Privacy Policy

Last updated: 15 May 2026

Introduction

MM Studio S.r.l. (hereinafter also «MM» or «the Controller») through this privacy policy intends to inform you about how your personal data will be processed in relation to the website https://www.mm.studio (hereinafter the «Website»), in line with European Regulation no. 679/2016 («GDPR»).

This Privacy Policy does not apply to other websites, pages or online services reachable through hyperlinks possibly published on the Website but referring to resources external to the MM domain.

Users are invited to read this Privacy Policy regularly as it may change over time, also as a result of legislative and regulatory amendments concerning the protection of personal data, internal company decisions or the addition of services delivered through the Website.

Data Controller

MM Studio S.r.l., with registered office in Milan (MI), Via Bartolomeo Eustachi 7, Italian tax code and VAT number 11601460964, is the data controller. For any request relating to the processing of personal data, you may write to privacy@mm.studio.

Purpose of the processing

The processing aims at the correct and complete management of any communication or request sent to MM using the contact details available on the Website or through the contact form on the Website (for example, requests for information, assistance or an appointment).

Cookies and tracking tools

The Website uses cookies and other tracking tools to ensure the proper functioning of its pages, to improve the browsing experience and, where applicable, to analyse traffic and deliver personalised content. For more information about the types of cookies used and how to manage your preferences, please refer to the Cookie Policy.

Processing methods

Personal data are processed by the Controller using both paper-based and electronic/telematic tools and are stored within MM’s information system. Appropriate security measures are observed to prevent the loss or alteration of data — including accidental — unlawful or incorrect uses and unauthorised access.

Legal basis of the processing

The legal basis of the processing is the performance of pre-contractual or contractual obligations of MM. In the event of disputes, the legal basis is MM’s legitimate interest in adequately defending its rights and interests.

Mandatory or optional provision of data

The forms to be filled in include both data that are strictly necessary — whose omission prevents the request from being processed — and data that may be provided optionally. Strictly necessary data are usually marked with an asterisk. Where the provision of data is mandatory, their absence may make it impossible to obtain what is requested.

Data retention period

Data will be retained in our archives for the prescription periods applicable under the law, without prejudice to any longer retention periods justified by pending litigation.

Place of data processing

Processing related to the Website takes place at MM’s premises and is handled by personnel authorised to process data. Where necessary, personal data collected through the Website may be processed by the personnel of third-party companies that maintain the technical infrastructure of the Website (specifically appointed as data processors pursuant to Article 28 GDPR) at their own premises.

Transfer of personal data abroad

Although personal data is normally processed on servers owned by the Controller and/or by third-party companies duly appointed as processors and located within the European Union, if necessary MM may transfer data to non-EU countries. In such cases, the Controller hereby ensures that the transfer of data will take place in compliance with applicable legal provisions, for example by adopting the standard contractual clauses approved by the European Commission (Article 46 GDPR).

Recipients of the data

Data processors and authorised persons

Personal data may be processed directly by MM or by third parties carrying out processing operations on behalf of MM. The complete and updated list of data processors (and, where applicable, of sub-processors appointed by the initial processor with MM’s prior authorisation) may be requested at privacy@mm.studio. Personal data collected will also be made available to persons authorised by MM under Article 29 GDPR to deliver the specific services to which the Website is dedicated.

Independent third-party controllers

The data of data subjects may be disclosed to third parties in compliance with applicable law and for the purposes specified above. The list of such third parties may be requested from MM using the contact details provided in this policy.

Rights of data subjects and how to exercise them

In the cases provided for by Articles 15 et seq. of the GDPR, data subjects have the right to ask MM for access to their personal data, the rectification or erasure of such data, the restriction of their processing, and the right to data portability. They also have the right to object at any time to the processing of data based on MM’s legitimate interest and the right not to be subject to automated decision-making. Data subjects also have the right to withdraw any consent previously granted.

To exercise the rights listed above, data subjects can write to the following MM email address: privacy@mm.studio.

Finally, we point out that, where the conditions are met, data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) as the supervisory authority, in accordance with the procedures provided for.

Changes to this Privacy Policy

MM reserves the right to make changes to this Privacy Policy at any time, informing users on this page. The date shown at the top indicates the latest revision.