Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR), national legislation in force in UK (Data Protection Act 2018 and Gdpr Uk), national legislation in force in Italy (dlgs 196/03) and subsequent amendments and supplements.

1.     General Information

illycaffè Uk- hereinafter also referred to simply as "ICUK" - and illycaffè S.p.A.-. hereafter also referred to simply as "illycaffè"- hereby communicate the information relating to the processing of your data/data of the company that you represent (hereafter referred to as "data subject" or "client") that will be in the possession of ICUK  (e.g. addresses, names, tax ID, VAT number, data concerning accounting, data necessary for customer management, contract execution and compliance with legal obligations, data concerning payments, data necessary for the defence or exercise of a company right) and illycaffè (e.g. addresses, names, e-mail, data concerning participation in an event, registration for special initiatives, purchase of a product, category of activity,  data necessary for the defence or exercise of a company right). The data relating to the solvency and debt behaviour of the person concerned may also be found at commercial information companies for the evaluation of the solvency and debt behaviour of the person concerned and communicated to these companies for the evaluation of his solvency and debt behaviour. In addition, data on insolvency, income and miscellaneous data on economic activity may be obtained from commercial information companies and public registers, lists, deeds or documents accessible to all.

2.     Purposes and legal basis

Data can be processed by the ICUK:

A) for pre-contract and contract purposes (e.g. orders management, fulfilment of administrative and accounting purposes, customer management). The processing is based on the following legal basis: necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

B) to asses the client and therefore for a legitimate interest in limiting insolvencies. The processing is based on the following legal basis: fulfillment of legitimate interests;

C) to carry out (even with the use of specific software, but without making decisions based on a fully automated process) an analysis on the type of customer and its activity, aimed at managing the customer and planning the activity and therefore for purposes related to the execution of the contract and the legitimate interests of the Company to develop business and commercial relations. Please note that the data subject may at any time request the result of the analysis and the resulting decisions. The processing is based on the following legal basis: fulfillment of legitimate interests; in considering these legitimate interests, it was analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest was assessed on the basis of a Triple Test available by contacting the company);

D) if you contact customer service by telephone, in order to document the content of the telephone call through its recording and thus for the legitimate interests of the Company consisting in being able to prove what was said during the telephone call itself.  The legal basis for the processing is the pursuit of legitimate interests. In considering these legitimate interests, it was analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the person concerned (the legitimate interest was assessed on the basis of a Triple Test available by contacting the Company.

Data can be processed by illycaffè:

E) in order to carry out marketing communications informing you about products, services, promotions and initiatives regarding the illy brand and the brands whose products are sold on illycaffè websites and apps and in order to carry out market researches and/or interviews on the product-services' illycaffè,  all performed and carried out by illycaffè via telephone numbers (and therefore also through SMS/MMS messages) and addresses (including the email address through which periodical newsletters can be received) you provided (we remind that emails and SMS/MMS messages can also be sent electronically with the help of automatic tools).

Please note that you may also communicate that you wish to be subject to the activities only by e-mail or only by telephone or postal communication, or to be subject only to marketing or market research activities, by writing to infoprivacy@illy.com or by contacting the company at the contact details given in point 6.

You can at any time withdraw your consent for said purposes by contacting the illycaffè at the official contacts. The processing is based on the following legal basis: consent.

F) to analyse information relating to commercial activity, all in order to better understand clients’ habits and propensity to purchase, and to guide purchases by means of communications (to the addresses provided) and specific initiatives or to carry out market surveys as set out in point 2(E), all taking into account the analysis itself; the legal basis for the processing is consent. If you do not consent to the processing of data for this purpose but authorize the use of profiling cookies in the appropriate section of the site, you may still be subject to the activities carried out through these cookies; purchasing data can be found at ICUK.

G) for the publication of the data subject data (address, name) in the illycaffè website and app and, consequently, for the company's legitimate interest in announcing the locations of its products. The processing is based on the following legal basis: pursuit of legitimate interests; in considering these legitimate interests, it was analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest was assessed on the basis of a Triple Test available by contacting the company).

Data can be processed by the ICUK and illycaffè:

H) to fulfil law obligations, European regulations and registrations. The processing is based on the following legal basis:  the fulfillment of legal obligations;

I) for legitimate interests such as to assert or defend an illycaffè Uk and illycaffè rights. The processing is based on the following legal basis: the fulfillment of legitimate interests; in considering these legitimate interests, it was analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest was assessed on the basis of a Triple Test available by contacting the company)

3.     Mandatory provision of data

The communication of the required data is necessary for the purposes stated at point 2 (A), 2 (H), 2 (I) and therefore refusal to provide such data, be it total or partial, may make it impossible for the Company to perform the contract or to proceed with the contract relationship.  The provision of the data for the purposes referred to in point 2 (B) is optional but the refusal to provide such data, be it total or partial, may make it impossible for the Company to perform the contract or to continue the contract. The provision of the data requested for the purposes referred to in point 2 (C) is optional and a possible refusal to provide such data will not have any consequence other than that of not being able to carry the activities referred to in point 2 (C) or of not taking into account the data not provided for these purposes.

The provision of data for the purposes indicated in point 2(D) is optional, but if you do not wish to be registered and therefore provide data for the purposes indicated in that point, you will not be able to receive telephone assistance. Therefore, if you do not want your call to be recorded, please do not continue the call and contact illycaffè UK through the other channels indicated on the www.illy.com website

The communication of the required data for the purposes stated at point 2 (E) is optional, as well as of the relevant consent (it is always possible to withdraw consent by addressing the Data Controller) and failure to provide such data and the relevant consent will entail no consequence other than not being able to perform the activities as described under this point or to the addresses that were not provided; the provision of the data requested for the purposes referred to in point 2 (F) is optional and a possible refusal to provide such data will not have any consequence other than that of not being able to carry the activities referred to in point 2 (F) or of not taking into account the data not provided for these purposes. The provision of the data requested for the purposes referred to in point 2 (G) is optional and a possible refusal to provide them, in whole or in part, may result in illycaffè being unable to publish the data.

4.     Data addressee categories

Notwithstanding any further communication (of which you will be informed unless not yet communicated) that may be necessary for the fulfilment of legal and contractual obligations, the Company may transmit the collected and processed data for those purposes listed under point no.2 letter A a.: banks, professionals (e.g. legal ones), advisors and service companies, carriers and couriers, distributors, logistics companies, judicial authorities and police and supervisory bodies, public institutions, debt collection agencies, post offices-couriers (communication of data necessary to send the possible aforementioned communications), consulting companies, factoring companies, companies to which credits can be transferred.

For the purposes listed at point no.2 (B), data can be transmitted to commercial and credit information companies.

For the purposes referred to in point 2 (C) and 2 (F), the data will not be communicated.

For the purposes indicated in point 2(D) the data may be communicated by illycaffè UK to judicial bodies, lawyers or legal advisors.

For the purposes listed at point no.2 (E), data can be transmitted to carriers and couriers in case paper material/communications have to be sent.

For the purposes referred to in point 2 (G), the data may be published on the illycaffè web site and apps.

For the purposes indicated in point 2(H), the data may be communicated to public bodies and police authorities.

For the purposes set out in point 2(I), the data may be communicated to lawyers-legal advisors, public bodies and judicial bodies and to the postal service (they may see the address to send any written communications).

The data may also be known and processed by persons specifically delegated by ICUK to process the data (administrative/legal, technical/IT and logistic staff, also outside ICUK, customer care staff also outside ICUK, marketing staff, also outside ICUK, members of the social bodies, commercial agents, heads of sector, sales administration, also outside ICUK, consultants - e.g. lawyers, legal experts, quality/certification consultants, IT consultants, tax consultants - trainees, internal auditors, employees of subcontractors) and by illycaffè (information systems staff and IT technicians, also external to illycaffè, marketing staff, also external to illycaffè, members of the company's organs, staff in charge of customer relations, also external to illycaffè, consultants - for example quality/certification consultants, IT and legal consultants - trainees, internal auditors, employees of data processors). The data may also be communicated to data processors appointed by ICUK (e.g. companies/consultants that carry out activities ancillary to those of the ICUK, such as, for example, tax, accounting and auditing consultancies/consultants, marketing and communication consultancies/consultants, logistics and shipping companies, customer care companies, IT consultancy companies/consultants, companies that collaborate in the management of the ICUK organization) and appointed by illycaffè (for example, companies/consultants that carry out activities ancillary to those of the company, such as, for example, marketing and communication companies, logistics and shipping companies, IT consultancy companies/consultants). The list of data processors can be found at ICUK and illycaffè (by contacting them at the addresses indicated in point 6). It should be remembered that for the debt collection activity, ICUK may use debt collection companies and lawyers (who are sometimes appointed as data processors).

5.     Data retention

Data can be retained and processed by the Company during the whole period necessary to pursue the purposes stated in this information report. The period of data retention is the following:

-for pre-contract purposes until the possible approval or formalization of the contract, except possible further retention provided for by UK legislations  and European legislations.

- for contract purposes until the termination of the employment and after the termination for the period of time set by Uk legislations  and European legislations;

- for the purposes referred to in point 2 (B), until the termination of the contract and even after the termination for the period determined by Uk regulations;

- for the purposes referred to in 2 (C), until the termination of the contract or the request for cancellation;

- for the purposes indicated in point 2(D):

a) for the entire period provided for by UK law for the retention of data concerning the contractual relationship or data whose retention is necessary to assert or defend a right of the company

b) for six months in the case of requests for general information that do not fall within the cases referred to in point a above.

- for the purposes referred to in point 2 (E), until you revoke your consent and/or request the deletion of your data (which you may do at any time, including by e-mail to infoprivacy@illy.com) without prejudice to retention for evidential purposes for the purposes indicated in point 2(H) and 2(I); by 31 December of the second year following the year of registration, you will in any case be sent a communication to understand whether you are still interested in being subject to the activities referred to in paragraph 2(E) and therefore to the retention of data by us for the purposes indicated in that paragraph and if such interest ceases, the data will be deleted without prejudice to the retention for the purposes indicated in point 2(H) and 2(I). If, on the other hand, there is still your interest in being subject to the activities referred to in point 2(E) and therefore to the retention of the data by us for the purposes indicated in that point, by 31 December of the second year from the communication, you will be sent a further communication of the same nature and so on until your interest remains;

-for the purposes referred to in point 2 (F) until the withdrawal of the consent or the request for cancellation (always possible by writing to the illycaffè addresses) or for a maximum of 12 months from the registration, except for real anonymization which does not allow, even indirectly or crossing the information with other databases, to identify the data subjects;

- for the purposes referred to in point 2 (G), data may be retained (and published) until cancellation/oblivion request if possible, according to law, without prejudice to retention for the purposes indicated in point 2(H) and 2(I)

- for law obligations, European regulations and legislations, data can be retained for periods of time set by said legislative sources;

-  in any case all data can be retained for such a period as necessary to exercise or defend company’s rights according to Uk, Italian and European legislations.

6.     Data Controller and Data Protection Officer

The data controller for the purposes indicated to the point 2 (A), 2 (B), 2(C) 2(D) 2(H), 2 (I)  is illycaffè UK Limited a company duly incorporated and validly existing under the laws of England & Wales, whose registered office is at Unit 7 – 8 Osyth Close Brackmills Northampton NN4 7DY, Ph: +44(0)1604 821234, e-mail sales.uk@illy.com. The data controller for the purposes indicated to the point 2 (E), 2 (F), 2 (G), 2 (H), 2 (I)  is illycaffè S.p.A. with headquarters in via Flavia 110, Trieste, phone +39  0403890111, fax +39 0403890490, e-mail infoprivacy@illy.com. There is also a Data Protection Officer available at the e-mail dpo@illy.com and at the Company’s addresses.

7.     Rights

Please note that the GDPR Uk and the GDPR, provides that you may request (by contacting illycaffè and ICUK at the contact details set out in point 6) access to and rectification of your personal data, erasure of your data or limitation of the processing concerning you, data portability; you may also have the opportunity, again by contacting illycaffè and ICUK, to oppose the processing of your data and to exercise the other rights contained in Chapter 3 Section 1 of the GDPR and GDPR UK, including the right to withdraw consent, where applicable: the withdrawal of consent shall not affect the lawfulness of the processing based on the consent given before the withdrawal

8.     Complaints

If you believe that the processing of your data is in violation of the provisions of the GDPR, you have the right to lodge a complaint with the Uk Data Protection Authority (whose contact details can be found at https://ico.org.uk/) and the Italian Data Protection authority ((whose contact details can be found at https://ico.org.uk/), as provided for in Article 77 of the Uk GDPR, or to take appropriate legal action (Article 79 of the Uk GDPR). 

9.     Logic used for profiling

The profiling referred to in point 2(F) is carried out by illycaffè through the analysis, also in an automated manner, of the data, characteristics and actions of the data subject (e.g. category of activity, target customers, geographic area, adhesion to an event, adhesion to particular initiatives, purchase of certain products, filling in questionnaires, actions carried out while browsing our websites if the data subject has accepted profiling cookies on the websites, interactions with customer care). A profile is then created, which is also included in specific groups (clusters). Profiling has the purposes indicated in point 2(F) and therefore to better understand the customer's propensity to purchase and also to propose services and products in line with the customer's needs through specific communications and initiatives; this processing, however, does not constitute a particular risk for the customer given the type of basic profiling that does not require data of a particularly delicate nature or that would allow the detailed reconstruction of particularly confidential aspects of private life. In any case, the data subject shall always have the right to obtain human intervention, to express his or her opinion, to obtain an explanation of the decision reached and to contest the decision.

10.  Processing procedures

We inform you that such data will be processed and stored by illycaffè and ICUK manually, on paper, computerized or telematic systems. Protection systems are in force to ensure confidentiality. All data will be stored and processed confidentially in compliance with all applicable regulations (in particular, the principles of correctness, lawfulness, transparency, and protection of confidentiality and rights) and strictly for the purposes referred to in this policy. The data will undergo only the operations necessary for the purposes referred to in this policy. The data will be stored by the data processors appointed by illycaffè and ICUK as well as the third parties to whom the data is transmitted in compliance with this policy. The data may also be organized in databases (also electronic ones).

11.  Collaborators/employees’ data

Please note that in case the interested party to whom this information report is addressed has to communicate to the Company - for reasons concerning the performance of the contract – names and contacts of their collaborators, the interested party must inform said collaborator of the information contained in this information report and of the fact that their data will be transmitted to the Company, which can process data for reasons concerning the performance of the contract, obtaining consent to transmission and processing where necessary.

Policy updated on 10/10/2023

Earlier versions are available from the illycaffè S.p.A. and illycaffè UK limited