back

Privacy policy for data collection at illy SHOP_illy CAFFÈ (accounting purposes)

Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR) and national legislation in force

General information
illycaffè S.p.A. (hereinafter also referred to "illycaffè” or "Company") having its registered offices at Via Flavia 110, Trieste, Italy, Register of Companies of Trieste - registration number and VAT code IT00055180327 informs you that it will process some personal data of you/of a firm/company represented by you (as a customer, hereinafter also referred to “customer” or “data subject”) instrumental to achieve the purposes of this privacy policy. illycaffè may only require and process data which are instrumental to achieve the purposes of this privacy policy. The data are collected from the data subject, from third parties (in the cases specified in point 2 of this privacy policy) or as a result of processing by illycaffè.
Purposes
The data can be processed by illycaffè:
for administrative and accounting purposes (including the practices necessary for the management of the Tax Free Refund), to be compliant with the requirements pursuant to the legislation in force, regulations or EU regulations and for legitimate interests such as to assert or defend the rights of the Company in the appropriate offices; some data (VAT number, Company name, address) may also be collected in public records and business information companies if illycaffé is not in possession of any of these data essential to the contract or if illycaffé want to verify the correctness of data.
Mandatory nature of the provision
The provision of data requested for the purposes under point 2 of this privacy policy is necessary and the lack of them could make it impossible for illycaffè to execute the contract or continue the contractual relationship. If other data are required for other purposes you will be informed of the new purposes and consequences of failure to provide them. Any such new purposes will of course be subject to your specific new and free consent if it is expected.
Data recipient categories
Without prejudice to any further communications that may be necessary for legal and fiscal purposes, the data may be communicated by illycaffè for the purposes under point 2 of this privacy policy to: postal carriers and freight forwarders (for any communication), to organizations and public bodies or police forces (in the case of justified claims or provision of law), external consultants (e.g. legal), to audit firms or individual auditors (if not appointed as Data Processor), to business information companies to verify the correctness of the data as specified in point 2 of the privacy policy.
Please note that illycaffé can communicate data which are instrumental to achieve each purpose.
The data may be disclosed on behalf of illycaffè, each for own role, to all subjects delegated by illycaffè (illy Shop and/or illy Caffè staff also external to the Company, administrative/legal and logistic staff- also envelope filling and mailing staff also external to the Company, executives, managers, members of the Board of Directors and the Board of Auditors, IT staff that can also carry out tasks of system administrators, being appointed as such in this case, customer service staff, call center staff, advisors also external to the Company- e.g. quality consultants/certifications, IT technicians that can also carry out tasks of system administrators being appointed as such in this case, lawyers, tax consultants – trainees, internal auditor, staff of the internal and external data processors) and to internal and external data processors (such as enveloping and shipping companies, more in general company-external studies and professionals performing instrumental activities to those of illycaffè such as accounting, audit, consulting - IT outsourcers that can also host illycaffé server, call center companies, companies involved in the practices related to Tax Free Refund).
Data retention
Data will be retained by illycaffè for the entire period necessary for the pursuit of the purposes contained in this information. The data retention period is as follows:
- for legal obligations, regulations and community regulations, data may be retained for the periods imposed by these regulatory sources;
- for contractual purposes until the end of the relationship and also following the end for the period determined by Italian and European regulations, including in tax matters;
in any case, all data may be retained for a period necessary to assert or defend a company right according to Italian and European regulation.
Data Controller and Data Protection Officer
The Data Controller is illycaffè S.p.A., having its registered office in via Flavia 110, Trieste, phone number +39.040.3890.111, fax number +39.040.3890.490, e-mail: infoprivacy@illy.com. There is also a Data Protection Officer available at the email address dpo@illy.com and at the addresses of the Company.
Rights
We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.
Complaints
The data subject can always lodge a complaint with a supervisory authority whose references can be found on the website www.garanteprivacy.it/web/guest/home/footer/link.
Legal Basis
The legal basis the legal basis consists of legal and contractual obligations (Italian and European laws) as well as the legitimate interests of the Data Controller in the customer-supplier relationship.
Processing procedures
Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè may file data both on paper and IT support). illycaffè has implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. Data will be retained and processed by illycaffè in compliance with its confidentiality requirements and with the applicable local provisions in the different states in which illycaffè has its offices (in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. Data will be processed by illycaffè exclusively to achieve the aims set forth in this privacy policy. Data will be filed at illycaffè S.p.A. offices and at the appointed data processors (as well as third parties who receive data as specified in point 4 of this privacy policy). Data will be entered in databases, including IT databases.

This privacy policy is updated as at 25/05/2018. Such update is carried out inside of policy of constant review of the informative ones. The versions of the previous policy statements are available writing to Data Controller (email dpo@illy.com).