Privacy and cookies

Scope

This notice covers www.milleemmi.it, browsing, contacts, custom enquiries and online purchases. Newsletters, reviews and the order area have separate notices. Images, fonts and videos are served by this website.

Controller and contact

The controller is MILLEEMMI DI CERETTA EMILIE, Via Gian Giorgio Trissino 15, 36040 Sarego (VI), Italy, VAT 04483080240. For information and rights: shop@milleemmi.it, +39 375 9933696.

Browsing and security

Connections transmit your IP address, request time and resource, and technical browser information to the server. Logs support delivery, troubleshooting and protection against abuse, based on our legitimate interest in availability and security (GDPR Art. 6(1)(f)). These data are necessary for the connection. Application logs normally last 30 days; hosting infrastructure logs follow the provider’s security rules. Ask us about the applicable periods.

Contacts and custom enquiries

Email and telephone links open your chosen application without sending messages automatically. We use information you supply to respond: pre-contractual steps or a contract (Art. 6(1)(b)), legitimate interest for other enquiries (f), and legal obligations where applicable (c). Contacting us does not subscribe you to marketing. We need sufficient contact information to reply. The configurator requires a name, configuration and email or mobile number; another contact, message and images are optional. Enquiries are sent to shop@milleemmi.it, without creating an order or payment. Fields remain in page memory until it is closed or reloaded, not persistent browser storage. You may upload up to five JPG/PNG/WebP images, 10 MB in total. The server creates resized JPEG copies without embedded metadata; temporary originals are deleted after processing, while email copies follow correspondence retention. Images are not published. Send only relevant material without unnecessary personal data. Technical sessions, rate limits and temporary content fingerprints prevent abuse and duplicates for up to 24 hours. Message content is not included in application logs or automatically copied to external addresses supplied in the form.

Necessary cookies and browser storage

Basket and currency preferences (milleemmi-intima-bag-v5, milleemmi-currency) remain in local storage until changed or cleared. Filters appear in the URL; scroll position, video rotation/pause and temporary checkout entry/retry information, when used, last for the tab session. Forms and restricted services use technical session and CSRF cookies, with a session timeout of 120 minutes of inactivity. These support requested functions without advertising purposes. Blocking them can prevent some functions.

Your choice and consent evidence

Choose “Accept all cookies”, “Necessary cookies only”, or enable “Visit analytics” under “Cookie preferences”. Closing the first banner with X keeps only necessary storage. Scrolling or continuing to browse is not consent; refusing does not restrict the website. Your choice is stored in milleemmi-visit-consent-v1 for six calendar months; previous refusals remain respected until expiry. The panel may reappear after you clear browser data or processing changes substantially. A private ledger records a hashed random code, choice, server date, language and version/hash of the displayed notices. It contains no name, email, IP address, visited pages or order link. It documents and manages consent (GDPR Arts. 5(2), 7(1) and 6(1)(c)). Events are deleted after 18 months; application backups rotate within an additional 30 days. This period covers choice validity and analytics retention, with a limited margin for verification. Clarity stays off if the choice cannot be saved or confirmed.

Visit analytics with Microsoft Clarity

With your consent (Art. 6(1)(a)), Clarity processes visited pages, clicks, scrolling, pointer movements, interaction times, device and connection information and pseudonymous identifiers. It generates heatmaps and session replays to improve the website, without a camera or microphone. Pseudonymous data are not necessarily anonymous. No Clarity code loads before consent or after refusal. We do not send names, emails or customer IDs; forms, baskets and reviews are masked. Account, order and payment pages are excluded, as are URLs with free-text searches or unknown parameters. Recording stops before a custom enquiry is filled in. GPC and Do Not Track disable analytics. First-party analytics cookies are _clck (browser identifier, Microsoft’s expected lifetime one year) and _clsk (session, one day); they are removed on withdrawal or on the next visit after choice expiry. The website choice lasts six months. Withdraw anytime using “Cookie preferences” in the footer → “Necessary cookies only”. New recording stops even if the server is unavailable. Withdrawal does not affect previous lawful processing or itself erase previously collected data.

Microsoft: roles, uses and transfers

Under its Clarity terms, Microsoft is an independent controller, not a processor acting solely for Milleemmi. Microsoft identifies Microsoft Ireland Operations Limited as the contracting provider for EU customers. Data are stored on Azure and may be processed in the USA; Microsoft describes standard contractual clauses between its Irish entity and Microsoft Corporation. Ask Microsoft’s privacy contacts or us for information or copies of transfer safeguards. Microsoft’s terms cover providing and improving services and, generally, Microsoft Advertising and advertising profiles; they also permit research and development, including AI, with non-personal data. This integration requests analytics consent only: it always sends advertising consent as “denied”, without enabling Microsoft Advertising or granting marketing consent. Microsoft’s privacy statement describes its independent processing and choices. Ordinary recordings are available for 30 days; aggregates, samples and favourites may remain for up to nine months. We do not use recordings to make decisions about individuals. See the Clarity terms, Microsoft privacy statement and rights contacts, FAQ and consent controls.

Purchases, payments and shipping

We process names, contact details, addresses and items to fulfil orders and take pre-contractual steps (GDPR Art. 6(1)(b)); administrative and tax duties rely on Art. 6(1)(c). Stripe processes payments through secure components embedded in the website or on its own page; PayPal is also available when displayed at payment. The shop does not receive full card numbers or PayPal passwords. Checkout requires an email address for order confirmation and updates and a phone number for delivery. Payment components load only after the request to proceed to payment, to process the transaction and prevent fraud; they do not activate the website’s optional analytics. Necessary delivery data go to the selected carrier. For international quotes our server sends Easyship country, postcode, city and state/province, parcel description, value, weight and dimensions, without the customer’s name, street address, email, phone or card details. Local quotes expire after 10 minutes; the applied price and reference remain with the order. No shipment is automatically purchased. Providers may process data outside the EEA under the safeguards described in their agreements and notices.

Details of orders, recipients, transfers and retention (Italian) · Terms of sale (Italian). Easyship Privacy · Easyship DPA.

Address suggestions with Google Maps

At checkout, after at least three characters, text entered in the street field may be sent to Google Maps to suggest addresses. Our server sends only the search text, selected country, language and a random session code: it does not forward the customer’s name, email, telephone, payment details or IP address. Google receives technical data from the server connection. Choose “Enter without Google” before typing to enter everything manually, with no effect on the purchase. Always check suggested details.

This feature assists address entry requested for a purchase (GDPR Article 6(1)(b)). It loads no Google code or cookies in the browser. The shop does not archive searches or suggestions; only the chosen address follows checkout and order retention periods. A temporary IP fingerprint is used for one minute to limit abuse (Article 6(1)(f)); monthly counters contain only request counts. Google processes data as an independent controller under Maps terms and its privacy policy, including outside the EEA with applicable safeguards described in its agreements, including standard contractual clauses. See the sources below for Google’s retention, rights and safeguards.

Google Maps Terms · Google Privacy · Google Controller Terms

Withdrawal, recipients and retention

The withdrawal form collects name, email, order reference and information you provide; confirmation precedes submission. The statement and date support contract handling and legal obligations (Art. 6(1)(b)/(c)), not promotions. Server Plan S.r.l. provides hosting and domain email as a processor for its services on our behalf, under its data processing agreement. Access is limited to the controller, authorised people and service providers within their functions; authorities receive data when legally required. Staff notifications contain only a generic alert and fixed link to the protected management area, without customer data, order numbers/amounts or payment details. Paid-order records, contracts, tax documents and withdrawal declarations: 10 years from the relevant last entry or closure of the relationship, subject to applicable periods, investigations and disputes. Information enquiries, unaccepted quotes and related images: up to 24 months after the last interaction, unless obligations or open cases require retention. The controller reviews archives and email; email deletion is not automatic. Contact details of expired, certainly unpaid checkouts: removed after 90 days, subject to safeguards and open cases. Closed support notes: 24 months. Application logs: 30 days; access and security events: 180 days. Application backups: 30 days, with pruning paused if no recent intact copy exists. Provider backups and other logs follow recovery, security and legal-obligation criteria described in the checkout notice. Correspondence copies in operational mailboxes, including those hosted by Google, follow the same document-retention criteria. Analytics and consent-record periods remain as stated above.

Your rights

Where GDPR Arts. 15–22 apply, you can request access, correction, erasure, restriction and portability, and object to legitimate-interest processing for reasons relating to your circumstances. Write to shop@milleemmi.it; Microsoft also handles requests concerning its own controller activities. You need not provide new identifiers where we cannot identify you; we may request only information necessary to locate data and verify the request. We normally respond within one month and notify justified extensions within legal deadlines. You may complain to the Italian data protection authority or your competent authority. Legal retention duties may limit erasure. We do not make automated decisions with legal or similarly significant effects.