Privacy Policy

Effective date: October 4, 2026

This Policy explains how Milan Design Studio (Jonas Francisco Milan Ltda, CNPJ 42.091.024/0001-43, Av. Eng. Max de Souza, 1068 - Coqueiros, Florianópolis - SC, 88080-000, Brazil) collects, uses, shares and protects your personal data. It is designed to comply with Brazil's General Data Protection Law (LGPD – Law 13,709/2018), the EU General Data Protection Regulation (GDPR) and UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other U.S. state privacy laws. This Policy also serves as our Notice at Collection for California residents.

1. Controller and Data Protection Officer

Milan is the controller of personal data processed through the Site. Data Protection Officer (Encarregado): Jonas Milan – contato@milandesignstudio.cc.

2. Personal data we collect

Identifiers and contact details: name, email, phone/WhatsApp, company and job title, provided by you through our form, email or WhatsApp.

Project information: project description, estimated budget, timelines, links and files you send us.

Internet and device activity: IP address, browser and device type, pages visited, referral source, date and time, collected automatically through cookies and similar technologies.

Communications: history of our messages and meetings with you.

We do not intentionally collect sensitive personal data (such as health, religion or racial origin). Please do not send it to us.

3. Purposes and legal bases

Replying to inquiries and sending proposals: based on steps prior to entering a contract (LGPD art. 7, V / GDPR art. 6(1)(b)).

Delivering contracted projects, mentoring and workshops: based on performance of a contract (LGPD art. 7, V / GDPR art. 6(1)(b)).

Measuring audience and improving the Site: based on your consent to non-essential cookies (LGPD art. 7, I / GDPR art. 6(1)(a)).

Sending content and news by email: based on your consent, which you may withdraw at any time (LGPD art. 7, I / GDPR art. 6(1)(a)).

Site security and fraud prevention: based on legitimate interests (LGPD art. 7, IX / GDPR art. 6(1)(f)).

Complying with legal, tax and accounting obligations: based on legal obligation (LGPD art. 7, II / GDPR art. 6(1)(c)).

Establishing or defending legal claims: based on the regular exercise of rights (LGPD art. 7, VI / GDPR art. 6(1)(f)).

4. Sharing

We do not sell or rent your personal data. We share it only with:

• Service providers (processors) that help us run the Site and our business: hosting and forms (Framer), cloud email and storage, messaging (WhatsApp/Meta), analytics (Google Analytics and Microsoft Clarity) and accounting.

• Project partners, such as partner developers or studios, only when needed to deliver a contracted project and under confidentiality obligations.

• Public authorities, when required by law or court order.

5. International transfers

Some providers (such as Framer, Google and Microsoft) store data outside Brazil, including in the United States and the European Union. These transfers follow LGPD (art. 33) and GDPR (Chapter V), relying on standard contractual clauses or other appropriate safeguards.

6. Data retention

• Inquiries that did not become projects: up to 2 years after the last contact.

• Client and contract data: for the contract term plus 5 years, for legal and tax purposes.

• Browsing and cookie data: as stated in our Cookie Policy, generally up to 2 years.

• Email list: until you unsubscribe.

After these periods, data is deleted or anonymized.

7. Your rights

You may, free of charge and at any time:

• confirm whether we process your data and access it;

• correct incomplete, inaccurate or outdated data;

• request anonymization, blocking or deletion of unnecessary data or data processed based on consent;

• request data portability;

• learn with whom we share your data;

• withdraw consent and be informed of the consequences of not consenting;

• object to processing based on legitimate interests;

• request review of decisions made solely by automated means (we do not make such decisions).

EU and UK residents may also request restriction of processing and lodge a complaint with their local data protection authority.

U.S. residents (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws) have the right to know what personal data we collect, and to access, correct, delete and obtain a portable copy of it, and to opt out of the sale of personal data, sharing for cross-context behavioral advertising, and profiling. In the past 12 months, Milan has not sold personal data or shared it for targeted advertising, and we honor Global Privacy Control (GPC) browser signals. You may use an authorized agent, and we will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our email.

How to exercise your rights: email contato@milandesignstudio.cc. We may ask for information to verify your identity. We respond within 15 days (LGPD), 30 days (GDPR) or 45 days (U.S. laws). Brazilian residents may also file a complaint with the National Data Protection Authority (ANPD).

8. Security

We use encrypted connections (HTTPS), access controls, strong passwords with two-factor authentication and providers with recognized security standards. No system is 100% secure. If an incident may cause relevant risk or harm, we will notify you and the competent authorities as required by law.

9. Children

The Site is intended for businesses and professionals. We do not knowingly collect personal data from anyone under 18 (or under 16 in the EU). If we learn we have, we will delete it.

10. Cookies

Details about cookies and how to manage them are in our Cookie Policy.

11. Changes

We may update this Policy. The current version, with its effective date, will always be on this page. We will announce material changes on the Site or by email.

12. Contact

Milan Design Studio – contato@milandesignstudio.cc