Informativa sulla privacy
Privacy notice provided under arts. 13 and 14 of Regulation (EU) 2016/679 (GDPR), of Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and of the guidelines of the Italian data protection authority. Last updated: September 2026.
1. Who processes your data
Data controller: KÌRON PARTNER S.p.A., credit broker registered with the OAM under no. M39 and with the IVASS register no. E000228451, Section E, operating in this area through the Kìron agency in Cesano Maderno, Via Borromeo, 29 · 20811 Cesano Maderno (MB).
Owner of this website: Calogero Fortunato — listed with the OAM as an associate of Kìron Partner S.p.A. — VAT no. —, tax code —, Via Borromeo 29, 20811 Cesano Maderno (MB). Tel. 0362 528415 — [email protected].
Data processor: Calogero Fortunato, reachable at [email protected] and at the office, Via Borromeo, 29 · 20811 Cesano Maderno (MB), tel. 0362 528415. This is the person to contact about anything concerning the data collected through this website, including the exercise of the rights set out in section 8.
General contact details: [email protected] · tel. 0362 528415.
Any Data Protection Officer appointed by Kìron Partner S.p.A. can be reached at the addresses given on the corporate website kiron.it.
2. For which services
This website presents, and allows you to enquire about, the following credit broking services: first-home mortgages, second-home mortgages, remortgaging, debt consolidation, salary-backed loans and renovation mortgages, together with any insurance policies connected to the lending. The data we collect is what is needed to assess whether your enquiry is feasible and, if the case proceeds, to take it forward with the lenders.
3. What data we collect
3.1 Data you give us
Through the website form we collect, in the order in which it is asked for:
- the province where you are or where the property is;
- the type of finance you are interested in (home loan, remortgage, consolidation or salary-backed loan);
- your employment status (permanent or fixed-term employee, self-employed, retired, other);
- whether you have any adverse listing on the credit databases (CRIF, protests). This concerns your creditworthiness and is asked as a simple yes or no, with no detail: its only purpose is to tell you straight away whether there is any point proceeding, because with an active listing no lender will assess the application;
- your name, telephone number, email address (optional) and the time slot in which you would rather be called.
If you select «Outside these provinces», the enquiry is not taken on: nothing is saved and no email is sent. You are simply shown our direct contact details.
Through the other channels — telephone, WhatsApp, email, an appointment at the office — we collect whatever you tell us.
If the case proceeds we collect the documents the lender requires: identity document, tax code, payslips, pension statements, salary certificates, tax returns, bank statements, settlement figures for existing loans, property documents, quotations and planning consents. That stage happens away from this website and, where necessary, comes with its own privacy notice.
3.2 Data collected automatically
IP address, device and browser type, pages visited, where the visit came from, and the date and time of access, collected through cookies and similar technologies. Apart from strictly necessary cookies, this processing only takes place after you have given consent: the full detail, service by service, is in the Cookie notice.
To prevent automated submission of false enquiries, the form records a value derived from your IP address (an encrypted string from which the address cannot be reconstructed) for a maximum of ten minutes, purely to limit the number of submissions in quick succession. No profiling, and nothing kept beyond that period.
3.3 Special categories of data
We do not collect special categories of data under art. 9 GDPR through this website. If you volunteer such data — for example health information relevant to a policy connected to the loan — we process it only where strictly necessary and on the basis of your explicit consent.
4. Why we process it, on what legal basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering your enquiry and carrying out the preliminary feasibility assessment | Pre-contractual measures taken at your request — art. 6.1.b | 12 months from the last contact, if the case does not proceed |
| Carrying out the credit broking work: preparing the file, dealing with lenders and intermediaries, seeing the case through to the release of funds | Performance of the contract — art. 6.1.b | 10 years from the closing of the case |
| Insurance intermediation for policies connected to the loan | Performance of the contract — art. 6.1.b; IVASS obligations — art. 6.1.c | 10 years from the end of the relationship |
| Meeting customer due diligence and record-keeping obligations under anti-money-laundering law (Legislative Decree 231/2007), banking transparency rules and requests from the OAM, the Bank of Italy, IVASS and the UIF | Legal obligation — art. 6.1.c | 10 years, within the periods set by each set of rules |
| Contacting you with commercial proposals about the services you enquired about or similar ones, by email, telephone or messaging | Consent — art. 6.1.a; for similar services already requested, legitimate interest under recital 47 and art. 130.4 of the Italian privacy code | 24 months from the last contact, or until withdrawal or objection |
| Measuring use of the website through aggregate statistics (Google Analytics 4) | Consent — art. 6.1.a and art. 122 of the Italian privacy code | 14 months |
| Showing the map of the office and the videos in the «Recent cases» section (Google Maps, YouTube, Instagram) | Consent — art. 6.1.a and art. 122 of the Italian privacy code | Until consent is withdrawn |
| Measuring advertising results and showing relevant ads on Meta platforms (Meta Pixel) | Consent — art. 6.1.a | Until withdrawal; event data up to 90 days |
| Keeping the site secure and preventing spam, abuse and attempted fraud | Legitimate interest — art. 6.1.f | Technical logs: 30 days. Anti-abuse limiter: 10 minutes |
| Establishing, exercising or defending a legal claim | Legitimate interest — art. 6.1.f | For the duration of proceedings and any appeal periods |
Enquiries sent through the form are also stored in the restricted area of this website, accessible only to Calogero Fortunato and to authorised staff, for the period given in the first row of the table.
5. Who we share data with
Data may be shared, so far as necessary:
- with the partner banks and financial intermediaries to which we submit your application, which process it as independent controllers under their own privacy notices;
- with Kìron Partner S.p.A. and its group companies, for administration, control and supervision of the agency network;
- with insurance companies, solely for policies connected to the loan;
- with notaries, surveyors and other professionals involved in the case;
- with IT service providers — website hosting, email, case management software, measurement tools — appointed data processors under art. 28 GDPR;
- the external consultant who handles the agency's communications ([email protected]), who receives a copy of enquiries sent through the form for technical support on the website and statistical analysis of contacts, appointed data processor under art. 28 GDPR;
- with public authorities in the cases provided for by law (OAM, Bank of Italy, IVASS, UIF, the tax authorities, the courts).
We do not sell your data and we do not pass it to third parties for their own marketing.
6. Transfers outside the European Union
Some digital service providers may process data on servers located outside the European Economic Area: Google Ireland Ltd. (Analytics, Maps, YouTube, Search Console), Meta Platforms Ireland Ltd. (Facebook, Instagram, Meta Pixel) and WhatsApp Ireland Ltd. Such transfers take place on the basis of an adequacy decision of the European Commission (the EU-US Data Privacy Framework) or of standard contractual clauses, together with the supplementary measures assessed case by case. You may ask for a copy of the safeguards in place by writing to [email protected].
7. How we protect data
The site is served over HTTPS. Access to data is limited to Calogero Fortunato and to authorised staff, bound to confidentiality and instructed under art. 29 GDPR. Systems are protected by individual credentials, two-factor authentication on administrative access, limits on login attempts and regular backups. The form uses anti-abuse measures that do not profile the user.
8. Your rights
You may at any time request: access to your data and a copy of it (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), portability (art. 20), and you may object to processing based on legitimate interest, including direct marketing (art. 21). You may also withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights write to Calogero Fortunato at [email protected] or to the office at Via Borromeo, 29 · 20811 Cesano Maderno (MB). We reply without undue delay and in any event within one month. Cookie preferences can be changed from the button on every page.
If you believe the processing of your data breaches the rules, you may lodge a complaint with the Italian data protection authority (Piazza Venezia 11, 00187 Rome) or bring proceedings before the courts.
9. Whether providing data is compulsory
In the form, your name, telephone number, province, type of finance, employment status, the answer about adverse listings and the privacy consent are required: without them we cannot call you back or tell you whether the enquiry is feasible. Email and preferred time slot are optional but useful in arranging the call. Consent for marketing and for measurement, third-party and advertising cookies is entirely optional: without it you can still use the site and receive advice.
10. Automated decision-making and profiling
The form assigns each enquiry an internal priority based on two answers only — the province and your employment status — purely to organise the order in which calls are returned during the day. It is not automated decision-making producing legal effects under art. 22 GDPR: every assessment is made by a person, and the decision to grant credit rests solely with the bank, under its own criteria.
If you consent to advertising cookies, Meta may link your visit to your social profile in order to show you relevant ads and to build similar audiences: this is profiling for advertising purposes, and can be withdrawn at any time from the cookie preferences and from your Meta account settings.
11. Children
These services are for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, write to us and we will delete it.
12. Updates
This notice may be updated to reflect changes in the law or in the services used. The version in force is always published at this address, with the date of last update at the top. Where changes materially affect processing based on consent, we will ask for your consent again.