Skip to content
Gate Milano

Privacy Policy

Last updated: 30 August 2026

1. Data Controller

The data controller is Gate Milano, located at Via Valtellina 21, 20159 Milan, Italy. For any privacy-related requests, please contact us at info@gatemilano.it.

2. Data We Collect

  • Browsing data: IP address, browser type, operating system, pages visited, and session duration, collected through the analytics tools listed in the Cookie Policy when you accept Analytics.
  • Contact data: name and email address, voluntarily provided via the newsletter subscription form.
  • Behavioural data: interactions with the website (clicks, scrolling, navigation paths) collected via Microsoft Clarity when you accept Analytics.

3. Purpose of Processing

  • Statistical analysis of traffic and website improvement (Google Analytics 4, Microsoft Clarity, Vercel Web Analytics, and Speed Insights)
  • Sending promotional communications about events and news (newsletter, only with explicit consent)
  • Handling contact requests

4. Legal Basis

  • Consent (Art. 6(1)(a) GDPR): for the newsletter and non-essential tools in the Analytics and Marketing categories.
  • Legitimate interest (Art. 6(1)(f) GDPR): for anonymised traffic analysis.

5. Data Sharing

Your data is never sold to third parties. It may be shared with the following service providers:

  • Google LLC — Google Analytics 4 and Search Console (USA; transfers are subject to the safeguards described below)
  • Microsoft Corporation — Microsoft Clarity (USA; transfers are subject to the safeguards described below)
  • Vercel Inc. — hosting, Web Analytics, and Speed Insights (USA; transfers are subject to the safeguards described below)

6. Data Retention

Browsing data is retained for a maximum of 26 months (Google Analytics default setting). Newsletter data is retained until consent is withdrawn, subject to legal obligations. The specific limits for the pseudonymized Meta matching proof and operational runs are stated in section 9.

7. Your Rights

Under the GDPR, you have the right to access, rectify, and delete your data, object to processing, request data portability, and withdraw consent at any time. To exercise these rights, write to info@gatemilano.it.

8. Cookies

For detailed information on the cookies used by this website, please read our Cookie Policy.

9. Newsletter matching and Meta Customer Audience

If you voluntarily provide your email for the newsletter and accept the Marketing category, we normalize the address and convert it to lowercase; we then calculate SHA-256 locally before using the hashed, pseudonymized data for matching in a Meta Customer List Custom Audience.

Meta Platforms Ireland Limited receives the hashed data and provides matching with Meta accounts for people covered by the GDPR.

Matching is used to measure the effectiveness of and personalize Gate Milano campaigns on Meta. The legal basis is your consent under Art. 6(1)(a) GDPR.

Newsletter signup and delivery remain available even if you reject Marketing; in that case, we do not use the email for this Customer Audience.

You can withdraw Marketing consent at any time. Withdrawing it is as easy as giving it: open Cookie Preferences in the footer. You can also use the unsubscribe link in every newsletter or write to info@gatemilano.it through the privacy contact channel; withdrawal does not affect the lawfulness of earlier processing.

When you join with Marketing active, a first-party encrypted HttpOnly cookie remains for no more than 12 months solely to link withdrawal from the browser to the newsletter contact and request removal from matching. It contains no Meta access secrets, cannot be read by scripts, and is not used to track you.

We retain pseudonymized proof of consent while the consent remains active. After withdrawal, the pseudonymized proof is retained for up to 24 months and then deleted, provided no Customer Audience membership remains. Aggregate data from operational runs is retained for 12 months. The SHA-256 hash is pseudonymized, not anonymous.

For transfers of data outside the European Economic Area, Gate Milano and the applicable providers rely, as appropriate, on adequacy decisions or the European Commission's Standard Contractual Clauses and supplementary measures.

You have the rights, where applicable, to access, rectification, erasure, restriction, portability and to object, as well as to withdraw consent and lodge a complaint with the relevant data protection authority. You can exercise them by writing to info@gatemilano.it.

Table bookings

When you book a VIP table on this site we ask for your name and email address, and nothing else: no phone number, no date of birth. We use them for one purpose only: to confirm the booking, send you the confirmation email and let our staff manage the night; until they are deleted they stay in the systems we use to run the booking. When your payment is confirmed we post the name on the booking (the name only, never your email) to our staff channel on Discord (Discord Inc., USA), so the team knows who is coming. They are never used for marketing, never combined with the anonymous site statistics described below, and never sold or shared with anyone else. The payment itself is handled by Revolut Merchant: your card details never reach us and we never store them. We delete name and email 90 days after the date of the event. A booking that is started but never paid is released within minutes and its data is deleted with the release. The legal basis is the performance of the contract you are entering into (art. 6.1.b GDPR). To ask what we hold about you, or to have it deleted sooner, write to info@gatemilano.it.

Anonymous site statistics

We collect aggregate statistics about how the site is used (pages viewed, links clicked, traffic source, device type, country and language) with our own system, hosted on our servers. For the duration of the tab session, the browser's sessionStorage retains the validated first and last touch with the site: source, medium, campaign, content, term and, when present, the click ID supplied by the provider. The entry page is not part of this snapshot. This measurement does not use cookies; before saving values, it discards unsafe values or values that appear to contain personal data. The server temporarily uses the IP address and user agent to calculate a technical visit identifier that is separated by site and renewed for each analytics day; the IP address and user agent are not written to analytics data. To measure the journey through payment, we temporarily record two pseudonymous records, checkout_started and purchase_confirmed, associated, when available, with the technical session identifier and the first/last-touch data described above. The raw order identifier is transformed using a one-way HMAC before it is written and is not retained in analytics data. These records and individual raw analytics events are retained for no more than 90 days and then deleted; only aggregate rollups without visit or order identifiers may remain. Xceed provides only aggregate totals by sales channel and event, so those purchases cannot be attributed to an individual visit or an exact campaign. Data stays on our systems and is never sold or shared. Vercel Web Analytics is active independently of consent: it uses no cookies, stores anonymized aggregate data, and resets its visitor hash daily, while the session is discarded within 24 hours. Vercel Speed Insights is active independently of consent and collects site performance metrics. The legal basis for this internal measurement is our legitimate interest in understanding how the site performs (art. 6.1.f GDPR): you may object at any time, without giving a reason, by writing to info@gatemilano.it. Consent instead applies to Google Analytics, Meta Pixel and Microsoft Clarity, which are enabled only if you give it; declining them does not disable our internal measurement, Vercel Web Analytics or Speed Insights.