Privacy policy

Data controller

1. What data we process and why

We collect only what we need to fulfil your request or to keep the site running. Each case is listed separately below, together with its legal basis.

• Placing an order: your name, phone number, optionally e-mail, order comment and cart contents. Basis — conclusion and performance of the sales contract, and steps taken at your request before it. Without a name and phone number the order cannot be confirmed.
• Contact form: your name, phone, optionally e-mail, subject and message. Basis — action at your request: you ask us to get in touch, we reply. No separate consent is required here.
• Discount card: the card number you enter in the cart to receive a discount. Basis — performance of the contract.
• Running the site: technical cookies for the cart, the selected language and protection of forms against request forgery. Basis — technical necessity; the shop does not work without them.
• Server logs: IP address, date and time of the request, page address, browser type. Basis — legitimate interest: protection against attacks and troubleshooting.
• Map on the Contacts page: when it loads, your IP address and browser details go to the OpenStreetMap Foundation. Basis — your consent: without it the map does not load and a button is shown instead.
• Spam protection for the contact form (Google reCAPTCHA): once you start filling in the form, Google receives your IP address and information about your behaviour on the page. Basis — legitimate interest: without it the form is flooded with automated messages. Nothing is sent to Google before you start filling the form in.

2. Cookies and browser storage

There are no advertising or analytics trackers on this site: we do not count visits, build profiles or pass data to ad networks. The following is used:

• milano-boutique-session — session: cart, wishlist, selected language. Lives for 2 hours, not accessible to page scripts. Strictly necessary.
• XSRF-TOKEN — protects forms against request forgery. Lives for 2 hours. Strictly necessary.
• milano_consent — the record of your choice in the cookie window (what you allowed, version and date). Stored in your browser localStorage and never sent to our servers. Strictly necessary as proof of your choice.
• The OpenStreetMap map may store technical data in your browser — only after you have allowed it to load.

3. Who receives the data

We do not sell data and do not pass it on for third-party advertising. Data is shared only as far as the purposes above require:

• Telegram (Telegram FZ-LLC, UAE) — orders and form messages reach our staff as a Telegram message, including name, phone, e-mail, message text and order contents.
• Google Ireland Limited — the reCAPTCHA service protecting the contact form. Your IP address and technical browser details are sent while you fill in the form.
• OpenStreetMap Foundation (United Kingdom) — the map on the Contacts page, with your consent only. Your IP address is sent.
• Cloudflare, Inc. — content delivery network and protection against attacks: all requests to the site pass through it, including your IP address. Cloudflare may also count visits anonymously (Web Analytics), without cookies and without profiling.
• The hosting provider whose servers hold the site and the order database.
• Public authorities — only upon a lawful request.

4. Transfers outside the country

Some of the services listed above are located outside the Republic of Moldova, including countries outside the European Economic Area. Transfers rely on those providers' standard contractual clauses and are limited to the minimum necessary.

5. How long we keep data

Each kind of data is kept exactly as long as its purpose requires:

• Orders and related data — for the period required by accounting and tax legislation.
• Contact form messages — until the correspondence is finished, plus a reasonable period afterwards.
• Server logs — up to a few months, then deleted or anonymised.
• Technical cookies — 2 hours from your last request to the site.
• The record of your cookie choice — until you change it or clear your browser data.

6. Your rights

In relation to your data you have the right to:

• find out what data we process and receive a copy of it;
• request correction of inaccurate data;
• request erasure where there is no longer a basis for keeping it;
• request restriction of processing or object to it;
• withdraw consent where processing is based on it — this does not affect the lawfulness of processing before withdrawal;
• lodge a complaint with the supervisory authority.

7. How to exercise your rights

Write to the e-mail address above or call the phone number listed. We will reply within the period set by law. To avoid disclosing data to the wrong person, we may ask you to confirm details of your order.

Consent for the map and other external content can be changed at any time — the "Cookie settings" link is in the footer of every page.

8. Supervisory authority

If you believe your rights have been infringed, you may lodge a complaint with the National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP): MD-2004, Chișinău, str. Serghei Lazo 48, datepersonale.md, [email protected].

If you are in the European Union, you may also contact the supervisory authority of your country of residence.

9. Changes to this policy

If the data we process changes, we will update this text and the date at the bottom of the page. If the set of cookie categories changes, the choice window will appear again so that you can decide anew.