Privacy policy
Data controller: Milano Leather Group S.r.l.
Registered office: Via Spezia 20, 20142 Milano (MI), Italy
VAT / Tax code: IT12437860963
Email: info@milanoleathergroup.com
Phone: +39 02 8157 7288
WhatsApp: +39 339 995 8500
Last updated: 2 September 2026
1. What this notice covers
Milano Leather Group S.r.l. ("we", "the Controller") is the controller of the personal data collected through all the group's properties:
- milanostraps.it — online watch strap store (Milano Straps brand)
- casatimilano.com — bespoke atelier and leather goods (Casati Milano brand)
- milanoleathergroup.com — the group's corporate website
- watchbands.ai — watch/strap compatibility database
- the group's WhatsApp channel and the digital assistant that operates it
- the Milan atelier, for in-person appointments
This notice applies to all of these channels. Where a channel processes specific categories of data, we say so in the dedicated section.
2. What data we process and where it comes from
Data you provide to us
- Identification and contact data: first name, last name, email, phone number, shipping and billing address.
- Order data: products purchased, returns, exchanges, preferences, purchase history.
- Content of conversations: messages exchanged on WhatsApp, in chat or by email, including the photographs of your watch or your wrist that you send us to assess sizing or craftsmanship.
- Data collected in the atelier: wrist measurement, leather and finishing preferences, watch references, notes relating to the commission.
- Payment data: handled directly by payment service providers; we do not store full card numbers.
Data collected automatically
- Technical browsing data: IP address, browser and device type, pages visited, referral source, cookie identifiers.
- On watchbands.ai: the images you upload for model recognition and the parameters you enter in the calculator. The images you upload are processed exclusively to return your search result and are not retained once processing is complete. They are not used to identify people and do not constitute processing of biometric data.
Data from third parties
- From the platforms that host our channels (Shopify, Meta/WhatsApp) and from logistics and payment partners, limited to what is needed to fulfil the order.
We do not knowingly process children's data. Our services are not intended for anyone under 16.
3. Why we process it and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Fulfilling your order: production, shipping, returns and warranty | Contract — Art. 6(1)(b) |
| Answering enquiries and quotes on WhatsApp, chat, email or in the atelier, including before an order | Pre-contractual measures — Art. 6(1)(b) |
| Making a bespoke piece, including wrist measurements and preferences | Contract — Art. 6(1)(b) |
| Invoicing, accounting, tax obligations | Legal obligation — Art. 6(1)(c) |
| System security, fraud prevention, defence of legal claims | Legitimate interest — Art. 6(1)(f) |
| Usage statistics and service improvement | Consent (non-technical cookies) — Art. 6(1)(a), or legitimate interest for aggregate measurements |
| Newsletter and promotional communications | Consent — Art. 6(1)(a), revocable at any time |
| Emails about products similar to those you already purchased | Legitimate interest / soft spam — Art. 130(4) of the Italian Privacy Code, with the right to object always available |
| Operating the digital assistant | Contract and pre-contractual measures — Art. 6(1)(b) |
Providing the data needed for an order is mandatory: without it, we cannot perform the contract. Everything else is optional.
4. AI-based digital assistant
First contact on WhatsApp and in the chat on our websites is handled by an automated assistant based on artificial intelligence, which identifies itself as such at the start of every conversation, as required by Art. 50 of Regulation (EU) 2024/1689 (the "AI Act").
At any time you can ask to speak to a person by writing "I want an operator", or by writing directly to the WhatsApp number +39 339 995 8500.
How it works, in practice:
- The text of your messages, and the images you send, are transmitted to the language model provider listed in section 5 so that the assistant can compose its reply.
- Conversations are retained in our systems to give you continuity of assistance, manage the commission and keep evidence of the agreements made. Retention periods are in section 7.
- The assistant does not make solely automated decisions that produce legal effects or similarly significantly affect you (Art. 22 GDPR). Prices, acceptance of a bespoke commission and appraisals always remain with a person.
- The assistant provides information drawn from our knowledge base. It does not express appraisals, estimates or opinions on watches: those rest exclusively with the owner.
- If you do not want the conversation to be processed by the assistant, you can ask for an operator from your very first message.
5. Who we share the data with
The data are processed by the Controller's authorised and instructed staff, and shared with the following parties, appointed as processors under Art. 28 GDPR:
| Provider | Role | Location |
|---|---|---|
| Shopify Inc. | e-commerce platform, checkout, order management | Canada / USA |
| Meta Platforms Ireland Ltd. | WhatsApp Business Platform, messaging | Ireland / USA |
| Anthropic PBC | language model that processes the text of the assistant's conversations | USA |
| Supabase Inc. | application database, storage of conversations and logs | USA |
| Vercel Inc. | hosting of the group's applications and websites | USA |
| Algolia SAS | search engine and catalogue | France / USA |
| Resend | transactional and system email delivery | USA |
| Twilio Inc. | SMS and service notification delivery | USA |
| Google Ireland Ltd. | usage statistics (Google Analytics 4) | Ireland / USA |
| Couriers and shipping companies | order delivery | EU / non-EU |
| Payment service providers | payment collection and anti-fraud | EU / non-EU |
| Tax, legal and accounting advisors | legal compliance | Italy |
The data may also be disclosed to public authorities where required by law. We do not sell your data and we do not disseminate it.
6. Transfers outside the European Union
Some of the providers listed are based in or have infrastructure in the United States. In those cases the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Implementing Decision EU 2021/914), supplemented where necessary by additional measures, or on the basis of an adequacy decision applicable to the provider. You can request a copy of the safeguards adopted by writing to info@milanoleathergroup.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Order and invoicing data | 10 years from the accounting entry (legal obligation) |
| Customer account | until deletion is requested by the user, or after 36 months of inactivity |
| WhatsApp and chat conversations | 24 months from the last message |
| Measurements and specifications of a bespoke commission | 10 years, to allow reorders and servicing of the piece |
| Images uploaded to watchbands.ai | not retained: processed solely to return your result and deleted once processing is complete |
| Newsletter data | until consent is withdrawn |
| Technical and security logs | 12 months |
| Browsing statistics | according to the cookie lifetimes stated in the cookie policy |
Once these periods expire, the data are deleted or irreversibly anonymised.
8. Your rights
You can exercise at any time the rights provided by Arts. 15-22 GDPR: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, withdrawal of consent (without affecting the lawfulness of processing already carried out).
Write to info@milanoleathergroup.com or to Milano Leather Group S.r.l., registered office at Via Spezia 20, 20142 Milan (MI), not open to the public (the atelier is at Via XX Settembre 15, Milan, by appointment only), Italy. We reply within one month, extendable by two months in complex cases, in which case we will let you know.
You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority), Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it — or with the supervisory authority of the country where you live.
9. Cookies
The group's websites use technical cookies, which are necessary for operation, and — subject to your consent collected through a banner — statistics and marketing cookies. You can change your choices at any time from the preferences panel. The details of individual cookies, their purposes and lifetimes are available in the website's cookie preferences panel.
10. Changes
We may update this notice to reflect changes in our services, our providers or the law. The updated version is published on this page with a new "last updated" date; if the changes are substantial, we will notify you through the channels you use with us.
Annex — milanostraps.it (Milano Straps)
Direct-to-consumer sales. We process order, shipping, payment, customer account and review data and, where consent is given, newsletter data. The platform is Shopify; for the processing that Shopify carries out as an independent controller for its own purposes, please refer to its privacy notice. Assistance and first contact may take place through the digital assistant described in section 4.
In the event of any discrepancy between language versions, the Italian version shall prevail.