Privacy policy for illycaffè Shanghai Co. Ltd. pursuant to Regulation (EU) 2016/679 (GDPR) and Chinese regulations concerning the processing of personal data

1. General information

illycaffè Shanghai Co. Ltd. (hereinafter also referred to as the "Company" or "illycaffè Shanghai") hereby informs you (according to you to register to the site e-shop and defining you also as "user" or "data subject") the purposes and procedures of data processing (provided by you and/or as a result of processing by the Company) of which will be hold. If you purchase and register as a legal representative of a firm/company/organization, per user or data subject shall be considered the firm /company/organization represented by you (which will be ​​the subject recorded and will purchase) and your data will be processed by illycaffè Shanghai only to identify you as the legal representative and for the purposes specified in point 2 letter A,B,C, considering the consent to the processing of data provided (through you) by the firm/company/organization that you represent. In addition, the consent for the purposes specified in section 2 letter A of this information, will be considered provided also by you in registering in the site your name as the legal representative of the firm/company/organization represented by you. Registration allows you to not have to retype all the data every time (but only a few) and give the consents required. Please remember that you are also free not to register (not consenting therefore to data processing) and however to buy our products going in the appropriate section of this website where you can buy without registering.

illycaffè Shanghai uses the registration data and purchase collected and stored in server Italians, who then reports and processes in China for the delivery management, billing and everything necessary to fulfill the contract and manage the registration. Therefore, illycaffè Shanghai applies Italian legislation for data processed by means located in Italy (and that pursuant to art. 4 letter C of 95/46/EC) and applies the Chinese laws and regulations to all operations in China with means Chinese. The user is therefore in both cases protected.

Please note that your will indicate only your data (except as specified below in point 3 letter F of this information) and/or data of the firm/company/institution represented by you. For the purposes specified in point 2 letter B of this information, if the purchase and registration are made by the firm/company/organization represented by you, addresses the object of the activities listed in point 2 letter B of this information will be the addresses of the firm/company/organization represented by you.

The points from 2 to 10 concern the processing of data carried out with means located in Italy and then in accordance with EU 2016/679.

2. Purposes

illycaffè Shanghai may process data for the following purposes:

1. in order to allow the registration to the shop recognize you as a user registered and manage the recording (without the consent for such purposes you will not sign up and the consent will also be provided, as indicated above, to illycaffè S.p.A., illycaffè France s.a.s., illycaffè UK Limited, illy caffè North America Inc. and illycaffè Sud America Comercio, Exportação e Importação Ltda). Registration will also allow you to access with a single username and password to all reserved sections of www.illy.com;
2. where you shall purchase, to fulfill obligations arising from the purchase contract, and therefore also for administrative-accounting purposes and for the order management. About the credit card information is you also refer to the contents of the payment section of the site;
3. to be compliant with the requirements pursuant to the legislation in force, regulations or EU regulations and for legitimate interests such as to assert or defend the rights of the Company.

For the purposes described in point 2 letter B and C of this information, the processing can be carried out without the consent of data subjects. Therefore, this consent is not required.

3. Mandatory nature of the provision
   1. The provision of data on the registration form marked as mandatory (those marked in bold) is necessary for the purposes specified in point 2 letter B of this information and therefore the refusal to provide it in whole or in part may make it impossible for the Company to execute the contract and then buying products illycaffè. The indication of the product to purchase and the method of payment is necessary in order to purchase the product (and then again for purposes specified in point 2 letter B of this information) and the lack of information will make it impossible to buy the product. As far as shipping information if different from billing you see to point 3 letter F of this information. About other data contained in the optional fields see also as shown below. Where not otherwise specified in this information data in optional fields can optionally be provided and the failure does not lead to any result other than that not to use such information (which may still be useful for the purpose in object).
   2. The provision of data that may be necessary in pursuance of legal obligations and legislation or regulations to enforce or exercise a right of illycaffè Shanghai) for the purposes specified in point 2 letter C of this information is necessary and failure makes it impossible to register and/or to follow up the purchase contract.
   3. The provision of data specified as mandatory (those marked in bold) in the registration form in order of registration (point 2 letter A of this information) is optional but the absence of data will make it impossible to register the same. As far as shipping information if different from billing see the point 3 letter F of this information. About data relating to invoice request also see the point 3 letter E of this information. As far as credit card information see the point 3 letter D of this information. As for other data not marked in bold in the registration form and any other data provided, the provision is optional and failure to provide not lead to any result but to disregard such data that may be useful in some cases to better manage the order (refer to point 3 letter E of this information).
   4. As far as credit card information, your provision is optional and failure to make it impossible to pay by credit card.
   5. The provision of requested data in case of invoice request is optional, but failure to make it impossible to invoice with the data given, if required.
   6. The provision of data relating to alternative addresses to which to send the goods and/or a gift is optional but the missing data in bold will make it impossible to ship the material to the address indicated. Please note that for these activities, the user agrees on its own responsibility to obtain the consent of the subject of which indicates the data, send the goods to him address or indicate him as holder of the gift. In addition, User engages for these activities to inform the subject of which he communicates data to illycaffè Shanghai (subject to which to send the goods or holder of the gift) that he will communicate data to illycaffè Shanghai, so illycaffè Shanghai can treat them (through persons in charge and data processors specified they must have knowledge to perform the tasks assigned by illycaffè Shanghai) in order to send the material to the address and also informing him that illycaffè Shanghai will give specific information about processing of data, putting him still aware immediately on that illycaffè Shanghai may disclose data to carriers and shippers, and that provision of data is optional and failure to make it impossible to ship the goods to the address and/or to indicate the subject as a holder of the gift. You agree to obtain consent (where due) to communicate the data to illycaffè Shanghai and their processing (therefore also consenting to the recording in databases illycaffè Shanghai) by illycaffè Shanghai for the purposes specified above in this section. User data will then be known even by those who receive the goods.
4. Data recipient categories

The data will not be disclosed to third parties by illycaffè Shanghai for the purposes specified in point 2 letter A of this information. The data may be communicated by illycaffè Shanghai for the purposes specified in point 2 letter B of this information (communicating only data that are necessary for the pursuit of these purposes) both in Italy and in China to: banks for payments, carriers and forwarding agents, post offices, distributors, companies (including foreign) that contracts could be sold as provided in the contract of purchase (in which case it will be, with the assignment of the contract, including the transfer of data relating to the contract and its implementation and management), lawyers and legal consultants, companies audit where no appointed as data processor. For the purposes specified in point 2 letter B and C of this information, data may be communicated in Italy and in China (by communicating only the data that are necessary for the pursuit of these purposes) by illycaffè Shanghai to judicial authorities, tax police and public security and public bodies if there is an obligation to this disclosure, also to law firms and legal advisers and to post offices (being able to see the address and the name for sending any written notices). The data may be disclosed on behalf of illycaffè, each for own role, to all subjects delegated by illycaffè (administrative staff, transport and correspondence staff, IT technicians and IT staff, public relations staff, legal department staff, trainees, freelancers and consultants-employees also external to the Company acting under the direct responsibility of the Company, such as IT technicians, legal consultants, staff of internal and external Data processors) and to internal and external Data processors (companies-professional studies who perform instrumental activities of illycaffè S.p.A. such as information technology outsourcing company especially illycaffè S.p.A. that manages the entire application part and security of the data base of the site shop). The list of Data Processors is always available by contacting the Data Controller.

5. Data retention

Data will be retained by illycaffè Shanghai for the entire period necessary for the pursuit of the purposes contained in this information. The data retention period is as follows:

• for legal obligations, regulations and community regulations, data may be retained for the periods imposed by these regulatory sources;
• for contractual purposes until the end of the relationship and even after the end of it for the period determined by Chinese and European regulations, including in tax matters;
• for the purposes described in point 2 letter A of this policy, the data can be retained until the withdrawal of consent or request for cancellation;

in any case, all data may be retained for a period necessary to assert or defend a company right according to Chinese and European regulations.

6. Data Controller

The Data Controller is the undersigned company illycaffè Shanghai Co. Ltd. located in 7 D, Silver Tower, Jiu An Plaza, 258 Tong Ren Road Shanghai 200040, China P.R.C., telephone number 0086-21-6279-1979, fax number 0086-21-6279-2905.

7. Rights

We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to exercising the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.

8. Complaints

The data subject can always lodge a complaint with the Italian Data Protection Authority, whose references can be found on the website www.garanteprivacy.it.

9. Legal Basis

The legal basis is provided by the fulfilment of legal obligations (Chinese and European laws) as well as the legitimate interests of the Data Controller in the customer-supplier relationship. Furthermore, for the purposes for which consent is provided, the legal basis is the consent itself.

10. Processing procedures

Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè Shanghai may file data both on paper and IT support). illycaffè Shanghai has implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. The data will be processed and stored by illycaffè Shanghai in accordance with EU 2016/679 and the relevant legal requirements (in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned). Data will be filed at illycaffè Shanghai and at the appointed data processors by illycaffè Shanghai as well as third parties, specified by category in that information, who receive data as independent data controllers). Data will be entered in databases, including IT databases. illycaffè Shanghai has appointed as a representative in the Italian territory pursuant to art. 5 comma 2 of Legislative Decree 196/03 illycaffè S.p.A. located at via Flavia 110 to Trieste in Italy that conserves data in the server located at Salesforce.com Inc. that retains data in the server located in Great Britain.

N.B. The consent can only be given by persons over 14 years, if the subject is under 14, he cannot use what is provided for in the purposes for which consent is required (e.g. registration, ...).

About data processed in China and their processing, we inform the Chinese user of the following information.

illycaffè Shanghai will process user’s data (provided by the user and collected in the online form and in the shopping cart of the site shop.illy.com and then collected from the user and provided by him if necessary) in China in accordance to laws of the P.R.C. and with full respect for human dignity of the individual processing data on paper, manually, with IT and electronic means (therefore, illycaffè Shanghai may file data both on paper and IT support). illycaffè Shanghai has implemented safety measures to protect the confidentiality and logic strictly in line with the purposes set forth in this privacy policy. Especially all the precepts specified in the new rules of the internet service provider (ISP) issued by the Ministry of Industry and Information Technology in December 2011 "Certain Provisions regulating the Market Order of Internet Information Services" will be respected, as well as all the rules of civil and penal nature.

illycaffè Shanghai will process data in an appropriate manner and will take immediate action to remedy the possibility of an actual or potential information leakage informing of any leak of information the local communications authority and giving support during the investigation if the incident may cause serious consequences.

illycaffè Shanghai is not responsible for the information leakage due to force majeure, hacker attacks and user’s malicious behavior.

The data can be processed by illycaffè Shanghai by persons acting on its behalf for administrative-accounting purposes, for requirements pursuant to the legislation in force, to assert or defend its rights in the relevant jurisdiction. In this sense, the data will be disclosed to the same persons referred to in point 4 of the information pursuant to Italian law, with reference to point 2 letter C of the information and the provision of data required is necessary to deliver the services.

illycaffè Shanghai will not make illicit actions to obtain the data of the computer or electronic system and the illegal manipulation of computer or electronic system, as well as its damage. illycaffè Shanghai will not interfere with others' use of their name, and not use the same fraudulently or assume another's identity in accordance with Article 99 of the General Principles of Civil Law. Furthermore, according to what is stated by the Supreme Court of China, Shanghai illycaffè will not process the facts in order to openly denigrate another person or with the intent to cause damage to his reputation of substantial entity by means of offense or slander.

illycaffè Shanghai will not install on user computers MALWARE, not also FEATURE unnecessary without the consent of users.

illycaffè Shanghai will safeguard the security of the information uploaded on users ("Information load") and will allow users to use, modify and delete information loaded. illycaffè Shanghai will not change or delete the information loaded without a legitimate reason; illycaffè Shanghai will not transfer the information uploaded without user’s permission, nor will force the user to transfer information loaded (except for those communications required by law and administrative regulations or communications to the courts to assert or defend a right of illycaffè Shanghai).

illycaffè Shanghai will require and process only the data necessary to provide the services related to Chinese e-shop and data necessary for the purposes specified in this information. The data will be subject to consent, unless the processing (including communication) is provided for by laws or administrative regulations.

illycaffè Shanghai will always process data respecting the rights of consumers provided in the law on the protection of the rights and interests of consumers.

The user can make claims and/or contact illycaffè Shanghai at the following addresses: 7 D, Silver Tower, Jiu An Plaza, 258 Tong Ren Road Shanghai 200040, China P.R.C., telephone number 0086-21-6279-1979, fax number 0086-21-6279-2905 (or writing to infoprivacy@illy.com).

illycaffè Shanghai will respond within the time required by law.

This privacy policy is updated as at 29.01.2020. Such update is carried out inside of policy of constant review of the informative ones. The versions of the previous policy statements are available writing to Data Controller (email dpo@illy.com).