On May 25, 2018 the new European regulation on personal data entered into force.

illycaffè S.p.A. informs you that everything contained in the previous privacy policy (provided pursuant to art. 13 of Legislative Decree 196/2003)  is confirmed with the following  changes and additions.


Where the Legislative Decree 196/2003 is mentioned, this must be replaced by the EU 2016/679 European Regulation and related sections.

We indicate the parts that complete or replace what was previously written in the privacy policy.

  1. Data Controller and Data Protection Officer (instead of the previous section “Data Controller”)
    The Data Controller is illycaffè S.p.A., having its registered office in via Flavia 110, Trieste, phone number +39.040.3890.111, fax number +39.040.3890.490, e-mail: infoprivacy@illy.com. There is also a Data Protection Officer available at the email address dpo@illy.com and at the addresses of the Company.
  2. Rights (instead of the section 7 of Legislative Decree 196/2003)
    We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.
  3. Complaints
    The data subject can always lodge a complaint with the Italian Data Protection Authority, whose references can be found on the website www.garanteprivacy.it.
  4. Legal Basis
    The legal basis the legal basis consists of legal obligations (Italian and European laws) as well as the legitimate interests of the Data Controller in the customer-supplier relationship. Furthermore, for the purposes for which consent is provided, the legal basis is the consent itself.
  5. Data retention
    Data will be retained (depending on the purpose contained in the policy) and processed by illycaffè for the entire period necessary for the pursuit of the purposes. The data retention period is as follows:
  • For the pre-contractual purposes until the eventual approval or formalization of the contract, subject to possible further conservation provided by Italian and European regulations;
  • For contractual purposes until the end of the relationship and also following the end for the period determined by Italian and European regulations, including in tax matters;
  • For legal obligations, regulations and community regulations, data may be retained for the periods imposed by these regulatory sources;
  • To carry out advertising communications/information and market research and/or interviews the data can be retained until the withdrawal of consent or request for cancellation without prejudice to the conservation in accordance with the law to prove the consent previously given;
  • For profiling the data can be retained until the withdrawal of consent or request for cancellation not exceeding 12 months from their registration, save the effective transformation into anonymous form that does not allow, even indirectly or by linking other databases, to identify the data subjects;
  • For publishing the name and the address of the point of sale on illycaffè websites to allow the consumer to know where illy coffee is served, the data can be retained until the client is illycaffè customer or until the request for cancellation (right to be forgotten);

in any case, all data may be retained for a period necessary to assert or defend a company right according to Italian and European regulations.

  1. Profiling (if provided)
    The profiling is based on customer data related to its purchases in order to better understand his consumption habits and direct his purchases with targeted communications. The data are extracted and processed through software that creates a consumption profile consisting of the indication of the most purchased products. This processing, however, does not constitute a particular risk for the data subject considering the business-to-business relationship and the purposes of profiling.

Where consent is excluded, the section 24 of Legislative Decree 196/2003 will be replaced with the different legal bases provided for by art. 6 of the Regulation.