Privacy Policy

Last updated: 2026-04-21 · Effective: 2026-04-21

This Privacy Policy explains how Umzikim Inc. ("we", "us") collects, uses, and protects personal data when you use milandesignweek.org and related subdomains (the "Service"). We operate the Service as a free, independent planner for Milan Design Week events. We are not affiliated with Fuorisalone.it, Salone del Mobile, or any official organizer.

1. Who We Are (Data Controller)

The data controller for the Service is:

• Umzikim Inc. (Republic of Korea)
• Business Registration No.: 119-86-48239
• Representative: Hyo Chung Lee
• Registered address: 2-9 Chungmuro 5-gil, 4F, Jung-gu, Seoul 04559, Republic of Korea
• Contact: [email protected]

2. EU Representative (GDPR Art. 27)

As we are established outside the European Economic Area (EEA) but offer the Service to individuals in the EEA, we have designated the following EU representative under Article 27 of the GDPR:

• [TO BE INSERTED — DataRep / Prighter / other]
• EEA contact email: [TO BE INSERTED]

You may contact our EU Representative on matters relating to our processing of your personal data.

3. Data We Collect

3.1 Account data (only if you sign in)

When you sign in with a magic link, we collect:

• Email address — to deliver the login link and identify your account.
• Sign-in metadata — timestamp, IP address, user agent (stored by our authentication processor for security).
• Display name & avatar URL — optional, set by you in the planner.

3.2 Content you create

• Interests — likes, bookmarks, planned events (with date/time/notes), visited events (with rating/notes).
• Photos — optional JPEG/PNG/WebP/HEIC uploads (max 5 MB) attached to visited events. Uploaded to a public storage bucket so that team members and holders of your shared wishlist link can view them.
• Teams — team name, description, invite code, membership.
• Reviews / comments — body text (up to 1000 characters), star rating, and visibility setting (private / connections / public).
• Share tokens — opaque tokens for optional iCal calendar feeds and public wishlist pages you explicitly enable.

3.3 Local device storage

We store the following in your browser's localStorage. These do not leave your device except when syncing to our backend above.

• mdw_interests — local cache of your interests (so the Service works offline).
• mdw_last_user_id, mdw_return_to, mdw_pending_invite — session continuity.
• mdw_onboarded — remembers that you dismissed the welcome tour.
• Theme and language preferences.
• Supabase auth session token.

We do not use tracking cookies, advertising cookies, fingerprinting, or cross-site trackers.

3.4 Automatically-collected technical data

Our hosting and infrastructure providers automatically log technical information such as IP address, user agent, and request URLs for security, abuse prevention, and service reliability. This data is processed by Cloudflare and Supabase under their standard terms.

4. Why We Use Your Data (Purposes & Legal Basis)

We do not sell your data. We do not use it for advertising or profiling.

5. Who We Share Data With (Processors)

We use the following processors, each under a written Data Processing Agreement compliant with GDPR Article 28:

We do not share your personal data with any third party for marketing, analytics, or profiling.

6. International Transfers

Your data may be processed outside the Republic of Korea and outside the EEA. Where data is transferred to the USA or other third countries, we rely on the EU Standard Contractual Clauses (2021/914) and the processor's certifications (e.g., EU-US Data Privacy Framework where applicable). Transfer Impact Assessments are available on request.

7. How Long We Keep Data (Retention)

• Account and content data — for as long as your account exists. If you delete your account, we delete your personal data within 30 days, except items we must retain by law.
• Year-specific data — event interests, plans, reviews, and photos tied to a specific Milan Design Week year remain associated with your account as personal history. You can delete any item at any time.
• Security logs — up to 90 days.
• Email delivery logs — retained by Resend per their retention policy (typically 30 days).

8. Your Rights

Under the GDPR (if you are in the EEA) and under the Korean Personal Information Protection Act (PIPA), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Port your data (receive it in a machine-readable format).
• Withdraw consent at any time (does not affect prior processing).
• Lodge a complaint with a supervisory authority — in Italy the Garante per la protezione dei dati personali; in Korea the Personal Information Protection Commission.

9. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Security

We rely on Supabase (encrypted in transit and at rest), Cloudflare, and Resend for industry-standard security. Access to personal data is restricted by Row-Level Security policies in the database. In the event of a personal data breach, we will notify affected users and the relevant supervisory authority within 72 hours as required by GDPR Art. 33.

11. Cookies & Local Storage

We do not use tracking or advertising cookies. The only client-side storage we use is essential localStorage (listed in §3.3) and the Supabase session token. Because this storage is strictly necessary for the Service to function, no consent banner is required under Italian Garante guidelines (2021).

If and when we enable privacy-first web analytics (Cloudflare Web Analytics), it will be cookieless and will not track individuals. We will update this policy first.

12. Changes

We may update this policy. Material changes will be announced on the Service and, where we have your email, by email. The "Last updated" date at the top reflects the current version.

13. Contact

For any privacy question or to exercise your rights:

• Email: [email protected]
• Postal: Umzikim Inc., 2-9 Chungmuro 5-gil, 4F, Jung-gu, Seoul 04559, Republic of Korea
• EU Representative: [to be inserted]