Why this notice?

INFORMATION NOTE IN COMPLIANCE WITH REGULATION (EU) 2016/679, hereinafter also GDPR). Article 13 to subscribe to news letters

1. General information

We inform you that, for the purposes indicated below, we as illycaffè S.p.A. (hereinafter also referred to as the "Company" or "illycaffè" for short) will, in our capacity as data controller, process your personal data that you have provided on the form or at other times. Only the data necessary for the achievement of the purposes indicated in this information notice will be requested and processed.

2. Purpose and basislegal

We may process your data:

1. FOR THE PURPOSE OF CARRYING OUT MARKETING COMMUNICATIONS informing you about products, services, promotions and initiatives (including discounts dedicated to our users) relating to the illy brand and brands whose products are sold on illycaffè websites and apps, to the email address you have indicated in the form (please note that the email may also be sent electronically with the help of automated tools); communications may also take place via push notifications from the illy application, if you have activated them. The basis legal for the processing is consent;
2. to COMPLY WITH LEGAL OBLIGATIONS, REGULATIONS AND COMMUNITY RULES; the legal basis for the processing is compliance with legal obligations);
3. TO EXERCISE OR DEFEND A RIGHT OF THE COMPANY, and therefore for a legitimate interest of the company; the legal basis for the processing is the pursuit of legitimate interests; when considering these legitimate interests, it was analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest was assessed on the basis of a Triple Test available by contacting the company);
4. to ANALYSE YOUR ACTIONS on the blog in order to carry out, depending on the result of the analysis, specific marketing actions. Consent for these purposes is given by authorising the use of profiling cookies in the cookie banner and is freely revocable at any time by changing the cookie preferences. The legal basis for the processing is consent; see also point 10.

3. Mandatory reporting of data

The provision of data for the purposes mentioned in POINT 2(A) and the related consent (which you can always revoke, thus objecting to the processing of your data for these purposes, by contacting us at the addresses indicated in point 6) are OPTIONAL and the lack of provision and consent will imply that you will not be subject to the activities, referred to in the point, on our part.

The provision of data for the purposes set out in POINTS 2(B) and 2(C) is REQUIRED and failure to provide such data will make it impossible for you to submit to activities referred to in POINT the2(A).

The provision of the data requested for the purposes indicated in POINT 2(D) is optional, as is the relative consent (which can always be revoked by contacting the Data Controller or by changing the cookie preference) and failure to provide such data and consent will have no consequence other than that illycaffè will not be able to carry out the activities indicated in the point.

4. Categories of data recipients

For the purposes set out in POINT 2(A), the data WILL NOT BE TRANSMITTED to third parties.

For the purposes set out in 2(B) above, we may disclose the data to public authorities, judicial bodies and law enforcement agencies.

For the purposes indicated in POINT 2(C) WE MAY communicate the data to lawyers-legal advisors, public bodies, judicial and police bodies and to post offices (being able to see the address to send any written communication).

For the purposes of point 2(D), the data will not be communicated to third parties.

We will only disclose the data necessary for the purposes stated in this information notice.

The data may be known on our behalf, each for his or her own function, by all subjects delegated by us for data processing (legal officers also external to the company, marketing officers also external to the company, site management officers also external to the company, consultants also external to the company - e.g. legal consultants, IT technicians who may sometimes also perform the functions of system administrators and who in these cases are appointed system administrators, quality and website management personnel, information systems personnel who may sometimes also perform the functions of system administrators and who in these cases are appointed as system administrators, public relations employees, including those outside the company, mailing and envelope stuffing employees, including those outside the company, internal auditors, trainees, employees of data processors), as well as by the data processors delegated by us, such as, for example, shipping and packaging companies, IT outsourcing companies, marketing consultancy companies and, in general, companies-studios that carry out activities instrumental to those of illycaffè, such as, for example, legal and communication consultancy companies-studios. You can always ask us for a list of data processors by contacting us at the addresses indicated in point 6.

5. Data retention

We will retain and process the data for as long as is necessary to fulfil the purposes set out in this information notice. The data retention period is as follows:

• for LEGAL OBLIGATIONS, REGULATIONS AND COMMUNITY RULES, during the periods imposed by these sources of law;
• for the purposes indicated in POINT 2(A), until you revoke your consent and/or request the deletion of your data (which you may do at any time, including by e-mail to infoprivacy@illy.com), without prejudice to the retention for the purposes indicated in POINTS 2(B) and (C); before 31 December of the second year following the year of registration, you will in any case be informed whether or not you are still interested in being the subject of the activities referred to in POINT 2(A) and, therefore, in our keeping your data for the purposes indicated in that point and, in the event that this interest ceases, the data will be deleted without prejudice to their retention for the purposes indicated in POINTS 2(B) and (C). If, on the other hand, your interest in being the subject of the activities referred to in point 2(A) and, therefore, in the storage of the data by us for the purposes referred to in that point persists, before 31 December of the second year following the communication, another communication of the same nature will be sent to you and so on until such time as your interest remains;
• for the purposes of POINT 2(D) until consent is revoked or for the lifetime of the cookie, as set out in the cookie policy ;

In any case, all data may be retained for the period necessary to assert or defend a right of the company under Italian civil and criminal law, and therefore for a maximum of 10 years from the termination of the relationship, except in the case of litigation or disputes that require an additional retention period.

6. Data Controller and Data Protection Officer

The Data Controller is the company illycaffè S.p.A. with registered office in via Flavia 110 in Trieste (Italy), telephone +39.040.3890.111, fax +39.040.3890.490, e-mail infoprivacy@illy.com . In addition, a Data Protection Officer is available at the e-mail address dpo@illy.com and at the company addresses.

illycaffè S.p.A. can be contacted in Spain at illycaffè S.p.A. branch in Spain, C/ Pere IV, 397/401, Navi 7-8, 08020 - Barcelona, Telephone: +34 933034050 e-mail: illy.iberica@illy.com

7. Rights

We inform you that the GDPR provides for the possibility for you to request (by contacting us at the addresses indicated in point 6) access to personal data and the rectification or deletion of such data or the restriction of processing;

In addition, you may have the possibility, by contacting us, to object to the processing of your data and to exercise the other rights contained in Chapter 3, Section 1 of the GDPR, including the right to withdraw consent: the withdrawal of consent will not affect the lawfulness of the processing based on the consent prior to its withdrawal.

8. Complaints

If you believe that the processing of your data violates the provisions of the GDPR, you have the right to lodge a complaint with the Italian Supervisory Authority (whose contact details can be found at www.garanteprivacy.it), pursuant to Article 77 of the GDPR, or to take appropriate legal action (Article 79 of the GDPR).

In addition, you may also contact the supervisory authority of the State in which you normally reside or work.

The list of supervisory authorities can be consulted atwww.garanteprivacy.it/home/footer/link (for Spain, you can contact the authority at https://www.aepd.es).

9. Modalities

The data may be processed by us both in paper and manual form and in computer and telematic form (thus storing and processing the data both in paper and computer form). We observe specific security measures to prevent the loss of data, illegal or incorrect use and unauthorised access. The data will be processed and stored by us in full respect of confidentiality in compliance with all the laws in force in the various states in which illycaffè has offices (and therefore also in compliance with the principles of legality, transparency and protection of privacy and rights) and with logics strictly related to the purposes indicated in this information note. Only the operations necessary to achieve the purposes indicated in this notice will be carried out on the data. The data will be stored at the offices of illycaffè S.p.A. and at the offices of the designated data controllers (as well as at third parties to whom the data are communicated as autonomous owners and indicated in point 4) and will also be organised in computer databases.

10. Logic used for profiling

whether or not you have downloaded a guide "The secrets of the coffee shop"). A profile is then created, which is also placed in specific groups (clusters). Profiling has the purposes indicated in POINT The profiling referred to in POINT 2(D) is carried out by illycaffè by analysing, also in an automated way, the actions performed on the blog (e.g. 2(D) and thus to better understand behaviour in order to be able to carry out targeted marketing actions such as direct marketing by e-mail; this processing, however, does not constitute a particular risk for the customer given the type of basic profiling which does not require data of a particularly sensitive nature or which allows for the detailed reconstruction of particularly confidential aspects of private life. In any case, the data subject will always have the right to obtain human intervention, to express his or her opinion, to obtain an explanation of the decision taken and to contest it.

11. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

The data may be communicated and therefore transferred outside the European Union to IT companies providing IT services on behalf of the Company that have been specifically designated as processors These parties undertake to comply with all the requirements of European law, including by signing the appropriate Contractual Clauses indicated by the European Commission and/or the competent supervisory authority and provided for by the GDPR (art. 46, par. 2, lett. c) (a copy of which is available by contacting us at the contact details indicated in point 6), when in the indicated countries there is no specific adequacy decision whereby the non-EU Member State is deemed to offer the same guarantees provided for by European legislation; in any case, all the guarantees provided for by law are adopted. The list of the subjects and, therefore, of the States (including the United States of America) to which the data could be transferred can be consulted by contacting the Company at the addresses indicated in point 6.

Information note updated as of 23/01/2024. This update has been carried out as part of a policy of constant revision of the information notes. Versions of the above information can be obtained by writing to the Data Controller (e-mail: ).infoprivacy@illy.com

INFORMATION ON THE PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH REGULATION (EU) 2016/679 (hereinafter GDPR) to perform the requested actions (e.g. download a coffee guide).

1. General information

The data controller (illycaffè S.p.A. hereinafter "Controller" or "illycaffè") informs that, for the purposes indicated below, it will process your personal/activity data (also referred to as "applicant" or "data subject"), provided in the form or subsequently to the form.

Only data necessary to fulfil the purposes of this information will be requested and processed.

2. Purposes

The data may be processed by illycaffè for:

1. To enable you to carry out the requested actions (e.g. download a coffee guide); the legal basis for the processing is consent;
2. To comply with an obligation under law, regulation or EU law; the processing is based on the following legal basis: compliance with legal obligations;
3. Legitimate interests, such as asserting or defending a right of illycaffè; the processing is based on the following legal basis: pursuit of legitimate interests; in considering these legitimate interests, it has been analysed that the legitimate interests do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest was assessed by means of a Triple Test available when contacting the Company);
4. To carry out marketing communications about illycaffè products, services and initiatives and about products marketed by illycaffè, all by illycaffè via the telephone numbers (and therefore also via SMS/MMS messages/messaging applications) and addresses (including the e-mail address for receiving periodic newsletters) provided by you (please note that e-mails and telephone messages can also be sent electronically with the help of automated tools).
5. To analyse your actions performed on the blog in order to perform, depending on the result of the analysis, specific marketing actions. Consent for these purposes is given by authorising the use of profiling cookies in the cookie banner and is always freely revocable at any time by changing the cookie preferences; the legal basis for processing is consent; see also point 10.

We inform you that you may also indicate your wish to be the subject of activities only by e-mail, only by telephone communication, SMS/MMS/messaging applications, or only by post, by writing to infoprivacy@illy.com or by contacting the company at the addresses indicated in point 6. You may revoke your consent for these purposes at any time by contacting illycaffè at the addresses indicated in point 6; consent for these purposes is always freely revocable at any time by contacting the company at the addresses indicated below; the legal basis for the processing is consent;

3. Obligation or non-obligation to retain the data

The provision of data for the purposes indicated in point 2(A) is optional, but failure to provide the data marked with an asterisk will make it impossible to follow up your request (e.g. download the guide). Consent to the processing of data for the purposes indicated in point 2(A) is also optional, but failure to consent will make it impossible to follow up your request (e.g. download the guide).

The provision of data required for the purposes indicated in point 2(D) is optional, as is your corresponding consent (always revocable by contacting the Data Controller), and failure to provide and consent will not have any consequences other than not being able to carry out the activities indicated in the point or not being able to carry them out at the addresses not provided. By ticking the box relating to the request to carry out the activities indicated in point 2(D), you consent to the processing for the purposes indicated therein.

The provision of data required for the purposes indicated in point 2(E) is optional, as is your consent (always revocable by contacting the Data Controller), and failure to provide and consent will have no consequence other than that illycaffè will not be able to carry out the activities indicated in the point.

For the purposes stated in 2(B) (for which the provision of data is required as an obligation if provided for by law) and 2(C), the provision of personal data or other data that may be necessary is necessary, and failure to provide such data will make it impossible to carry out the purposes stated in 2(A), (D), (E).

4. Categories of data recipients

For the purposes set out in point 2(A), the data will not be disclosed to third parties.

For the purposes indicated in point 2(B), the data may be disclosed (disclosing only the data necessary for the achievement of those purposes) to judicial, tax and public security authorities, as well as to public bodies where there is a disclosure obligation.

For the purposes indicated in point 2(C), the data may be communicated (communicating only the data necessary for the achievement of these purposes) to judicial, tax and public security authorities, as well as to public bodies in the event of an obligation to communicate, as well as to law firms and legal advisors and to postal services/post offices (being able to see the address for the sending of written communications).

For the purposes indicated in point 2(D), the data may be communicated to postal services/post office (where you can see the address for sending written communications).

For the purposes set out in point 2(E), the data will not be disclosed to third parties.

illycaffè will only communicate data that is essential for the individual purposes indicated in this information.

The data controllers will be those appointed by illycaffè to process the data on its behalf, all the subjects specifically entrusted with the processing (customer management personnel, marketing personnel, agents and area managers, site management personnel also external to the Company, IT technicians responsible for the management of information systems who may also perform system administrator functions, personnel in charge of relations with the public, personnel from the legal department, consultants and collaborators also external to the Company who act under the direct responsibility of the Company, such as, for example, IT technicians who may also perform system administrator functions, quality consultants, legal advisors, privacy management personnel, call centre personnel also external to the Company, collaborators of the data controllers) and data processors (always designated by the Data Controller) such as IT outsourcing companies, call centres, marketing companies and, in general, companies that carry out activities instrumental to those of illycaffè, such as, for example, packaging and shipping companies). The list of data controllers is available from the Data Controller.

5. Data retention

The data may be retained and processed by the Data Controller for the time necessary to fulfil the purposes set out in this information. The data retention period is as follows:

For legal obligations, regulations and EU regulations, during the periods imposed by these regulatory sources.

For the purposes indicated in point 2(A) of this information, for 6 months.

For the purposes indicated in point 2(D), until the revocation of consent and/or request for deletion of your data (which you may do at any time, including by e-mail to the address infoprivacy@illy.com), without prejudice to the retention for the purposes indicated in points 2(B) and 2(C). Before 31 December of the second year following the granting of consent, a communication will be sent to you to determine whether you are still interested in being subjected to the activities referred to in points 2(B) and 2(C), and if you are no longer interested, the data will be deleted without prejudice to the retention for the purposes indicated in points 2(B) and 2(C). If, on the other hand, your interest in being subject to the activities referred to in point 2(D) and therefore in the storage of the data by us for the purposes indicated in that point persists, another communication of the same nature will be sent to you by 31 December of the second year after the communication, and so on for as long as your interest persists.

For the purposes indicated in point 2(E), until the revocation of consent or for the duration of the cookies as indicated in the cookie policy.

In any case, all data may be retained for the time necessary to assert or defend the Company's rights under Italian, Spanish and European legislation.

6. Data Controller and Data Protection Officer

The Data Controller for the processing of the data provided is illycaffè S.p.A. with registered office in Via Flavia 110 in Trieste, telephone number +39. 040.3890.111, fax number +39.040.3890.490, e-mail infoprivacy@illy.com. In addition, a Data Protection Officer is available at the e-mail address dpo@illy.com and at the Company's addresses.

illycaffè SpA is represented in Spain by illycaffè S.p.A. branch in Spain, C/ Pere IV, 397/401, Naves 7-8, 08020 - Barcelona, Tel: +34 933034050, e-mail: illy.iberica@illy.com.

7. Rights

It is informed that the GDPR allows the applicant to request from the Company (at the addresses indicated above) access to personal data and rectification of the same, erasure or restriction of processing, data portability; the applicant may also have the possibility to object, also by addressing the Company, to the processing of the data and to exercise other rights contained in Chapter 3 Section 1 of the GDPR, among which the right to revoke consent, where provided for: the revocation of consent does not affect the lawfulness of the processing based on the consent given prior to the revocation.

8. Complaints

If the applicant considers that the data processing is carried out in violation of the provisions of the GDPR, he/she has the right to lodge a complaint with the Italian Data Protection Authority (details of which can be found on the site www.garanteprivacy.it), as provided for in Article 77 of the GDPR, or to appeal to the competent courts (Article 79 of the GDPR). In addition, you can also turn to the Supervisory Authority of the State in which you usually reside or work. The list of Authorities is available at the link www.garanteprivacy.it/home/footer/link and among them is mentioned, for convenience, the Spanish authority whose details can be found on the site https://www.aepd.es.

9. Treatment modalities

The data may be processed by us both in paper and manual form and in computer and telematic form (thus storing and processing the data both in paper and computer form). We observe specific security measures to prevent the loss of data, illegal or incorrect use and unauthorised access. The data will be processed and stored by us in full respect of confidentiality in compliance with all the laws in force in the various states in which illycaffè has offices (and therefore also in compliance with the principles of legality, transparency and protection of privacy and rights) and with logics strictly related to the purposes indicated in this information note. Only the operations necessary to achieve the purposes indicated in this notice will be carried out on the data. The data will be stored at the offices of illycaffè S.p.A. and at the offices of the designated data controllers (as well as at third parties to whom the data are communicated as autonomous owners and indicated in point 4) and will also be organised in computer databases.

10. Logic used for profiling

The profiling mentioned in point 2(E) is carried out by illycaffè through the analysis, even in an automated way, of the actions performed on the blog (e.g. whether or not a guide "The secrets of the coffee shop" was downloaded). A profile is then created, which is also inserted in specific groups (clusters). Profiling serves the purposes outlined in point 2(E), which include better understanding behaviours in order to be able to carry out targeted marketing actions, such as direct marketing emails. However, this processing does not constitute a particular risk for the customer, given the basic nature of profiling which does not require particularly sensitive data and does not allow for reconstructing highly sensitive aspects of private life. In any case, the data subject always has the right to request human intervention, to express his/her opinion, to receive an explanation of the decision taken and to contest the decision.

Information updated on 15/01/2024