Choosing software
Where is the condominium's data hosted: what to ask the vendor
The first question to put to a condominium software vendor concerns data location: in which country do the servers that hold owner records, financial statements, documents, and communications physically reside. This is not an irrelevant technical detail. A condominium processes the personal data of dozens of families, and the manager, acting as controller or processor, must know where it ends up. A clear answer signals a mature vendor. A vague reply, such as in the cloud, is already a sign to dig deeper. This guide explains what answer to expect and how to judge it.
Location questions to ask before signing
- In which country are the data centers that host the data located?
- Does the data stay within the European Economic Area or can it be transferred outside?
- Which cloud provider is used and in which region?
- Are there copies or backups kept in a different country?
- In case of a non-EU transfer, what safeguards are applied?
Why location really matters
Regulation EU 2016/679 does not forbid storing data outside the European Union, but it imposes specific safeguards when that happens. If the servers sit in a third country without an adequacy decision from the European Commission, the transfer requires instruments such as standard contractual clauses and a risk assessment. Knowing where the data resides is therefore the prerequisite for understanding which obligations fall on the manager.
For the condominium the stakes are concrete. The platform gathers names, addresses, thousandths (millesimi), arrears situations, and sometimes sensitive information tied to disputes or to the vulnerability of individuals. A vendor that hosts this data in Europe, under the full application of the GDPR, offers a protection framework that is simpler to govern than one that spreads it across global infrastructure.
What answer to expect
A reliable vendor answers precisely: it names the country or region of the data centers, identifies the infrastructure provider used, and states whether copies exist in other locations. The best answer documents the choice in writing, for example in the privacy notice or in the contract, rather than limiting itself to a verbal reassurance.
Be wary of generic replies. The word cloud on its own says nothing: the cloud is still a set of physical servers located somewhere. If the contact cannot answer or defers to an unreachable technical department, data governance is probably not a corporate priority.
- Strong answer: servers in the EU, provider and region named, no non-EU transfers, all put in writing.
- Acceptable answer: non-EU transfers present but covered by standard contractual clauses and a documented risk assessment.
- Weak answer: no precise indication, vague deferrals, inability to obtain the information in writing.
Backups and copies: following the data trail
Location is not only about the main server. Many vendors replicate data to business continuity environments that may sit in different regions. Ask explicitly where the backup copies are kept and for how long. A backup located in a third country carries the same obligations as the primary server.
Check the ancillary tools too: email or messaging systems, signature services, technical support platforms. Each of these may process condominium data and reside elsewhere. The complete map of data flows should emerge from the privacy notice and from the list of sub-processors.
How to put the answer in writing
A spoken reassurance is not enough. Ask that the location be declared in the service contract or in the data processing agreement, together with the list of sub-processors and the regions involved. This way the manager can answer precisely if an owner exercises the right of access or if the supervisory authority asks about the choices made.
AmministraPro stores condominium data on infrastructure within the European Union and makes its processing choices transparent in the contractual documentation. You can compare the features on the /funzioni page and review the plans on /prezzi before deciding.
Frequently asked questions
Must the condominium's data stay in Italy?
No, the law does not require data to remain in Italy. The GDPR allows storage within the European Economic Area without additional constraints and transfers outside the Union provided adequate safeguards are adopted, such as standard contractual clauses. Staying in the EU, however, simplifies the manager's obligations.
What does it mean if a vendor uses a global cloud provider?
It means the infrastructure may be spread across several regions of the world. This is not inherently a problem, but you should verify in which region the service is configured. Many global providers let you choose European data centers: ask the vendor which region it selected for your data.
How do I find out whether there are non-EU transfers?
Ask the vendor for the list of sub-processors and their locations, information that should appear in the data processing agreement. If an ancillary service is based in a third country, the vendor must state which safeguards it applies to make the transfer lawful.
Why should the answer be in writing?
Because the manager must be able to demonstrate their choices if an owner requests access or if the authority carries out a check. A written statement in the contract or in the privacy notice is documentary evidence, whereas a verbal reassurance has no probative value.
Try AmministraPro
Accounting, thousandths-based cost splitting, meetings, communications and artificial intelligence in a single Italian software, compliant with UNI 10801 and GDPR.