Privacy Policy

1. Data Controller

The Data Controller for the processing of personal data is:

For any information regarding the processing of personal data, you can contact the Data Controller at the email address indicated above.

2. Types of Data Collected

In providing its services, MDB Milano collects the following categories of personal data:

2.1 Data voluntarily provided by the user

• Contact data: name, surname, email address, phone number
• Professional data: company/organization, role, industry
• Communication content: messages sent through contact forms

2.2 Automatically collected data

• Navigation data: IP address, browser type, operating system, pages visited, time spent
• Technical data: technical and session cookies necessary for website operation

2.3 Newsletter data

• Email address for sending informational and promotional communications
• Interaction data: email opens, link clicks

3. Processing Purposes

Personal data is processed for the following purposes:

3.1 Necessary purposes

• Contact request management: responding to information and quote requests
• Contract execution: providing requested services (website creation, social media management, press office, digital graphics, political communication)
• Legal compliance: fulfilling legal, regulatory, or EU law obligations

3.2 Consent-based purposes

• Newsletter: sending informational communications about news, services, and blog content
• Direct marketing: sending commercial offers and promotions about our services

3.3 Legitimate interest purposes

• Statistical analysis: improving website and service quality
• Security: fraud prevention and IT security

4. Legal Basis for Processing

Personal data processing is based on the following legal bases under Article 6 of the GDPR:

• Consent (Art. 6.1.a): for newsletter subscription and marketing communications
• Contract performance (Art. 6.1.b): for providing requested services
• Legal obligation (Art. 6.1.c): for tax, accounting, and regulatory compliance
• Legitimate interest (Art. 6.1.f): for statistical analysis and website security

5. Processing Methods

Personal data is processed using IT and/or electronic tools, with organizational and logical methods strictly related to the stated purposes.

The Data Controller adopts appropriate technical and organizational security measures to protect personal data from unauthorized access, loss, destruction, or disclosure, including:

• SSL/TLS encryption for communications
• Firewalls and perimeter protection systems
• Data access limited to authorized personnel only
• Regular data backups
• Security incident management procedures

6. Data Retention Period

Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected:

• Contact data: up to 24 months from collection, unless a contractual relationship is established
• Contractual data: 10 years from termination of the contractual relationship (tax obligations)
• Newsletter data: until consent is withdrawn by the data subject
• Navigation data: 14 months (Google Analytics)
• Technical cookies: duration of the browsing session

At the end of the retention period, data is deleted or irreversibly anonymized.

7. Data Recipients

Personal data may be communicated to:

7.1 Internal parties

• Authorized MDB Milano personnel for management and administrative activities

7.2 External parties (Data Processors)

• Hosting providers: for website technical management
• Email marketing services: for newsletter management
• Google LLC: for analytics services (Google Analytics)
• Professional consultants: accountants, lawyers for legal and tax compliance

7.3 Extra-EU transfers

Some data may be transferred to countries outside the European Union (e.g., USA for Google Analytics). In such cases, the transfer is carried out in compliance with GDPR safeguards, including Standard Contractual Clauses approved by the European Commission.

8. Your Rights

Under Articles 15-22 of the GDPR, data subjects have the right to:

• Access (Art. 15): obtain confirmation of processing and access to their data
• Rectification (Art. 16): obtain correction of inaccurate data or completion of incomplete data
• Erasure (Art. 17): obtain deletion of data ("right to be forgotten")
• Restriction (Art. 18): obtain restriction of processing
• Portability (Art. 20): receive their data in a structured, machine-readable format
• Objection (Art. 21): object to processing on legitimate grounds
• Withdraw consent: withdraw consent at any time

To exercise your rights, you can send a request to: [email protected]

9. Cookie Policy

The website uses technical cookies and, with user consent, third-party analytical cookies. For detailed information on cookie usage, please refer to our Cookie Policy.

9.1 Types of Cookies Used

• Technical cookies: necessary for website operation (no consent required)
• Analytical cookies: Google Analytics for aggregated statistics (with consent)
• Third-party cookies: potential social widgets (Facebook, Instagram, LinkedIn)

10. Changes to This Privacy Policy

The Data Controller reserves the right to modify this Privacy Policy at any time. Changes will be published on this page with an indication of the last update date.

Users are advised to periodically check this page to be informed of any changes.