Privacy notice

This notice explains which personal data we process when you visit milanostand.com or use the Milano Stand app, why we process them, how long we keep them and what your rights are, as required by Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003).

Who the controller is

The data controller is Mazzetti Martin S.r.l., registered office at Via Giuseppe Di Vittorio 7 int. 23, 20017 Rho (MI), tax code and VAT number 03133760128. For any question about your data, or to exercise your rights, write to privacy@milanostand.com.

What data we process

• Browsing data. The servers hosting the site automatically record some technical data about each request: the IP address, the date and time, the page requested, the browser and the operating system.
• Data you send us. If you write to us, for example from the finder on the Home page, we process your email address and what you tell us in your message. The site has no forms and the finder sends nothing: it prepares the message, which leaves your own email program only if you send it.
• Account data. If a client or supplier organisation invites you to the app, we process your email address and, if you sign in with Google, the name and photo of your Google account; your sign-in credentials (the password is kept only by the authentication service, in encrypted form); your second factor, if you turn it on; your role and organisation; and the records of your sign-ins and of the operations you carry out, which show your identifier and not your email address.
• Security data. Only on the sign-in pages, a Google service, reCAPTCHA Enterprise, assesses whether a request comes from a person or from an automated program, using technical signals from the browser and the device.

Business contacts collected from public sources

This part is in preparation. We will apply it when the collection starts, and we will update this page. Below you will find how it will work.

Milano Stand designs and builds stands for companies exhibiting at trade shows. To offer our work, we collect information about exhibiting companies from public sources. Here you will find what we collect, where from, for how long, and how to tell us no.

Exhibiting companies

From the exhibitor catalogues published by show organisers we collect only company data:

• company name, registered office, website;
• sector and brands;
• the show, the edition, the hall and the stand.

Of email addresses we keep only the company’s generic mailboxes, on its own domain, such as info@ or sales@. We do not take people’s names, personal email addresses or mobile numbers: if a catalogue contains them, we discard them before saving anything.

We use only the catalogues on a closed list. For each one we have checked that the organiser allows its reuse.

If the exhibitor is a sole trader, the business name is a person’s name. We then treat that data as personal data: we save neither a mailbox nor a phone number, and we do no further research on that person.

The purpose is to offer companies our services for their shows. The legal basis is our legitimate interest in making ourselves known to exhibitors (Art. 6(1)(f) GDPR).

People found on the public web

For some companies we will look for the person in charge of trade shows or marketing. The sources are the company’s website and public professional profiles found through a web search. We may save:

• name, role and department;
• work email and phone number;
• the address of the public profile and of the page where we found them.

We do not use automated programs on LinkedIn, Instagram or Facebook: of a profile we save only its address.

To search public information we also use automated tools, including an artificial intelligence service from a provider acting on our behalf as a processor: we will name it here before this part becomes active. What it finds remains a hypothesis until a person in our office checks it. We do not make automated decisions about you.

These data are encrypted. Only authorised people in our company can read them, and every reading is logged. They are deleted automatically 30 days after collection, unless in the meantime you give us your consent to stay in touch.

The purpose is to offer you, as your company’s contact person, our services for trade shows. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

How we inform you

If you did not give us your data yourself, the law requires us to tell you (Art. 14 GDPR):

• if we write to you, already in the first message: who we are, where we found your contact and how to object, with a link to this page;
• in any case within one month of collection.

On request we tell you the exact source of your data.

Promotional emails

We send newsletters and campaigns only to those who have given us their consent, from the it@, en@ and es@milanostand.com mailboxes. Every email contains a link to unsubscribe.

Your right to object and the exclusion list

You can object at any time, free of charge and without giving reasons: reply to one of our messages, or write to privacy@milanostand.com. The same applies to a company that does not want to be contacted.

From that moment we no longer write to you, and we delete your contact details. So as not to collect them again at the next show, we keep only a fingerprint on our exclusion list, with the reason and the date. The fingerprint is a code calculated from your email, phone number, profile or company domain, and the data cannot be recovered from it. It serves only to recognise you if you reappear in a new collection, and to leave you out.

Where these data are

Companies, people and the exclusion list are kept in our database, on Google Cloud in Europe (the Netherlands). People’s data are encrypted with keys that stay in the same region. The emails we exchange pass through our email service in Canada, a country the European Commission recognises as adequate.

Why we process them, and on what basis

• To run and protect the site, with browsing and security data: our legitimate interest in offering a secure service (Art. 6(1)(f) GDPR).
• To answer your messages and prepare a quote: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• To give you access to the app and run it for the organisation that invited you: performance of the contract with that organisation and our legitimate interest in managing access securely (Art. 6(1)(b) and (f) GDPR).
• To meet legal obligations, such as tax and accounting duties, once a business relationship begins (Art. 6(1)(c) GDPR).
• To defend our rights in the event of a dispute: our legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for profiling or advertising, and we do not make decisions based solely on automated processing.

Do you have to give us your data?

No. But without your email address we cannot answer you, and without account data you cannot use the app. Browsing and security data are needed to use the site.

Who receives the data

The data are processed by authorised staff of Mazzetti Martin S.r.l. and, on our behalf, by suppliers acting as processors (Art. 28 GDPR), under a contract that obliges them to protect the data:

• Google (Google Cloud and Firebase), which hosts the site, the app, the database, authentication and logs, and provides reCAPTCHA Enterprise;
• the email provider of the milanostand.com domain, OpenSRS Hosted Email by Tucows, for service emails such as invitations and for the mailboxes you write to;
• advisers and professionals, such as our accountant, when needed for legal obligations.

In the app, your account data are visible to the people of your organisation, according to the roles it assigns. We do not sell or disclose your data.

Where the data are

The site, the app, the database and the logs run on Google Cloud in the European Union, in the Netherlands. Some data leave the European Union:

• accounts: Google’s Firebase Authentication keeps in the United States the email address and, for those who sign in with Google, the name and photo;
• reCAPTCHA Enterprise, on the sign-in pages, processes browser signals on Google servers, also outside the European Union;
• email, invitations and the messages to our mailboxes, is kept by our provider in Canada.

For the United States the transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework and on Google Cloud’s data processing terms, with the standard contractual clauses; for Canada, on the European Commission’s adequacy decision (Articles 45 and 46 GDPR).

How long we keep them

• Browsing and security data: 30 days, unless they are needed to establish an abuse.
• Messages and quote requests: as long as needed to answer you and, if no relationship follows, no more than 24 months.
• Account data: as long as the account is active; when the organisation closes it, we delete them within 12 months, except those the law requires us to keep.
• Invitations not accepted: we delete them 30 days after they expire.
• Accounting and tax records: 10 years, as required by law (Article 2220 of the Italian Civil Code).

Cookies and browser storage

On the site we use only technical tools; on the sign-in pages also Google’s reCAPTCHA Enterprise, a third-party security tool. We do not use profiling cookies or analytics tools.

• NEXT_LOCALE, on the site and in the reserved area: it remembers the language, to take you to the right one when you return to the Home page. It lasts until you close the browser. On the site’s pages it is the only cookie, together with the theme one if you chose a theme.
• __session, in the reserved area, after you sign in: it tells the server who is signed in. It lasts from one hour to 14 days, depending on the type of account, and is deleted when you sign out.
• theme, only if you choose light or dark in the account section of the reserved area: it remembers the theme you chose, and pages, the site’s included, open that way. It lasts one year. It is not used to recognise or track you.
• Browser storage, in the reserved area: an invitation code, for up to 7 days, until you accept it; and what the authentication service and App Check keep to keep you signed in and to protect access, for periods managed by the service.
• reCAPTCHA Enterprise, only on the sign-in pages: Google may use its own cookies or browser storage to recognise automated programs.

Your rights

At any time you can ask us to access your data, to correct or delete them, to restrict their processing and to receive them in a machine-readable format, and you can object to processing based on legitimate interest (Articles 15–22 GDPR). You can withdraw your consent at any time, without affecting what was done before (Art. 7(3) GDPR). Write to privacy@milanostand.com: we will answer within one month.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

Minors

The site and the app are meant for businesses and professionals, not for anyone under 16.

Changes to this notice

If we change the way we process data, we will update this page and the date at the top. If the changes are significant, we will also say so in the app.