Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR)

Some data (personal data, contact details and data relating to purchases) in the USA and Canada can be stored on servers located in Europe observing the requirements of the GDPR, as well as, for safety reasons. illy caffè North America has been identified as the data processor with storage at illycaffè S.p.A. headquarters in via Flavia 110, Trieste, which makes use of its own staff (IT technicians also external to illycaffè S.p.A such as collaborators of data sub-processors and IT consultants) for server management.

 The servers hosting the website are located at:

• Salesforce.com Inc. in one of its data centers in Great Britain;
• Engineering D.Hub S.p.A.- Via Carlo Viola 76 - 11026 Pont Saint Martin (AO) Italy;
• Adobe Inc. on cloud Amazon Web Services in Frankfurt, Germany.

illycaffè S.p.A. uses the data sub-processors for managing the servers mentioned above. The data is therefore processed only for the purpose of preservation and security and therefore for the legitimate interests of illy caffè North America consisting in protecting the data and making use of the best servers. Data is not displayed in Europe unless it is necessary to perform technical activities.

The data is simply stored, and no data is processed in Europe. The data is stored for the periods prescribed by the US and Canadian regulations (depending on the area in which illy caffè North America operates) and in any case for the entire period necessary to achieve the objectives pursued in the USA and Canada.

No data is communicated from Europe. By providing the data to illy caffè North America for the purposes described in this privacy policy, the user consents to data processing and to automatic data storage in Europe. The provision of data may or may not be necessary according to the provisions in policy privacy of illy caffè North America. The user, for the data stored in Europe and only for storage, can exercise the rights provided by the GDPR. In fact, the GDPR provides the possibility for the data subject to ask the data controller for access to personal data and the correction of data, the cancellation of the same or the limitation of the processing that concerns the user, the portability of data; the data subject may also have the opportunity to object to the processing of data and to exercise the other rights contained in Chapter 3 of Section 1 of the GDPR including the one to revoke the consent, where required: the revocation of consent does not affect the legality of processing based on the consent given before the revocation.

The rights can be asserted by contacting illycaffè S.p.A. with headquarters in via Flavia 110 in Trieste, phone +39. 040.3890.111, fax +39.040.3890.490, e-mail infoprivacy@illy.com. illycaffè S.p.A. also has a Data Protection Officer available at the e-mail dpo@illy.com and at the address of the company.

Furthermore, according to the GDPR, the user, if deems it appropriate, can always lodge a complaint with a supervisory authority. Having illycaffè S.p.A. (the data processor on behalf of illy caffe North America) the headquarter in Italy, the Italian Data Protection Authority is identified as the authority whose references can be found on the website www.garanteprivacy.it.

This privacy policy is updated as of 07/15/2019.