PRIVACY POLICY

Maison Avaro Figlio Milano respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your personal data when you visit www.avarofiglio.com, place an order, or otherwise interact with us. This Policy is issued in accordance with Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree No. 196/2003 as amended.

1. Data Controller

The Data Controller responsible for your personal data is:

Avaro Figlio S.R.L.

Via Pietrasanta 12, 20141 Milano, Italy

VAT: 13276150961

Email: info@avarofiglio.com

2. Personal Data We Collect

We collect the following categories of personal data:

Data you provide directly to us

•       Identity and contact data: full name, email address, telephone number, delivery and billing address, country of residence.

•       Order and payment data: products ordered, order history, payment method, billing details. We do not store full card numbers; payments are processed by our payment providers.

•       Made-to-order data: body measurements, fit preferences, fabric and colour selections, and other customisation details necessary to produce your garment.

•       Communications: messages exchanged via email, WhatsApp, contact form, or social media channels.

•       Marketing preferences: your consent to receive newsletters and promotional communications.

Data collected automatically

•       Technical data: IP address, browser type, device identifiers, operating system, referral source, pages viewed, time spent on pages.

•       Cookies and similar technologies: see our Cookie Policy below.

3. Purposes and Legal Bases of Processing

We process your personal data for the following purposes:

•       To perform the contract with you — process and fulfil orders, manage made-to-order production, handle delivery, process payments, and provide customer service. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

•       To comply with legal obligations — including tax, accounting, consumer protection, and anti-money laundering obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

•       To send marketing communications — newsletters, new collection announcements, and promotional content. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

•       To improve our website and services — analytics, service improvement, fraud prevention, and security. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR) in running and improving our business.

4. Recipients of Your Personal Data

We share your personal data only with parties who need it to provide services to us, and only under appropriate contractual safeguards. These include:

•       E-commerce platform: Shopify International Limited (Ireland).

•       Payment processors: e.g. Shopify Payments, Stripe, PayPal.

•       Shipping carriers: e.g. DHL, FedEx, UPS, and local couriers, for the purpose of delivering your order.

•       Email marketing platform: e.g. Klaviyo (subject to appropriate safeguards for international transfers).

•       IT, analytics, and hosting providers supporting the operation of our website.

•       Professional advisers (accountants, lawyers, auditors) where legally required.

•       Competent authorities where required by law.

We do not sell your personal data to third parties.

5. International Data Transfers

Some of our service providers (for example Shopify and Klaviyo) may process data outside the European Economic Area. Where this occurs, we ensure that appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses or, where applicable, adequacy decisions.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected:

•       Order and contract data: for the duration of the commercial relationship and for 10 years thereafter, in line with Italian tax and civil law obligations.

•       Marketing data: until you withdraw your consent or unsubscribe.

•       Website analytics data: as set out in our Cookie Policy.

7. Your Rights

Under the GDPR, you have the right to:

•       Access your personal data and obtain a copy of it.

•       Rectify inaccurate or incomplete data.

•       Erase your personal data (“right to be forgotten”) where applicable.

•       Restrict or object to the processing of your data.

•       Receive your data in a portable format.

•       Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

•       Lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it) or your local supervisory authority.

To exercise any of these rights, please contact us at info@avarofiglio.com. We will respond within one month of receiving your request.

8. Cookies

Our website uses cookies and similar technologies to provide essential site functionality, remember your preferences, analyse site traffic, and — with your consent — personalise content and measure marketing performance.

You can manage your cookie preferences at any time through the cookie banner on our website or through your browser settings. For more information, please see our separate Cookie Policy.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. However, no transmission of data over the internet can be guaranteed to be completely secure.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Last updated” date and will be effective as soon as it is posted on the website. We encourage you to review this Policy periodically.

11. Contact

For any question regarding this Privacy Policy or how we handle your personal data, please contact us at info@avarofiglio.com.