Privacy notice

This is a translation: in case of differences, the Italian text prevails. Italiano

Last updated: 6 November 2026

This notice explains how MIA79 LTD (“we”) processes the personal data of those who visit boutiquestefany.com and those who contact us, as required by Article 13 of Regulation (EU) 2016/679 (GDPR).

Data controller

MIA79 LTD
Registered office: ul. Bor 3, 2660 Boboshevo, Bulgaria
ЕИК 206623294
Email: stefkamia79@gmail.com
Phone: +359 877 128 711

What data we process

Browsing data: IP address, browser and device type, pages visited, date and time. These are collected automatically by the systems that run and protect the site.
Viber messages: your number, your profile name and what you write to us, including attachments.
WhatsApp messages: your number, your profile name and what you write to us, including attachments.
Emails and phone calls: your email address or your number, and what you write or say to us.
Data from analytics and advertising tools, only if you accept them in the cookie banner: the identifiers of their cookies, the pages viewed and certain actions on the site, such as a click on Viber or WhatsApp, or submitting the form.

In your messages, write only what the request requires: no health data or other special categories of data, such as religious beliefs or political opinions.

Why we use the data and on what legal basis

For each use, we indicate the legal basis, that is, the letter of Art. 6(1) GDPR that permits it.

Replying to your requests and, if you ask, preparing a quotation or an offer for you: pre-contractual measures taken at your request (letter b).
Managing the contract arising from the request: performance of the contract (letter b).
Replying to other messages, such as a report or a job application: legitimate interest in replying to those who write to us (letter f).
Complying with legal obligations, such as tax and accounting obligations: legal obligation (letter c).
Protecting the site from abuse and automated programs: legitimate interest in security (letter f).
Counting visits in aggregate form, with Cloudflare Web Analytics: legitimate interest in understanding how the site is used (letter f). The tool saves nothing on your device, creates no profiles and does not track individual visitors.
Showing you the Google map, if you choose to load it: your consent, given by the click (letter a).
Measuring visits and understanding whether a request comes from advertising, with analytics and advertising tools: consent (letter a, and Art. 122 of the Italian Privacy Code), only if you accept them in the cookie banner.
Asserting or defending a legal right: legitimate interest (letter f).

Mandatory and optional data

Providing your data is your choice: without the data we need, however, we cannot reply to you.

When we ask for your consent, giving it is optional: if you refuse, the site and the service work just the same.

How and for how long we keep the data

We process the data with IT tools and, where necessary, on paper. Only authorised persons can see them, and we protect them with appropriate security measures.

The site has a password-protected restricted area, from which MIA79 LTD updates the content. Visitors to the site do not have access to it and do not receive its cookies.

Browsing data are kept by the provider hosting the site for as long as necessary for security, according to its own rules.
Requests and messages that do not lead to a contract are kept for as long as necessary to reply and to handle the negotiation, and in any case for no more than 6 months from the last contact.
To protect the form and the restricted area from abuse, the site keeps for a short time, 48 hours at most, a hash of the IP address, calculated with a secret key, which does not contain the address in clear text.
If a contract arises from the request, we keep the data for its entire duration and then for 10 years, as the law requires for accounting and tax records (Art. 2220 of the Italian Civil Code).
Cookies from analytics and advertising tools last for the period stated in the cookie notice.

Who receives the data

The data are not sold or disseminated. They may be received only by the following parties, each within its own remit:

persons authorised by MIA79 LTD, who are bound by confidentiality;
OnlinePerTutti.com (T.H.K. Consulting Limited, Hong Kong), which built and manages the site: it processes data on our behalf, solely for the technical management of the site;
Cloudflare, Inc. (United States), which hosts and protects the site and provides the technical tools described on this page: it processes data on behalf of OnlinePerTutti.com, as its supplier;
Viber Media S.à r.l. (Luxembourg), if you write to us on Viber: it processes messages as an independent controller (Viber's privacy notice);
WhatsApp Ireland Limited, if you write to us on WhatsApp: it processes messages as an independent controller (WhatsApp's privacy notice);
Google Ireland Limited, if you load the map: it receives your IP address and may use its cookies, as an independent controller (Google's privacy notice);
the providers of the analytics and advertising tools listed in the cookie notice, such as Google and Meta, only if you accept them: they process data as independent controllers or, for collection on the site, jointly with us;
the accountant and other advisers, banks and public authorities, where required by law or by the contract.

Data outside the European Union

Some of the listed providers are based outside the European Union, for example in the United States, and may process part of the data there. They do so with the safeguards provided for by the GDPR (Arts. 44-46):

for US companies that participate in the EU-U.S. Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795);
in other cases, the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914).

OnlinePerTutti.com (T.H.K. Consulting Limited) is based in Hong Kong, which is not covered by an adequacy decision of the European Commission. The data are stored on the systems of the providers listed above: T.H.K. Consulting Limited accesses them solely for the technical management of the site, on our behalf.

For information on these safeguards, or a copy of them, write to stefkamia79@gmail.com.

Your rights

At any time, you may:

see your data and obtain a copy of them (access, Art. 15 GDPR);
have them corrected or completed (rectification, Art. 16);
have them erased, when they are no longer needed or the law does not require us to keep them (erasure, Art. 17);
have their use restricted (restriction, Art. 18);
receive them in a machine-readable format, in order to transfer them elsewhere (portability, Art. 20);
object to their use based on our legitimate interest and, at all times, to their use for promotional purposes (objection, Art. 21).

If you have given us your consent, you may withdraw it whenever you wish: withdrawal does not affect what we did before (Art. 7(3)).

To exercise your rights, write to stefkamia79@gmail.com. We will reply within one month. In more complex cases this period may be extended by a further two months: if so, we will inform you within the first month (Art. 12(3)).

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22).

Complaint to a supervisory authority

If you believe that your data are being processed in a way that does not comply with the GDPR, you may lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority), Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it, or with the authority of the country where you live or work, or where you believe the infringement took place (Art. 77 GDPR).

MIA79 LTD is based in Bulgaria, where the supervisory authority is the Commission for Personal Data Protection (Комисия за защита на личните данни), bul. “Prof. Tsvetan Lazarov” 2, 1592 Sofia, www.cpdp.bg.

The cookies and similar tools used by the site, and how you can manage them, are explained in the cookie notice.

Analytics and advertising tools run only if you accept them in the cookie banner. If you refuse, or close the banner with the X, you continue with technical cookies only and the site works just the same.

Changes to this notice

This notice may change, for example if the site adds a feature or a regulation changes. The version in force is always this page, with the date at the top.