Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR), national legislation in force in UK (Data Protection Act 2018 and Uk GDPR), and national legislation in force in Italy (D.Lgs. 196/03)

1.    General information
illycaffè Uk Limited ((hereinafter, also “illycaffè UK”) and illycaffè S.p.A. (hereinafter, also “illycaffè”) inform you (hereinafter, also referring to you as the “user”) that it will process the personal data you have provided for the purposes illustrated below. Only the data necessary for the purposes referred to in this policy will be requested and processed.

2.    Purposes and legal basis
The data will be processed by illycaffè UK:
A.    to enroll you in the ILLY LOVERS program as per the General Membership Conditions and to let you enjoy the dedicated benefits. The processing is based on the following legal basis: need for for the performance of a contract;
The data will be processed by illycaffè UK and illycaffè:
B.    to fulfill an obligation established by law, by a regulation or by EU legislation; for these purposes the legal basis is the fulfillment of legal obligations;
C.    for legitimate interests such as to assert or defend an illycaffè Uk and illycaffè rights (for these purposes the legal basis is the fulfillment of legal obligations).
The data will be processed by illycaffè S.p.A:
D.    in order to allow you to create an illycaffè account (My account) that allows you to access, with the same identification data, specific services, reserved areas and/or specific functions (dedicated to My account holders) of our websites and applications and those of our subsidiaries, as well as to access a restricted area to view and manage your relationship with us and our subsidiaries and thus, for example, to view purchases, manage shipping addresses, manage data processing authorisations, view initiatives or sections in which the My Account holder is registered, update data, upload a profile photo that will not be visible to other users, etc. Our subsidiaries that provide products or services that are also accessible through My Account may access your My account data if you enter into contractual relations with them (e.g. make purchases or subscribe to or activate services provided by a subsidiary). The list of the subsidiaries that access My Account (independent data controllers for the activities they carry out) is available by contacting us at the addresses indicated in point 6 of the policy. The legal basis for processing is consent. You may at any time request the deletion of your account;
E.    to deliver advertising communications and information on products, services, programs of illycaffè and its partners and to carry out market research and/or surveys regarding illycaffè products and services. For these purposes, illycaffè will use the e-mail address you provided in the registration form or other contact details provided also afterwards (please note that e-mails and SMS/MMS can also be sent through automated systems). The processing is based on the following legal basis: consent;
F.    in order to create, on the basis of the information in  possession of illycaffè about you, a your profile (profiling) including the study of your consumption habits and choices derived also from the analysis of your product choices, aimed at carrying out specific marketing, promotion, direct sales and commercial communications activities by illycaffè, in accordance with the your specific needs that emerge from the profiling and also aimed at analysing the choices and consumption habits of illycaffè product customers to improve business development. Processing for this purpose will also take place in databases in automated form. illycaffè will be able to create both a profile of the individual user and of homogeneous classes of users. illycaffè may also combine and compare data from different databases of our partners (associated, subsidiary and parent companies of illycaffè S.p.A. resident in the European Union and associated, subsidiary and parent companies of the illy S.p.A. Group resident in the European Union). See also point 9 of the privacy policy. illycaffè will carry out marketing, promotion, commercial communication and direct sales activities only if you have consented to such processing. The processing is based on the following legal basis: consent. If you do not consent to the processing of your data for this purpose but authorise the use of profiling cookies in the appropriate section of the site, you may still be subject to the activities carried out by means of such cookies;

3.    Mandatory provision of data
The provision of data is necessary for the purposes referred to in the previous point 2(A), and any refusal to provide it in whole or in part may give rise to the impossibility for the illycaffè UK to enroll you in the ILLY LOVERS program/ access its benefits.
The provision of the data required for the purposes set out in point 2(D) is optional, however, without providing this data, you will not be able to create a My Account/ access its benefits and to enroll you in the ILLY LOVERS program/ enjoy the its dedicated benefits.
Consent (which you can always withdraw by contacting illycaffè at the addresses indicated in point 6) for the purposes indicated in point 2(D) is optional. However, without consent, you will not be able to create or maintain a My Account/access its benefits and to enroll you in the ILLY LOVERS program/ enjoy its dedicated benefits. Provision of data for the purposes described point 2(E) of this privacy policy and the relative consent (which you can always withdraw, thus opposing the processing of your data for these purposes, by contacting us at the addresses indicated in point 6) are not mandatory; failure to provide such data and the consent will have not consequences, except that you will not be subject to the activities indicated in the point on our part or you will not be subject to the addresses you have not provided.
Provision of data for the purposes described point 2(F) of this privacy policy and the relative consent (which you can always withdraw, thus opposing the processing of your data for these purposes, by contacting us at the addresses indicated in point 6) are not mandatory; failure to provide such data and the consent will have not consequences, except that you will not be subject to the activities indicated in the point on our part  or will not be subject with the data not provided.
The provision of the data requested for the purposes of points 2(B) and 2(C) is necessary and, consequently, a possible refusal to provide them, in whole or in part, may result in the impossibility of creating or maintaining a My account/ access its benefits, to enroll you in the ILLY LOVERS program/ enjoy its dedicated benefits and/or being subject to the activities indicated in this information notice.

4.    Data addressee categories
The data collected and processed may be disclosed to public bodies and notaries and post offices (which can see the address for sending any written communications) for the purposes referred to in point 2 (A).
The data may be disclosed to public bodies, judicial bodies, police forces for the purposes referred to in point 2 (B). The data may be disclosed to lawyers or legal consultants, public bodies, judicial bodies, police forces and post offices (which can see the address for sending any written communications) for the purposes referred to in point 2 (C).
The data will not communicate to third parties, for the purposes indicated in point 2(D), above except for specific services, for which you will be subject to specific conditions and for which you will be asked for explicit consent where necessary, and except for access to the data by the subsidiaries as indicated in point 2(D).
For the purposes referred to in point 2(E), the data may be disclosed to forwarding agents and post offices, for the dispatch of advertising material.
For the purposes referred to in point 2(F), the data will not be disclosed to third parties. illycaffè Uk and illycaffè will disclose only the data necessary for the pursuit of the purposes referred to in this policy. The data may be disclosed on behalf of illycaffè UK, each for own role, to all subjects delegated by illycaffè UK [employees in charge of the Program (also external to the Company), employees in charge of public relations (also external to the Company), administrative employees, the IT staff (also external to the Company, who can also carry out system administration duties being appointed as such in this case), consultants (also external to the Company) such as IT technicians who can also carry out system administration duties being appointed as such in this case or legal consultants, interns, website management staff (also external to the Company), marketers (also external to the Company), call center employees (also external to the Company), enveloping and shipping staff (also external to the Company), legal procedures employees (also external to the Company), staff of data processors, internal auditor], and to data processors  (such as marketing companies, IT outsourcers, enveloping and shipping companies, call center companies, companies that support illy UK in various activities). The data may be disclosed on behalf of illycaffè, each for own role, to all subjects delegated by illycaffè [employees in charge of public relations (also external to the Company), administrative employees, the IT staff (also external to the Company, who can also carry out system administration duties being appointed as such in this case), consultants (also external to the Company) such as IT technicians who can also carry out system administration duties being appointed as such in this case or legal consultants, interns, website management staff (also external to the Company), marketers (also external to the Company), call center employees (also external to the Company), enveloping and shipping staff (also external to the Company), legal procedures employees (also external to the Company), staff of data processors, internal auditor], and to data processors (such as marketing companies, IT outsourcers, enveloping and shipping companies, call center companies). The full list of data processors is available upon request to the illycaffè UK and illycaffè (by contacting them at the addresses indicated in point 6).

5.    Data retention
The data will be retained for the whole period necessary for the purposes stated in this policy. The data retention period is as follows:
-   for legal obligations, regulations and EU legislation, the data may be kept for the terms provided for by each regulatory source;
-    for the purposes referred to in point 2(A) of this policy, for the terms established by law or up to the withdrawal of the Member from the ILLY LOVERS program without prejudice to the retention in accordance with the law;
-    for the purposes described in point 2(D), until the withdrawal of consent or request for cancellation of data or My account without prejudice to retention for evidential purposes for the period provided for by law;
-    for the purposes indicated in point 2(E) until consent is revoked or the request for cancellation is made, without prejudice to retention for evidential purposes for the period provided for by law;
-    for the purposes referred to in point 2(F) until the withdrawal of the consent or the request for cancellation or for a maximum of 12 months from the registration, except for real anonymization which does not allow, even indirectly or crossing the information with other databases, to identify the data subjects;
in any case, all data can be kept for a period necessary to assert or defend a company right based English, Italian and European regulations.

6.    Data Controller and Data Protection Officer
The data controller for the purposes indicated to the point 2(A), 2(B) is llycaffè UK Limited a company duly incorporated and validly existing under the laws of England & Wales, whose registered office is at Unit 7 – 8 Osyth Close Brackmills Northampton NN4 7DY, Ph: +44(0)1604 821234, e-mail sales.uk@illy.com.. The data controller for the purposes indicated to the point 2 (B), 2 (C), 2 (D), 2 (E), is illycaffè S.p.A. with headquarters in via Flavia 110, Trieste, phone +39 0403890111, fax +39 0403890490, e-mail infoprivacy@illy.com. There is also a Data Protection Officer available at the e-mail dpo@illy.com and at the Company’s addresses.

7.    Rights
Please note that the GDPR and GDPR Uk, provide that you may request (by contacting illycaffè and/or illycaffè UK at the contact details set out in point 6) access to and rectification of your personal data, erasure of your data or limitation of the processing concerning you, data portability; you may also have the opportunity, again by contacting illycaffè and/or illycaffè UK, to oppose the processing of your data and to exercise the other rights contained in Chapter 3 Section 1 of the GDPR and the GDPR Uk, including the right to withdraw consent, where applicable: the withdrawal of consent shall not affect the lawfulness of the processing based on the consent given before the withdrawal.

8.    Complaints
If you consider that the processing of your personal data is in violation of the GDPR, GDPR UK and Nationals privacy regulations, you can always address a complaint to the British Supervisory Authority (for illycaffè UK) whose references can be found on the website https://ico.org.uk/ and to the italian Data protection Authority (for illycaffè) whose references can be found on the website www.garanteprivacy.it.

9.    Logic used for profiling
The profiling referred to in point 2(F) takes place on our part through the analysis, also in an automated manner, of your data and your characteristics (for example, age, geographical area, sex, adhesion to an event, adhesion to particular initiatives, purchase of certain products, completion of questionnaires, actions carried out during navigation on our websites if you have accepted the profiling cookies on our websites). We then create a consumer profile that is also included in specific groups (clusters). Profiling has the purposes indicated in point 2(F); such processing, however, does not represent a particular risk for you, given the type of basic profiling that does not require data of a particularly sensitive nature or that would allow the detailed reconstruction of particularly confidential aspects of your private life. You will always have the right to obtain human intervention, to express your opinion, to obtain an explanation of the decision made and to contest the decision.

10.    Processing procedures
We inform you that such data will be processed and stored by illycaffè Uk and illycaffè manually, on paper, computerized or telematic systems. Protection systems are in force to ensure confidentiality. All data will be stored and processed confidentially in compliance with all applicable regulations (in particular, the principles of correctness, lawfulness, transparency, and protection of confidentiality and rights) and strictly for the purposes referred to in this policy. The data will undergo only the operations necessary for the purposes referred to in this policy. The data will be stored by the data processors appointed by illycaffè UK and illycaffè as well as the third parties to whom the data is transmitted in compliance with this policy. The data may also be organized in databases (also electronic ones).

11.    Transfer of data outside the European Union
11.1    In case of access to the services offered by illy caffè North America INC, illycaffè UK Ltd and llycaffè Sud America Comercio, Exportação e Importação Ltda, the data in My account may be viewed remotely also by these companies (for the purposes indicated in point 2(A) and therefore by non-EU countries (USA, Brazil and United Kingdom). All this will take place either because it is necessary for the conclusion or performance of a contract entered into between the data controller and another natural or legal person in favour of the data subject, or on the basis of standard contractual clauses indicated by the European Commission and/or the competent supervisory authority and provided for by the GDPR (art. 46, par. 2, lett. c) to guarantee the transfer (a copy of which is available by contacting us at the addresses indicated in point 6) where in the countries indicated there is no specific adequacy decision for which the non-EU state is deemed to provide the same guarantees provided by European law.
11.2    Moreover, only for technical assistance needs, the data may be sent to companies operating outside the European Community that are specifically appointed as data processors, undertaking to comply with all the requirements of European legislation, including by signing the appropriate Contractual Clauses indicated by the European Commission and/or the competent supervisory authority and provided for by the GDPR (art. 46, par. 2, lett. c), (a copy of which is available by contacting us at the addresses indicated in point 6) where in the countries indicated there is no specific adequacy decision for which the non-EU state is deemed to provide the same guarantees provided by European law.; the data are only a copy of those contained in the European servers and a copy of the same can therefore always be found at illycaffè S.p.A.

Privacy policy updated to 03rd May 2022. This update is part of a policy of constant revision of the information. The versions of the previous disclosures can be obtained by contacting the Data Controller (e-mail infoprivacy@illy.com and sales.uk@illy.com).