Privacy policy

This translation is for your convenience. If anything differs, the Italian version applies. Read it in Italian.

Privacy notice on the processing and protection of personal data
(art. 13 of EU Regulation 2016/679)

Last updated: July 23, 2026

1. Introduction

This privacy notice describes the processing of personal data entered or collected on the website https://www.attivita24.com and is provided pursuant to art. 13 of EU Regulation 2016/679 ("GDPR") and applicable national legislation (D.Lgs. 196/2003, as amended). It explains how we collect, use, and protect your personal information when you use our platform for buying and selling businesses and related services.

2. Data controller

The data controller is Sohostudio S.R.L., VAT No. 18227661008, email hello@attivita24.com (hereinafter, "Attivita24" or the "Controller").

The Controller has not appointed a Data Protection Officer (DPO), as there is no such requirement under art. 37 GDPR. For any request relating to personal data, you can write to hello@attivita24.com. The updated list of data processors appointed pursuant to art. 28 GDPR is available upon request.

3. Types of data collected

3.1 Data provided voluntarily

  • Registration data: first name, last name, email address, phone number.
  • Authentication data: passwords stored exclusively in encrypted form using bcrypt hashing (never in plaintext). Alternatively, you can sign in using a Google account (Google OAuth).
  • Profile data: profile photo, biography, visibility preferences.
  • Communication data: messages exchanged through the platform and related history.

3.2 Business data and listings

  • Information about businesses: description, category, location, financial data.
  • Business name, VAT number, and business contact information associated with the listing (confidential data, not published).
  • Documents, images, and multimedia materials uploaded to listings.

3.3 Billing data

If you purchase paid services, we process billing data (business name/name, address, tax code, VAT number, certified email address (PEC)/recipient code) and tax documents (electronic invoices). We do not process or store payment card data: payments are handled directly by Stripe.

3.4 Browsing and statistical data

  • Listing view statistics based on pseudonymous fingerprints: identifiers generated using a SHA-256 hash of the combination of IP address and User-Agent, with a daily salt. The IP address is never stored in plaintext, and the daily salt prevents long-term correlation.
  • Usage and traffic analysis data (pages visited, source, device type, session duration), collected through the tools described in the Cookie Policy.
  • Traffic source attribution data (UTM parameters, fbclid, gclid) for campaign measurement, processed with your consent.

The website uses cookies and tracking technologies as described in the Cookie Policy.

4. Purposes of processing and legal basis

4.1 Performance of a contract, art. 6(1)(b) GDPR

  • User registration and authentication.
  • Provision of listing publication and search services.
  • Facilitating contact between sellers, buyers, and intermediaries.
  • Managing payments and transactions relating to paid services.
  • Sending service communications (transactional emails).

4.2 Legal obligations, art. 6(1)(c) GDPR

  • Tax and accounting compliance and retention of documents required by law.

4.3 Legitimate interest, art. 6(1)(f) GDPR

  • Platform security and prevention of fraud and abuse.
  • Aggregated statistics to improve the service.
  • Direct email marketing relating to services similar to those already provided to an existing customer, with the option to object (opt out) in every communication, pursuant to art. 130, comma 4, D.Lgs. 196/2003.

4.4 Consent, art. 6(1)(a) GDPR

  • Installation of analytics and marketing cookies and related tracking (Google, Meta, Microsoft), including server-side conversion measurement technologies (Meta Conversions API).
  • Subscription to newsletters and promotional communications for users who are not yet customers (e.g., valuation leads, waitlist).

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

5. Processing methods and security

Data is processed using electronic and telecommunications tools, with appropriate technical and organizational measures to ensure an appropriate level of security, including:

  • Data transmission protected by TLS encryption.
  • Passwords stored exclusively using bcrypt hashing.
  • IP addresses used for anti-spam purposes processed only in pseudonymized form (SHA-256 hash with a daily salt), never stored in plaintext.
  • Access to data limited to authorized personnel, based on the principle of data minimization.
  • Backup and recovery procedures.

We apply the principles of privacy by design and by default, limiting collection to the data necessary for the stated purposes.

6. Data retention

We retain personal data for as long as necessary for the purposes for which it was collected and according to the following criteria:

Data category Retention period
Account data Until the account is deleted (see section 9)
Contractual and tax data 10 years, to comply with legal obligations
Anti-spam pseudonymous fingerprints No longer than 365 days
Messages and communications between users Up to 2 years from the last interaction
Data collected with consent (analytics/marketing) For the period indicated in the Cookie Policy or until consent is withdrawn

At the end of the indicated periods, the data is deleted or anonymized.

7. Data recipients

Data may be processed on our behalf and as data processors under art. 28 GDPR by the following providers:

  • Hosting and infrastructure: Amazon Web Services (AWS), including the Amazon CloudFront CDN network.
  • Payments: Stripe.
  • Transactional and marketing email: Brevo (Sendinblue).
  • Analytics and statistics: Plausible Analytics, Google Analytics, Microsoft Clarity.
  • Advertising and conversion measurement: Meta Platforms (Facebook Pixel and Conversions API), Google Ads, Microsoft Advertising.
  • Authentication: Google (Google OAuth), for users who choose to sign in with Google.

Data may also be disclosed to public authorities when required by law or a judicial authority. Cookies and analytics/marketing tools are activated according to the choices you make through the cookie banner (see Cookie Policy).

8. Transfers outside the EU

Some providers (particularly Google, Meta, Microsoft, Stripe, AWS) may involve the transfer of data to the United States or other third countries. These transfers are made on the basis of appropriate safeguards pursuant to arts. 44 et seq. GDPR, such as the EU-US Data Privacy Framework adequacy decision (where the provider has joined it) and/or the Standard Contractual Clauses (SCCs) adopted by the European Commission, together with supplementary measures.

9. Data subject rights

Under arts. 15-22 GDPR, you have the right to:

  • Access (art. 15)
  • Rectification (art. 16)
  • Erasure (art. 17)
  • Restriction (art. 18)
  • Data portability in a structured format (art. 20)
  • Object to processing based on legitimate interest, including direct marketing (art. 21)
  • Not to be subject to automated decision-making (art. 22)

You can delete your account directly from your profile settings: the listings will be archived and your personal data anonymized, except for the retention of tax data as required by law.

To exercise your rights, write to hello@attivita24.com. We will respond within 30 days. You also have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) (www.garanteprivacy.it).

10. Minors

The services are restricted to people who are at least 18 years old. We do not knowingly collect data from minors; if we become aware that we have done so, we will delete it.

11. Changes

We reserve the right to amend this privacy notice. Material changes will be communicated by email and/or through a notice on the platform.

12. Contact

Email: hello@attivita24.com