1. Data controller

The data controller is BlaBlaOffice - STC, Gabbro - Via delle Capanne 17, Livorno (Italia), VAT No. 01655710497. Privacy contact: info@blablaoffice.com. This policy applies to the website www.blablaoffice.com and explains what data we process, why, and what rights you have, under Regulation (EU) 2016/679 (“GDPR”).

2. What data we process

• Account: first name, surname, username, email, password (stored in encrypted form), language and subscription details.
• “Offer” listings: the details of the space and of the contact person that you enter (name of the space, address, telephone, email, website, VAT number, photos, prices, opening hours). The details you choose to display are public.
• “Wanted” requests: name, email, telephone (optional), city, preferences regarding the space, description and photo (optional).
• Messages to spaces: name, email, telephone (optional), text and preferences stated in the form.
• Payments: amount, date, plan, transaction ID and billing details. Card or account details are processed only by PayPal (or the other payment provider chosen).
• Ratings and statistics: the rating given and an anonymous device fingerprint to prevent duplicate votes; counts of visits and messages per listing, without profiling individuals.
• Technical and security data: IP address (stored in a non-reversible form for anti-abuse checks), browser type, server logs.
• Affiliate programme: for affiliates, their account data and the data of the customers they introduce; for people arriving via an affiliate's link, the code in a technical cookie.

3. Why we process it and on what legal basis

• Providing the service you request: account, publication of listings and requests, forwarding of messages, subscription and support — legal basis: contract and pre-contractual measures (Art. 6(1)(b) GDPR).
• Complying with legal obligations, in particular tax and accounting obligations relating to payments — basis: legal obligation (Art. 6(1)(c)).
• Security and abuse prevention: spam and bot filters, sending limits, checking of listings, establishment and defence of legal claims — basis: legitimate interest (Art. 6(1)(f)).
• Aggregate statistics for advertisers (visits and messages per listing) and to improve the website — basis: legitimate interest, without profiling.
• Service emails (confirmations, expiry notices, renewals): these are part of the service. We do not send marketing newsletters without your consent.

4. Who can see the data

• The public: the content of “Offer” listings that you choose to display; for “Wanted” requests, only the description, city, preferences and shortened name.
• Space owners with a subscription: name, email and telephone number from “Wanted” requests, to be used only to respond to that request.
• The recipient of the messages you send via the form.
• Our suppliers, who process data on our behalf as data processors: hosting and email, technical services for the website.
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and other payment providers, as independent controllers for payment processing.
• OpenStreetMap / Nominatim, to which we send only the address of spaces in order to calculate their position on the map.
• Authorities, where required by law.

We do not sell data or disclose it for marketing purposes.

5. Transfers outside the European Union

We process data within the European Union. If a supplier processes it outside the EU, the transfer takes place only to countries covered by an adequacy decision of the European Commission or under the standard contractual clauses approved by the Commission.

6. How long we keep it

• Account and listings: as long as the account is active; when it is closed, we delete them within 30 days, except for data that the law requires us to keep.
• “Wanted” requests: for as long as they are published; expired or closed requests remain saved (not visible) for 12 months so that they can be renewed, and are then deleted. Requests that are never confirmed are deleted after 7 days. You can delete them immediately using the private link.
• Messages to spaces: 12 months.
• Payment data: 10 years, as required by tax legislation.
• Security logs: no more than 12 months.

7. Cookies

The listings plugin uses only technical cookies, which do not require consent: session cookies to keep you logged in to your account and, if you arrive via an affiliate's link, a cookie that remembers their code for 30 days. Star ratings are stored in your browser so that we can show you the rating you have already given. If the website uses other services (for example statistics or external content), they are listed in the cookie banner and activated only with your consent where required by law.

8. Your rights

You can ask us at any time to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. Write to info@blablaoffice.com: we reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country in which you live.

9. Minors

The service is reserved for adults. We do not knowingly collect data from minors: if we become aware that this has happened, we delete it.

10. Security

We protect data with appropriate technical and organisational measures: encrypted connection, passwords stored in encrypted form, access to data restricted to those who need it, checks against automated submissions, backups.

11. Changes

We may update this policy; the date at the top of the page shows the latest version. Significant changes are notified to registered users by email. The terms of use supplement this policy.