Privacy policy pursuant to Regulation Data Protection Act 2018, UK General Data Protection Regulation and subsequent amendments and supplements

1.   General information

illycaffè UK Limited - hereinafter also referred to as “illycaffè UK” or “Company”- hereby communicates the information relating to the processing of your data.

2.   Purposes and legal basis

illycaffè UK may process data for the following purposes:

A.   in order to deepen your evaluation of the satisfaction of the received service, also by contacting you; the legal basis for the processing is a consent;

B.   to fulfill an obligation established by law, by a regulation or by EU legislation. The processing is based on the following legal basis: the fulfillment of legal obligations;

C.   for legitimate interests such as that of asserting or defending a right of illycaffè. The processing is based on the following legal basis: the pursuit of legitimate interests.

3.   Mandatory provision of data

The provision of the data requested for the purposes indicated to in point 2(A) is optional and a possible refusal to provide them, in whole or in part, may result in the impossibility for illycaffè UK to deepen its evaluation. Consent for the purposes indicated to in point 2(A), which can always be revoked by contacting the data controller, is always optional, but non-consent will not allow us to deepen your evaluation. The provision of the data requested for the purposes indicated in points 2(B) and 2(C) is necessary and, therefore, a possible refusal to provide them, in whole or in part, may result in the impossibility for illycaffè UK to deepen your evaluation.

4.   Data addressee categories

The data will not be communicated by illycaffè UK to third parties, for the purposes of point 2(A); for the purposes of points 2(B) and 2(C) the data may be disclosed by illycaffè UK to advisors (e.g. lawyers), judicial and police authorities, public bodies, post offices / couriers (by communicating the data necessary for the sending of any communications). The data may also be known and processed by subjects delegated by illycaffè UK, each for own role, to process the data (legal, technical, informatics, marketing and logistic staff, also external to illycaffè UK, staff in charge of customer relations, also external to illycaffè UK, persons in charge of the management of the websites, also external to illycaffè UK, members of company boards, advisors - e.g. lawyers, quality/certification advisors, IT advisors- trainees, internal auditors, staff of  data processors).The data may also be known and processed by data processors appointed by illycaffè UK (e.g. companies/consultants that carry out activities ancillary to those of illycaffè UK, such as, for example, IT consultancy companies/consultants, website management companies, companies that collaborate in the management of illycaffè UK organization, marketing and communication companies, logistics and shipping companies). The full list of data processors is available upon request to illycaffè UK at the addresses indicated in point 6.

5.   Data retention

Data will be retained by illycaffè UK for the entire period necessary for the pursuit of the purposes contained in this information. The data retention period is as follows:

-       the data may be retained for the purposes set out in point 2(A) for a maximum of 8 months saves the right of the data subject to request cancellation before the end of the 8 months without prejudice to the right of the data subject to request cancellation beforehand;

-       for legal obligations, regulations and community regulations, data may be retained for the periods imposed by these regulatory sources;

in any case, all data may be retained for a period necessary to assert or defend a company right according to UK laws.

6.   Data Controller

The data controller is illycaffè UK Limited a company duly incorporated and validly existing under the laws of England & Wales, whose registered office is at Unit 7 – 8 Osyth Close Brackmills Northampton NN4 7DY, Ph: +44(0)1604 821234, e-mail sales.uk@illy.com.

7.   Rights

We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to exercising the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.

8.   Complaints

The data subject can always lodge a complaint with the British Supervisory Authority whose references can be found on the website https://ico.org.uk/.

9.   Processing procedures

Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè UK may file data both on paper and IT support). illycaffè UK has implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. Data will be retained and processed by illycaffè UK in compliance with its confidentiality requirements and with the applicable local provisions (i.e. in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. Data will be processed by illycaffè UK exclusively to achieve the aims described in this privacy policy.

Policy updated on 17^th December 2021.