Privacy policy for data collection via card

Privacy policy for data collection via card for promotional purposes applicable to all initiatives not otherwise specified
 

Privacy policy pursuant to Regulation EU 2016/679 (GDPR) and national legislation in force

1. General information

This privacy policy statement is full information in relation to the data provided in the card at one of the illy shop and/or illy caffè or in other situations.

The undersigned company (illycaffè S.p.A., hereinafter also referred to as the "Company" or "illycaffè") hereby informs you that it will process the data you have provided in the card for the purposes listed in the following paragraphs. illycaffè may only require and process data which are instrumental to achieve the purposes of this privacy policy.

1. Purposes

illycaffè may process data for the following purposes:

1. to send advertising communications/information on products-services-initiatives of illycaffè and its partners and market research and/or interviews for the evaluation of product-services of illycaffè, all by illycaffè to the telephone numbers (and therefore also through SMS/MMS) and post address (including the e-mail address through which you can receive regular newsletters) that you specified in the card (please note that the sending of SMS/MMS and e-mail will also be in electronically with the help of automated tools);
2. to create, based on the information about the user in possession of illycaffè, a user profile (profiling) including the study of habits and consumer choices also deriving from analysis of the choices of products aimed at specific activities of marketing, promotion, direct marketing and business communications by illycaffè S.p.A., in accordance with the user's specific needs emerged from the profiling and also designed to analyze the choices and consumer habits of customers of illycaffè products. It can be created a profile both user and of homogeneous classes of users. Marketing activities, promotion, commercial communications and direct sales will be conducted only if the user has agreed to the processing for the purposes specified in point 2 letter A of this information;
3. to comply with the requirements pursuant to the legislation in force, regulations or EU regulations and for legitimate interests such as to assert or defend the rights of the Company.

1. Mandatory nature of the provision

The provision of data for the purposes under point 2, letter A of this privacy policy is optional and the lack of them could make it impossible to be subject to the activities specified in this point at the addresses not conferred (In fact, you are always free to give even just one address. For example, you can communicate only the e-mail if you do not wish to receive SMS/MMS, or the phone if you wish to receive SMS/MMS messages or phone calls and not receive e-mail). Please note that for the purposes specified in point 2 letter A the consent is optional and the only consequence will be not to be subject to the activities by illycaffè; also, if you have agreed to the processing you can always oppose to such activities at any time by getting in contact with the Data Controller. For the purposes under point 2, letter B of this privacy policy the provision of data and the consent are optional and the lack of them could make it impossible to be subject to the activities specified in this point.

The provision of data for the purposes under point 2, letter C of this privacy policy is necessary for the purposes specified in this point and the lack of them could make it impossible to be subject to the activities specified in this privacy policy (always where you have agreed).

1. Data recipient categories

illycaffè may disclose collected data for the purpose described in point 2, letter C of this privacy policy to couriers/shippers, to lawyers, legal advisors, public authorities, judiciary, police. For the purpose described in point 2, letter A of this information data may be disclosed by illycaffè to couriers/shippers. illycaffè discloses only the data essential to the pursuit of each purpose specified in this privacy policy. For the purpose described in point 2, letter B of this information data will not be disclosed to third parties. The data may be disclosed on behalf of illycaffè, each for own role, to all subjects delegated by illycaffè (managers, legal staff, mailing and enveloping staff also external to the Company, IT staff that may also perform the role of system administrators being appointed as such in this case, staff of the Data Processors internal and external, consultants also external to the Company- such as IT technicians that may also perform the role of system administrators being appointed as such in this case and quality staff- interns, staff in charge of the website also external to the Company, marketing staff also external to the Company, staff of illy shop and/or illy caffè, hostess also external to the Company, internal auditor) and to data processors internal and external to the Company (e.g enveloping and shipping companies, IT outsourcers, marketing company and more in general consultants performing instrumental activities such as legal and communication advisors). The list of Data Processors is always available by contacting the Data Controller.

1. Data retention

Data will be retained by illycaffè for the entire period necessary for the pursuit of the purposes contained in this information. The data retention period is as follows:

• for legal obligations, regulations and community regulations, data may be retained for the periods imposed by these regulatory sources;
• for the purposes described in point 2 letter A of this policy, the data can be retained until the withdrawal of consent or request for cancellation without prejudice to the conservation in accordance with the law to prove the consent previously given;
• for the purposes described in point 2, letter B the data can be retained until the withdrawal of consent or request for cancellation not exceeding 12 months from their registration, save the effective transformation into anonymous form that does not allow, even indirectly or by linking other databases, to identify the data subjects;

in any case, all data may be retained for a period necessary to assert or defend a company right according to Italian and European regulations.

1. Data Controller and Data Protection Officer

The Data Controller is illycaffè S.p.A., having its registered office in via Flavia, 110 – 34147-Trieste (TS), Italy, telephone number +39.040.3890.111, fax number +39.040.3890.490, e-mail: infoprivacy@illy.com. There is also a Data Protection Officer available at the email address dpo@illy.com and at the addresses of the Company.

1. Rights.

We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.

1. Complaints

The data subject can always lodge a complaint with the Italian Data Protection Authority, whose references can be found on the website

1. Legal Basis

The legal basis the legal basis consists of legal obligations (Italian and European laws) as well as the legitimate interests of the Data Controller in the relationship with the user. Furthermore, for the purposes for which consent is provided, the legal basis is the consent itself.

1. Profiling

The processing of data for the purposes referred to in point 2, letter B of this privacy policy can be considered profiling. Profiling is based on consumer data to better understand his consumption habits and direct his purchases with targeted communications. The data are extracted and processed through software that create a consumption profile consisting in the indication of the actions carried out (adherence to an event, accessions to specific initiatives, purchase of certain products) and in the analysis of specific characteristics that can make better understand the customer category (e.g. age). This processing, however, does not constitute a specific risk for the data subject considering the type of basic profiling that does not require data of a particularly delicate nature or that allows the detailed reconstruction of particularly reserved aspects of private life. Moreover, they are not produced based on profiling, legal effects that affect the person concerned or that significantly affect his person, as no decision is made on the basis of automated processing which is used only to send advertising material in line with the tastes and habits of the interested party. However, everything is always filtered by physical subjects who send it to the defined groups. The interested party always has the right to obtain human intervention, to express his opinion, to obtain an explanation of the decision obtained and to challenge the decision.

1. Processing procedures

Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè may file data both on paper and IT support). illycaffè has implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. Data will be retained and processed by illycaffè in compliance with its confidentiality requirements and with the applicable local provisions in the different states in which illycaffè has its offices (in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. Data will be processed by illycaffè exclusively to achieve the aims set forth in this privacy policy. Data will be filed at illycaffè S.p.A. offices and at the appointed data processors (as well as third parties who receive data as specified in point 4 of this privacy policy). Data will be entered in databases, including IT databases.

N.B. The consent can only be given by persons over 14 years, if the subject is under 14, he cannot use what is provided for in the purposes for which consent is required (e.g. receiving commercial communication, profiling, ... ).

This privacy policy is updated as at 30/11/2018. Such update is carried out inside of policy of constant review of the informative ones. The versions of the previous policy statements are available writing to Data Controller (email dpo@illy.com).