Privacy Notice

The Data Controller is CORSAL S.r.l. (Unistel brand), registered office Lungo Po Alessandro Antonelli n. 21, 10153 Torino, VAT 13156860010, REA TO-1343353. For privacy matters: privacy@unistel.it.

Typical data subjects: students (or prospective guests) using Contact or the place-request form; third parties named in a request (preferred roommate, emergency contact).

The Site is not intended for children under 16. A place request requires an age compatible with the form checks (indicatively at least 16).

Contact form: first and last name; email; topic (stable id: availability, visit, ongoing request, other); message; acceptance of the privacy notice; technical anti-abuse data (e.g. form timing, honeypot).

Place request: first and last name; email and confirmation; phone with dialling code; gender; date of birth; nationality; university and faculty (including “Other”); residence and room type; stay option/period; optional message; optional preferred roommate (name and email, double rooms only, same gender); emergency contact (first name, last name, relationship, phone); scan of the identity document; enrolment certificate or self-declaration (D.P.R. 445/2000) with signature; acceptance of privacy and terms.

Student portal: if you create an account, email and login credentials, to view and update your requests.

Check-in and police guest schedule: place and date of birth, identity-document type and number, place of issue — if the stay reaches registration.

Payments and contract: amounts, due dates, methods and references recorded by staff; contract and receipt PDFs; messages exchanged on the request.

Technical data: IP address and logs so the site can work, for security and against spam. On the Contact and request forms the Cloudflare Turnstile anti-spam check receives the IP address and some technical signals from the browser and device (see points 7 and 9). If you press “Accept” on the banner, Google Analytics 4 starts: anonymous visit statistics (how many people, which pages, which device and which area they come from). The data goes to Google, including outside the European Union. Without that yes, no Google script starts. How long the `_ga` and `_ga_…` cookies last, and how to withdraw, is in the Cookie policy. If you have answered the banner and the service is configured, error reports (Sentry) without email or IP address.

Browser storage: the site saves on your device your cookie choice, the place-request draft with the documents being uploaded, and the student portal session. What they hold and how long they last is in the Cookie policy.

The identity document and proof of enrolment (or self-declaration) are used to verify eligibility for student housing. Files stay in private storage, accessible to authorised staff.

If you name a roommate or an emergency contact, we process their data only to coordinate the request or for emergency contact related to the stay. Whoever provides those details must be entitled to do so and, where required, have informed them.

Art. 6.1.b GDPR: pre-contractual steps at your request and, if accepted, performance of the contract.

Art. 6.1.c GDPR: legal obligations (e.g. tax or identification, where applicable).

Art. 6.1.f GDPR: legitimate interest in preventing Site abuse and managing the residences securely. The Cloudflare Turnstile anti-spam check on the Contact and request forms relies on this interest.

Art. 6.1.a GDPR: non-essential cookies, only with consent. Google Analytics 4 sits here: without “Accept” it does not start.

Authorised staff of CORSAL S.r.l.

Public authorities only if required by law.

We do not sell data and we do not use it for unsolicited marketing newsletters.

Contact messages and place requests without a contract: for as long as needed to handle them and any disputes, in line with applicable limitation periods.

If a contract is signed: for the duration of the relationship and subsequent legal duties (e.g. tax and accounting). Contracts, payment receipts and proof of the police guest notification remain after the request is closed.

24 months after rejection or cancellation, an automatic process cleans up the request: identity and enrolment documents are removed from storage; the request row is deleted if there is nothing that must be kept, otherwise it is anonymised (name, email, phone and notes replaced) while amounts, dates and the request number stay.

This is not erasure of the person. The student record (name, email, phone) and the messages exchanged on the request remain. Only the identity fields used for the police guest schedule are cleared, and only if no other live requests remain.

Closed Contact messages are deleted after 24 months.

Signed links to files expire after a short time (about one hour in the staff panel). Files stay in private storage until that process removes them or they are removed on request.

Erasure of your data on request (Art. 17 GDPR) is not automatic: write to privacy@unistel.it. It is handled by hand, within the limits of what the law requires us to keep.

Some providers may also process data outside the European Economic Area, on the basis of adequacy decisions, standard contractual clauses and further safeguards under the GDPR.

Google Analytics 4, if you accept it, sends visit statistics to Google. Google may process them in the United States. The transfer relies on the EU–US Data Privacy Framework, where it applies, and on standard contractual clauses.

Cloudflare Turnstile, on the Contact and request forms, processes the IP address and the device’s technical signals. Cloudflare may process them in the United States. Here too the transfer relies on the EU–US Data Privacy Framework, where it applies, and on standard contractual clauses.

We apply technical and organisational measures appropriate to the risk (staff-only access, protected channels, anti-abuse submission limits). No system is 100% immune: if a relevant breach occurs we will notify you as required by law.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on your place request: staff review the application.

You may request access, rectification, erasure, restriction, objection and portability (Arts. 15–22 GDPR) by writing to privacy@unistel.it.

An erasure request is handled by hand: it does not start on its own after 24 months and it is not the same as the automatic clean-up of rejected or cancelled requests.

You also have the right to lodge a complaint with the Garante per la protezione dei dati personali.

You can withdraw consent to Google Analytics whenever you want, from the footer (“Manage cookies”). If you switch from accepted to rejected, we delete the `_ga` and `_ga_…` cookies and collection stops.

We may update this notice to reflect product or legal changes. The date at the top of the page shows the latest revision.