante), as the Italian supervisory authority, and to make use of the other remedies provided for by the applicable legislation.
11. Automated decision-making
In the context of the processing operations described in this privacy notice, Case di Roma Group S.r.l. does not make decisions referred to in art. 22 GDPR, that is, decisions based solely on automated processing which produce legal effects concerning the data subject or similarly significantly affect him or her.
12. Processing relating to partnerships and confidential relationships
The public form on the website is intended exclusively to enable initial contact and is not designed for the collection of asset, financial, or corporate documentation, or of documentation for the in-depth identification of the counterparty.
Where, following the initial contact, specific discussions are initiated concerning a partnership, an individual real estate project, a corporate relationship, a due diligence process, or access to a restricted area, further processing of personal data may become necessary.
Before any data beyond those necessary for the initial contact are collected, the data subject will receive, where required by the applicable legislation, a specific or supplementary privacy notice describing the purposes of the processing, the related legal bases, the categories of data concerned, the recipients, the retention periods, and any other necessary information.
13. Changes to the Privacy Policy
This Privacy Policy may be updated as a result of regulatory, organizational, or technological changes, the introduction of new website features, or changes in the way personal data are processed.
The updated version is published on this page with an indication of the date of its last update. In the event of substantial changes, the Data Controller will adopt, where necessary, appropriate measures to bring them to the attention of data subjects.