Why the present document

This page describes the site’s procedures for the processing of the personal data of its users. Data are always processed within the law and to the highest ethical standards in accordance with all relevant legal requirements and adopting all security measures necessary for their protection.

Giving due consideration to technological innovations, suitable prevent measures are adopted by illycaffè S.p.A. (hereinafter also “the Company” or “illycaffè”) when using personal data, in order to minimise the risk of even accidental destruction or loss, unauthorised access to the data, or uses which are illegal or incompatible with the purposes for which the data were acquired. illycaffè will only perform on the data the operations necessary for the pursuance of the purposes specified in the aforesaid notice and in the privacy policy statement given to the users to the collection of personal data.

Data will be conserved and used for a period appropriate to the relative purposes and compliant with the relevant legal requirements. Data may also be organised in databanks/databases, including computer-managed ones.

The privacy policy information is also provided as a short notice pursuant to art. 13 of Italian Legislative Decree 196/ 03 (Italian data protection law, implementing Directive 95-46-EC), to all those who interact with the web services of this site, for the purposes of the protection of the personal data accessible by internet through the address:

www.illysustainart.org

the address of the site’s home page.

The information is provided solely for the site specifically referred to and not for any other websites the user may visit by means of links. The aforesaid websites are independent data controllers (except in the case of sites belonging to the company) and users should refer to the sites concerned.

The information is also based on Recommendation n. 2/2001, adopted by the European data protection authorities, meeting in the Group established by art. 29 of Directive 95-46-EC, on 17th May 2001 to set a number of minimum requirements for the on-line acquisition of personal data, and especially procedures, times, and the information the data controllers are required to provide to users when they log on to web pages, regardless of their reason for doing so.

The server on which the website resides is at Accenture OutSourcing - Strada 4, palazzo Q1, Milano Fiori - 20089 Rozzano (Milan) Italy.

In addition to server address, data may be processed at illycaffè S.p.A.’s head-office or wherever data processors appointed by illycaffè S.p.A. may be based (as well as on the premises of third parties to whom the data can be communicated in quality of independent data controllers and that are indicated in such policy or in appropriate privacy policy statement inside of the site).

Depending on the processing, data may be stored and processed on paper, by means of computers, and/or telematically.

Users are however advised to view all the specific information provided in the various sections of the site that ntegrate and complete such policy privacy.

Types of data processed, procedures and purposes of processing of optional or compulsory data

Navigation data

During their normal operation, the IT systems and software procedures which operate this website acquire some personal data the transmission of which is implicit in the use of Internet communications protocols.

These data are not gathered for association with identified subjects, but by their very nature, when processed or associated with data held by third parties, they might allow users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users who log onto the site, the addresses in URI (Uniform Resource Identifier) notation of the resources requested, the time of the request, the method used when submitting the request to the server, the size of the file obtained in reply, the numerical code indicating the server’s response status (concluded successfully, error, etc.) and other parameters relating to the user’s operating system and IT environment.

These data are used for the sole purpose of obtaining anonymous statistical information concerning use of the site and to check that it is operating correctly and are deleted immediately after processing. The data might be used to identify those responsible in the event of IT crime against the site. In this case the data may be communicated to the said judicial authorities, as in the case of reasoned requests from the same authorities.

Data supplied voluntarily by the user

For specific provisions for which there is a specific form (e.g. form of registration) it is better to refer to the specific privacy policy statement.

The optional, explicit, voluntary dispatch of electronic mail to the addresses provided on this site (in the event in which it is only indicated address email and does not exist an appropriate form in presence of which it is better to refer to the specific notices that regulate the provision in the various form),leads to the subsequent acquisition of the sender’s address, necessary in order to reply to the enquiry, and any other personal data included in the message (and its attachments) or the specific forms used. Where contact email addresses are provided alone, without a specific form, by sending the email users agree to the use of their data (email address and data contained in the enquiry) by illycaffè, in accordance with this privacy policy, in order to reply to the emails sent and fulfil the requests they contain. The provision of data is optional but failure to provide an address or other data necessary for dealing with the request will make any reply to the email, and thus the fulfilment of the request, impossible.

In case of requests for material shipment, the necessary data to the shipment could be communicated by illycaffè to mail-carriers. In the other cases the data could be communicated (communicating only the necessary data to the shipment) to carriers, shippers, mail, for the shipment of any answers on paper. For the rest, the data will not be communicated less than in the email there is an explicit request to communicate the data to thirds party by who provide the data and with the aim of dealing the request.

Data, in paper or electronic format, could be dealt by illycaffè manually or with computerized instruments.

Users are however advised to view all the specific information provided in the various sections of the site that integrate and complete such policy privacy.

Cookies

Definition of cookies

Cookies are small text files that are sent to your computer. The site in question uses two types of cookies.

Session cookies

So-called session cookies (i.e. temporary cookies that are erased when the browser is closed at the end of a surfing session) are solely used for transmitting session identifying data in the form of numbers randomly generated by the server. These cookies are necessary to ensure secure and efficient site browsing.

Session cookies are used in this site precisely to ensure maximum user privacy during surfing as they do not permit acquisition of user’s personal details that would otherwise permit user identification and recognition.

Persistent cookies

Persistent cookies are small data files that the server sends to the user’s browser upon accessing a website to enable the requested pages to be accessed and to monitor the visited pages.

illycaffè uses persistent cookies in one case concerning the registered user. If the user wishes to use the “remember me on your computer” function, he/she accepts a persistent cookie, which means the website will remember him/her on the next visit, avoiding having to type in the password again (by clicking on “remember me on your computer” the user gives consent to the use of cookies and the relative data use). The registered user is always free to refuse this cookie, by not clicking the option. He/she is also free to delete cookies from his/her browser.

In any case systems for tracing the users are not used.

Data controller, data processor and data subject’s rights

The data controller is illycaffè S.p.A. with registered office at via Flavia 110, Trieste.

The data processor, whom you may contact to exercise your rights under art. 7 of Italian Legislative Decree 196/03, within the times and by the procedures envisaged by the law, and to obtain the full, up-to-date list of any other data processors, is the Information Systems and Process Organisation Manager, who can be contacted for the purposes of this role at the Company’s addresses and by email on infoprivacy@illy.com (all communications must be addressed “to the Data Processor”. Any changes in the data processor will appear in the website’s privacy policy.

For any information required, users may write to infoprivacy@illy.com, to the attention of the data processor, with subject “privacy”.

Section 7 of D.Lgs. 196/2003 - Right to Access Personal Data and Other Rights

1. A data subject shall have the right to obtain confirmation as to whether or not personal data concerning him exist, regardless of their being already recorded, and communication of such data in intelligible form.
2. A data subject shall have the right to be informed
   1. of the source of the personal data;
   2. of the purposes and methods of the processing;
   3. of the logic applied to the processing, if the latter is carried out with the help of electronic means; 19
   4. of the identification data concerning data controller, data processors and the representative designated as per Section 5(2);
   5. of the entities or categories of entity to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated representative(s) in the State’s territory, data processor(s) or person(s) in charge of the processing.
3. A data subject shall have the right to obtain
   1. updating, rectification or, where interested therein, integration of the data;
   2. erasure, anonymization or blocking of data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed;
   3. certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.
4. A data subject shall have the right to object, in whole or in part,
   1. on legitimate grounds, to the processing of personal data concerning him/her, even though they are relevant to the purpose of the collection;
   2. to the processing of personal data concerning him/her, where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of market or commercial communication surveys.

Context of communication and disclosure of personal data and procedures for use

For specific processing for which there is a specific form (e.g. form of registration) it is better to refer to the specific notices.

For the other processing the data submitted by the users are known (and dealt on behalf of illycaffè S.p.A.) by subjects appointed by illycaffè S.p.A as persons in charge of processing the data (administration staff, public relations staff, staff specifically referred in the various notices, information system staff, IT consultancy companies, internal and external marketing staff, internal and external mailing staff, staff of data processors that process the data for performing the same tasks that the data processors perform on behalf of illycaffè S.p.A., internal and external website staff). Data Processor appointed by da illycaffè S.p.A. may also process the data (also external companies that perform activities of mailing, marketing, management and maintenance of server, call center, website management). These external subjects process the data also through their staff as persons in charge of processing on behalf of illycaffè and perform the same tasks that the external subjects appointed data processor perform on behalf of illycaffè S.p.A in addition to tasks of management and maintenance of server/pc on which the data of illycaffè are hosted.

Persons in charge of processing and data processors may process the data if the process is necessary for the performance of their tasks only carrying out the operations necessary for the performance of the said tasks.

If necessary, the data can also be communicated by illycaffè to judicial bodies or to the police or to anyone it is necessary in order to satisfy obligation provided for the law, regulations or EU law or in order to assert a right during judicial proceedings.

Specific Notices

The various sections of the website also contain specific notices, which should be referred to with regard to the uses of the data which they cover. In particular, the specific information for registration for the website’s services, and thus the SustainArt project, should be read with care. This notice specifies the procedures and purposes of the use of personal data for those registering on the site and therefore wishing to take part in Sustain Art.

Information updated as at 05/11/2010. Such update is carried out inside of policy of constant review of the informative ones. The versions of the previous policy statements are available writing to infoprivacy@illy.com.