Information
Privacy & cookies
Last updated: 16 October 2026
Who is responsible for your data
This notice explains the processing of personal data when you visit this website or send an enquiry through its contact form, under Article 13 of Regulation (EU) 2016/679 (GDPR).
The data controller is:
Elia MilaniVia Leonardo Bistolfi 49
20134 Milano (MI), Italy
Email: info@eliamilani.com
Professional identification details are available in the Legal notice.
What is collected and why
The contact form collects your name, email address and the message you choose to send. These details are used to read, answer and follow up on your enquiry. Please include only information relevant to your request.
For enquiries about a possible professional engagement, processing is necessary to take steps at your request before entering into a contract (Article 6(1)(b) GDPR). Other correspondence is handled on the basis of the controller's legitimate interest in answering messages addressed to the professional activity (Article 6(1)(f) GDPR), balanced against your rights and reasonable expectations.
The form requires a name, a working email address and a message. Providing information is voluntary; without these fields the form cannot send your enquiry. You can also use the email address above.
These details are not used to enrol you in a newsletter or send unrelated promotional messages. There is no profiling or solely automated decision-making that produces legal or similarly significant effects.
How messages are handled
Form submissions are sent to a professional mailbox hosted by Aruba. The website application does not maintain a database or separate archive of message contents. The correspondence is downloaded to the controller's computer using Thunderbird over an encrypted POP3S connection, without automatic forwarding to other mailboxes.
Routine access to the correspondence is limited to Elia Milani. Authorised service-provider personnel may process data where necessary to deliver and protect the hosting and email services. The controller does not make separate backups of the email archive; any provider-managed technical copies are governed by the provider's service arrangements.
How long data is kept
| Data | Retention |
|---|---|
| Enquiries without an engagement | For the time needed to answer and manage relevant follow-up, and no longer than 12 months after the last substantive exchange. Data that is no longer needed may be deleted earlier. |
| Mailbox content on the mail server | The mail client is configured to leave downloaded messages on the server for no more than 14 days. Removal is performed when the client connects. Provider-managed logs or technical copies may have different retention periods. |
| Professional engagements | If an enquiry leads to an engagement, relevant correspondence becomes part of the professional file. It may be retained beyond the enquiry period where needed for the engagement, applicable legal obligations or the establishment, exercise or defence of legal claims. Information on the professional engagement is provided separately. |
| Spam and irrelevant messages | Deleted once identified and no longer needed for security handling. |
Where a specific legal obligation or a concrete legal claim requires longer retention, only the relevant data is retained for that purpose and for the necessary period.
Technical data and security
The hosting infrastructure processes connection information, such as IP addresses, requested resources, timestamps and technical request information, to deliver the site, diagnose errors and protect the service. The controller does not use this information for advertising or visitor profiling.
The form uses an essential security session and an anti-spam rate limit. The rate-limit file contains an IP-derived pseudonymous identifier, a counter and an expiry time; it does not contain your name, email address or message. Counters are valid for ten minutes. Expired entries are removed during a subsequent form submission, so an inactive temporary file may remain until that cleanup occurs.
These security operations are based on the legitimate interest in maintaining a reliable website, preventing abuse and protecting correspondence (Article 6(1)(f) GDPR). Provider-operated connection and delivery records are retained under the applicable service terms and legal requirements. Aruba's own notice currently specifies six years for email traffic metadata; this is separate from the content-copy periods above.
Service providers and transfers
Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy, provides the hosting and professional email infrastructure. For data processed on the controller's behalf, the relevant data-processing terms apply. Aruba may separately act as a controller for its own service administration, security and legally required traffic records.
The controller operates from the professional office in Italy. No external email-forwarding or third-party contact-form service is used. Aruba's published notice describes EU storage and the safeguards applicable to any necessary transfers outside the European Economic Area, including adequacy decisions or appropriate contractual safeguards. Details and copies of applicable safeguards can be requested through the controller or the provider contacts listed in Aruba's privacy notice.
Where legally necessary, relevant data may also be disclosed to competent authorities or professional advisers assisting with legal obligations or claims. Enquiry contents are not published on the website.
Your rights
Depending on the circumstances and legal basis, you may request access to your personal data, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Erasure is subject to the exceptions provided by law, including necessary legal retention and the defence of legal claims.
To exercise your rights, contact info@eliamilani.com. Requests are normally answered within one month. If a lawful extension is necessary because of complexity or the number of requests, you will be informed within that first month.
You may also lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali, or another competent supervisory authority.