Privacy policy pursuant to national legislation in force in UK (Data Protection Act 2018), to Regulation (EU) 2016/679 (GDPR), and subsequent amendments and supplements

1. General information
illycaffè UK Limited (hereinafter, also “illycaffè UK”) inform you (hereinafter, also referring to you as the “user”) that it will process your personal data communicated by you also within the message. Only the data necessary for the purposes referred to in this policy will be requested and processed. The data may also be processed in the European Community by illycaffè S.p.A. and its suppliers (sub data processors) with registered office in via Flavia 110 Trieste as data processor.

2. Purposes and legal basis
The data will be processed by illycaffè UK:
A.    to manage your request and thus provide you with any answers. The processing is based on the following legal basis: consent;
B.    to fulfill an obligation established by law (for this purpose the legal basis is the fulfillment of legal obligations) and for legitimate interests such as to assert or defend an illycaffè UK rights (for this purpose the legal basis is the fulfillment of legal obligations).

3. Mandatory provision of data
The provision of data for the purposes referred to in point 2(A) and the consent to its processing are optional and failure to provide data may make it impossible to respond to your request. Consent for this point (2A) is always optional and always revocable, and failure to give consent make it impossible to respond to your request. The provision of data is necessary for the purposes referred to in the previous point 2(B) and failure to provide data may make it impossible to respond to your request and/or may always involve the consequences provided for by law.

4. Data addressee categories
For the purposes indicated in point 2(A), the data may be communicated by illycaffè UK to affiliated companies/distributors, offices of the Università del Caffè, post offices/ express Couriers (which can see the address for sending any written communications/other materials) where necessary to manage a request.
The data may be disclosed to lawyers or legal consultants, public bodies, judicial bodies, police forces and post offices (which can see the address for sending any written communications) for the purposes referred to in point 2(B) of this policy.
The data may be disclosed on behalf of illycaffè UK, each for own role, to all subjects delegated by illycaffè UK (public relations staff, legal affairs staff who may also be external to the Company, consultants - e.g. legal consultants, IT technicians- information systems officers, staff in charge of the specific sector inherent to the request, web site gestion staff, collaborators of the data processors) and to data processors (IT outsourcers, enveloping and shipping companies, companies that support illy UK in various activities). The full list of data processors is available upon request to the illycaffè UK by contacting it at the addresses indicated in point 6.

5. Data retention
The data will be retained for the whole period necessary for the purposes stated in this policy. The data retention period is as follows:
- for legal obligations, regulations and EU legislation, the data may be kept for the terms provided for by each regulatory source;
- for the purposes indicated in point 2(A), the data may be conserved up to a maximum of 6 months from the final reply to the request;
in any case, all data can be kept for a period necessary to assert or defend a company right based English, Italian and European regulations.

6. Data Controller and Data Protection Officer
The data controller is illycaffè UK Limited a company duly incorporated and validly existing under the laws of England & Wales, whose registered office is at Unit 7 – 8 Osyth Close Brackmills Northampton NN4 7DY, Ph: +44(0)1604 821234, e-mail sales.uk@illy.com.

7. Rights
We inform you that the GDPR and the Data Protection Act 2018 allows the data subject to request to the Data Controller (at the contacts mentioned above) full access to personal data and its correction, cancellation or limitation of the processing and to object to the processing, in addition to exercising the right to data portability, as well as other rights provided for by Chapter 3 of the GDPR and by Chapter 3 of the Data Protection Act 2018, including that of revoking consent, where envisaged: the revocation of consent does not affect the lawfulness of the processing based on the consent given before the revocation.

8. Complaints
The data subject can always lodge a complaint with the British Supervisory Authority whose references can be found on the website https://ico.org.uk/. And, for for data processing within the European Community, the italian Data protection Authority whose references can be found on the website www.garanteprivacy.it

9. Processing procedures
We inform you that such data will be processed and stored by illycaffè UK manually, on paper, computerized or telematic systems. Protection systems are in force to ensure confidentiality. All data will be stored and processed confidentially in compliance with all applicable regulations (in particular, the principles of correctness, lawfulness, transparency, and protection of confidentiality and rights) and strictly for the purposes referred to in this policy. The data will undergo only the operations necessary for the purposes referred to in this policy. The data will be stored by the data processors appointed by illycaffè UK as well as the third parties to whom the data is transmitted in compliance with this policy. The data may also be organized in databases (also electronic ones).

Policy updated on 27th October 2021.