Privacy Policy and Cookie Policy

Information notice pursuant to EU Regulation 2016/679 (GDPR)

Privacy notice

How we handle your data on Milan Nel Cuore

A fan site, not a business

This privacy notice describes how Milan Nel Cuore manages the processing of data relating to users who visit the site, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, GDPR) and Italian data protection legislation.

Milan Nel Cuore is an unofficial fan site, run by enthusiasts and in no way affiliated with, sponsored by or endorsed by A.C. Milan S.p.A. The site does not pursue commercial purposes and does not generate revenue from the collection or sale of personal data.

Last updated: April 2026.

1. Data controller

Who manages this website

Milan Nel Cuore — Fan site

The data controller is Dario Mattioli, operator of the fan site Milan Nel Cuore (milannelcuore.it), a non-commercial personal project run on an amateur basis.

As this is a small-scale personal project, the appointment of a Data Protection Officer (DPO) is not required under Article 37 of the GDPR. For any privacy-related enquiries, please write to info@milannelcuore.it.

Non-affiliation disclaimer: Milan Nel Cuore is not affiliated with, sponsored by, endorsed by or in any way connected to A.C. Milan S.p.A. Trademarks, logos and AC Milan-related content mentioned on the site belong to their respective owners and are used solely for informational and sporting celebration purposes.

2. Data collected and processing methods

What is stored and where

Server-side data

Milan Nel Cuore is a static website: it does not have its own application back-end, does not manage remote databases and does not collect, transmit or store personal data through servers owned by the data controller. There are no registration forms, newsletter sign-ups or contact forms that send data to servers controlled by the site operators.

Browser data (localStorage)

Some user preferences are stored exclusively in the user's browser via the standard Web APIs localStorage and sessionStorage. These data are never transmitted to external servers and remain on the user's device. Users can delete them at any time by clearing the site data in their browser settings.

List of locally stored data

The following information may be stored in the user's browser via localStorage or sessionStorage:

  • Theme preference (light/dark) — Key: milan_theme. Stores the visual theme chosen by the user (light or dark mode) so that the preference is maintained between visits.
  • Admin session — Keys: milan_admin_session, RATE_LIMIT_KEY. Data used exclusively by site administrators to access the restricted area. Includes temporary session tokens and the login attempt counter for the rate limiting system (maximum 5 attempts, 15-minute lockout). Not accessible or meaningful to ordinary visitors.
  • Blog content — Key: milan_posts. Blog posts are written by administrators and stored locally. They do not contain any personal data of visiting users.
  • Next match — Key: milan_next_match. Data about Milan's next match (opponent, date, competition, venue) entered by administrators and displayed on the homepage for the countdown. Does not contain any personal data of users.

Which cookies Milan Nel Cuore uses

Technical and analytical cookies

Milan Nel Cuore does not use profiling or marketing cookies. The site uses strictly necessary technical cookies for the functionality requested by the user and analytical cookies via Google Analytics, with IP address anonymisation.

Technical cookies do not require user consent under Recital 30 and Article 5(3) of Directive 2002/58/EC (ePrivacy). Google Analytics analytical cookies are used with IP address anonymisation to collect aggregate statistical data on site traffic. Users are informed via a dedicated banner on their first visit.

Preference cookies

Used to remember user choices, such as the graphic theme preference (light or dark). These cookies improve the browsing experience by maintaining the selected settings between sessions. They are stored via localStorage in the user's browser and are not transmitted to any server.

Session cookies (admin area)

Used exclusively in the administrative section of the site to maintain active administrator sessions and for the anti-brute-force protection system. They have a duration limited to the session or a predefined period and are not accessible to ordinary visitors.

How to delete cookies and local data

Users can delete the locally stored site data at any time by accessing their browser settings and clearing the browsing data for the domain milannelcuore.it. Below are instructions for the most common browsers:

  • Google Chrome: Settings → Privacy and security → Clear browsing data → Cookies and other site data
  • Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data
  • Microsoft Edge: Settings → Privacy, search, and services → Clear browsing data
  • Apple Safari: Preferences → Privacy → Manage Website Data

4. Third-party services

External providers acting as independent data controllers

For the proper functioning of the site, Milan Nel Cuore relies on certain services provided by third parties. These parties act as independent data controllers and have their own privacy policies, accessible at the links provided. The controller of Milan Nel Cuore does not have access to any data collected by these services.

Google Analytics

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Aggregate statistical analysis of site traffic (pages visited, session duration, approximate geographic origin, device type and browser). The service uses IP address anonymisation to collect aggregate statistical data. Users are informed about the use of analytical cookies via a dedicated banner on their first visit to the site.

Data transmitted: IP address (anonymised), browser and device information, pages visited, session duration, approximate geographic origin.

Cookies used: _ga, _ga_* (duration: 2 years).

Privacy policy: policies.google.com/privacy

Opt-out: Google Analytics opt-out browser add-on

Extra-EU transfer: Data may be transferred to the USA. Google adheres to the EU-US Data Privacy Framework.

Google Fonts

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Loading the typographic fonts used by the site (Inter, Montserrat, Oswald) via the Google Fonts distribution network.

Data transmitted: Visitor's IP address, browser and operating system information, referring page URL.

Privacy policy: policies.google.com/privacy

Extra-EU transfer: Data may be transferred to the USA. Google adheres to the EU-US Data Privacy Framework.

Font Awesome (Cloudflare CDN)

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Purpose: Loading the vector icons used in the site interface via the Cloudflare CDN (cdnjs.cloudflare.com).

Data transmitted: Visitor's IP address, browser information, HTTP requests for icon files.

Privacy policy: cloudflare.com/privacypolicy

Extra-EU transfer: Data may be transferred to the USA. Cloudflare adheres to the EU-US Data Privacy Framework.

hCaptcha

Provider: Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA.

Purpose: Anti-bot protection for the site's administrative login page. hCaptcha is loaded exclusively on the admin.html page and is not present on the site's public pages.

Data transmitted: User behaviour information, IP address, browser data collected during CAPTCHA resolution.

Privacy policy: hcaptcha.com/privacy

Extra-EU transfer: Data may be transferred to the USA.

football-data.org

Provider: Football-Data.org (Daniel Fransen), a football data API service.

Purpose: Retrieval of Milan match calendar data (results, standings, upcoming matches) for the Calendar section of the site.

Data transmitted: Visitor's IP address during API requests made by the browser when loading the Calendar page.

Privacy policy: football-data.org/privacy

Firebase (Google)

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Management of the comments system on blog articles. Firebase Realtime Database is used to store and display comments left by users under articles.

Data transmitted: Username (entered voluntarily), comment text, IP address, date and time of submission.

Privacy policy: firebase.google.com/support/privacy

Extra-EU transfer: Data may be transferred to the USA. Google adheres to the EU-US Data Privacy Framework.

Facebook Page Plugin (Meta)

Provider: Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland (for EU/EEA users); Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA (for non-EU users).

Purpose: Blog articles integrate the Facebook Page Plugin, which displays a preview of the Milan Nel Cuore Facebook page. Loading the plugin requires downloading the Facebook SDK (connect.facebook.net) and transmitting data to Meta.

Data transmitted: IP address, browser and operating system information, URL of the visited page, date and time of the visit. If the user is logged into Facebook, Meta may associate the visit with their profile.

Cookies: The plugin may set third-party cookies (including _fbp, fr) for analytics and advertising purposes. These cookies are managed directly by Meta as an independent data controller.

Privacy policy: facebook.com/privacy/policy

Cookie policy: facebook.com/policies/cookies

Extra-EU transfer: Data may be transferred to the USA. Meta adheres to the EU-US Data Privacy Framework.

Google AdSense (future)

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: In the future, the site may integrate the Google AdSense service for displaying advertisements. In that case, AdSense may use profiling cookies to show personalised ads based on the user's interests.

Note: When AdSense is activated, this privacy notice will be updated with all details regarding the advertising cookies used and the consent mechanisms. The activation of advertising cookies will always be subject to the user's explicit consent.

Privacy policy: policies.google.com/technologies/ads

5. Legal basis for processing

The legal grounds for processing under the GDPR

Applicable legal bases

Data processing carried out through Milan Nel Cuore is based on the following legal bases provided by Article 6 of the GDPR:

  • Legitimate interest (Art. 6(1)(f) GDPR) — For strictly necessary technical cookies for the functioning of the site, such as theme preference storage. The controller's legitimate interest in providing a functional and consistent browsing experience prevails over the user's interest, given the minimal and non-intrusive nature of such processing.
  • Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) — For admin area session data, necessary for administrators to access the site's restricted features.
  • Consent (Art. 6(1)(a) GDPR) — For Google Analytics analytical cookies and for submitting comments via Firebase. Processing only takes place with the user's explicit consent, which may be withdrawn at any time.
  • Processing by third parties — For third-party services integrated into the site (Google Analytics, Google Fonts, Font Awesome CDN, hCaptcha, football-data.org, Firebase), each provider acts as an independent data controller under its own legal bases and privacy policies.

6. User rights (Arts. 15-22 GDPR)

Your rights regarding personal data protection

Under Articles 15-22 of the GDPR, every data subject has the right to exercise the following rights against the data controller. Since Milan Nel Cuore does not collect personal data through its own servers, most of these rights can be exercised directly by the user by managing the data stored in their browser.

Right of access

(Art. 15 GDPR) — The right to obtain confirmation as to whether or not personal data concerning them are being processed and, if so, to access the personal data and information relating to the processing.

Right to rectification

(Art. 16 GDPR) — The right to obtain the rectification of inaccurate personal data concerning them and to have incomplete personal data completed, including by providing a supplementary statement.

Right to erasure

(Art. 17 GDPR) — The right to obtain the erasure of personal data (the so-called "right to be forgotten") when the conditions laid down by law are met. For locally stored data, users can exercise this right directly by clearing the site data from their browser.

Right to restriction

(Art. 18 GDPR) — The right to obtain the restriction of processing of personal data when the conditions laid down by law are met, for example where the accuracy of the data is contested or the data subject objects to the processing.

Right to data portability

(Art. 20 GDPR) — The right to receive personal data provided to the controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance.

Right to object

(Art. 21 GDPR) — The right to object at any time to the processing of personal data concerning them based on the controller's legitimate interest, on grounds relating to their particular situation.

How to exercise your rights

To exercise the rights listed above against the controller of Milan Nel Cuore, please write to info@milannelcuore.it or contact the controller through the channels indicated in the Contacts section at the bottom of this page.

Please note that, for data stored exclusively in the browser via localStorage, users can autonomously and immediately exercise their rights of access, erasure and portability by accessing their browser settings and managing the browsing data for the site milannelcuore.it.

Users also have the right to lodge a complaint with the competent supervisory authority. In Italy, the relevant authority is the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority), located at Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it .

7. Security measures

How we protect the site's features

Admin area protection

Access to the site's administrative area is protected by a rate limiting system that allows a maximum of 5 failed login attempts, followed by an automatic 15-minute lockout. This mechanism is implemented entirely on the client side via localStorage and aims to reduce the risk of unauthorised access through brute-force attacks.

Anti-bot protection (hCaptcha)

The administrative login page integrates the hCaptcha service (Intuition Machines) to prevent automated access. The use of hCaptcha involves the transmission of data to the provider as described in the "Third-party services" section of this notice.

Content sanitisation

Blog content entered by administrators is sanitised before display through the sanitizeHTML function, which applies an allowlist of permitted HTML tags (strong, em, u, br, a). This prevents XSS (Cross-Site Scripting) attacks and ensures that any malicious content is not executed in visitors' browsers.

8. Minors

Protection of underage users

Site not intended for minors

Milan Nel Cuore is not specifically intended for children under the age of 16 and does not knowingly collect personal data from minors. As there are no registration forms or personal data collection systems, the risk of processing minors' data is structurally minimised.

Parents or guardians who believe that a minor has provided personal data through third-party services integrated into the site (in particular hCaptcha in the admin area) may contact the relevant provider directly to request the deletion of such data.

9. Changes to this notice

Updates and previous versions

Periodic revisions

This privacy and cookie policy notice may be updated periodically to reflect changes to the site, integrated third-party services or applicable legislation. Substantial changes will be indicated by updating the date at the bottom of this page.

Users are encouraged to check this page periodically for any updates. Continued use of the site following the publication of an updated version of this notice implies acceptance of the changes made, to the extent permitted by applicable law.

Current version: 1.1
Effective date: February 2026
Last updated: April 2026

10. Contacts

How to reach us for privacy-related matters

Contact channels

To exercise the rights under Arts. 15-22 GDPR, to request information about data processing or for any other matter relating to this notice, you may contact the controller through the following channels:

We are committed to responding to privacy-related requests within 30 days of receipt, in accordance with the terms set out in Article 12 of the GDPR.