Privacy policy
Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (the “Italian Privacy Code”).
Last updated: 4 November 2026
1. Data controller
The data controller is Editions S.r.l., with registered and operational office at Via Solferino 46, 20121 Milan, Italy, VAT No. and Tax Code 09618860960, trading under the brand Editions Milano (“Editions Milano” or the “Controller”). For any request concerning personal data, you can write to privacy@editionsmilano.com or by certified email (PEC) to editions@pec.it.
2. What data we process
Browsing data. The IT systems that run the website editionsmilano.com collect, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP address, browser and device type, operating system, date and time of the visit, and pages visited. This data is used to ensure the operation and security of the website.
Data provided voluntarily. When users write to us by email or through the website forms (contact forms, requests for information or quotes, requests from professionals and retailers), we process the data entered: first and last name, email address, telephone number, company, country and the content of the message.
Newsletter. If users subscribe to the newsletter, we process their email address and any preferences indicated, as well as data on the opening of and clicks on the communications sent. Opens and clicks are tracked only with the user’s prior consent.
Purchases and accounts. To manage orders from private and business customers, we process personal details, company name and VAT number where applicable, shipping and billing addresses, email address, telephone number, order history and, if the user creates an account, login credentials. Payments by card, Apple Pay and the other methods offered at checkout are handled by Shopify and the integrated payment service providers: Editions Milano does not receive or store full card details. Certain technical order data may be used to prevent fraud. Automated fraud assessments do not lead to the final rejection or cancellation of an order without human review.
Cookies and tracking tools. For information on cookies, please refer to the Cookie Policy.
Artificial intelligence tools. [To be completed only if the website or customer service use chatbots or other AI tools: state the tool, the data processed, the purpose, the legal basis, the providers and any transfers outside the EEA. Anyone interacting with a chatbot must be informed, at the point of interaction, that they are dealing with an AI system (Article 50 of Regulation (EU) 2024/1689).]
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Operation and security of the website | Legitimate interest of the Controller (Art. 6(1) (f) GDPR) |
| Replying to requests for information, quotes and business enquiries | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b)) |
| Management of orders, accounts, payments, deliveries, returns and after-sales service | Performance of a contract (Art. 6(1)(b)) |
| Tax, accounting and legal obligations | Legal obligation (Art. 6(1)(c)) |
| Sending the newsletter and promotional communications | Consent (Art. 6(1)(a)), which may be withdrawn at any time |
| Communications about similar products to customers who have already made a purchase | Legitimate interest, pursuant to Article 130(4) of the Italian Privacy Code, with the right to object at any time; tracking of email opens and clicks requires consent |
| Statistics and marketing through non-technical cookies | Consent (Art. 6(1)(a) GDPR and Article 122 of the Italian Privacy Code) |
| Establishment, exercise or defence of the Controller’s legal claims | Legitimate interest (Art. 6(1)(f)) |
| Prevention of fraud in orders | Legitimate interest of the Controller (Art. 6(1) (f) GDPR) |
| [If carried out: customer segmentation in the CRM for marketing purposes] | [Consent (Art. 6(1)(a)) or legitimate interest] |
Where the legal basis is legitimate interest, this consists of the security of the website and of orders, the prevention of fraud and the protection of the Controller’s rights, after verifying that the user’s rights and freedoms do not override it.
4. How data is processed
Data is processed using electronic tools and, where necessary, on paper, by authorised and trained personnel, with appropriate technical and organisational measures to protect it against unauthorised access, loss or destruction. We do not carry out automated decision-making, including profiling, that produces legal effects for the user.
5. Retention period
| Data | Retention |
|---|---|
| Browsing data (logs) | [7 days], unless needed to investigate unlawful acts |
| Requests for information and enquiries | [24 months] from the last contact, unless a contractual relationship is established |
| Contractual, tax and accounting data | 10 years, as required by Article 2220 of the Italian Civil Code |
| Newsletter | Until consent is withdrawn or the user unsubscribes |
| Account data | Until the account is closed or, if earlier, after [24 months] of inactivity, subject to retention obligations |
| Fraud prevention data | [12 months] from the order, unless needed to investigate unlawful acts |
| Communications about similar products to customers | Until the user objects |
| Cookies | According to the durations stated in the Cookie Policy |
At the end of these periods, data is deleted or anonymised.
6. Recipients of data
Data may be disclosed, to the extent necessary, to: IT and website hosting service providers (Shopify International Limited, Ireland); email marketing service providers (Shopify Email); CRM system providers (Salesforce), into which website orders and contacts are transferred; payment service providers; advertising and traffic analysis service providers (for example Google and Meta), within the limits of the consents given; couriers and shipping companies; tax, accounting and legal advisers; Editions Milano’s sales agents and representatives for their respective areas; public authorities, where required by law.
These parties act as data processors under Article 28 GDPR or as independent controllers. An up-to-date list of processors is available on request. Data is not disseminated or sold to third parties. For Meta advertising tools (for example the pixel), Editions Milano and Meta Platforms Ireland Ltd. may be joint controllers for the collection and transmission of data; the essential information on the joint controllership arrangement is available on the provider’s website.
7. Transfers of data outside the European Economic Area
Some providers may process data outside the European Economic Area, in particular in the United States. In such cases, the transfer takes place on the basis of an adequacy decision of the European Commission (for example, for the United States, the EU-US Data Privacy Framework, for certified providers, and, for Canada, where Shopify Inc. is based, the European Commission’s adequacy decision for entities within its scope) or of the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR). Information on the safeguards adopted can be obtained by writing to privacy@editionsmilano.com.
8. Whether providing data is mandatory
Providing the data requested in the forms is necessary to reply to requests and to manage orders: without it, we will not be able to process the request. Consent to the newsletter and to non-technical cookies is optional, and refusing it does not prevent users from browsing the website.
9. Rights of the data subject
Users may at any time exercise the rights provided for by Articles 15 to 22 GDPR: access to their data, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest or for direct marketing purposes. They may also withdraw their consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Right to object. Users have the right to object at any time, on grounds relating to their particular situation, to processing based on legitimate interest and, without having to give reasons, to processing for direct marketing purposes, including through the link in every promotional communication.
Requests should be sent to privacy@editionsmilano.com. We will reply within one month of receipt, which may be extended by two further months in the cases provided for by Article 12 GDPR.
Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country in which they live or work.
10. Minors
The website is not intended for persons under 18 years of age, and we do not knowingly collect data relating to minors.
11. Links to third-party websites and social networks
The website may contain links to third-party websites and to Editions Milano’s social media profiles (for example Instagram). Processing carried out on those platforms is governed by their respective privacy notices, for which Editions Milano is not responsible.
12. Changes
This privacy notice may be updated, including as a result of changes in the law. The version in force is always published on this page, together with the date of the last update.
Cookie Policy
Information on the use of cookies and other tracking tools pursuant to Article 122 of Italian Legislative Decree 196/2003, Regulation (EU) 2016/679 and the Guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali) of 10 June 2021.
Last updated: 4 November 2026
1. What cookies are
Cookies are small text files that the websites you visit save on your device, so that they can be read again on subsequent visits. Similar tools (pixels, tags, local storage, fingerprinting) are governed in the same way and, for simplicity, are referred to in this policy as “cookies”.
Cookies may be “first-party”, if set directly by Editions Milano, or “third-party”, if set by external parties through our website.
2. Data controller
The data controller is Editions S.r.l. (Editions Milano), with registered and operational office at Via Solferino 46, 20121 Milan, Italy, VAT No. and Tax Code 09618860960, who can be contacted at privacy@editionsmilano.com. For full information on the processing of data, please refer to the Privacy Policy.
3. Types of cookies used
Technical cookies. These are necessary for the website to function and to provide the services requested by the user, such as navigating between pages and remembering the language, the cart and the choices made about cookies. They do not require consent and cannot be disabled through the banner, but users can block them in their browser settings, which may cause the website to malfunction. They include the Shopify cookies required for the store to function (cart, checkout, security, language and country). Shopify’s statistics and marketing cookies (_shopify_analytics, _shopify_marketing) are not technical: they are set only with consent to the analytics and marketing categories respectively.
Analytics cookies. These collect aggregate information on how the website is used, such as the number of visitors and the most viewed pages. They are set only with prior consent. Analytics tools such as analytics cookies are subject to the user’s express consent.
Profiling and marketing cookies. These are used to show users advertising in line with their interests, including on other websites and social networks, and to measure the effectiveness of campaigns. They are set only with prior consent.
4. List of cookies
The list below comes from a scan of the website carried out on 1 November 2026, before any choice, after refusing and after accepting all cookies. It also includes the browser storage (local storage) used by the website. Google’s tag is loaded only after consent to the analytics or marketing category, and Google is told the user’s choice through Google Consent Mode.
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| _shopify_cmp | Shopify Inc. / Shopify International Limited | Stores the user’s cookie choices | Technical, first-party | 1 year |
| _shopify_essential | Shopify Inc. / Shopify International Limited | Session, cart, checkout and security of the store | Technical, first-party | 1 year |
| localization | Shopify Inc. / Shopify International Limited | Country and language of the store | Technical, first-party | 1 year |
| cart, cart_currency | Shopify Inc. / Shopify International Limited | Contents and currency of the cart | Technical, first-party | 2 weeks |
| discount_code | Shopify Inc. / Shopify International Limited | Keeps a discount code received through a link until checkout | Technical, first-party | Session |
| _shopify_test | Shopify Inc. / Shopify International Limited | Checks that the browser accepts cookies | Technical, first-party | 1 minute |
| __Host-Http-shop_binding, _shop_app_essential | Shopify Inc. / Shopify International Limited (Shop) | Sign-in with Shop and saved checkout details | Technical, first-party | 3 hours / 1 year |
| signInWithShop:* (local storage) | Shopify Inc. / Shopify International Limited (Shop) | Keeps the cart in sync for users signed in with Shop | Technical, first-party | Until deleted |
| editions-milano:wishlist (local storage) | Editions Milano | Products saved in the wishlist | Technical, first-party | Until deleted |
| em-popup-* (local storage) | Editions Milano | Remembers that the newsletter or catalogue window was closed | Technical, first-party | Until deleted |
| _shopify_analytics | Shopify Inc. / Shopify International Limited | Statistics on the use of the store and checkout | Analytics, first-party | 1 year |
| _ga, _ga_* | Google Ireland Ltd | Website usage statistics | Analytics, third-party | 2 years |
| _shopify_marketing | Shopify Inc. / Shopify International Limited | Marketing data on the use of the store and checkout | Marketing, first-party | 1 year |
| _gcl_au | Google Ireland Ltd | Measurement of Google advertising and Shopping conversions (set when arriving from a Google ad) | Marketing, third-party | 90 days |
For third-party cookies, processing is governed by the privacy notices of the respective providers: Shopify; Google (see also how Google uses information from sites that use its services). For Meta tools (for example the pixel), Editions Milano and Meta Platforms Ireland Ltd. may be joint controllers for the collection and transmission of data; these tools are activated only after consent to the marketing category.
5. How to give, refuse and change consent
On the first visit to the website, a banner is shown that allows users to:
- accept all cookies;
- reject all non-technical cookies, using the “Reject” button or by closing the banner with the “X”: in this case browsing continues with technical cookies only;
- choose which categories of cookies to allow, using the “Customise” button.
No non-technical cookie is set before the user has given consent. Choices are stored and the banner is not shown again for 12 months, unless there are significant changes to the conditions of processing or it is technically impossible to know the choice already made. In the first layer of the banner, the “Reject” button is as prominent as the “Accept” button.
Users can change or withdraw their consent at any time through the “Cookie preferences” link in the footer of every page of the website.
6. Managing cookies through the browser
Users can also manage or delete cookies in their browser settings. Instructions for the most common browsers: Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge. Disabling technical cookies may affect some functions of the website.
7. Transfers outside the EU
Some third-party cookie providers may transfer data outside the European Economic Area, in particular to the United States. Such transfers take place on the basis of the EU-US Data Privacy Framework for certified providers or of the European Commission’s Standard Contractual Clauses.
8. User rights
Users may exercise the rights provided for by Articles 15 to 22 GDPR and lodge a complaint with the Italian Data Protection Authority, as described in the Privacy Policy.
9. Changes
This Cookie Policy may be updated, including as a result of changes to the tools used on the website or to the law. The version in force is always published on this page.
