1.    General information

illycaffè UK LTD (hereinafter also referred to as "Company" or "illycaffè UK" for brevity) informs you that, for the purposes indicated below, it will process your personal data communicated by you. Only the data necessary to the pursuit of the purposes set out in this privacy policy will be requested and processed. If you are acting as the legal representative of a company/company/entity, we will indicate the company/company/entity that you represent and your data will only be processed by us to identify you as the legal representative and for the purposes indicated in point 2 letters A, B, C, D.

2.    Purposes and legal basis

We may process data for the following purposes:

A.     in order to be able to process your request for information and to do whatever is necessary to fulfil your request. The legal basis for the processing is consent;

B.     to be compliant with the requirements pursuant to the legislation in force, regulations or EU regulations. The processing is based on the following legal bases: the fulfillment of legal obligations;

C.     for legitimate interests such as to assert or defend the rights of the Company. The legal basis for the processing is the pursuit of legitimate interests; in considering these legitimate interests, it was analyzed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest was assessed on the basis of a Triple Test available by contacting the Company);

D.     In order to document the content of the telephone call through its recording and thus for the legitimate interests of the Company consisting in being able to prove what was said during the telephone call itself.  The legal basis for the processing is the pursuit of legitimate interests. In considering these legitimate interests, it was analyzed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the person concerned (the legitimate interest was assessed on the basis of a Triple Test available by contacting the Company).

3.    Mandatory nature of the provision

The provision of data for the purposes indicated in point 2(A) is optional, but failure to provide such data may make it impossible to process your request. The provision of data for the purposes indicated in point 2(A) is optional, but failure to provide consent will make it impossible to fulfil your request.

The provision of data for the purposes indicated in point 2(B) (obligatory if required by law) and 2(C) is necessary and failure to provide such data may make it impossible to fulfil your request.

The provision of data for the purposes indicated in point 2(D) is optional, but if you do not wish to be registered and therefore provide data for the purposes indicated in that point, you will not be able to receive telephone assistance. Therefore, if you do not want your call to be recorded, please do not continue the call and contact illycaffè UK through the other channels indicated on the www.illy.com website

4.    Data addressee categories

For the purposes indicated in point 2(A), data may be communicated by illycaffè UK to subsidiaries/distributors/offices of the Università del Caffè, service centers, carriers/shippers.

For the purposes indicated in point 2(B), the data may be communicated by illycaffè UK to public bodies and police authorities.

For the purposes set out in point 2(C), the data may be communicated by illycaffè UK to public bodies and judicial bodies and also, to assert or defend a right, to lawyers-legal advisors, public bodies, judicial bodies and police organs and to the postal service (they may see the address to send any written communications).

For the purposes indicated in point 2(D) the data may be communicated by illycaffè UK to judicial bodies, lawyers or legal advisors.

illycaffè UK will only communicate the data that is indispensable for the pursuit of the individual purposes indicated in this statement.

The data may also be disclosed on behalf of illycaffè UK, each according to his or her role, to all persons delegated by the Company (public relations staff also external to the Company, legal affairs staff also external to the Company, consultants also external to the Company - e.g. legal consultants, computer technicians - information systems staff, shipping and envelope stuffing staff also external to the Company and persons in charge of the specific sector inherent to the request - e.g. personnel of the University of Coffee for information on the University of Coffee, marketing staff for commercial information, etc.- internal auditors, privacy management staff also external to the company, collaborators of the data processors) and to data processors (foe example, enveloping and mailing companies, IT outsourcing companies, companies that manage call centers, companies that provide administrative, organizational and IT support, and more generally companies-studios that carry out activities instrumental to those of illycaffè UK, such as, for example, companies-studios providing legal advice). You can always ask us for the list of data processors by contacting us at the addresses given in point 6.

5.    Data retention

The data will be conserved for as long as is necessary for the pursuit of the purposes contained in this privacy policy. The period of data retention is as follows:

I. for legal obligations, regulations and EU legislation, for the periods imposed by these regulatory sources;

II. for communications of a general nature and not related to contractual disputes or requests and for the purposes indicated in point 2(A), up to a maximum of six months from the final response to the request

III. for the purposes indicated in point 2(D):

a) for the entire period provided for by UK law for the retention of data concerning the contractual relationship or data whose retention is necessary to assert or defend a right of the company

b) for six months in the case of requests for general information that do not fall within the cases referred to in point a above.

IV. in any event, all data may be kept for the period necessary to assert or defend a right of the company in accordance with UK law.

6.    Data Controller

The Data Controller is illycaffè UK Limited a company duly incorporated and validly existing under the laws of England & Wales, whose registered office is at Unit 7 – 8 Osyth Close Brackmills Northampton NN4 7DY, Ph: +44(0)1604 821234, e-mail sales.uk@illy.com.

However, as a precautionary measure, the company has appointed illycaffè S.p.A. with registered office in via Flavia 110 Trieste, as the Data Controller's Representative in the European territory for subjects located in the European Union.

7.    Rights

Please note that the UK GDPR provides that you may request (by contacting us at the contact details set out in point 6) access to and rectification of your personal data, erasure of your data or limitation of the processing concerning you, data portability; you may also have the opportunity, again by contacting us, to oppose the processing of your data and to exercise the other rights contained in Chapter 3 Section 1 of the UK GDPR, including the right to withdraw consent, where applicable: the withdrawal of consent shall not affect the lawfulness of the processing based on the consent given before the withdrawal.

8.    Complaints

If you believe that the processing of your data is in breach of the provisions of the UK GDPR, you have the right to lodge a complaint with the UK Supervisory Authority (whose contact details can be found at https://ico.org.uk/), or to take appropriate legal action (art 78 UK GDPR).

9.      Processing procedures

Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè UK may file data both on paper and IT support). We have implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorized access. We will conserve and process the personal data, in compliance with its confidentiality requirements and with the applicable local provisions (i.e. in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. We will process personal data exclusively to achieve the aims described in this privacy policy. Data will be entered in databases, including IT databases.

10.   Transfer of data outside the UK

The data may be known and therefore transferred outside the UK to companies that provide IT or call management services on behalf of the Company that are specifically appointed as data processors. Said subjects undertake to comply with all the requirements of the UK legislation, also by signing the appropriate Contractual Clauses and/or the competent control Authority and provided for by the UK GDPR (a copy of which is available by contacting us at the contact details indicated in point 6), where in the countries indicated there is not a specific adequacy decision for which the non-UK state is deemed to provide the same guarantees provided for by UK law or; in any case, all the guarantees provided for by law are adopted. The list of subjects and therefore of the states to which the data may be transferred can be found by contacting the Company at the addresses given in point 6.

Privacy policy updated to 11/08/2023. This update is part of a policy of constant revision of the information. The versions of the previous disclosures can be obtained by contacting the Data Controller (e-mail sales.uk@illy.com).