Use the code BENVENUTO10% to receive an exclusive 10% discount on your first order.

Account

Privacy Policy

Last updated: 16 October 2026.

This notice explains how personal data of users who visit www.familyaffairmilano.com and purchase our products is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”). For information on cookies and tracking tools, please see our Cookie Policy.

1. Data controller

The data controller is Family Affair Milano, Viale della Resistenza, 10 – 40026 Imola (BO), Italy – VAT no. IT03650071206. Email address for any privacy-related request: info@familyaffairmilano.com.

2. What data we process

  • Data provided by the user: first and last name, billing and shipping address, email, phone number, company name, tax or VAT number where applicable, and the content of messages sent by email, forms or WhatsApp.
  • Order data: products purchased, amounts, selected payment method and payment status. Full payment card details are never known or stored by us: they are processed directly by payment service providers.
  • Account data: credentials and order history, if the user creates an account.
  • Browsing data: IP address, device and browser type, pages visited, date and time, and information collected through cookies and similar technologies, within the limits of the consent given.

3. Purposes and legal bases

  • Order management, payment, shipping and customer support (performance of a contract or pre-contractual measures – Art. 6(1)(b) GDPR).
  • Administrative, accounting and tax obligations (legal obligation – Art. 6(1)(c) GDPR).
  • Creating and managing the user account (performance of a contract – Art. 6(1)(b) GDPR).
  • Replying to contact requests sent by email, forms or WhatsApp (pre-contractual measures and legitimate interest – Art. 6(1)(b) and 6(1)(f) GDPR).
  • Newsletter and promotional communications, by voluntary subscription which can be cancelled at any time (consent – Art. 6(1)(a) GDPR). For customers, possible communications about products similar to those purchased (legitimate interest – Art. 130(4) of the Italian Privacy Code).
  • Statistics and traffic measurement through Google Analytics, and marketing and remarketing through Meta (Facebook) and Google Ads: only with prior consent given through the cookie banner (Art. 6(1)(a) GDPR).
  • Website security and prevention of abuse or fraud (legitimate interest – Art. 6(1)(f) GDPR).
  • Establishing, exercising or defending legal claims (legitimate interest – Art. 6(1)(f) GDPR).

Providing the data needed to manage an order is mandatory: without it the purchase cannot be completed. Providing data for newsletters and marketing is optional.

4. Recipients of the data

Data may be disclosed, to the extent strictly necessary, to parties acting as data processors or as independent controllers:

  • website hosting, maintenance and technical support providers;
  • payment service providers (Stripe, PayPal and any other payment method active on the website);
  • couriers and logistics providers for product delivery;
  • Mailchimp (The Rocket Science Group LLC) for newsletter management;
  • Google (Google Analytics, Google Ads), Meta Platforms (Facebook Pixel) and WhatsApp, within the limits of the consents given and the features enabled;
  • tax advisers, accountants and legal advisers, and competent authorities where required by law.

Personal data is neither disseminated nor sold to third parties.

5. Transfers outside the EU

Some of the providers listed above (for example Google, Meta, Mailchimp, Stripe, PayPal) may process data in countries outside the European Economic Area, in particular the United States. In such cases the transfer takes place on the basis of a European Commission adequacy decision (such as the EU–US Data Privacy Framework) or appropriate safeguards such as Standard Contractual Clauses.

6. Retention period

  • order and invoicing data: 10 years, as required by civil and tax law;
  • account data: until the user deletes the account or requests deletion;
  • contact requests: for the time needed to reply and, afterwards, for a maximum of 24 months;
  • newsletter: until consent is withdrawn (unsubscribing from the list);
  • data collected through cookies: for the periods stated in the Cookie Policy.

7. Your rights

Users may at any time exercise the rights provided for by Articles 15-22 GDPR: access to their data, rectification, erasure, restriction of processing, portability, objection to processing and withdrawal of consent (without affecting the lawfulness of processing carried out before withdrawal). Requests can be sent to info@familyaffairmilano.com. Users also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of their country of residence.

8. Minors

The website is not aimed at children under 14 and does not knowingly collect their personal data.

9. Changes to this notice

The controller may update this notice, for example to reflect legal or website changes. The date at the top shows the latest version in force.

Scroll to Top