Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR) and national legislation in force in Italy (D.Lgs.196/03)

1.    General information
We hereby inform you that, for the purposes indicated below, we, as 'illycaffè S.p.A. (data controller, hereinafter also referred to as the "Company" or "illycaffè" for the sake of brevity), will process the personal data that you have provided to us in the form or following the provision of the form. Only the data necessary for the purposes stated in this information note will be requested and processed.

2.    Purposes and legal basis
We may process data for the following purposes:
A.    in order to allow you to create an illycaffè account (My account) that allows you to access, with the same identification data, specific services, reserved areas and/or specific functions (dedicated to My account holders) of our websites and applications and those of our subsidiaries, as well as to access a restricted area to view and manage your relationship with us and our subsidiaries and thus, for example, to view purchases, manage shipping addresses, manage data processing authorisations, view initiatives or sections in which the My Account holder is registered, update data, upload a profile photo that will not be visible to other users, etc. Our subsidiaries that provide products or services that are also accessible through My Account may access your My account data if you enter into contractual relations with them (e.g. make purchases or subscribe to or activate services provided by a subsidiary). The list of the subsidiaries that access My Account (independent data controllers for the activities they carry out) is available by contacting us at the addresses indicated in point 6 of the policy. The legal basis for processing is consent. You may at any time request the deletion of your account;
B.    to sign up you in the reserved area of the site, to recognize you as a Professional customer and to let you access the reserved area to use it; the processing is based on the following legal basis: consent;
C.    to carry out advertising communications/information on our and our partners’ products-services-initiatives and to make market research and/or interviews for the evaluation of our product-services, all from us to the addresses that you provided in the form or other contact details provided later (please note that the sending of SMS/MMS and e-mail will also be in electronically with the help of automated tools); the consent can will  be possibly requested at further stage also on the registration pages of affiliates companies . The activities in this point will not be carried out without your consent. The processing is based on the following legal basis: consent;
D.    to be compliant with the requirements pursuant to the legislation in force, regulations or EU regulations. The processing is based on the following legal bases: the fulfillment of legal obligations;
E.    for legitimate interests such as to assert or defend the rights of the Company. The processing is based on the following legal bases: the pursuit of legitimate interests.

3.    Mandatory nature of the provision
The provision of the data required for the purposes set out in point 2(A) is optional, however, without providing this data, you will not be able to create a My Account/access its benefits and to access the reserved and the services of the reserved area itself. Consent (which you can always withdraw by contacting us at the addresses indicated in point 6) for the purposes indicated in point 2(A) is optional. However, without consent, you will not be able to create or maintain a My Account/access its benefits and to access the reserved area and the services of the reserved area itself.
The provision of the data required for the purposes set out in point 2(B) is optional, however, without providing this data, you will not be able to access the reserved area and the services of the reserved area itself. Consent (which you can always withdraw by contacting us at the addresses indicated in point 6) for the purposes indicated in point 2(A) is optional. However, without consent, you will not be able to access the reserved area and the services of the reserved area itself.
Provision of data for the purposes described point 2(C) of this privacy policy and the relative consent (which you can always withdraw, thus opposing the processing of your data for these purposes, by contacting us at the addresses indicated in point 6) are not mandatory; failure to provide such data and the consent will have not consequences, except that you will not be subject to the activities indicated in the point on our part or you will not be subject to the addresses you have not provided.
The provision of the data requested for the purposes of points 2(D) and 2(E) is necessary and, consequently, a possible refusal to provide them, in whole or in part, may result in the impossibility of creating or maintaining a My account/access its benefits and to access the reserved area and the services of the reserved area itself.

4.    Data addressee categories
We will not communicate the data to third parties, for the purposes indicated in point 2(A), above except for specific services, for which you will be subject to specific conditions and for which you will be asked for explicit consent where necessary, and except for access to the data by the subsidiaries as indicated in point 2(A).
For the purposes indicated in point 2(B), we will not communicate the data to third parties.
For the purposes indicated in point 2(C), we may communicate the data to the postal service/ express couriers (as the address is visible when sending any written material), in case of sending paper communications.
For the purposes of point 2(D) of this privacy policy, we may communicate the data to public authorities, the judiciary, the police.
For the purposes of point 2(E) of this privacy policy, we may communicate the data to  lawyers, solicitors, public authorities, the judiciary, the police, the post office (as the address is visible when sending any written material).
We will only communicate data that is indispensable for the purposes indicated in this policy privacy
The data may also be disclosed on our behalf, each for his or her role, to all subjects delegated by us to process the personal data data, (legal staff also external to the Company, marketing staff also external to the Company, staff in charge of the website also external to the Company - such as legal advisors, IT experts that may also perform the role of system administrators, and appointed as such, quality service staff and staff in charge of the administration of the website – IT system staff which may also be system administrators, and which are appointed as such, external relations staff also external to the Company, staff in charge of mailing and enveloping also external to the Company, internal auditors, trainees, staff of data processors) in addition to the data processors also delegated by us,  such as, for example, enveloping and shipping companies, IT outsourcing companies, call center, marketing consulting companies and, more generally, consultancy companies/firms that perform activities instrumental to those of illycaffè, such as, for example, legal and communications consultancy companies/firms. You can always ask us for the list of data processors by contacting us at the addresses given in point 6.

5.    Data retention
We will be conserved the personal data for the entire period necessary for the pursuit of the purposes indicated in this policy privacy. The data retention period is as follows:
-   for legal obligations, regulations and community regulations, for the periods imposed by these regulatory sources;
-   for the purposes described in point 2(A), until the withdrawal of consent or request for cancellation of data or My account without prejudice to retention for evidential purposes for the period provided for by law;
-    for the purposes described in point 2(B), until the withdrawal of consent or request for cancellation of data without prejudice to retention for evidential purposes for the period provided for by law;
-  for the purposes indicated in point 2(C) until consent is revoked or the request for cancellation is made, without prejudice to retention for evidential purposes for the period provided for by law;
-    for the purposes referred to in point 2(C) until revocation of the consent/request for deletion or for a maximum of 12 months from their registration, without prejudice to their actual transformation into an anonymous form which does not allow, even indirectly or by linking other databases, the identification of the data subjects;
in any case, all data may be conserved for a period necessary to assert or defend a company right according to Italian and European regulations.

6.    Data Controller and Data Protection Officer
The Data Controller is illycaffè S.p.A., having its registered office in via Flavia 110, Trieste, phone number +39.040.3890.111, fax number +39.040.3890.490, e-mail: infoprivacy@illy.com. There is also a Data Protection Officer available at the email address dpo@illy.com and at the addresses of the Company.

7.    Rights
Please note that the GDPR provides that you may request (by contacting us at the contact details set out in point 6) access to and rectification of your personal data, erasure of your data or limitation of the processing concerning you, data portability; you may also have the opportunity, again by contacting us, to oppose the processing of your data and to exercise the other rights contained in Chapter 3 Section 1 of the GDPR, including the right to withdraw consent, where applicable: the withdrawal of consent shall not affect the lawfulness of the processing based on the consent given before the withdrawal.

8.    Complaints
If you consider that the processing of your personal data is in violation of the GDPR and Nationals privacy regulations, you can  always address a complaint to the Italian Data Protection Authority whose contacts are available on the website www.garanteprivacy.it.

9.    Processing procedures
Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè may file data both on paper and IT support). We have implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. We will conserve and process the personal data, in compliance with its confidentiality requirements and with the applicable local provisions (i.e. in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. We will process personal data exclusively to achieve the aims described in this privacy policy. Data will be filed at illycaffè S.p.A. offices in Europe and at the appointed data processors (as well as third parties who receive data as independent data controllers as described in point 4 of this privacy policy). Data will be entered in databases, including IT databases.

10.    Access to collaborators
If you decide to allow access to your collaborators through the appropriate sharing function, you undertake to inform the collaborator of the communication of him/her e-mail to illycaffè so that illycaffè can send an e-mail containing the link to register, obtaining him/her consent, and informing him/her of everything contained in this privacy policy as well as the optional nature of the provision.

11.    Transfer of data outside the European Community
11.1    In case of access to the services offered by illycaffè North America INC, illycaffè uk ltd and llycaffè South America comercio, exportação e importação ltda, the data in My account may be viewed remotely also by these companies (for the purposes indicated in point 2 (A) and therefore by non-EU countries (USA, Brazil and United Kingdom). All this will take place either because it is necessary for the conclusion or performance of a contract entered into between the data controller and another natural or legal person in favour of the data subject, or on the basis of standard contractual clauses indicated by the European Commission and/or the competent supervisory authority and provided for by the GDPR (art. 46, par. 2, lett. c) to guarantee the transfer (a copy of which is available by contacting us at the addresses indicated in point 6) where in the countries indicated there is no specific adequacy decision for which the non-EU state is deemed to provide the same guarantees provided by European law.
11.2    Moreover, only for technical assistance needs, the data may be sent to companies operating outside the European Community that are specifically appointed as data processors, undertaking to comply with all the requirements of European legislation, including by signing the appropriate Contractual Clauses indicated by the European Commission and/or the competent supervisory authority and provided for by the GDPR (art. 46, par. 2, lett. c), (a copy of which is available by contacting us at the addresses indicated in point 6) where in the countries indicated there is no specific adequacy decision for which the non-EU state is deemed to provide the same guarantees provided by European law.; the data are only a copy of those contained in the European servers and a copy of the same can therefore always be found at illycaffè S.p.A.

Privacy policy updated to 3rd May 2022. This update is part of a policy of constant revision of the information. The versions of the previous disclosures can be obtained by contacting the Data Controller (e-mail infoprivacy@illy.com).