Privacy Policy

1. Who we are and to whom this Privacy Notice applies

This Privacy Notice on the protection of personal data (“Privacy Notice”) describes how Deodato.Gallery S.p.A. hereinafter referred to as “Deodato” or the “Data Controller”, processes the personal data of natural persons who interact with and use its websites and access the related activities.

Data Controller

Deodato.Gallery S.p.A.

Registered office: Via Nerino 2, 20123 - Milan (MI), Italy

General contact email address: [email protected]

Certified email address PEC: [email protected]

This Privacy Notice applies to the processing of personal data carried out by Deodato in relation to the following brands and online channels, mainly intended for the European Union / European Economic Area EU/EEA market:

• Deodato Arte
• Wunderkammern
• LoveSpot Galleries
• Arte.Wedding
• Deodato Tech
• Artuu
• Phygi.io

including their respective websites, ecommerce platforms, reserved areas, online forms, newsletters, membership/fidelity programmes, official social media channels connected to such websites and any other digital initiative referred to on the websites themselves.

Unless otherwise specified, Deodato acts as Data Controller pursuant to Regulation EU 2016/679 “GDPR”.

2. What is meant by processing of personal data

“Personal data” means any information that identifies or makes a natural person identifiable, directly or indirectly, such as, by way of example: name and surname, email address, telephone number, shipping address, payment data, IP address, purchase data, preferences expressed on the website.

“Processing” means any operation carried out on personal data, including collection, recording, storage, consultation, use, disclosure, erasure, and so forth.

Data processing is carried out in compliance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, as provided for by the GDPR and by the Italian Privacy Code Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.

3. Who are the data subjects and what data we process

3.1 Categories of data subjects

We process personal data relating to the following categories of natural persons:

• Visitors to the websites of the Deodato group, including non-registered visitors.
• Online customers who purchase through the ecommerce platform, with or without creating an account, including guest checkout.
• Offline customers, for example purchases made in galleries, when their data are managed through tools and systems connected to the websites or digital programmes.
• Registered users who create an account on the group websites.
• Members of the Membership/Fidelity programme, where active for one or more brands.
• Subscribers to newsletters and other marketing communications.
• Users who interact with customer care through “Contact Us” forms, online chat, email, telephone, or social media channels connected to the websites.
• Participants in competitions, events, initiatives and promotional campaigns organised by Deodato, online and/or offline but connected to digital channels.
• Candidates and potential business partners or artists who contact us through the dedicated sections of the websites.

3.2 Categories of data processed

Depending on how the interaction with Deodato takes place, we may process the following categories of personal data:

• Identification and contact data: name, surname, title, postal address, shipping and billing address, email address, telephone number, tax code or VAT number where expressly required for tax obligations, and any company data if you request an invoice in the name of a company.

Any additional basic identification data, such as date of birth and gender, may be collected on an optional basis in order to better personalise communications and initiatives, or to verify compliance with minimum age requirements. Providing such additional information is optional and does not affect the possibility of making purchases or using the basic services of the websites.

• Purchase and contract data: products/artworks purchased, amounts, currencies, date and place of purchase, payment method used, order history, returns, refunds, after-sales assistance requests, data necessary for invoicing.
• Account and Membership/Fidelity data: access credentials in protected form, account settings, communication preferences, enrolment in the membership/fidelity programme, level/tier, points accrued and used, benefits enjoyed, history of activities related to the programme.
• Website and ecommerce activity data: products added to the cart, abandoned carts, wishlists and “favourites” category, browsing history of certain content or categories where linkable to the user, interactions with newsletters and communications such as openings, clicks, unsubscribes, choices made in the cookie panel unless the data have been anonymised.
• Browsing and technical data: IP address, online identifiers such as cookie identifiers and similar technologies, browser type and version, operating system and device used, time and date of access, system and security logs, information on traffic source referrer URL and other technical data necessary for the operation of the websites or for IT security. Some of these data may be collected through cookies or similar tools: for further information, please see section 9.
• Data provided when contacting customer care: content of messages including emails, chats and forms, order information, any attachments sent by the user, internal notes necessary to handle the request.
• Data relating to events, competitions and initiatives: identification and contact data, information required for participation, such as preferences regarding certain artists or declared interests, any images or user-generated content, logistical information such as preferred time slot or city.
• Data relating to participation in surveys, reviews and feedback: product or service ratings, comments, questionnaire answers, scores assigned.

We do not request or process, through the channels described, special categories of data, so-called “sensitive data”, relating, by way of example but not limited to, health, religion, political opinions, genetic or biometric data, except in exceptional cases and always with a specific dedicated notice and subject to the data subject’s prior consent.

4. Purposes and methods of data processing

In this section we describe the main purposes for which we process your personal data, the legal basis that allows us to process them, the main categories of data involved and the retention periods.

The legal bases adopted for the processing and retention of personal data are listed below:

• Contract or pre-contractual measures taken at your request Article 6, paragraph 1, letter b, GDPR and in performance thereof.
• The data subject’s express consent, especially with regard to broader marketing profiling; for the use of images of participants for promotional purposes, where required by the circumstances and where such use is not based on other permitted legal bases; and for the use of browsing data collected through cookies and similar technologies for advertising or remarketing purposes, in line with EDPB Guidelines 1/2024 on legitimate interest and with the decision of the Italian Data Protection Authority on cookies and other tracking tools dated 10 June 2021.
• Legitimate interest of Deodato, only where such interest does not override your rights and interests.
• Legal obligations in tax, accounting and consumer protection matters Article 6, paragraph 1, letter c, GDPR and related national laws.

4.1 Online and offline purchases, performance of the contract and order management

Main purposes

• To allow you to purchase artworks, products and services online and, where systems are integrated, also offline.
• To manage the entire order cycle: confirmation and management of cart and checkout, payment, issuance of receipts or invoices, shipping and delivery, any returns, refunds, complaints or disputes connected with the purchase.
• To manage access to the legal and tax documentation related to the purchase.

Data processed main categories

• Identification and contact data.
• Data relating to the order, products purchased, amounts and payment methods.
• Billing and shipping data.
• Purchase history, returns and refunds.

Guest checkout

In line with European recommendations on data minimisation and with the most recent indications of the European Data Protection Board EDPB on the legal basis for the creation of accounts on ecommerce websites, Deodato allows you to make purchases without creating a personal account guest checkout. In this case, we collect only the data necessary to fulfil the order and comply with the related legal obligations.

Retention periods

• Data relating to purchases and invoicing: for the time necessary to perform the contract and, in any event, solely for legal and tax purposes, until expiry of the applicable statutory periods, generally 10 ten years from the end of the financial year in which the transaction is recorded, unless longer periods apply in case of litigation.

4.2 Customer account management and reserved area

Main purposes

• To allow you to create and manage a personal account on the group websites registration and authentication.
• To allow you to view your order history, manage shipping and billing addresses, save preferences, wishlists and favourite products.
• To facilitate subsequent purchases and communication with customer care.

Legal basis

• Performance of a contract creation and management of the account at your request pursuant to Article 6, paragraph 1, letter b, GDPR.
• Deodato’s legitimate interest Article 6, paragraph 1, letter f, GDPR in managing the account service efficiently and securely, in a context in which the user expects such processing; this interest is balanced against your rights and fundamental freedoms.

Data processed main categories

• Identification and contact data.
• Credentials in a form not readable by Deodato’s staff.
• Account settings and preferences.
• Order history, saved addresses, wishlist, products saved as favourites.

Retention periods

• Account data: for the entire duration of registration to the service. We may adopt procedures for deactivation and deletion of inactive accounts after a prolonged inactivity period of 36 thirty-six months, informing you in advance where technically possible.
• Once the account has been deleted, we will retain only the data necessary to comply with legal obligations, such as accounting and tax obligations, or to protect our rights in the event of litigation.

You may request deletion of your account at any time by following the instructions in the reserved area or by contacting us at the contact details indicated in section 10.

4.3 Membership/Fidelity Programme

Deodato may activate Membership/Fidelity programmes in order to reward and retain regular customers, including through dedicated benefits, point collections, early access to exhibitions and special initiatives.

Main purposes

• To allow enrolment in the Membership/Fidelity programme and management of the related account.
• To assign and manage points, membership levels, benefits, vouchers and other advantages provided for by the programme rules.
• To send you communications strictly connected to the programme, such as changes to the rules, points balance, expiry of benefits, operational information on initiatives reserved for members.
• To verify compliance with participation conditions and prevent abuse or fraudulent behaviour.

Data processed main categories

• Identification and contact data.
• Data relating to enrolment in the programme and access credentials to the member area.
• Points history, benefits used, reserved initiatives in which you participated.
• Information on certain purchases and interactions carried out as a member, where necessary for the management of the programme.

Retention periods

• Membership/Fidelity programme data: for the entire duration of enrolment and, after termination, for the time necessary to manage any disputes related to the programme or to the use of benefits.

Enrolment in the programme is entirely optional and failure to enrol does not affect the possibility of making purchases or using the other basic services of the website.

4.4 Newsletter and marketing communications

Main purposes

• To send you, by email, SMS or other electronic channels, newsletters and promotional communications concerning products, services, events, exhibitions, initiatives of the Deodato group and its connected brands.
• To offer you content of general interest, such as new artworks, artists, collections, promotions and editorial updates, without advanced profiling.

Data processed main categories

• Identification and contact data, in particular email address and, where provided, telephone number.
• Preferences expressed upon subscription, where applicable.
• Data relating to interaction with communications, such as email openings, clicks on links and unsubscribes, used in aggregated form to assess the effectiveness of campaigns.

Retention periods

• Until consent is withdrawn or the right to object is exercised opt-out. In any event, data processed for marketing purposes will not be retained beyond a reasonable period of 24 twenty-four months from the last significant interaction, unless further retention is necessary to demonstrate the lawfulness of the processing, such as proof of consent.

You may unsubscribe at any time by clicking on the link at the bottom of each communication or by contacting us at the contact details indicated in section 10. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

4.5 Personalised marketing, abandoned carts and favourites “light” profiling

Main purposes

• To send you communications relating to abandoned carts, products left in the cart or wishlist, or artworks recently viewed, in order to remind you of the possibility of completing the purchase or to inform you of availability or price changes.
• To offer you personalised communications and content, such as suggestions of artworks or artists similar to those already purchased or viewed, based on information collected through order history, expressed interests, interactions with the website and newsletters.
• To carry out, in certain cases, non-invasive segmentation, for example by country, language, macro-category of product or spending range, in order to make communications more relevant.

The use of marketing automation tools, such as newsletter and multichannel campaign platforms, and advertising features offered by third parties, such as Meta, Google or other operators, which allow personalised ads and content to be shown on external websites and platforms, is always carried out in compliance with the choices expressed through the cookie banner and the consents provided.

Data processed main categories

• Identification and contact data.
• Order history and declared preferences.
• Data relating to abandoned carts, wishlists, products saved as favourites, browsing history linkable to the account.
• Browsing data and online identifiers collected through cookies or similar technologies, within the limits allowed by the choices expressed in the cookie banner and cookie panel.
• Data disclosed to third-party advertising platforms, such as email address or other identifiers, duly pseudonymised, used to create personalised advertisements, within the limits allowed by the consents given and by the settings of the accounts on the relevant platforms.

Retention periods

• Data used for consent-based marketing personalisation activities will be processed until consent is withdrawn and, in any event, for no longer than an indicative period of 24 twenty-four months from the last significant interaction, unless further retention is necessary to ensure proof of consent and the management of disputes.
• Data relating to individual abandoned carts may be used for a very limited period of time, for example a few days from creation of the cart, after which they will be used only in aggregated or anonymised form for statistical purposes.

You may object at any time to the processing of your data for marketing and profiling purposes, as indicated in section 8.

4.6 Customer care and customer support

Main purposes

• To handle requests, reports, complaints, requests to exercise privacy rights or requests for information in general, received through the contact forms on the websites, email, online chat, telephone or other indicated channels.
• To improve the quality of the support service and customer satisfaction.

Data processed main categories

• Identification and contact data.
• Content of requests, including texts and attachments.
• Data relating to orders and customer history, where necessary to respond to the request.

Retention periods

• Data relating to requests will be retained for the time necessary to handle the request and, thereafter, for a maximum indicative period of 24 twenty-four months for the purposes of documenting the activity carried out and defending Deodato’s rights, unless further retention obligations arise from the nature of the request or from involvement in judicial proceedings.

Support requests may also be handled through instant messaging applications, such as WhatsApp Business. In such cases, certain data provided, such as telephone number, message content and any attachments, will be processed to respond to your requests and may also be processed by the providers of the messaging applications, acting as independent controllers or processors, according to their respective privacy policies.

The use of messaging apps for promotional communications will take place only on the basis of your specific consent or, in any case, consent clearly extended to that channel.

In order to facilitate online interactions and improve customer service, we may also use chats and virtual assistants such as chatbots, possibly based on AI technologies. In such cases, the data provided in chats are processed solely to provide you with answers, support or suggestions, as well as, in aggregated form, for internal analysis and service improvement. No decisions are made solely on the basis of automated processing that produce legal effects concerning you or that may significantly affect your personal sphere.

4.7 Events, competitions and special initiatives

Main purposes

• To organise and manage participation in events, openings, previews, exhibitions, prize competitions, promotional initiatives and similar activities, including those promoted online but held offline.
• To send operational and informational communications relating to the event or competition, such as registration confirmation, reminders, programme changes and access to post-event content.
• To manage obligations connected with prize competitions, such as the drawing and notification of winners, allocation and delivery of prizes, tax obligations and reporting requirements.
• To document and promote the event, including through images and content published on the Data Controller’s official channels, where this is compatible with the rights and freedoms of the data subjects.

Retention periods

• For data collected for the management of the event or contest: for the duration of the initiative and for the time necessary to comply with related legal obligations and manage any disputes, for a maximum period of 24 twenty-four months.

4.8 Analysis, statistics and business development

Main purposes

• To carry out aggregated and statistical analyses on the operation of the websites, sales, effectiveness of promotional campaigns, customer journey and use of digital features.
• To improve products, services, browsing experience and internal processes.

Data processed main categories

• Transactional and order-related data in aggregated form.
• Browsing and use data relating to the websites and newsletters, preferably in aggregated or pseudonymised form.
• Results of surveys, feedback and reviews.

Retention periods

• Data used only in aggregated or anonymised form for statistical purposes may be retained without time limits, as they are no longer attributable to an identified or identifiable natural person.
• Personal data that may be used for internal analysis in non-anonymous form will be retained for limited periods compatible with the purposes described above.

4.9 Compliance with legal obligations and litigation management

• Main purposes

• To comply with legal obligations, regulations, directives and requests from competent authorities.
• To exercise or defend a right in judicial or extrajudicial proceedings.

Retention periods

• For the entire duration of the judicial or extrajudicial proceedings and until expiry of the limitation periods applicable to enforceable rights.

4.10 IT security, fraud prevention and management

Main purposes

• To ensure the security of IT infrastructures, websites and online services, including access monitoring, anomaly detection, prevention and management of security incidents.
• To prevent and combat fraud, abuse, unlawful or unauthorised use of online services, including in relation to Membership/Fidelity programmes.

Data processed main categories

• System access and usage logs.
• Online identifiers, including IP address.
• Data relating to suspicious or disputed transactions.
• Any information collected during internal investigations into specific incidents.

Retention periods

• Logs and security-related data will be retained for limited periods proportionate to the purpose, up to a maximum of 24 twenty-four months.

5. To whom we disclose personal data

Your personal data are processed by authorised Deodato personnel, duly instructed and bound by confidentiality obligations.

In addition, for the purposes described above, data may be disclosed to the following categories of recipients:

• IT service providers and companies providing software solutions, cloud infrastructures, hosting services and technical maintenance of information systems and websites.
• Payment service providers, such as payment gateway operators, banking institutions, card issuers and online payment platforms, acting as independent controllers or processors.
• Logistics and shipping service providers, such as couriers or postal services appointed to deliver products.
• Marketing, communication and advertising service providers, such as newsletter platforms, marketing automation tools and online advertising campaign providers, acting on Deodato’s instructions as processors or, for certain specific processing operations, as independent controllers, such as social networks.
• Consultants and professionals, such as tax advisors, legal advisors and auditors, who assist Deodato in complying with legal obligations and protecting its rights.
• Companies managing prize competitions and events, where appointed by Deodato.
• Judicial and administrative authorities and, in general, entities entitled to request or receive data in the cases provided for by applicable law.
• Other companies that may belong to the Deodato group, where existing, for legitimate internal administrative purposes, within the limits permitted by law.

The updated list of processors may be requested by contacting Deodato at the contact details indicated in section 10.

6. Transfers of data to third countries

Personal data are normally processed within the European Economic Area EEA. However, certain service providers, such as cloud service providers, marketing and advertising tools, payment or communication platforms, may be located in or process data in countries outside the EEA.

In such cases, transfers of data to third countries will take place in compliance with Articles 44 et seq. of the GDPR, adopting one of the following safeguards:

• Adequacy decisions of the European Commission pursuant to Article 45 GDPR, where existing.
• Standard Contractual Clauses SCC adopted by the European Commission and, where necessary, supplementary technical and organisational measures, such as data encryption, minimisation and access restrictions, in line with EDPB recommendations on international data transfers.
• One of the specific derogations provided for by Article 49 GDPR, where applicable and only in residual cases.

Upon request, we may provide additional information on the safeguards adopted for transfers outside the EEA and a copy of the relevant Standard Contractual Clauses, within the limits allowed by confidentiality and security requirements.

7. How we use cookies and similar technologies

Our websites use cookies and similar technologies, such as pixels, tags and SDKs, for technical, statistical and, subject to consent, marketing and profiling purposes.

• Technical cookies are necessary for the proper functioning of the websites, such as session management, language selection, cart storage and security.
• Non-technical cookies, such as non-anonymised analytics cookies, profiling or advertising cookies, are used only subject to your consent, collected through the banner and cookie management panel, in compliance with the decision of the Italian Data Protection Authority on cookies and other tracking tools dated 10 June 2021 and with the applicable European guidelines.

For more details on the types of cookies used, the specific purposes and retention periods, we invite you to consult the dedicated Cookie Policy, which is constantly updated and available on our websites. Through the dedicated panel, you may at any time change your preferences and withdraw consent to the use of non-technical cookies.

8. Your rights

As a data subject, you have the following rights in relation to your personal data, within the limits and under the conditions set out in Articles 15 to 22 of the GDPR:

• Right of access: to obtain confirmation as to whether or not personal data concerning you are being processed and to receive information on the processing, such as purposes, categories of data, recipients and retention periods, as well as a copy of the data.
• Right to rectification: to obtain rectification of inaccurate personal data or completion of incomplete data.
• Right to erasure right to be forgotten: to obtain erasure of personal data concerning you where the conditions set out in Article 17 GDPR are met, such as data no longer necessary in relation to the purposes, withdrawal of consent or unlawful processing, without prejudice to legal retention obligations.
• Right to restriction of processing: to obtain restriction of processing in the cases provided for by Article 18 GDPR, in the following circumstances: contesting the accuracy of the data, objecting to processing based on legitimate interest, unlawful processing as an alternative to erasure, or where processing is necessary for Deodato to establish, exercise or defend a legal claim.
• Right to data portability: to receive, in a structured, commonly used and machine-readable format, the personal data concerning you that you have provided, processed by automated means on the basis of consent or a contract, and to transmit those data to another controller, where technically feasible.
• Right to object: to object at any time, on grounds relating to your particular situation, to the processing of personal data carried out on the basis of the Data Controller’s legitimate interest Article 6, paragraph 1, letter f, GDPR, including profiling based on that legal basis. In the event of objection, Deodato will refrain from further processing the data unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
• Right to withdraw consent: where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, unless the conditions set out in Article 22 GDPR apply, in which case you will be informed and may exercise the rights provided for.

To exercise your rights, you may contact Deodato at the contact details indicated in section 10. We will respond, as a rule, within 30 thirty days of receipt of the request, subject to the extensions provided for by the GDPR in particularly complex cases.

9. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data violates the applicable data protection legislation, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you habitually reside, work or where the alleged infringement occurred.

In Italy, the supervisory authority is the Italian Data Protection Authority, Autorità Garante per la protezione dei dati personali.

This is without prejudice to your right to refer the matter at any time to the competent judicial authorities.

10. Contact details of the Data Controller and Data Protection Officer DPO

Data Controller

• Deodato.Gallery S.p.A.
• Registered office: Via Nerino 2, 20123 - Milan MI, Italy
• Email: [email protected]
• Other contact details, including telephone and PEC, are indicated in the “Contacts” sections of the group websites.

Data Protection Officer DPO

If Deodato appoints a Data Protection Officer DPO pursuant to Articles 37 to 39 of the GDPR, the relevant updated contact details will be indicated in the updated versions of this Privacy Notice and in the privacy sections of the group websites.

For any question or request relating to the processing of your personal data, including the exercise of the rights described above, you may write to the Data Controller’s contact details, specifying “Privacy” in the subject line.

11. Changes to this Privacy Notice

This Privacy Notice may be subject to changes or updates, including as a result of:

• developments in all services offered by Deodato;
• adjustments to applicable legislation or measures issued by supervisory authorities;
• significant internal organisational changes.

In the event of substantial changes, we will inform you by appropriate means, through email communications, informative pop-ups or notices published on the group websites, so that you may review the updated version before the changes produce significant effects.

The latest version of the Privacy Notice is always available on the Deodato group websites.

Below is the Cookie policy to be used as an extended disclosure in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter "GDPR").

What are Cookies?

Cookies are pieces of information sent by a web server (e.g., the site) to the Internet browser of the user, automatically stored by the user on the computer and automatically sent back to the server each time the site is accessed. By default, almost all web browsers are set to automatically accept cookies. Typically, cookies can be installed:

•         directly by the owner and/or manager of the website (so-called first-party cookies);
•         by external parties outside the website visited by the user (so-called third-party cookies). Unless otherwise specified, it is recalled that these cookies fall under the direct and exclusive responsibility of the same operator. Further information on privacy and their use can be found directly on the websites of the respective operators.

This website may use, also in combination with each other the following types of cookies classified according to the indications of the Privacy Guarantor and the Opinions issued in the European context by the Working Group Art. 29 / European Data Protection Committee:

•         Session: they are not stored persistently on the user's computer and are deleted when the browser is closed. They are strictly limited to the transmission of session identifications necessary to enable the safe and efficient exploration of the site while avoiding the use of other IT techniques potentially prejudicial to the privacy of users' browsing.
•         Persistent: they remain stored on the computer's hard drive until they expire or are deleted by users. Through persistent cookies, users accessing the site are automatically recognized each time they visit. Users can set their computer's browser to accept/reject all cookies or to display a warning whenever a cookie is offered so that they can consider whether to accept it. Users can, however, change the default configuration and disable cookies (i.e., block them outright) by setting the highest level of protection.
•         Technical: these are the cookies used to authenticate, to enjoy multimedia content or to allow the choice of navigation language. Since they are necessary for the easy navigation and correct display of the site, it is not necessary to acquire the user's consent for these markers. Also included in this case are cookies used to statistically analyze access/visits to the site, only if used exclusively for statistical purposes and through the collection of information in aggregate form.
•         Non-technical: these are all cookies that are not essential for the proper use of the site. Their use on users' terminals is forbidden unless they have first been adequately informed and have given free, specific, informed and unequivocal consent in this regard. Based on the purposes they perform, these markers can in turn be grouped into:
  • Analytics. These are the cookies used to collect and analyze statistical information about access/visits to the website. In some cases, associated with other information such as credentials entered for access to restricted areas (such as e-mail address and password), they can be used to profile the user (personal habits, sites visited, content downloaded, types of interactions made, etc.).
  • Widgets. This category includes all those graphic components of a program's user interface, which is intended to facilitate the user's interaction with the program. For example, social network cookies (Facebook, Instagram, Twitter) are widgets.
  • Advertsing. This category includes cookies used to advertise within a site.
  • Web beacons. Code snippets that allow a website to transfer or collect information through the request of a graphic image fall into this category. Web sites may use them for a variety of purposes, such as analyzing Web site usage, monitoring and reporting activities on advertisements, and customizing advertisements and content.

Cookies on the Site

Technical cookies for which consent is not required

The Data Controller will install on your device and, in particular, in your browser or allow third parties to install certain cookies that are necessary for us to acquire or have our partners acquire statistical information in an anonymous and aggregate form related to your navigation on the pages of the Site.

Non-technical cookies for which your consent is required

Subject to your free, specific, informed and unambiguous consent, the Data Controller or third parties may install other markers that do not fall under the definition of technical cookies.

By default, such cookies are disabled.

When you first access the Site, you will see a banner that briefly informs you about the cookies used and allows you, via a special button, to select your preferences on such cookies. Please be advised that where you do not set preferences or close the banner without making choices, the Site will only use technical cookies for which consent is not required.

At any time, you may change your choices regarding these cookies through the appropriate preference management panel by clicking on the appropriate button at the bottom left.

If you do not wish to receive third-party cookies on your device, you may, through the link below, access the policies and consent forms of those third parties and exclude their receiving. These cookies are not directly controlled by the Site, therefore, you will need to refer to the third party websites, or to https://www.youronlinechoices.com/uk/ for information on how you can delete or manage cookies based on the browser you are using and to manage your preferences on third party cookies.

How to disable cookies by browser configuration

If you wish, you can also manage cookies directly through your browser settings. However, by deleting cookies from your browser, you may remove the preferences you have set for the Site, including technical cookies that record your preferences and your previous access to the Site. In that case, when you log in to the Site again, the cookie banner may appear again.

For more information and support you can also visit the specific help page of the web browser you are using, such as:

– Internet Explorer / Microsoft Edge:https://support.microsoft.com/en-gb/windows/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d

– Google Chrome: https://support.google.com/chrome/answer/95647?hl=en-GB

– Mozilla Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

LIST OF COOKIES COLLECTED

The table below lists the cookies we collect and what information they store.

Cookies used by this website

Technical cookies do not require consent. Analytics and marketing cookies are set only after your consent, which you can withdraw at any time via the “Manage cookies” link.

Cookie	Category	Purpose	Duration
shop_cart	Technical	Shopping cart	30 days
shop_paese	Technical	Proposed shipping country	30 days
shop_lingua, mm_lingua	Technical	Chosen language	30 days / 1 year
mm_sito, mm_dentro	Technical	Mio Mondo login	30 days / 6 months
cc_cookie	Technical	Stores your cookie choices	6 months
_ga, _ga_*, _gid	Analytics	Usage statistics (Google Analytics)	up to 2 years
_gcl_au	Marketing	Google Ads campaign measurement	3 months
_fbp, fr	Marketing	Meta campaign measurement (Facebook/Instagram)	3 months
_pin_unauth, _derived_epik	Marketing	Pinterest campaign measurement	1 year
bcookie, lidc, li_sugr, ln_or	Marketing	LinkedIn campaign measurement	up to 1 year

Manage cookies