The Data Controller for Personal Data processing is LUIGI LAVAZZA S.p.A. (hereinafter “Lavazza” and/or the “Data Controller”), with registered office in Turin – Via Bologna, 32, represented by the appointed legal representative.
In accordance with the provisions of the Regulation, the Data Controller has selected and appointed a Data Protection Officer (DPO), whose task it is to oversee compliance with the Regulation and to act as a point of contact for subjects affected by the processing, as well as for the Authority for the Protection of Personal Data. The DPO can be contacted by email PrivacyDPO@lavazza.com
Depending on the needs prompting access to the various sections of the Lavazza Websites (and setting aside individual initiatives that require the provision of certain Personal Data, for which specific information will be published on a case-by-case basis), the purposes for the processing of the Personal Data and the related legal grounds are given below:
The purpose of the registration procedure, which consists of creating an account or using an existing social media account, is to enable use of the Lavazza portal as a “Registered User” and to gain access to a series of exclusive offers through the same applications. The provision of data is optional. The legal grounds for processing is the implementation of pre-contractual measures to which the data subject is party.
In the event of registration through the APP, authorisation will be sought to show notifications regarding the publication of new content, initiatives, events, promotions, etc. The legal grounds for processing is the consent of the data subject. You can always change your mind and alter settings related to the receipt of these notifications directly from your device, through the “Settings” and “Notifications” section.
In the event of registration or access through your social media account, we may have access to certain extra personal data in addition to those provided during registration on the portal, depending on the authorisations you have given to the social network. Consult the latter in relation to its policies on the management of your privacy.
Through our Website/APP, you can purchase Lavazza products both as a Registered User (in which case you will not need to re-enter all your Personal Data each time you make a purchase) and as an Unregistered User (re-entering all the data needed to complete the purchase on each occasion). Both cases involve the processing of your Personal Data.
Your Personal Data will be processed in order to manage orders and payments and to fulfil the resulting requirements in relation to administration and accounting, as well as to contact you with any communications regarding your purchases (e.g. information on the progress of your orders). It is necessary to provide the data in order to complete the purchase order. The legal grounds for such processing is the performance of a Contract to which the data subject is party.
The Personal Data are collected in order to respond to requests sent to us by email; including, but not limited to, those concerning the maintenance/repair/replacement of coffee machines, as well as requests regarding products and initiatives from the various brands of the Lavazza Group. The legal grounds for such processing is the implementation of pre-contractual measures to which the data subject is party.
With your express consent, we may process your Personal Data in order to send you commercial communications, as well as to invite you to take part in our promotional initiatives, participate in our events, or subscribe to the newsletter. The legal grounds for such processing is the consent of the data subject, which may be withdrawn at any time.
We may process your Personal Data in order to enable you to participate in competitions and initiatives involving prizes, including our brands’ loyalty programmes. The legal grounds for the processing of data for the purposes of participation in competitions and initiatives involving prizes is the implementation of pre-contractual measures to which the data subject is party; while the legal grounds for processing as part of our brands’ loyalty programmes is the legitimate interest of the data controller.
With your express consent, we may process your Personal Data for profiling purposes; i.e. to analyse or predict your tastes, possible habits and consumption choices, in order to offer you products, services, promotions and personalised commercial communications. The legal grounds for such processing is the consent of the data subject, which may be withdrawn at any time.
Apart from the foregoing hypotheses:
The Personal Data you provide in your interactions with the world of Lavazza and the information related to these interactions shall be held within our database and shall be used in anonymous form to analyse and improve the services offered, evaluate the effectiveness of the activities and initiatives promoted by Lavazza, and conduct statistical analyses on the composition of the database itself. The legal grounds for the processing is the legitimate interest of the data controller.
Any further purposes in relation to which you have provided your express consent, which can be withdrawn at any time.
The provision of your Personal Data is optional. However, failure to provide them could hinder your ability to use certain services (e.g. to place orders and make purchases, participate in competitions and initiatives involving prizes, receive the newsletter, etc).
It will be possible to tell whether the provision of data is obligatory or optional in each case thanks to the use of symbols (e.g. “*”) placed beside the information that is obligatory in order to achieve the specific purpose.
Your Personal Data shall be processed in accordance with the provisions of the applicable Privacy Legislation, using both electronic and automated tools and manual processes, with logics strictly related to the processing purposes, through the databases, the electronic platforms managed by Lavazza or by third parties (known as Data Processers), the integrated IT systems of Lavazza and the aforementioned third parties, and/or the websites belonging to or in use by Lavazza.
Your Data shall be processed using procedures that are suitable to ensure the maximum security and confidentiality thereof, and only by people trained and authorised to process them. The Data Controller shall implement adequate technical and organisational measures to ensure a level of security suitable for the processing risk.
The Personal Data are mainly processed at the offices of the Data Controller and in the places where the Data Processers are located.
Your Personal Data may be made accessible, for the purposes given above, to LAVAZZA employees and collaborators in Italy and abroad.
The Personal Data provided by you may be communicated to the companies that belong to the Lavazza Group and/or to third-party companies that perform activities in Italy and abroad on behalf of the Data Controller, in the role of Data Processers.
The Data Controller has drawn up a list of Data Processers, which is constantly updated, and which it will make available to you if you contact it at the addresses given in point 11 of this Policy.
Finally, your Data may be transmitted to the judicial authorities where necessary and in the cases provided for by law.
In order to ensure compliance with the principles of necessity and proportionality of processing, various Personal Data storage periods have been established for the specific purposes pursued:
The Personal Data that you provide in order to Register on the website/APP shall be stored for the entire duration of your registration on the portal. In the event of inactivity lasting for a period of 24 months, your Account will be closed.
The data will be stored for a suitable period of time to ensure the correct performance of the contract, and in any case for a further 10 years in order to fulfil the related administrative and tax obligations.
The data collected for the management of competitions and initiatives involving prizes shall be stored for the entire duration of the initiative and for a suitable period of time to ensure its correct performance. This is without prejudice to the fulfilment of administrative and tax obligations, in relation to which the data storage period shall be that provided for by law.
The data collected for the purposes of profiling and marketing, for which you have consented to processing, shall be stored for a period of time no longer than 12 months (profiling) or 24 months (marketing), or for a different period of time if so indicated by the Supervisory Authorities. If you have not provided the aforementioned consent, your personal data shall be rendered anonymous and used for statistical analysis activities.
The data collected in order to manage and respond to requests regarding products and initiatives from the various brands of the Lavazza Group and the data provided during interactions with the world of Lavazza shall be stored for the period necessary to fulfil such requests and subsequently deleted if no further contact ensues.
Lavazza does not normally intend to collect the Personal Data of minors, nor to deliberately establish communications with them. For this reason, we encourage parents to actively monitor the online activities of their children below the age of sixteen.
Despite this, if we do find ourselves in contact with a child below the age of 16 years, the consent of the child’s parents or guardians will be necessary, except in the case of responding to a question or fulfilling a request from the child.
You may at any time assert the rights provided for by articles 15 et seq. of the Regulation in relation to the Data Controller. These include:
a) the right to obtain confirmation of whether or not personal data concerning you exist, even if they are not yet registered, and the communication of such data in an intelligible form;
b) the right to withdraw, at any time, consent previously provided by you in relation to the purposes of processing;
c) the rights of access to and rectification or erasure of personal data, the restriction of processing and the right to data portability;
d) the right to object to processing at any time you wish;
e) the right to bring an appeal before the competent Supervisory Authority, in the event that you believe the processing of your data to be contrary to applicable legislation.
If you wish to exercise the aforementioned rights, or to receive further clarification in relation to the processing of your personal data, you can write to the following email address: PrivacyDPO@lavazza.com or to the registered office of the Data Controller, at Via Bologna 32, 10152, Turin (TO), Italy.