DATA CONTROLLER
Luigi Lavazza S.p.A., Torino, Italy – Via Bologna, n.32

PERSONAL DATA
Lavazza will process only the following categories of personal data:
- Identity (data includes first name, maiden name, last name, username or similar identifier)
- Contact details (email, telephone number, delivery address)
- Geo-location data and/or Internet browsing data processed through the use of cookies installed on your PC or mobile device (for any further information please check the Cookie Policy)
- Bank details useful for the management of the commercial relationship (includes bank account and payment card details);
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us

PURPOSES OF PERSONAL DATA PROCESS 
a) Site Sign-in: registration on the Website by creating an account or using a social network account.
b) Activation and handling of purchase orders, contractual and commercial relationships and related activities
c) Marketing
sending of informative and promotional materials relating to the Lavazza Group products d) Partaking in prize draw, competition or surveys 
e) Profiling activities
performing market analysis and data processing for statistical purposes as well as analyze or predict in order to offer products and services more and more suited to the cutomers’ interests and to develop customized promotions and commercial communications.

COMMUNICATION OF DATA TO THIRD PARTIES
The personal data will not be disclosed to third parties, except for the other companies belonging to the Lavazza Group, Italian and / or abroad. 
The personal data may also be disclosed to primary third-party companies (business partners and service providers) if and as legitimately instructed by Lavazza as Data Processors to perform functional activities to achieve the purposes as indicated above. 
The list of the Data Processor will be constantly updated and at your disposal by contacting the Data Controller at the addresses indicated below

RIGHTS OF THE DATA SUBJECT 
Access, update, integrate, rectify, delete data, blocking request, opposition to the process; request data portability, propose a complaint to the Authorities

Following the provision of the EU Regulation 679/2016 (“GDPR – General Data Protection Regulation”) Luigi Lavazza S.p.A. and the other affiliated companies inform that any personal data provided by the Data Subject (meaning the individual who is the subject of personal data) will be used in accordance with the applicable regulation and in compliance with the following criteria:

1) DATA CONTROLLER

Data Controller the person recognized by law who determines the purposes for which and the manner in which any personal data are, or are to be, processed is the Luigi Lavazza S.p.A (hereinafter Lavazza) having its registered office at Torino, Via Bologna 32–10152 - Italy in person of his pro-tempore legal representative. Lavazza Coffee (UK) Limited is is a wholly-owned subsidiary of Luigi Lavazza S.p.A. This privacy notice is issued on behalf of the Lavazza Group so when we mention "Lavazza", "we", "us" or “our” in this privacy notice, we are referring to the relevant company in the Lavazza Group responsible for processing your data. Lavazza Coffee (UK) Limited is the controller and responsible for this website.

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.

2) PERSONAL DATA

Lavazza will process only the following categories of personal data:

• Identity (data includes first name, maiden name, last name, username or similar identifier)
• Contact details (email, telephone number, delivery address)
• Geo-location data and/or Internet browsing data processed through the use of cookies installed on your PC or mobile device (for any further information please check the Cookie Policy)
• Bank details useful for the management of the commercial relationship (includes bank account and payment card details);
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us

Lavazza does not collect and does not process any sensitive data on the Site, such as, for example, those able for revealing racial and ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious, philosophical, political or trade union nature, as well as personal data capable of revealing the state of health and sexual life.

Lavazza will request only the personal data strictly necessary to provide the services requested by users. The data provided that will be processed for the purposes related to the activity of the Site and will be stored and processed to ensure the respect of the data subject rights

3) RIGHT TO WITHHOLD THE PERSONAL DATA

Providing personal data is optional, but may be necessary for the achievement of some of the purposes indicated (eg the activation of contractual and commercial relations, the management of competitions and prize operations, sending newsletters, etc. .), not provide personal data reported as mandatory will not allow Lavazza to pursue the abovementioned purposes .

The mandatory or optional nature of the personal data is from time to time reported using symbols (eg "*") placed alongside the information whose conferment is mandatory to pursue the respective purpose.

In any case, personal data will be processed by Lavazza only on the following legal basis:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject.
  
  

4) PURPOSE OF PERSONAL DATA PROCESS

The personal data you provide will be collected and processed by Lavazza for the following purposes:

• Site Sign-in: registration on the Website by creating an account or using a social network account allows the use of the Site as a "Registered User"; the purchase procedure will thus be simplified without re-entering all the personal data required for the completion of an order during each purchase process, but only some of them. The provision of data is optional. The Data processlegal basis is: the data subject given consent
• Access to the Website to proceed with the purchase of products without registering: in this case, the data you provide will be used by Lavazza as the data controller, exclusively for the purpose of completing the purchase order. The conferment of these data is in fact optional but necessary for the management of the order and for the consequent administrative-accounting purposes. You can also be contacted for any communications regarding the purchase itself. Your data may not be disclosed to third parties, other than the couriers appointed by Lavazza for the delivery of the products purchased.
  In any case, the processing of personal data supplied by you by making a purchase without creating an account will be compliant with the provisions of this Privacy Policy. The Data processlegal basis is: theperformance of a contract to which the data subject is party
• Activation managing purchase orders, contractual and commercial relationships and related activities (compliant with the Terms of Sale) - The Data processlegal basis isperformance of a contract to which the data subject is party

• Manage Technical requests relating to their purchases, such as information on the progress of their orders, and any other requests in a broad sense regarding the Site and the goods and services accessible through it; The Data processlegal basis isperformance of a contract to which the data subject is party
• Managing payments and deliveries of products purchased through the Site (compliant with the Terms of Sale) - The Data processlegal basis is:performance of a contract to which the data subject is party
• Partaking in prize draws, competitions or surveys; - The Data processlegal basis is:the data subject given consent

4.1 Further Purposes

• If expressly and freely authorized by the Data Subject, sending of informative and promotional materials relating to the Lavazza Group products. Sending of newsletters and other promotional and commercial communication initiatives, including through the use of the contacts provided by the Data Subject.
• If expressly and freely authorized by the Data Subject, the Data Controller may process personal data for profiling purposes, e.g. to perform market analysis and data processing for statistical purposes as well as analyze or predict, thanks to algorithms and other automated systems, tastes, potential habits and consumption choices, to offer products and services more and more suited to the customers’ real interests and to develop customized promotions and commercial communications. The aforesaid profiling activity could also be carried out using third-party cookies. In this regard, we invite you to read our Cookie Policy. The same treatment can be carried out, if you provide Lavazza with a further specific and optional consent;
  
  

5) HOW WE TREAT YOUR DATA

Personal Data process is compliant with the provisions of the GDPR and with all the other relevant applicable law, and it is performed with the help of electronic and automated tools, all designed to ensure the maximum security and confidentiality extent to the personal data processed In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

All personal data provided are kept by the Data Controller in compliance with appropriate security measures. The Data Controller will implement appropriate technical and organizational measures to guarantee a level of security appropriate to the risk of processing.

6) HOW DO WE COMMUNICATE OR TRANSFER YOUR PERSONAL DATA

Personal data may be made accessible for the purposes above mentioned to:

• employees and personnel of the Data Controller in Italy and abroad, as persons in charge of processing and / or system administrators and / or administrators;
• third party companies or other legal entities (as an indication, credit institutes, professional firms, consultants, insurance companies for the provision of insurance services, etc.) that carry out outsourcing activities in Italy and abroad on behalf of the Data Controller, as external Data Processor

The personal data will not be disclosed to third parties, except for the other companies belonging to the Lavazza Group, Italian and / or abroad. We do not transfer any personal data outside the European Economic Area.

The personal data may also be disclosed to primary third-party companies (business partners and service providers) if and as legitimately instructed by Lavazza as Data Processors to perform functional activities to achieve the purposes as indicated above.

The list of the Data Processor will be constantly updated and at your disposal by contacting the Data Controller at the addresses indicated below

7) DATA RETENTION PERIOD

Personal Data useful for Site signing-in will be kept for the entire duration of its registration on the Site and for the further period provided for by law, in relation to the purpose of the collection.

Personal Billing Data will be kept for a period of time to guarantee the correct execution of the contract and the fulfillment of the related administrative and fiscal obligations.

Data collected for the purposes of sending promotional and advertising materialand data collected for commercial profiling purposeswill be retained for a period not exceeding 24 monthsor the different period indicated by the supervisory authorities.

Personal data collected for the management of prize competitionsand transactions will be kept for the entire duration of the premium transaction and for a period of time to ensure the correct execution of the contract and the fulfillment of the related administrative and tax obligations.

The data collected for profiling purposes will be kept for a period of time not exceeding 12 months or at the different period indicated by the supervisory authorities

8) CHILDREN

We strongly recommend that parents take an active role in supervising the online activity of their children under the age of sixteen. Lavazza generally does not intend to collect personal data from and/or generally does not intentionally communicate with children. However, in case we need to communicate with a child, we will endeavor to give the parents or legal guardians a reasonable opportunity to consent before we use the personal data of the child, except where we merely answer the child’s question or service the child’s request

9) RIGHTS OF THE DATA SUBJECT

Data Subjects may at any time exercise the rights provided by the EU Regulation 679/2016, including:

•  
  1. the right to obtain confirmation of the existence or not of personal data concerning the data subject even if not yet registered, and their communication in an intelligible form;
  2. the right to revoke at any time the consensus given by the data subject with regards to the purpose of personal data process;
  3. the right to obtain access, rectification, cancellation, limitation on the data process and data portability in line with the indications provided to the Data Controller.
  4. the right to oppose to the data processing;
  5. the right to appeal before the competent Authority.

10) EXERCISE OF THE RIGHTS – DPO CONTACTS

In the event data subject wishes to exercise the aforementioned rights or wishes to receive further clarifications regarding the processing of personal data, data subject may write to the Data Controller at the following address:

LUIGI LAVAZZA S.p.A.
Via Bologna, 32
10152 Turin (TO)
P.I. IT00470550013
Tel. 011/2398863
E-mail: PrivacyDPO@lavazza.com