"Careers" Privacy policy – USA and Canada

Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR) and national legislation in force

1. General information
   illycaffè S.p.A. (having its registered office in Trieste, via Flavia 110, hereinafter also referred to as the "Company" or "illycaffè" ) hereby informs you that, for the purpose of this privacy policy, it will acquire some personal data that may also be provided in the CV.
   Please, note that sensitive data are not required, as personal data that may reveal racial and ethnic origins, religious or philosophical beliefs or any other beliefs, political views, membership to political parties, trade unions, religious, philosophical, political or trade union associations or organisations or personal data that may reveal the health status and sexual preferences.
   If such data have been provided, they will only be processed if required pursuant to the relevant regulations and in line with the authorisations of the Authority for the protection of personal data. In this case, please send us your express written consent for the processing of such data which otherwise will not be processed or taken into consideration.
   Please, read the privacy policy of this website.
    
2. Purposes 
   illycaffè may process data for the following purposes:
   A. for selecting staff, data may also be processed without the consent of the data subject; 
   B. If you wish to be hired in one of the companies of illycaffè group other than  illycaffè S.p.A., based in the US or Canada, to disclose such data (with your express consent) at the discretion of illycaffè, so that selection may occur independently; 
   C. to comply with the requirements pursuant to the legislation in force, regulations or EU regulations and for legitimate interests such as to assert or defend the rights of the Company in the appropriate offices.
    
3. Mandatory nature of the provision
   As for the purposes of point 2, letter A, of this privacy policy, the provision of data marked with an asterisk is optional, but it is essential to include the candidate into the selection process. Therefore, failure to provide such data may prevent the Company to include the candidate into the selection process. The provision of other data is optional and failure to provide them will not have any consequences, except that data that are not provided and that may be useful will not be taken into consideration. As for the purposes of point 2, letter B, of this privacy policy, the provision of data marked with an asterisk is optional, but it is essential to disclose data to the companies of the illycaffè group other than  illycaffè S.p.A.. Therefore, failure to provide such data may prevent the Company to refer the candidate to these companies. The provision of other data is optional and failure to provide them will not have any consequences, except that data that are not provided and that may be useful will not be taken into consideration. Failure to consent to this purpose will not prejudice the selection for illycaffè. Instead, data will not be passed on to the other companies of the group other than illycaffè S.p.A.. To the purposes of point 2, letter C, of this privacy policy, personal data, addresses and any other data what may be required to these purposes must be provided. Should these data not be provided, the candidate will not be included into the selection process. Please, note that for the purposes of point 2, letter C, of this privacy policy, data may also be processed without the consent of the data subject.
    
4. Data recipient categories 
   For the purposes described in point 2, letter A of this privacy policy, data will not be disclosed. For the purposes described in point 2, letter B, of this privacy policy, data may be disclosed to the above companies. For the purposes of point 2, letter C, of this privacy policy, illycaffè may disclose data to public authorities, the judiciary, the police, lawyers/ solicitors, the post office, to couriers/shippers (when notices must be sent). The data may be disclosed on behalf of illycaffè, each for own role, to all subjects delegated by illycaffè (managers, administrative staff, staff of the legal office, internal auditors, members of the Board of Directors and members of the Board of Auditors,  IT staff, including outsourcers that may also act as system administrators, staff of the internal and external Data Processors, trainees, staff of the enveloping and shipping departments, including outsourcers, external advisors acting under the responsibility of the Company, such as IT experts that may also act as system administrators, legal advisors, quality advisors, internal auditors) and to internal and external Data Processors (such as enveloping and mailing companies, IT outsourcing companies, hosting data in their servers and companies carrying out studies which are instrumental to illycaffè business).
    
5. Data retention 
   Data will be retained by illycaffè for the entire period necessary for the pursuit of the purposes contained in this information. The data retention period is as follows:
   - or legal obligations, regulations and community regulations, data may be retained for the periods imposed by these regulatory sources; - for the purposes described in point 2 lett. A of this policy, the data can be retained for 3 years;
   - for the purposes described in point 2 lett. B of this policy, the data can be retained until the withdrawal of consent or request of cancellation; 
   in any case, all data may be retained for a period necessary to assert or defend a company right according to Italian and European regulations.
    
6. Data Controller and Data Protection Officer
   The Data Controller is illycaffè S.p.A., having its registered office in via Flavia, 110 – 34147-Trieste (TS), Italy, telephone number +39.040.3890.111, fax number +39.040.3890.490, e-mail: infoprivacy@illy.com. There is also a Data Protection Officer available at the email address dpo@illy.com and at the addresses of the Company.
    
7. Rights
   We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.
    
8. Complaints 
   The data subject can always lodge a complaint with a supervisory authority whose references can be found on the website www.garanteprivacy.it/web/guest/home/footer/link
    
9. Legal Basis
   The legal basis the legal basis consists of legal obligations ((Italian, German, Spanish, Dutch, Austrian, French, Belgian and European laws) as well as the legitimate interests of the Data Controller in the customer-supplier relationship. Furthermore, for the purposes for which consent is provided, the legal basis is the consent itself.
    
10. Processing procedures
    Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè may file data both on paper and IT support). illycaffè has implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. Data will be retained and processed by illycaffè in compliance with its confidentiality requirements and with the applicable local provisions in the different states in which illycaffè has its offices (in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. Data will be processed by illycaffè exclusively to achieve the aims set forth in this privacy policy. Data will be filed at illycaffè S.p.A. offices and at the appointed data processors (as well as third parties who receive data as specified in point 4 of this privacy policy). Data will be entered in databases, including IT databases.
     
11. Data communicated outside the European community
    The data are communicated outside the European community only with the prior consent and only to companies of the illycaffè group that provide suitable guarantees, a copy of the data is always available at illycaffè

N.B. The consent can only be given by persons over 16 years, if the subject is under 16, he cannot use what is provided for in the purposes for which consent is required (eg. registration, ... ).

This privacy policy is updated as at 25/05/2018. Such update is carried out inside of policy of constant review of the informative ones. The versions of the previous policy statements are available writing to Data Controller (email: dpo@illy.com).