Privacy Notice

Data controller: Milano Leather Group S.r.l.
Registered office: Via Spezia 20, 20142 Milano (MI), Italy
VAT / Tax code: IT12437860963
Email: info@milanoleathergroup.com
Phone: +39 02 8157 7288
WhatsApp: +39 339 995 8500

Last updated: 2 September 2026

1. What this notice covers

Milano Leather Group S.r.l. ("we", "the Controller") is the controller of the personal data collected through all the group's properties:

milanostraps.it — online watch strap store (Milano Straps brand)
casatimilano.com — bespoke atelier and leather goods (Casati Milano brand)
milanoleathergroup.com — the group's corporate website
watchbands.ai — watch/strap compatibility database
the group's WhatsApp channel and the digital assistant that operates it
the Milan atelier, for in-person appointments

This notice applies to all of these channels. Where a channel processes specific categories of data, we say so in the dedicated section.

2. What data we process and where it comes from

Data you provide to us

Identification and contact data: first name, last name, email, phone number, shipping and billing address.
Order data: products purchased, returns, exchanges, preferences, purchase history.
Content of conversations: messages exchanged on WhatsApp, in chat or by email, including the photographs of your watch or your wrist that you send us to assess sizing or craftsmanship.
Data collected in the atelier: wrist measurement, leather and finishing preferences, watch references, notes relating to the commission.
Payment data: handled directly by payment service providers; we do not store full card numbers.

Data collected automatically

Technical browsing data: IP address, browser and device type, pages visited, referral source, cookie identifiers.
On watchbands.ai: the images you upload for model recognition and the parameters you enter in the calculator. The images you upload are processed exclusively to return your search result and are not retained once processing is complete. They are not used to identify people and do not constitute processing of biometric data.

Data from third parties

From the platforms that host our channels (Shopify, Meta/WhatsApp) and from logistics and payment partners, limited to what is needed to fulfil the order.

We do not knowingly process children's data. Our services are not intended for anyone under 16.

3. Why we process it and on what legal basis

Purpose	Legal basis (Art. 6 GDPR)
Fulfilling your order: production, shipping, returns and warranty	Contract — Art. 6(1)(b)
Answering enquiries and quotes on WhatsApp, chat, email or in the atelier, including before an order	Pre-contractual measures — Art. 6(1)(b)
Making a bespoke piece, including wrist measurements and preferences	Contract — Art. 6(1)(b)
Invoicing, accounting, tax obligations	Legal obligation — Art. 6(1)(c)
System security, fraud prevention, defence of legal claims	Legitimate interest — Art. 6(1)(f)
Usage statistics and service improvement	Consent (non-technical cookies) — Art. 6(1)(a), or legitimate interest for aggregate measurements
Newsletter and promotional communications	Consent — Art. 6(1)(a), revocable at any time
Emails about products similar to those you already purchased	Legitimate interest / soft spam — Art. 130(4) of the Italian Privacy Code, with the right to object always available
Operating the digital assistant	Contract and pre-contractual measures — Art. 6(1)(b)

Providing the data needed for an order is mandatory: without it, we cannot perform the contract. Everything else is optional.

4. AI-based digital assistant

First contact on WhatsApp and in the chat on our websites is handled by an automated assistant based on artificial intelligence, which identifies itself as such at the start of every conversation, as required by Art. 50 of Regulation (EU) 2024/1689 (the "AI Act").

At any time you can ask to speak to a person by writing "I want an operator", or by writing directly to the WhatsApp number +39 339 995 8500.

How it works, in practice:

The text of your messages, and the images you send, are transmitted to the language model provider listed in section 5 so that the assistant can compose its reply.
Conversations are retained in our systems to give you continuity of assistance, manage the commission and keep evidence of the agreements made. Retention periods are in section 7.
The assistant does not make solely automated decisions that produce legal effects or similarly significantly affect you (Art. 22 GDPR). Prices, acceptance of a bespoke commission and appraisals always remain with a person.
The assistant provides information drawn from our knowledge base. It does not express appraisals, estimates or opinions on watches: those rest exclusively with the owner.
If you do not want the conversation to be processed by the assistant, you can ask for an operator from your very first message.

5. Who we share the data with

The data are processed by the Controller's authorised and instructed staff, and shared with the following parties, appointed as processors under Art. 28 GDPR:

Provider	Role	Location
Shopify Inc.	e-commerce platform, checkout, order management	Canada / USA
Meta Platforms Ireland Ltd.	WhatsApp Business Platform, messaging	Ireland / USA
Anthropic PBC	language model that processes the text of the assistant's conversations	USA
Supabase Inc.	application database, storage of conversations and logs	USA
Vercel Inc.	hosting of the group's applications and websites	USA
Algolia SAS	search engine and catalogue	France / USA
Resend	transactional and system email delivery	USA
Twilio Inc.	SMS and service notification delivery	USA
Google Ireland Ltd.	usage statistics (Google Analytics 4)	Ireland / USA
Couriers and shipping companies	order delivery	EU / non-EU
Payment service providers	payment collection and anti-fraud	EU / non-EU
Tax, legal and accounting advisors	legal compliance	Italy

The data may also be disclosed to public authorities where required by law. We do not sell your data and we do not disseminate it.

6. Transfers outside the European Union

Some of the providers listed are based in or have infrastructure in the United States. In those cases the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Implementing Decision EU 2021/914), supplemented where necessary by additional measures, or on the basis of an adequacy decision applicable to the provider. You can request a copy of the safeguards adopted by writing to info@milanoleathergroup.com.

7. How long we keep it

Data	Retention
Order and invoicing data	10 years from the accounting entry (legal obligation)
Customer account	until deletion is requested by the user, or after 36 months of inactivity
WhatsApp and chat conversations	24 months from the last message
Measurements and specifications of a bespoke commission	10 years, to allow reorders and servicing of the piece
Images uploaded to watchbands.ai	not retained: processed solely to return your result and deleted once processing is complete
Newsletter data	until consent is withdrawn
Technical and security logs	12 months
Browsing statistics	according to the cookie lifetimes stated in the cookie policy

Once these periods expire, the data are deleted or irreversibly anonymised.

8. Your rights

You can exercise at any time the rights provided by Arts. 15-22 GDPR: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, withdrawal of consent (without affecting the lawfulness of processing already carried out).

Write to info@milanoleathergroup.com or to Milano Leather Group S.r.l., Via Spezia 20, 20142 Milano (MI), Italy. We reply within one month, extendable by two months in complex cases, in which case we will let you know.

You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority), Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it — or with the supervisory authority of the country where you live.

9. Cookies

The group's websites use technical cookies, which are necessary for operation, and — subject to your consent collected through a banner — statistics and marketing cookies. You can change your choices at any time from the preferences panel. The details of individual cookies, their purposes and lifetimes are available in the website's cookie preferences panel.

10. Changes

We may update this notice to reflect changes in our services, our providers or the law. The updated version is published on this page with a new "last updated" date; if the changes are substantial, we will notify you through the channels you use with us.

Annex — milanoleathergroup.com

Corporate website. We process the contact details spontaneously submitted by partners, suppliers and boutiques interested in B2B collaborations, for the sole purpose of answering the enquiry and assessing a business relationship.

In the event of any discrepancy between language versions, the Italian version shall prevail.