Privacy & Cookie Policy

1. Data controller

The Data Controller is Serena Terzoni, located at Via Giosuè Carducci 22B, 20068, Peschiera Borromeo, Milan, Italy.

For any privacy-related request, you can write to: terserena0{'@'}gmail.com.

2. Types of data collected

Through the site we may collect the following categories of data:

• identification and contact data, such as name, surname, email and phone number;
• information entered in request forms, such as dress preferences, size, measurements, notes and ceremony details;
• images or files voluntarily uploaded by the user as inspiration for creating the dress;
• technical browsing data, such as IP address, device information, browser used and data necessary for the correct functioning of the site;
• any data contained in messages sent through WhatsApp, email or other contact channels.

We recommend not sending unnecessary data, particularly sensitive data or information not relevant to the tailoring request.

4. Purposes of processing

Personal data is processed for the following purposes:

• replying to information requests sent through the site;
• managing requests related to Compose her dress, custom dresses or ready-to-ship products;
• preparing quotes, personalized proposals or communications related to the request;
• managing appointments, phone contacts, emails or WhatsApp conversations;
• fulfilling administrative, accounting, tax or legal obligations;
• keeping the website secure and functional;
• analyzing interactions, clicks and scrolling through aggregate statistics, heatmaps and masked session recordings, only after analytics consent;
• measuring and optimizing advertising campaigns on Facebook and Instagram, only after marketing consent.

5. Legal basis for processing

Data processing is based on:

• performance of pre-contractual or contractual measures, when the user requests information, quotes or tailoring services;
• user consent, where necessary, for example for the voluntary sending of images or for any non-technical cookies;
• analytics consent, which can be withdrawn at any time, for Google Analytics and Microsoft Clarity;
• marketing consent, which can be withdrawn at any time, for Meta Pixel, Meta Conversions API, advertising attribution and custom audience creation;
• legal obligation, for tax, accounting or administrative requirements;
• legitimate interest, to ensure site security, prevent abuse and manage any disputes.

6. Processing methods

Data is processed with IT, telematic and, if necessary, paper tools, adopting appropriate technical and organizational measures to protect it from unauthorized access, loss, alteration or improper disclosure.

Access to data is limited to authorized persons and technical providers necessary for the operation of the site and management of requests.

7. Data retention

Data is kept for the time necessary to manage the request and, afterwards, for the period required by legal obligations or to protect any rights of the Controller.

• contact and quote requests: up to 12 months from the conclusion of the request;
• images uploaded by the user: up to 12 months, unless early deletion is requested or processing needs require otherwise;
• administrative and tax data: according to the terms provided by applicable legislation;
• technical logs and security data: for the time strictly necessary for site security and maintenance.

The indicated periods must be confirmed according to the atelier’s actual organization and tools used.

8. Disclosure of data to third parties

Personal data is not sold or transferred to third parties for commercial purposes. It may be disclosed, within necessary limits, to:

• technical providers for website, hosting, database, storage and maintenance;
• communication services, such as email, phone or WhatsApp;
• Microsoft Ireland Operations Limited, exclusively after analytics consent, for Microsoft Clarity, heatmaps and masked session recordings;
• Meta Platforms Ireland Limited, exclusively after marketing consent, to measure and optimize Facebook and Instagram campaigns;
• tax, administrative or legal consultants, where necessary;
• public authorities, in cases provided by law.

9. Transfer of data outside the European Economic Area

Some technical services used by the site or communication channels may involve processing data by providers located outside the European Economic Area.

In such cases, where applicable, the transfer takes place on the basis of safeguards provided by the GDPR, such as adequacy decisions, standard contractual clauses or other suitable measures.

10. Data subject rights

The user may exercise the rights provided by Articles 15 and following of the GDPR, including:

• access to personal data;
• rectification of inaccurate data;
• erasure of data, where applicable;
• restriction of processing;
• objection to processing;
• data portability, where applicable;
• withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.

Requests can be sent to: terserena0{'@'}gmail.com. The user also has the right to lodge a complaint with the Italian Data Protection Authority.

11. Cookie Policy

The site may use cookies and similar technologies to ensure pages work correctly, improve the browsing experience and, only where provided and with prior consent, use third-party services.

Technical cookies

Technical cookies are necessary for the site to work and do not require user consent. They may include session cookies, security, technical preferences or tools essential to navigation.

Analytics cookies

Only after analytics consent, the site may use Google Analytics and Microsoft Clarity. Clarity captures technical information and interactions such as clicks, pointer movements and scrolling to produce aggregate statistics, heatmaps and session replays. Forms containing personal data and private areas are excluded or masked. Clarity may use cookies such as _clck and _clsk to connect pages and sessions; consent can be withdrawn at any time.

Marketing cookies, Meta Pixel and Conversions API

Only after marketing consent, the site may activate Meta Pixel and send events to Meta through Conversions API to attribute requests to campaigns, measure results, create custom audiences and optimize ads. Events may include the page visited, interactions with the configurator, opening a contact channel and successfully submitting a quote. For leads, a SHA-256 hash of the adult’s phone number may be sent to Meta, together with advertising identifiers, IP address and browser information needed to match the event. Images, names, measurements or other information relating to children are not sent to Meta.

Third-party cookies and embedded content

The site may include links or third-party content, such as maps, Google services, social networks or WhatsApp links. These services may process data according to their own privacy notices. Where technically possible, non-essential external content is loaded only after a user action or after consent, where required.

Managing preferences

The user may manage or withdraw consent to non-technical cookies through the cookie banner, the site preference panel when available, or by changing browser settings.

12. External services potentially used

Depending on the site’s actual configuration, the following services may be used:

• Hosting and database: to publish the site and save received requests;
• Image storage: to temporarily store images uploaded by the user;
• Google Maps / Google Places: to show location, directions and business reviews;
• WhatsApp: to allow the user to send requests by message;
• Email provider: to receive and manage communications sent by users.
• Google Tag Manager and Google Analytics: for tag management and visit analytics, according to the preferences expressed;
• Microsoft Clarity: for behavioral statistics, heatmaps and masked session recordings, only after analytics consent;
• Meta Platforms Ireland Limited: Meta Pixel and Conversions API for attribution, measurement, custom audiences and optimization of Facebook and Instagram campaigns, only after marketing consent.

13. Changes to this notice

This Privacy & Cookie Policy may be updated over time, including as a result of regulatory, technical or organizational changes. The updated version will be published on this page.