• SCROLL TO EXPLORE THE MILLEFIORI UNIVERSE • SCROLL TO EXPLORE THE MILLEFIORI UNIVERSE

Privacy Notice

PRIVACY NOTICE 

PURSUANT TO ART. 13 OF EU REG. 2016/679 (GDPR) AS AMENDED.


Data subjects: Users of the website “www.millefiorimilano.com”


Dear User, 

with this document, the Company Home Fragrance Italia S.r.l., in compliance with the applicable data protection legislation, provides this notice regarding the processing of your personal data collected through voluntary registration for the newsletter service.

Any processing of your personal data will be carried out in accordance with the principles of lawfulness, fairness and transparency.

Your personal data will be processed in accordance with the provisions of the GDPR and the confidentiality obligations set out therein, as well as those of the Privacy Code still in force.


  1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER.

The Data Controller (hereinafter also the “Controller” and/or “Company”) is Home Fragrance Italia S.r.l., in the person of its pro-tempore legal representative, with registered office at 20881-Bernareggio (MB), Via Del Commercio 28, VAT no.: 12886810154, contactable, in addition to the aforementioned registered office, at the following contact details:  +39 039 9220979 - e-mail: info@millefiorimilano.com - certified e-mail (PEC): millefiorisrl@legalmail.it;

 

  1. TYPES OF DATA PROCESSED

The Controller processes categories of personal data such as, by way of example and not limitation, contact details, e-mail address and IP address.


  1. DEFINITION OF PROCESSING

Pursuant to Art. 4(2) GDPR, “processing” means “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.


  1. METHODS OF PROCESSING

The processing of your Data will be carried out using suitable paper-based, electronic and/or telematic tools, in compliance with the legal provisions on the processing of personal data, adopting adequate security measures so as to ensure the security and confidentiality of the data. The processing of your Data will also be managed by personnel specifically trained and instructed.


  1. PURPOSES OF DATA PROCESSING.

a) Management of the newsletter service

Subject to your specific consent, your e-mail address will be used to send newsletters, promotional communications, product updates, offers, commercial initiatives and news about the Millefiori Milano brand.


b) Personalized marketing through profiling

Subject to your specific, separate and optional consent, the data provided by you and/or relating to your interactions with the website, your purchases and your consumption preferences may be processed to analyse tastes, habits and interests, in order to create individual and group profiles and send you commercial communications and personalized offers that are more relevant to your interests.

This activity constitutes profiling within the meaning of Art. 4(4) GDPR. It does not involve automated decision-making with legal effects on you, but affects solely the degree of personalization of the commercial communications received

  1. LEGAL BASIS OF PROCESSING. 

The legal basis for the processing of your personal data, for each of the purposes indicated, is as follows: 

a) Management of the newsletter service

The legal basis is your free, specific, informed and unambiguous consent, pursuant to Art. 6(1)(a) GDPR, given by means of a positive action and a dedicated checkbox that is not pre-ticked at the time of registration for the service.


b) Personalized marketing through profiling

The legal basis is your specific, free, optional consent, separate from that given for the newsletter, pursuant to Art. 6(1)(a) GDPR. This consent must be requested by means of a separate, dedicated checkbox that is not pre-ticked. Failure to consent to profiling does not prevent registration for or receipt of the general newsletter.


The consent given for one or both purposes may be withdrawn at any time, as easily as it was given, without prejudice to the lawfulness of the processing carried out prior to the withdrawal

  1. NATURE OF THE PROVISION OF DATA

Pursuant to Art. 13(2)(e) GDPR, the provision of the requested personal data is subject to the following:

a) Newsletter

The provision of your e-mail address for the purpose of managing the newsletter service is optional, but necessary in order to receive the requested service. Failure to provide it will make it impossible to register for and receive the newsletter;


b) Profiling

The provision of data and consent relating to the profiling purpose are entirely optional. Failure to give consent does not in any way prejudice registration for the newsletter or the receipt of general promotional communications, but solely results in the impossibility of receiving communications and offers personalized according to your interests

  1. RECIPIENTS OF PERSONAL DATA. 

Your personal data will not be disclosed to the public, but may be shared, solely for the pursuit of the purposes described above, with the following categories of recipients:

internal personnel of the Controller expressly authorized and instructed;

IT service providers, hosting and cloud providers, newsletter sending platforms, application service providers and parties that support the management of the website and marketing communications;

agencies or partners that collaborate with the Controller in carrying out direct marketing activities and managing promotional campaigns;

legal, tax and corporate advisors, within the limits of the services rendered;

judicial, administrative or supervisory authorities, in the cases provided for by law.

Where required, such parties act as Data Processors appointed pursuant to Art. 28 GDPR. The updated list of Data Processors is available at the Controller's registered office and may be requested by writing to info@millefiorimilano.com.


  1. TRANSFER OF DATA ABROAD. 

Users' personal data are, as a rule, processed within the European Economic Area (EEA).

Should it become necessary, for technical or organizational reasons, to transfer data to countries outside the EEA, the Controller ensures that such transfer will take place solely in compliance with Articles 44 et seq. GDPR, and in particular:

• to countries covered by an Adequacy Decision of the European Commission (including the EU-US Data Privacy Framework for transfers to the United States); or

• by entering into the Standard Contractual Clauses (SCC) adopted by the European Commission with Implementing Decision 2021/914 of 4 June 2021, supplemented, where necessary, by additional technical and organizational measures to protect data in transit.

  1. DATA RETENTION PERIOD

In compliance with the storage limitation principle, your personal data will be retained for a period that varies according to the purpose of the processing:


a) Newsletter

Your e-mail address will be retained until consent is withdrawn and, in any case, for no longer than 24 months from the last active interaction with the communications sent, without prejudice to the Controller's ability to verify the data subject's continued interest before deletion;


b) Profiling

Subject to your specific consent:

data relating to the details of purchases and interactions used for analysis and profiling will be retained for 12 months from collection;

contact data used to send personalized commercial communications will be retained for 24 months from the date consent was given.

Upon expiry of these periods, or in the event of withdrawal of consent, the data will be irreversibly deleted or permanently anonymized, in accordance with the technical deletion and backup procedures.

  1. RIGHTS OF THE DATA SUBJECT. 

The applicable law grants the data subject specific rights listed in Articles 15 to 22 of the GDPR. In particular, the data subject has the right to ask the Controller for:

• confirmation as to whether or not processing of their personal data is being carried out and, if so, to obtain access to it (Art. 15 – right of access);

• rectification of inaccurate data or completion of incomplete data (Art. 16 – right to rectification);

• erasure of the data where one of the grounds provided for applies (Art. 17 – right to erasure, “right to be forgotten”);

• restriction of processing in the cases provided for (Art. 18 – right to restriction of processing);

• to receive the data provided in a structured, commonly used and machine-readable format, and to transmit it to another controller, where the processing is based on consent or on a contract and is carried out by automated means (Art. 20 – right to data portability);

• to object at any time to processing based on the legitimate interest of the Controller (Art. 21 – right to object);

• to withdraw at any time any consent given, without prejudice to the lawfulness of consent-based processing carried out prior to the withdrawal.

Requests concerning the exercise of the above rights may be addressed to the Controller at the contact details indicated in the last paragraph, without any particular formality, including by means of the form for the exercise of data subjects' rights.

The data subject may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Art. 77 GDPR), or bring proceedings before the competent courts pursuant to Art. 79 GDPR. The data subject may also withdraw any consent given as easily as it was given, by written communication sent via certified e-mail (PEC) or registered letter with return receipt to the contact details indicated in the last paragraph.

The Italian Data Protection Authority (Garante per la protezione dei dati personali) is located at Piazza Venezia n. 11, 00187 Rome – switchboard tel. (+39) 06.696771 – e-mail garante@gpdp.it – PEC protocollo@pec.gpdp.it – website www.garanteprivacy.it.

  1. RIGHT TO LODGE A COMPLAINT

If you believe that the processing of your personal data is carried out in violation of the Regulation, you have the right to lodge a complaint with the Office of the Italian Data Protection Authority (Garante Privacy) (by e-mail, at the address: garante@gpdp.it, or by post, to the Garante per la protezione dei dati personali, located in Rome (Italy), Piazza Venezia 11 Staircase B, 00187), as provided for in Art. 77 of the Regulation, or to bring proceedings before the competent courts as provided for in Art. 79 of the Regulation.   


  1. UNSUBSCRIBING FROM THE SERVICE 

To stop receiving the newsletter, enter your e-mail address in the form on the page   https:/ /, by clicking the “Unsubscribe” button or the “unsubscribe” link, present in every newsletter.

In case of problems, you may send a report to the following e-mail address: info@millefiorimilano.com.


  1. CHANGES TO THIS NOTICE

The Data Controller reserves the right to update and/or modify the content of this notice, in part or in full, including as a result of any changes made to the applicable legislation.

Any such changes will be published on the website, which we invite you to visit regularly.

Last updated: 30.06.2026