Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR) and national legislation in force

1.   General information

illycaffè S.p.A. (hereinafter also referred to as the "Company" or "illycaffè") hereby informs you the purposes and procedures of data processing (provided by you) of which it will be hold.

2.   Purposes

illycaffè may process data for the following purposes:

A.   to allow you access to the reserved area of the site and its contents;

B.   to analyze your interactions within the area (e.g. pages visited, navigation time);

C.   to be compliant with the requirements pursuant to the legislation in force, regulations or EU regulations and for legitimate interests such as to assert or defend the rights of the Company.

3.   Mandatory nature of the provision

The provision of mandatory data for the purposes referred to in point 2 letter A of this information is optional but failure to provide it will make it impossible to access the area. The provision of optional data for the purposes referred to in point 2 letter A of this information is optional and failure to provide it will have no consequences. Consent to the processing for the purposes referred to in point 2 letter A of this information is optional, but failure to consent (always revocable by contacting the data controller) will make it impossible to access the area.

The provision and consent to the data processing for the purposes referred to in point 2 letter. B of this information are optional and failure to provide and consent will make it impossible to be subject to the activities indicated in this point.

The provision of data (personal data and other data required in the event of litigation or requests to exercise rights) given in the form or requested later is necessary for the purposes indicated in point 2 letter. C of this statement and failure to provide may result in the inability to access the reserved area and / or the inability to maintain access credentials once registered.

4.   Data recipient categories

The data may be communicated by illycaffè for the purposes specified in point 2 letter B of this information (communicating only data that are necessary for the pursuit of these purposes) to: judicial authorities, tax police and public security and public bodies if there is an obligation to this disclosure, also to law firms and legal advisers and to post offices (being able to see the address for sending any written notices). For the purposes specified in point 2 letter A of this information, data will not be communicated by illycaffè. The data may be disclosed on behalf of illycaffè, each for own role, to all subjects delegated by illycaffè (administrative staff and management of illycaffè clients, transport and correspondence staff, including external to the Company, marketing staff and site management staff also external to the Company, IT technicians and IT staff that can also carry out tasks of system administrators, being appointed as such in this case, call center employees also external to the Company, legal department staff, internal auditor, trainees, freelancers and consultants-employees also external to the Company acting under the direct responsibility of the Company, such as legal consultants, staff of the internal and external Data Processors) and to internal and external Data Processors to the Company (for example companies-professional studies who perform instrumental activities of illycaffè S.p.A. such as marketing activities, shipping and enveloping or call center activities, including information technology outsourcing company, management activities of the website). The list of Data Processors is always available by contacting the Data Controller.

5.   Data retention

Data will be retained by illycaffè for the entire period necessary for the pursuit of the purposes contained in this information. The data retention period is as follows:

-       for legal obligations, regulations and community regulations, data may be kept for the periods imposed by these regulatory sources;

-       for the purposes described in point 2 letter A of this policy, the data can be kept until the withdrawal of consent or request for cancellation;

-       for the purposes described in point 2 letter B of this policy, the data may be kept for up to 12 months unless cancellation is requested;

in any case, all data may be retained for a period necessary to assert or defend a company right according to Italian and European regulations.

6.   Data Controller and Data Protection Officer

The Data Controller is illycaffè S.p.A., having its registered office in via Flavia 110, Trieste, phone number +39.040.3890.111, fax number +39.040.3890.490, e-mail: infoprivacy@illy.com. There is also a Data Protection Officer available at the email address dpo@illy.com and at the addresses of the Company.

7.   Rights

We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to exercising the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.

8.   Complaints

The data subject can always lodge a complaint with the Italian Data Protection Authority, whose references can be found on the website www.garanteprivacy.it.

9.   Legal Basis

The legal basis is based on the fulfillment of legal obligations (Italian and European laws) as well as the legitimate interests of the Data Controller in relationship with the user. Furthermore, for the purposes for which consent is provided, the legal basis is the consent itself.

10.  Processing procedures

Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè may file data both on paper and IT support). illycaffè has implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. Data will be retained and processed by illycaffè in compliance with its confidentiality requirements and with the applicable local provisions in the different states in which illycaffè has its offices (in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. Data will be processed by illycaffè exclusively to achieve the aims set forth in this privacy policy. Data will be filed at illycaffè S.p.A. offices and at the appointed data processors (as well as third parties who receive data as specified in point 4 of this privacy policy). Data will be entered in databases, including IT databases.

We remind you that only for technical assistance needs data may be sent to companies outside the European community who are specifically designated as data processors by committing to comply with all the requirements of European legislation, also by signing the appropriate Contractual Clauses indicated by the Data Protection Authority; the data are only a copy of those contained in the European servers and the copy of the same is always available at illycaffè S.p.A..

11.  Third party data

If you indicate the company to which you belong, you undertake to inform the company of what is contained in this information notice and you undertake to receive the company's consent for the data to be communicated to illycaffè so that it can process them for the purposes envisaged in this information notice

12.  Profiling

The processing of data for the purposes referred to in point 2 letter B of this privacy policy can be considered profiling.

The profiling is based on user navigation data in order to analyze behavior within the private area to improve the area itself.

This processing, however, does not constitute a particular risk for the data subject considering the type of basic profiling that does not require data of a particularly delicate nature or that allows the detailed reconstruction of particularly reserved aspects of private life. Moreover, they are not produced based on profiling, legal effects that affect the person concerned or that significantly affect his person, as no decision is made based on automated processing

Everything is always filtered by physical subjects who provide the analysis of the data.

N.B. The consent can only be given by persons over 14 years, if the subject is under 14, he cannot use what is provided for in the purposes for which consent is required.

This privacy policy is updated as at 11/10/2019.