Privacy Policy

This Privacy Policy explains how personal data is collected, used, shared and protected when you visit www.fuori-milano.com (the “Site”), browse or use our online store, make a purchase, subscribe to our communications or contact us. It applies to customers and visitors in the European Union, the other countries of the European Economic Area (including Iceland and Norway), the United Kingdom and Switzerland, as well as to other individuals whose personal data we process through the Site.

Data controller

The data controller is Mobili D’Arte Cav. Severino Cantiero S.r.l., trading as Fuori Milano (“Fuori Milano”, “we”, “us” or “our”), with registered office at Via Cadalora 22, 37050 Ca’ degli Oppi (VR), Italy, Italian tax code and VAT number IT01526100233, REA VR-182826, share capital €1,200,000.00. You can contact us at support@fuori-milano.com. We have not appointed a Data Protection Officer.

Applicable law

We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”, which also applies in Iceland and Norway through the EEA Agreement) and the Italian Personal Data Protection Code (Legislative Decree no. 196/2003). For individuals in the United Kingdom, we also comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). For individuals in Switzerland, we also comply with the Swiss Federal Act on Data Protection.

 

1. Personal data we collect

The personal data we collect depends on how you interact with the Site and our services. It may include the following categories:

• Contact and identity information: first name, surname, email address, postal/billing/shipping address and telephone number, where you provide them.
• Order, payment and delivery information: products purchased, order details, billing and shipping addresses, contact details, payment method, payment status, transaction references, refunds, returns and related correspondence; and, if you ask for an invoice in your name or for your business, your tax code, VAT number and electronic-invoicing details (such as a PEC address or recipient code). Depending on the payment method selected, relevant information is processed by Shopify Payments, PayPal, Shop Pay or Klarna to authorise or complete the transaction, manage payment-related services and help prevent fraud. We do not collect or store full payment-card details: these are handled directly by the relevant payment provider.
• Shipping and fulfilment information: recipient name, delivery address, email address and telephone number where required, order and parcel details, shipping-label information, tracking references and delivery status. This information is processed to prepare, dispatch, track and deliver orders and to handle delivery-related enquiries.
• Customer-service information: information you choose to provide when you contact us or complete a form on the Site, and our correspondence with you.
• Newsletter and marketing information: your email address and, where you provide or have provided them when subscribing or at checkout, your first name, surname, postal address and telephone number; the source and date of your signup; your consent status and preferences; confirmation of your subscription through our confirmation email (double opt-in); information about how you interact with our marketing emails, such as whether you open them and which links you click; and the records we need to manage subscriptions and opt-outs. You can subscribe through the newsletter form on the Site or by ticking the optional marketing box at checkout, which is never pre-ticked. We send marketing emails only to people who have subscribed or ticked that box and have given their consent. Subscribing does not affect your ability to place an order.
• Technical and usage information: IP address, device and browser details, approximate location derived from IP address, pages visited, interactions with the Site, referral information and cookie or similar technology identifiers.
• Analytics and advertising interaction information: information collected through Google Analytics, Google Ads and the Meta Pixel (Facebook and Instagram), depending on your consent. This includes online identifiers (such as cookie IDs, advertising IDs and IP address), device and browser details, pages and products viewed, campaign and referral information, ad interactions, and events relating to visits, basket activity and purchases. If you give consent, we use this information for audience statistics, conversion measurement, remarketing (showing you our ads on other websites and platforms) and personalised advertising. Google Signals and enhanced conversions may link this information to your Google account and, in the case of enhanced conversions, to your email address and other order details in hashed form. If you do not give consent, these tools do not collect this information from your device.

Please do not send us sensitive personal data unless we specifically request it and have a lawful reason to process it.

 

2. How we collect personal data

We collect information directly from you when you place an order, complete a form, subscribe to marketing or contact us. Some information is generated automatically when you browse the Site, through essential technologies and, where permitted by your choices and applicable law, analytics and advertising cookies or similar technologies.

We also receive and process information through service providers that help us operate the Site, process payments and fulfil orders. Shopify, Sendcloud and Mailchimp process personal data on our behalf. Our payment providers (Shopify Payments, PayPal, Shop Pay and Klarna) process payment data under their own responsibility as independent controllers. Google and Meta process data collected through their analytics and advertising tools as described in sections 3 and 5.

We may receive information such as payment confirmations, transaction references, order status, shipping-label details and tracking updates from these providers. The information processed and the parties involved depend on the payment method selected and the delivery services used.

 

3. How and why we use personal data 

We use personal data for the purposes below. For each purpose we state the legal basis on which we rely.

Orders, payments, delivery and customer service

We use contact, order and transaction information to process purchases and payments, deliver products, provide order updates, handle returns and refunds, respond to enquiries. Depending on the payment method selected, payments are processed through Shopify Payments, PayPal, Shop Pay or Klarna. We use Sendcloud to support shipping and fulfilment, including the preparation of shipping labels and the coordination and tracking of deliveries. Relevant information may be shared with the carrier responsible for delivering your order.

The legal bases are: performance of a contract or steps taken at your request before entering into a contract (to process, pay for, ship and support your order); compliance with legal obligations (accounting, tax and invoicing requirements, including the electronic transmission of invoice data to the Italian tax authorities); and our legitimate interests in preventing fraud and in establishing, exercising or defending legal claims, where these are not overridden by your rights. Providing the personal data needed to place an order is a contractual requirement: without it we cannot accept or deliver your order. We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects. Our payment providers may carry out automated fraud-prevention checks under their own responsibility.

Operating, securing and improving the Site

We use relevant technical information to operate the store, maintain security, prevent fraud, troubleshoot errors and improve the Site. The legal basis is our legitimate interest in running a secure, functioning and improving online store, where this is not overridden by your rights. Strictly necessary cookies are used because they are needed to provide the service you request. Cookies and similar technologies that require consent are used only after you have given consent, as explained in section 4 and below.

Analytics and advertising (Google and Meta)

With your consent, we use Google Analytics, Google Ads and the Meta Pixel to understand how visitors use the Site, measure traffic and performance, evaluate advertising campaigns and conversions, and build audiences for remarketing and personalised advertising on Google services (including YouTube) and on Facebook and Instagram. The Google features we use are Google Analytics (including Google Signals), Google Ads conversion tracking, Google Ads remarketing and audience features, Google Consent Mode and enhanced conversions. The legal basis is your consent (Article 6(1)(a) GDPR, together with the consent requirements for cookies and similar technologies under the Italian Personal Data Protection Code and the equivalent rules in the United Kingdom and Switzerland).

Google tags and the Meta Pixel stay inactive until you give consent. We use Google Consent Mode in its basic mode: Google tags do not load, and no data is sent to Google, until you give consent; Google then receives your choice. If you refuse consent, these tools do not collect data from your device. Where we use enhanced conversions, hashed order details such as your email address are sent to Google only if you have consented. We and Meta are joint controllers for the collection of data through the Meta Pixel and its transmission to Meta; Meta is responsible for any later processing for its own purposes. Google acts on our behalf for analytics and, for some advertising features, as an independent controller. We do not treat a newsletter signup as consent to advertising cookies or to the upload of customer details to an advertising platform. You can change or withdraw your choice at any time through the “COOKIES” link in the Site footer; withdrawal does not affect processing carried out before it.

Privacy and advertising controls: Google Privacy Policy — https://policies.google.com/privacy ; Google Ads Settings — https://adssettings.google.com/ ; Google Analytics opt-out browser add-on — https://tools.google.com/dlpage/gaoptout ; Meta Privacy Policy — https://www.facebook.com/privacy/policy/ ; Meta ad preferences — https://www.facebook.com/adpreferences/ . You can also change your cookie choices using the “COOKIES” link in the Site footer.

Email marketing through Mailchimp

We use Mailchimp to manage newsletter subscriptions and send marketing emails. You can subscribe through the newsletter form on the Site or by ticking the optional marketing box at checkout, which is never pre-ticked. After you subscribe, we send you a confirmation email and add you to our mailing list only once you confirm (double opt-in). We record the source and date of your signup and your consent status.

If you subscribe at checkout, your first name, surname, postal address and telephone number are transferred from your order to Mailchimp together with your email address.

The legal basis for sending you marketing emails is your consent (Article 6(1)(a) GDPR and the equivalent provisions of the UK GDPR and Swiss law). We send marketing emails only to people who have given that consent. You can withdraw your consent at any time using the unsubscribe link in every email or by contacting us at support@fuori-milano.com. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Mailchimp records how you interact with our emails, such as whether you open them and which links you click, so that we can measure and improve our campaigns. This tracking forms part of the marketing consent you give when subscribing. Mailchimp is provided by Intuit and may process data outside the EEA, the UK and Switzerland (see section 6).

Your email marketing consent is separate from your cookie and advertising choices. Subscribing to our newsletter does not authorise targeted advertising cookies or the upload of your email address or other customer details to an advertising platform. If we ever introduce such uses, we will ask for separate consent first.

Mailchimp privacy information: https://www.intuit.com/privacy/statement/

Social media and advertising platforms

We advertise on and maintain accounts on platforms such as Meta (Facebook and Instagram), TikTok and Pinterest. When you interact with our ads or pages on those platforms, they process your data under their own privacy policies, and we may receive aggregated statistics about that interaction. We do not install TikTok or Pinterest tracking tools on this Site and do not send them personal data from your purchases.

Legal compliance and protection of rights

We may use or disclose personal data where reasonably necessary to comply with legal obligations, respond to lawful requests, establish or defend legal claims, enforce our terms, or protect the rights, property and safety of our business, customers or others. The legal basis is compliance with a legal obligation or our legitimate interests in establishing, exercising or defending legal claims, preventing fraud and protecting our business, as applicable.

 

4. Cookies and similar technologies

The Site uses cookies and similar technologies. Some are essential to provide core store functions, such as maintaining a shopping basket, securing the Site or remembering privacy preferences. Other technologies, including those used for analytics and targeted marketing, are not essential and require your consent.

The essential cookies are set by Shopify. With your consent, we also use cookies, tags and pixels from Google (Google Analytics and Google Ads) and Meta (Meta Pixel) for analytics, ad measurement, conversion attribution, audience creation, remarketing and personalised advertising. These may be first-party or third-party cookies. These non-essential technologies stay inactive until you give consent. A detailed list of the cookies used on the Site, with their providers, purposes and durations, is available in the cookie settings panel.

When you first visit the Site, the cookie banner offers you the options to accept, decline or manage non-essential cookies on its first screen. You can change or withdraw your choices at any time by clicking the “COOKIES” link in the website footer. Withdrawing consent does not make prior processing unlawful, but it stops future consent-based processing. Browser controls may also allow you to manage cookies, although blocking essential cookies may affect store functionality.

 

5. How we disclose personal data

We may disclose personal data to the following categories of recipients, only as relevant to the purposes described in this Policy:

• Shopify: we use Shopify to operate our online store and checkout. Shopify processes your data on our behalf to run the store. If you choose Shop Pay, Shopify processes your data for that service as an independent controller under its own privacy policy.
• Payment providers: payments are processed through Shopify Payments (powered by Stripe), PayPal and Klarna, depending on the payment method you choose at checkout. These providers process payment details, transaction references, payment status and the information needed to manage payments, refunds and fraud prevention. They act under their own privacy policies, in some cases as independent controllers.
• Sendcloud and delivery carriers: we use Sendcloud to prepare shipping labels and manage shipments. We share the information needed to deliver your order with Sendcloud and the relevant carrier. This includes your name, delivery address and, where required, your contact details and shipment information.
• Mailchimp (Intuit): we share your email address and, where you subscribed at checkout, your name, postal address and telephone number, together with signup and consent records and email interaction data, for newsletter administration and email marketing, as described in section 3.
• Google (including YouTube): with your consent, we use Google Analytics and Google Ads for analytics, conversion measurement, audience creation, remarketing and personalised advertising. Where we use enhanced conversions, hashed order details such as your email address are shared with Google only if you have given consent. For analytics, Google acts on our behalf; for some advertising features, Google also processes data for its own purposes as an independent controller.
• Meta (Facebook and Instagram): with your consent, we use the Meta Pixel to measure the effectiveness of our advertising and to show you our ads. We and Meta Platforms Ireland Limited are joint controllers for the collection of this data through the Site and its transmission to Meta. Meta is responsible for any processing it carries out afterwards for its own purposes.
• Accountants, professional advisers and authorities: our accountants and the provider of our invoicing software process invoice and accounting data on our behalf. We transmit invoice data to the Italian tax authorities (Agenzia delle Entrate) through the electronic invoicing system, as required by law. We also disclose personal data to auditors, insurers, regulators and law-enforcement authorities where disclosure is required or permitted by law, or necessary to establish, exercise or defend legal claims.
• Business successors: a successor or relevant party in connection with a reorganisation, merger, sale or transfer of assets, subject to applicable law.

We do not sell your personal data. We do not share your personal data with advertising or analytics providers other than those named above. Other service providers, such as our website hosting and IT support providers and the providers of the apps we use to run the store, process personal data on our behalf only as needed to operate the Site and fulfil orders.

 

6. International transfers

We are based in Italy. Some of our service providers process personal data outside the European Economic Area (EEA), the United Kingdom or Switzerland. Where this happens, an appropriate safeguard is in place, as follows:

• Shopify (Ireland, Canada and other countries): Shopify International Limited in Ireland is our contracting party. Transfers to Shopify Inc. in Canada rely on the European Commission’s adequacy decision for Canada; onward transfers to Shopify’s subprocessors, including in the United States, are protected by standard contractual clauses.
• United States (Stripe, Google, Meta and Mailchimp/Intuit): payments through Shopify Payments are processed by Stripe, and Google, Meta and Mailchimp (Intuit) operate in the United States. Transfers rely on the EU-US Data Privacy Framework and, for individuals in the United Kingdom and Switzerland, on the UK Extension to that framework and the Swiss-US Data Privacy Framework, where the recipient is certified (Mailchimp/Intuit is certified under all three), or otherwise on standard contractual clauses together with the UK Addendum or the Swiss amendments.
• PayPal (Luxembourg and other countries): PayPal (Europe) S.à r.l. et Cie, S.C.A. is established in Luxembourg. Transfers within the PayPal group rely on binding corporate rules approved by European data protection authorities.
• Klarna (Sweden): Klarna Bank AB is established in Sweden. Any transfer by Klarna outside the EEA relies on standard contractual clauses or another safeguard described in Klarna’s privacy notice.
• Sendcloud (Netherlands) and delivery carriers: Sendcloud is established in the EEA. When your order is delivered to an address outside the EEA, we and the carrier send your name, address and contact details to that country. The United Kingdom and Switzerland benefit from European Commission adequacy decisions; where no adequacy decision applies, the transfer is necessary to perform our contract with you.

You can request a copy of the relevant safeguards by contacting us at support@fuori-milano.com. For individuals in Switzerland: the countries to which personal data may be disclosed are Ireland, Canada, the United States, Luxembourg, Sweden, the Netherlands and the country of delivery of your order.

7. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the services, maintain required business records, comply with legal obligations, resolve disputes and enforce agreements. Retention periods depend on the type of data, why it was collected, and any applicable legal requirements.

We keep order, invoicing and tax records for 10 years, as required by Italian accounting and tax law. We keep customer-service correspondence for 24 months after our last contact with you, unless we need it for longer to handle a dispute or legal claim. We keep newsletter data until you withdraw your consent or unsubscribe, or until 24 months after you last opened or clicked one of our emails, whichever comes first; we then keep only a minimal record of your email address and opt-out so that we do not contact you again. Data collected through Google Analytics is kept for no longer than 14 months; data held by Google Ads and Meta is kept in accordance with their own retention rules and settings.

Payment and transaction information may also be retained by the relevant payment providers for the periods required to complete transactions, manage refunds and disputes, prevent fraud and meet their own legal or regulatory obligations. Shipping and tracking information may be retained by Sendcloud and the relevant delivery carriers for the periods needed to manage shipments, resolve delivery issues and meet applicable legal obligations. The retention periods applied by these providers are governed by their respective policies and practices.

 

8. Your privacy rights

Depending on your location and the circumstances, you may have the right to:

• Request access to personal data we hold about you.
• Obtain information about how we use your data and, where we did not collect it from you, where it came from.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data, subject to legal exceptions.
• Request restriction of processing or object to certain processing.
• Receive certain personal data in a portable format or ask us to transmit it to another organisation, where applicable.
• Withdraw consent at any time where we rely on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Object to processing based on our legitimate interests. You have an absolute right to object to direct marketing, including related profiling, where applicable.
• Complain to a competent data protection supervisory authority.

These rights are not absolute and may be subject to conditions or exceptions. To exercise a right, contact us at support@fuori-milano.com. We may need to verify your identity before responding. We respond free of charge within one month of receiving your request; this period may be extended by up to two further months where necessary, taking into account the complexity and number of requests, in which case we will tell you.

You have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (https://www.garanteprivacy.it/), which is also our lead supervisory authority. Other authorities include the Information Commissioner’s Office in the United Kingdom (https://ico.org.uk/), the Federal Data Protection and Information Commissioner in Switzerland (https://www.edoeb.admin.ch/), Datatilsynet in Norway (https://www.datatilsynet.no/) and Persónuvernd in Iceland (https://www.personuvernd.is/). You may also complain to the authority in your place of residence, place of work or where an alleged infringement occurred. We encourage you to contact us first so that we can try to resolve your concern, and we will acknowledge and handle your complaint without undue delay.

 

9. Marketing preferences

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link at the bottom of any marketing email or by contacting us at support@fuori-milano.com. Unsubscribing withdraws your consent to marketing emails going forward. We will keep a minimal record of your email address and opt-out so that we can make sure we do not contact you again. We keep this record on the basis of our legitimate interest in respecting your choice.

After you unsubscribe, we may still send you service messages about your purchases, deliveries, returns, account security or similar non-marketing matters.

Your cookie and advertising preferences are managed separately. Unsubscribing from marketing emails does not change your cookie choices, and changing your cookie choices does not unsubscribe you from marketing emails. You can change your cookie choices at any time through the “COOKIES” link in the Site footer.

 

10. Security

We use appropriate technical and organisational measures designed to protect personal data. No online system or method of transmission is completely secure, and we cannot guarantee absolute security. Please contact us promptly if you believe your interaction with us or your personal data may have been compromised.

 

11. Children

The Site is not intended for children, and our online store is for persons aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not place an order or provide us with personal data. If you believe a child has provided us with personal data, contact us at support@fuori-milano.com so we can take appropriate action, including deleting the data.

 

12. Third-party websites

The Site may contain links to websites or services operated by third parties. Their privacy practices are governed by their own notices and terms. We encourage you to review those notices. This Policy does not govern third-party websites that we do not control.

 

13. Changes to this Privacy Policy

We may update this Policy to reflect changes to our data-processing practices, services or legal requirements. We will publish the updated version on the Site and revise the “Last updated” date. Where required by law, we will provide additional notice or obtain consent for material changes.

 

14. Contact us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact:

Email: support@fuori-milano.com

PEC: cantiero@legalmail.it

Company Name: Mobili D’Arte Cav. Severino Cantiero S.r.l., trading as Fuori Milano

Registered Office Address: Via Cadalora, 22, 37050 Ca’ degli Oppi VR, Italia

Tax Code & Italian VAT ID: IT01526100233

 

Relevant links:

Shopify Privacy Policy

PayPal Privacy Statement

Sendcloud Privacy Policy

Mailchimp Privacy

 

Version 01 - Last updated: 28 Oct. 2026