Privacy policy

GLOBAL PRIVACY AND COOKIE POLICY

This Privacy and Cookie Policy describes the purposes and methods used by LARUS MIANI S.r.l., with registered office at Via Ulderico Ollearo No. 8, 20155 – Milan, Italy, VAT No. 00776770158, acting as Data Controller (the “Company”, the “Data Controller”, or “LARUSMIANI”), for the collection and processing of the personal data of the user (“User”) interacting with the website https://larusmiani.com (the “Website”), the integrated omnichannel platforms, and the services offered by the Maison.

The information contained in this policy is provided pursuant to Article 13 of EU Regulation No. 679/2016 (the “GDPR”), Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018, the Guidelines issued by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), EU Regulation 2024/1689 on Artificial Intelligence (the “AI Act”), and other applicable global privacy frameworks (including the CCPA/CPRA for United States residents). This policy applies exclusively to the Website and the processing activities carried out by LARUSMIANI, and does not extend to processing operated by third parties through external websites that the User may access via links.

1.1. Data Controller The Data Controller is LARUS MIANI S.r.l., with registered office at Via Ulderico Ollearo No. 8, 20155 – Milan (MI), Italy. The Company does not fall under the mandatory cases requiring the appointment of a Data Protection Officer (DPO) pursuant to Article 37 of the GDPR. For any inquiry regarding the processing of personal data or the exercise of privacy rights, the User may contact the Data Controller directly at the dedicated email address: privacy@larusmiani.com.

1.2. Purposes and Legal Basis of Data Processing LARUSMIANI processes the User's personal data through the Website for the following purposes:

  • a. Contact and Customer Care (including automated support via Chat / AI): To receive, manage, and respond to requests for information regarding products, orders, activities, and initiatives of LARUSMIANI submitted via the “Contact Us” section or the instant messaging service on the Website (Shopify Inbox). The chat service utilizes artificial intelligence systems to provide preliminary rapid responses to frequently asked questions and order status inquiries; should the system be unable to fulfill the request, or at the explicit request of the User at any time, the conversation is transferred to a human agent of the LARUSMIANI customer service team.
    • Legal basis: Performance of pre-contractual or contractual measures taken at the User's request (Art. 6, par. 1, lett. b GDPR).
  • b. Account Registration and Management: To allow the User to create a personal account, view order history, and manage shipping and billing addresses.
    • Legal basis: Performance of a contract or a service expressly requested by the User (Art. 6, par. 1, lett. b GDPR).
  • c. Sale of Products and Services: To conclude, execute, and manage the purchase agreement entered into between LARUSMIANI and the User, including administrative, accounting, electronic payment processing, shipping logistics, and return management through the global e-commerce platform (Shopify).
    • Legal basis: Performance of a contract to which the User is a party (Art. 6, par. 1, lett. b GDPR).
  • d. Events and Special Initiatives: To manage accreditation or participation in events, initiatives, or prize competitions promoted by LARUSMIANI.
    • Legal basis: Performance of a service expressly requested by the User (Art. 6, par. 1, lett. b GDPR).
  • e. Legal Defense and Fraud Prevention: To exercise the Data Controller's rights of defense in judicial or extrajudicial proceedings, manage complaints, recover debts, and prevent fraudulent transactions or IT abuses on the Website.
    • Legal basis: Legitimate interest of the Data Controller (Art. 6, par. 1, lett. f GDPR).
  • f. Compliance with Legal Obligations: To comply with obligations provided for by national laws, European Union regulations, or applicable international legislation (particularly regarding tax, customs, accounting, and consumer protection regulations).
    • Legal basis: Compliance with a legal obligation to which the Data Controller is subject (Art. 6, par. 1, lett. c GDPR).
  • g. Promotional Communications and Marketing: To send newsletters, invitations to exclusive events, and communications regarding LARUSMIANI collections and creations, highlighting artisanal craftsmanship (manifattura artigianale) and, distinctly, Made in Italy origin.
    • Legal basis: Consent freely given by the User (Art. 6, par. 1, lett. a GDPR). Pursuant to Article 130, paragraph 4 of the Italian Privacy Code and Recital 47 of the GDPR, if the User has already made a purchase, LARUSMIANI may use the email address provided to send communications regarding products and services similar to those already purchased (so-called soft-spam), without prejudice to the User's right to object to such mailings at any time.
  • h. Profiling: To analyze the User's preferences, purchasing habits, and browsing behaviors in order to offer a personalized experience and send communications aligned with their interests.
    • Legal basis: Consent freely given by the User (Art. 6, par. 1, lett. a GDPR).
  • i. Statistical Analysis: To conduct aggregated statistical analyses on Website usage in order to optimize technical performance and platform usability.
    • Legal basis: User's consent for non-anonymized analytical cookies (Art. 6, par. 1, lett. a GDPR) or legitimate interest of the Data Controller for strictly aggregated and anonymized data (Art. 6, par. 1, lett. f GDPR).

1.3. Categories of Processed Data and Artificial Intelligence Transparency

1.3.1. Data Collected via Browsing, Cookies, and Tracking Technologies During browsing on the Website, technical data such as IP addresses, viewed pages, access times, browser type, and operating system are acquired. LARUSMIANI uses this information, including through analytical and measurement tools such as Google Analytics 4 (GA4), Google Tag Manager, and advertising pixels (subject to the User's prior consent), to ensure Website security, analyze traffic, and measure the effectiveness of digital campaigns. The User may manage, modify, or withdraw their preferences regarding analytical, functional, and profiling cookies at any time via the Consent Management Platform (CMP) banner available on the Website. Strictly necessary cookies are always active as they are essential for the proper functioning of the shopping cart, checkout, and browsing security.

1.3.2. Data Voluntarily Provided by the User LARUSMIANI collects identification, contact, shipping, and billing data provided by the User when creating an account, completing a purchase, subscribing to the newsletter, or requesting assistance. Data relating to payment instruments (e.g., credit card numbers) are processed directly by certified payment service providers via encrypted connections and are not stored on LARUSMIANI systems.

1.3.3. Use of Artificial Intelligence Systems (Shopify Inbox) In accordance with the transparency obligations set forth in EU Regulation 2024/1689 (AI Act), the User is informed that the chat widget available on the Website integrates automated features powered by artificial intelligence provided by the Shopify Inbox infrastructure.

  • Operating Mode: The system processes the text entered by the User in the chat to provide immediate responses regarding general information, product availability, and order status.
  • Human Intervention: The system does not make automated decisions that produce legal effects or similarly significantly affect the User pursuant to Article 22 of the GDPR. Whenever a request falls outside the scope of the automated assistant, or at any time upon the User's request, the conversation is assigned to a human agent from the LARUSMIANI team.
  • Data Protection: Users are advised not to enter special categories of personal data (e.g., health data) or confidential financial information within the chat. Conversations are processed exclusively to provide assistance to the User and improve the quality of the Maison's customer service.

1.4. Disclosure and International Data Transfers The User's personal data will not be publicly disseminated, but may be disclosed to third parties formally appointed as Data Processors (Art. 28 GDPR) or acting as independent Data Controllers, belonging to the following categories:

  • Companies belonging to the same corporate group as LARUSMIANI;
  • Global technological and e-commerce infrastructure providers (specifically Shopify Inc. and its affiliates);
  • CRM, event management, and marketing automation platforms (e.g., Salesforce, Mailchimp);
  • Banking institutions and digital payment gateways in charge of processing transactions;
  • Freight forwarders, couriers, and logistics operators responsible for product delivery and customs clearance;
  • Professional firms and legal, tax, and administrative consultants;
  • Public or judicial authorities entitled to access data by law.

Where the provision of services requires transferring personal data to countries located outside the European Economic Area (EEA), including the United States, the United Kingdom, Switzerland, or countries in the APAC region, LARUSMIANI ensures that the transfer takes place in full compliance with Chapter V of the GDPR. Specifically, such transfers are based on:

  1. Adequacy Decisions adopted by the European Commission (including the EU-U.S. Data Privacy Framework for certified U.S. entities);
  2. Standard Contractual Clauses (SCCs) approved by the European Commission, supported by appropriate supplementary technical and organizational security measures (such as encryption of data in transit and at rest).

1.5. Data Retention Period The User's personal data are retained solely for the time strictly necessary to achieve the purposes for which they were collected, in accordance with the following criteria:

  • Contractual, administrative, and billing data: Retained for 10 years from the date of purchase, in compliance with civil and tax obligations under Italian law (Article 2220 of the Italian Civil Code).
  • Registered account data: Retained until the User requests account closure or following a prolonged period of inactivity, without prejudice to statutory retention obligations regarding completed orders.
  • Support requests and chat history (Shopify Inbox): Retained for the time necessary to fully handle the request and for a subsequent period not exceeding 24 months for contractual protection and continuity of customer care.
  • Marketing purposes (Newsletters and promotional communications): Data are processed until the User withdraws consent or exercises the right to object (opt-out), which can be done at any time via the unsubscribe link at the bottom of each communication or by contacting the Data Controller.
  • Profiling purposes: Data relating to purchase details and preferences used for profiling purposes are retained for a period not exceeding 24 months from their recording, in compliance with the provisions of the Italian Data Protection Authority.

1.6. User Rights (GDPR) Pursuant to Articles 15–22 of the GDPR, the User may exercise the following rights at any time:

  • Right of access: To obtain confirmation as to whether or not personal data concerning them are being processed and to receive a copy thereof.
  • Right to rectification: To obtain the correction or supplementation of inaccurate or incomplete personal data.
  • Right to erasure (right to be forgotten): To obtain the deletion of personal data in the cases provided for by Article 17 of the GDPR.
  • Right to restriction of processing: To obtain the restriction of processing in the cases envisaged by Article 18 of the GDPR.
  • Right to data portability: To receive the personal data provided in a structured, commonly used, and machine-readable format, and to transmit them to another controller.
  • Right to object and withdraw consent: To object at any time to the processing of data based on legitimate interest or for direct marketing purposes, as well as to withdraw previously given consent without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, the User may send a request to the email address: privacy@larusmiani.com. The User also has the right to lodge a complaint with the competent Supervisory Authority (for Italy, the Garante per la Protezione dei Dati Personali: www.garanteprivacy.it).

1.7. Specific Rights for United States Residents (CCPA/CPRA and U.S. State Laws) Users residing in California or other U.S. states with applicable data protection laws are granted the following additional rights:

  • Right to Know and Access: To request information about the categories and specific pieces of personal data collected over the past 12 months, the sources of collection, the business purposes, and the categories of third parties with whom the data have been shared.
  • Right to Delete and Correct: To request the deletion or correction of collected personal information, subject to statutory exceptions (e.g., completing a transaction or complying with legal obligations).
  • Right to Opt-Out of Sale or Sharing ("Do Not Sell or Share My Personal Information"): LARUSMIANI does not sell personal data in exchange for monetary consideration. However, the use of third-party advertising cookies and tracking tools for targeted promotional communications (cross-context behavioral advertising) may constitute a “sale” or “sharing” under the CCPA/CPRA. The User may exercise the right to opt-out at any time via the cookie preference management panel on the Website, the dedicated link in the footer, or by enabling the Global Privacy Control (GPC) signal on their browser.
  • Right to Non-Discrimination: The User will not be discriminated against in terms of service level or pricing for exercising their privacy rights.

1.8. Provisions for Residents of the United Kingdom, Switzerland, and the APAC Region For Users accessing the Website from the United Kingdom, Switzerland, or countries in the Asia-Pacific (APAC) region, LARUSMIANI processes personal data in accordance with applicable national regulations (including the UK GDPR, the Swiss Federal Act on Data Protection - FADP, and local APAC data protection laws), ensuring the adoption of required consent mechanisms, security and data breach notification protocols, and compliance with rules governing cross-border data transfers.

Last updated: October 29, 2026