Privacy & Cookie Policy

PRIVACY POLICY – Soave Oro

 

1. Data Controller

The Data Controller for personal data collected through the website www.soaveoro.com (the "Site") is Milor S.p.A., with registered office at Via dei Gracchi, 35 – 20146 Milan, VAT No. 04362490155 (the "Data Controller"), owner of the Soave Oro brand.

Contact details:

This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018 ("Privacy Code").

2. Personal data processed

The Data Controller may process the following categories of data:

  • Identification and contact data: first name, last name, email address, telephone number, shipping address, and billing address.
  • Order-related data: products purchased, amounts, purchase history, returns, and refunds.
  • Payment data: payments are processed by third-party providers (Shopify Payments, Shop Pay, Klarna, Apple Pay, Google Pay, card networks). The Data Controller does not store complete payment card details.
  • Customer account data: login credentials and preferences.
  • Browsing data: IP address, browser and device type, pages visited, date and time of access, referral source, and interactions with the Site.
  • Data collected through cookies and similar technologies: as described in the Cookie Policy.
  • Communications: content of messages sent via the contact form, email, or WhatsApp.

3. Purposes and legal bases for processing

Purpose Legal basis Retention period
Management of the account, orders, payments, shipments, returns, and warranty Performance of the contract (Art. 6.1.b GDPR) For the duration of the relationship and up to 10 years to comply with legal obligations
Tax, accounting, and legal compliance Legal obligation (Art. 6.1.c GDPR) 10 years (Art. 2220 of the Civil Code)
Customer support by email, telephone, and WhatsApp Performance of the contract and legitimate interest (Art. 6.1.b and 6.1.f GDPR) The time required to handle the request and, in any case, no longer than 24 months
Sending newsletters and promotional communications Consent (Art. 6.1.a GDPR) Until consent is withdrawn and, in any case, no longer than 24 months after the last interaction
Sending communications about products similar to those purchased Legitimate interest (Art. 130(4) of the Privacy Code) Until the data subject objects
Statistical analysis and measurement of the Site's performance Consent As stated in the Cookie Policy
Personalized advertising and remarketing on Google, Meta (Facebook, Instagram) and TikTok Consent (Article 6.1.a GDPR and Article 122 of the Privacy Code) As specified in the Cookie Policy; audience segments for no more than 12 months
Creating custom audiences by uploading encrypted (hashed) data Consent Until consent is withdrawn
Fraud prevention and Site security Legitimate interest (Article 6.1.f GDPR) Only for as long as strictly necessary
Defending rights in legal proceedings Legitimate interest (Article 6.1.f GDPR) For the duration of the dispute and until the limitation period expires

Providing the data required for a purchase is mandatory: without it, the order cannot be completed. Consent to marketing and personalized advertising is optional and can be withdrawn at any time, with no impact on the purchase.

4. Advertising and tracking (Google, Meta, TikTok)

With express consent given via the cookie banner, the Site uses tracking tools provided by:

  • Google Ireland Ltd. (Google Ads, Google Analytics 4, Google Tag Manager), including Google Consent Mode v2;
  • Meta Platforms Ireland Ltd. (Meta Pixel and Conversions API);
  • TikTok Technology Ltd. (TikTok Pixel and Events API).

These tools make it possible to measure campaign effectiveness, show relevant ads on third-party platforms, and create lookalike audiences. For server-to-server integrations (Conversions API, Events API, Enhanced Conversions), certain data, such as email addresses or phone numbers, is transmitted only in encrypted (hashed) form and only with prior consent.

For certain activities, the Controller and the platforms act as joint controllers pursuant to Article 26 GDPR. The providers' privacy notices are available at the following links:

5. Data recipients

Data may be disclosed to:

  • e-commerce platform providers (Shopify International Ltd., Ireland);
  • payment service providers (Shopify Payments, Klarna, Apple, Google, card networks);
  • express couriers and logistics providers responsible for delivery;
  • email marketing service providers;
  • messaging service providers (WhatsApp);
  • advertising and analytics platforms (Google, Meta, TikTok);
  • tax and legal advisors and auditing firms;
  • public authorities, where required by law.

These parties act as Data Processors pursuant to Article 28 GDPR or as independent Data Controllers. The updated list is available upon request. The data is not disclosed publicly.

6. Transfer of data outside the European Union

Some providers (for example, Shopify, Google, Meta, and TikTok) may also process data outside the European Economic Area, including in the United States. In these cases, the transfer is based on an adequacy decision by the European Commission, including the EU-U.S. Data Privacy Framework for certified providers, or on Standard Contractual Clauses approved by the European Commission.

7. Data subject rights

Under Articles 15-22 GDPR, you may at any time:

  • access your data and obtain a copy;
  • request its rectification or erasure;
  • request restriction of processing;
  • object to processing, particularly for marketing purposes;
  • obtain data portability;
  • withdraw your consent, without affecting the lawfulness of processing based on consent before its withdrawal;
  • lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise your rights, you can write to customerservice@milor.it. You can also unsubscribe from newsletters using the link in each email.

8. Minors

The Site is not intended for children under 14, and the Controller does not knowingly collect their data. Purchases are restricted to adults.

9. Security

The Controller adopts appropriate technical and organizational measures to protect data against loss, unlawful use, or unauthorized access, including encrypted connections (HTTPS) and PCI-DSS-certified payment providers.

10. Changes

This notice may be updated. The current version is always published on this page, along with the date of the latest update.

 


COOKIE POLICY – Soave Oro

Last updated: 09/23/2026

1. What cookies are

Cookies are small text files that the websites you visit save on your device so they can be read on subsequent visits. Similar technologies, such as pixels, tags, and local storage, work in a similar way and are collectively referred to as "cookies" in this policy.

This Cookie Policy supplements the Privacy Policy and is provided pursuant to Article 122 of the Privacy Code and the guidelines issued by the Italian Data Protection Authority on cookies on June 10, 2021. The data controller is Milor S.p.A., Via dei Gracchi, 35 – 20146 Milan, VAT no. 04362490155.

2. Types of cookies used

Technical cookies (necessary). These are essential for the Site to function: cart, checkout, login, security, country and currency selection, and storing cookie preferences. They do not require user consent.

Analytics cookies. These are used to understand how users use the Site (pages visited, time spent, traffic sources) to improve its performance. They are installed only with consent.

Profiling and marketing cookies. These are used to measure advertising campaign conversions and show personalized ads on Google, YouTube, Facebook, Instagram, and TikTok, including based on browsing activity on the Site (remarketing). They are installed only with consent.

3. Cookie list

Provider Cookie name Purpose Type Duration
Shopify _shopify_y, _shopify_s Basic store statistics Technical/analytics 1 year / 30 minutes
Shopify cart, cart_sig, cart_currency Cart management Technical 2 weeks
Shopify secure_customer_sig Customer login Technical 1 year
Shopify localization Country and currency Technical 2 weeks
Shopify _tracking_consent, _cmp_a Consent storage Technical 1 year
Shopify keep_alive, _secure_session_id Session and security Technical Session / 24 hours
Klarna, Shop Pay Various Payment and fraud prevention Technical Session / variable
Google Analytics 4 _ga, ga* Usage statistics Analytics 2 years
Google Ads _gcl_au, _gcl_aw Conversion measurement Marketing 90 days
Google (DoubleClick) IDE, test_cookie Remarketing and ads Marketing 13 months / 15 minutes
Meta _fbp, _fbc Conversions and remarketing on Facebook and Instagram Marketing 90 days
Meta fr Personalized ads Marketing 90 days
TikTok _ttp, _tt_enable_cookie, ttcsid Conversions and remarketing on TikTok Marketing 13 months

4. Managing consent

On your first visit, a banner informs you and lets you:

  • accept all cookies;
  • reject all non-essential cookies, including by closing the banner using the "X";
  • customize choices for each category.

If consent is not given, only technical cookies are installed. The Site uses Google Consent Mode v2: if the user denies consent, Google tags do not store analytics or advertising cookies.

Preferences can be changed at any time using the "Cookie Preferences" link in the Site footer. Your choice is saved, and the banner will not reappear for 6 months unless there are significant changes to the processing conditions.

5. Managing cookies through your browser

You can also block or delete cookies in your browser settings:

Blocking technical cookies may affect the functioning of the cart and checkout.

To manage advertising preferences on individual platforms:

6. Data transfers and data subject rights

For information about the transfer of data outside the European Union, recipients, and data subject rights, please refer to the Privacy Policy. For any requests, you can write to customerservice@milor.it.