Privacy policy pursuant to Regulation Data Protection Act 2018, UK General Data Protection Regulation and subsequent amendments and supplements

1.   General information

illycaffè UK Limited - hereinafter also referred to as “illycaffè UK” or “Company”- hereby communicates the information relating to the processing of your data.

2.   Purposes and legal basis

illycaffè UK may process data for the following purposes:

A.   in order to be able to contact you to establish a business relationship and therefore for pre-contractual purposes the legal basis is the necessity of the processing for the execution of pre-contractual measures performed at the request of the data subject;

B.   to fulfill an obligation established by law (for this purpose the legal basis is the fulfillment of legal obligations) and for legitimate interests such as to assert or defend illycaffè UK rights (for this purpose the legal basis is the pursuit of legitimate interests).

3.   Mandatory provision of data

The provision of the data requested is necessary for the purposes of points 2(A) and 2(B) and, therefore, a possible refusal to provide them, in whole or in part, may cause the impossibility of establishing a commercial relationship.

4.   Data addressee categories

The data collected and processed may be disclosed by illycaffè UK for the purposes of point 2(A) to post offices / couriers (by communicating the data necessary for the sending of any communications); for the purposes of point 2(B), the data may be disclosed by illycaffè UK to advisors (e.g., lawyers), judicial and police authorities, public bodies, post offices / couriers (by communicating the data necessary for the sending of any communications). The data may also be known and processed by subjects delegated by illycaffè UK, each for own role, to process the data (administrative/legal, technical/informatics and logistic staff, also external to illycaffè UK, staff in charge of customer relations, also external to illycaffè UK, persons in charge of the management of the websites, also external to illycaffè UK, members of company boards, advisors - e.g. lawyers, quality/certification advisors, IT advisors- trainees, internal auditors, staff of external data processors).The data may also be communicated to external data processors appointed by illycaffè UK (e.g. companies/consultants that carry out activities ancillary to those of illycaffè UK, such as, for example, IT consultancy companies/consultants, website management companies, companies that collaborate in the management of illycaffè UK 's organization, logistics and shipping companies). The full list of data processors is available upon request to illycaffè UK at the addresses indicated in point 6.

5.   Data retention

Data will be retained by illycaffè UK for the entire period necessary for the pursuit of the purposes contained in this information. The data retention period is as follows:

-       for the purposes described in point 2(A) of this policy, the data can be retained until any approval or formalization of the contract, unless otherwise provided for by UK laws;

-       for legal obligations, regulations and community regulations, data may be retained for the periods imposed by these regulatory sources;

in any case, all data may be retained for a period necessary to assert or defend a company right according to UK laws.

6.   Data Controller

The data controller is llycaffè UK Limited a company duly incorporated and validly existing under the laws of England & Wales, whose registered office is at Unit 7 – 8 Osyth Close Brackmills Northampton NN4 7DY, Ph: +44(0)1604 821234, e-mail sales.uk@illy.com.

7.   Rights

We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to exercising the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.

8.   Complaints

The data subject can always lodge a complaint with the British Supervisory Authority whose references can be found on the website https://ico.org.uk/.

9.   Processing procedures

Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè UK may file data both on paper and IT support). illycaffè UK has implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. Data will be retained and processed by illycaffè UK in compliance with its confidentiality requirements and with the applicable local provisions (i.e. in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. Data will be processed by illycaffè UK exclusively to achieve the aims described in this privacy policy.

Policy updated on 30^th September 2021.