Privacy policy

General information

illycaffè S.p.A. (hereinafter also referred to as the "Company" or "illycaffè") hereby informs you that it will process the data you have provided in the form and later for the purposes listed in the following paragraphs. illycaffè may only require and process data which are instrumental to achieve the purposes of this privacy policy.
Purposes and Legal Basis

illycaffè may process data for the following purposes:
1. in order to let you access and view the contents of the private area. The processing is based on the following legal basis: consent;
2. to be compliant with the requirements pursuant to the legislation in force, regulations or EU regulations and for legitimate interests such as to assert or defend the rights of the Company. The processing is based on the following legal bases: the fulfilment of legal obligations and the pursuit of legitimate interests.
Mandatory nature of the provision

The provision of data for the purposes described in point 2 letter A of the privacy policy is optional and failure to provide it will however make it impossible to access and view the contents of the private area. The consent for the purposes of point 2 letter A of this privacy policy is always free (and may be revoked at any time by contacting the Data Controller), but failure to give consent will make it impossible to access and view the contents of the private area. The provision of data for the purposes described in point 2 letter B of this privacy policy is necessary and failure to provide such data may make it impossible to access and view the contents of the private area.
Data recipient categories

The data will not be disclosed to third parties by illycaffè for the purposes specified in point 2 letter A of this information unless it is provided for specific services, for which you will be subject to specific conditions and for which you will be asked for explicit consent where necessary. The data may be communicated by illycaffè for the purposes specified in point 2 letter B of this information (communicating only data that are necessary for the pursuit of these purposes) to attorneys-legal advisers, public bodies judicial bodies, police and post offices (being able to see the address for sending any written notices). The Company will communicate only the data necessary for the pursuit of each purpose indicated in this privacy policy.The data may be disclosed on behalf of illycaffè, each for own role, to all subjects delegated by illycaffè (legal department staff also external to the Company, website management staff also external to the Company, consultants also external to the Company – e.g. legal advisors, IT technicians that can also carry out tasks of system administrators, and are in this case appointed system administrators, quality and website management personnel, - IT staff that can also carry out tasks of system administrators, and are in this case appointed system administrators, public relations staff also external to the Company, shipping and enveloping staff, also external to the Company, internal auditors, trainees, staff of internal and external data processors) and to internal and external data processors (e.g. enveloping and shipping companies, IT outsourcing companies and, more generally, companies-studies that carry out activities instrumental to those of the Company, such as legal advice and communication companies). The list of Data Processors is always available by contacting the Data Controller.
Data retention

Data will be retained by illycaffè for the entire period necessary for the pursuit of the purposes contained in this information. The data retention period is as follows:
- for legal obligations, regulations and community regulations, data may be retained for the periods imposed by these regulatory sources;
- for the purposes described in point 2 letter A of this policy, the data can be retained until the withdrawal of consent or request for cancellation and in any case no later than 5 years;
in any case, all data may be retained for a period necessary to assert or defend a company right according to Italian and European regulations.
Data Controller and Data Protection Officer

The Data Controller is illycaffè S.p.A., having its registered office in via Flavia 110, Trieste, phone number +39.040.3890.111, fax number +39.040.3890.490, e-mail: infoprivacy@illy.com. There is also a Data Protection Officer available at the email address dpo@illy.com and at the addresses of the Company.
Rights

We inform you that the GDPR provides the possibility for the data subject to ask the Data Controller (at the above addresses) to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to exercising the right to data portability, as well as other rights contained in Chapter 3 of the GDPR including the revocation of consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on consent given before revocation.
Complaints

The data subject can always lodge a complaint with the Italian Data Protection Authority, whose references can be found on the website www.garanteprivacy.it.
Processing procedures

Data may be processed on paper, manually, with IT and electronic means (therefore, illycaffè may file data both on paper and IT support). illycaffè has implemented safety measures to prevent any data loss, illegal use of data, misuse or unauthorised access. Data will be retained and processed by illycaffè in compliance with its confidentiality requirements and with the applicable local provisions (i.e. in compliance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and the rights of those concerned) strictly in line with the aims set forth in this privacy policy. Data will be processed by illycaffè exclusively to achieve the aims described in this privacy policy. Data will be filed at illycaffè S.p.A. offices in Europe depending and at the appointed data processors (as well as third parties to whom the data are communicated as specified in this privacy policy). Data will be entered in databases, including IT databases.

N.B. The consent can only be given by persons over 14 years, if the subject is under 14, he cannot use what is provided for in the purposes for which consent is required.

This privacy policy is updated as at 26.02.2020.