Rev. March 2021
Indledning
I henhold til EU’s forordning nr. 679/2016 (herefter benævnt “forordningen”) samt den nationale lovgivning om beskyttelse af personoplysninger (herefter samlet refereret til som “lovgivning om privatlivets fred”) opfordrer LUIGI LAVAZZA S.P.A. dig til omhyggeligt at læse denne privatlivspolitik, der indeholder vigtig information om beskyttelsen af dine personoplysninger.
Dine personoplysninger vil blive behandlet på grundlag af principperne om korrekthed, lovlighed, gennemskuelighed, formåls- og lagringsbegrænsning, minimering og præcision, integritet samt fortrolighed, og dette vil ske i henhold til bestemmelserne i forordningen.
****
1. DATAANSVARLIG
Den dataansvarlige er LUIGI LAVAZZA S.p.A. (herefter benævnt “Lavazza” og/eller “den dataansvarlige”), som har registreret kontor i Torino – Via Bologna 32 – og repræsenteres personligt af sin retslige repræsentant.
2. DATABESKYTTELSESANSVARLIG
I overensstemmelse med bestemmelserne i forordningen har den dataansvarlige identificeret og udpeget en databeskyttelsesansvarlig, som er ansvarlig for tilsynet med overholdelsen af forordningen, og som vil være kontaktperson for de registrerede samt den italienske databeskyttelsesmyndighed. Den databeskyttelsesansvarlige kan kontaktes på e-mailadressen PrivacyDPO@lavazza.com
3. BEHANDLEDE PERSONOPLYSNINGER
Hvis en anmodning sendes via sektionen “Kontakt os” på Lavazzas hjemmeside, skal visse personoplysninger gives, før Lavazza kan være i stand til at opfylde eventuelle krav, og derfor er de relaterede felter på registreringsblanketten markeret som værende obligatoriske.
I tillæg til de ovennævnte kategorier af personoplysninger kan andre data, som du direkte har givet os (såkaldte “bidrag”), blive behandlet og delt på sider på sociale netværk, der er dedikeret til Lavazza (Facebook, Twitter, Instagram osv.). Ønsker du at administrere dine indstillinger for disse sider, henvises du til de tredjeparter, som leverer disse tjenester. Som eksempler på data, der indsamles via sociale medier, kan nævnes likes, kommentarer, billeder og overordnet set alt det indhold samt de oplysninger, du eventuelt har delt på sider på de sociale netværk, som er dedikeret til de forskellige brands tilhørende Lavazza Group.
4. FORMÅL MED OG RETSGRUNDLAG FOR BEHANDLINGEN
I overensstemmelse med de krav, der er for tilgang til de forskellige dele af Lavazzas hjemmesider (og uden forbehold for de individuelle initiativer, der vedrører videregivelsen af specifikke personoplysninger, som der vil blive publiceret specifikke individuelle privatlivsmeddelelser for), beskrives formålet med behandlingen af dine personoplysninger samt retsgrundlaget for denne nedenfor:
Andre formål:
Tillæg til de tidligere beskrevne omstændigheder:
5. VIDEREGIVELSENS BESKAFFENHED
Videregivelse af dine personoplysninger er valgfrit. Imidlertid kan mangelfuld eller ingen videregivelse af personoplysninger resultere i, at det bliver umuligt at anvende visse tjenester (fx foretagelse af bestillinger og køb, deltagelse i konkurrence og giveaways, tilsendelse af nyhedsbrevet osv.).
I alle tilfælde, hvor videregivelse af dine personoplysninger er enten obligatorisk eller valgfrit, indikeres dette ved hjælp af symboler (fx “*”), som placeres ved siden af de personoplysninger, som skal videregives til det respektive formål.
6. BEHANDLINGSMETODER
Dine personoplysninger vil blive behandlet i overensstemmelse med bestemmelserne i den gældende lovgivning om privatlivets fred. Dette vil ske via elektroniske, automatiserede eller manuelle metoder, der følger fremgangsmåder, som er passende til de formål, dine personoplysninger er blevet indhentet til, eller de elektroniske platforme, som administreres af Lavazza eller tredjeparter (der er udpeget som databehandlere), Lavazzas samt de nævnte tredjeparters integrerede IT-systemer og/eller hjemmesider, der ejes eller anvendes af Lavazza.
Dine personoplysninger vil blive behandlet ved brug af metoder, som sikrer den højeste grad af fortrolighed, og behandlingen vil udelukkende blive foretaget af personer, der er trænet og godkendt til dette. Den dataansvarlige tager sig alle passende tekniske og organisatoriske forbehold for at garantere et sikkerhedsniveau, der er passende for den risiko, som er til stede under behandlingen.
Personoplysninger vil hovedsageligt blive behandlet på kontorer tilhørende den dataansvarlige samt lokationer tilhørende databehandlere.
7. MODTAGERE AF OPLYSNINGER
Til brug i forbindelse med de ovennævnte formål kan dine personoplysninger blive gjort tilgængelige for Lavazzas ansatte og partnere.
De personoplysninger, du giver, kan blive overført til selskaberne i Lavazza-koncernen og/eller tredjepartsvirksomheder, der er beliggende inden for såvel som uden for EU/Det Europæiske Økonomiske Samarbejdsområde. Disse virksomheder udfører ovennævnte aktiviteter vedrørende behandling af personoplysninger på vegne af den dataansvarlige og vil fungere som databehandlere.
Den dataansvarlige vedtager passende garantier for at sikre et tilstrækkeligt beskyttelsesniveau svarende til det, der anvendes i EU/EØS.
Den dataansvarlige har lavet en liste over databehandlere, som opdateres løbende og kan gennemses ved at kontakte de adresser, der nævnes under punkt 11 i denne privatlivspolitik.
Til slut kan dine personoplysninger blive videregivet til retslige myndigheder, såfremt dette er nødvendigt, og såfremt dette er påkrævet i henhold til lovgivningen.
8. LAGRINGSPERIODE FOR OPLYSNINGERNE
For at garantere overholdelse af nødvendigheds- og proportionalitetsprincipperne i forbindelse med behandlingen har vi fastlagt forskellige lagringsperioder for personoplysninger i forbindelse med de individuelle formål, disse benyttes til;
9. MINDREÅRIGES DATA
Lavazza indsamler normalt ikke personoplysninger tilhørende mindreårige, og virksomheden vil ikke forsøge at kommunikere med disse. Af denne årsag opfordrer vi forældre til aktivt at overvåge det, som deres børn under seksten år foretager sig online.
Hvis vi imidlertid skulle oprette kontakt til en mindreårig, der er yngre en 16 år, skal der indhentes samtykke fra vedkommendes forældre eller værger, medmindre denne kontakt består af et svar på et spørgsmål, som vedkommende har stillet, eller vi skal administrere en anmodning fra denne person.
10. DEN REGISTREREDES RETTIGHEDER
Du kan overfor den dataansvarlige til enhver tid udøve de rettigheder, som beskrives i artikel 15 mv. i forordningen, herunder:
a) Retten til af få bekræftet, om vi opbevarer personoplysninger om dig, uanset om disse allerede er blevet registreret, samt få videregivet oplysninger om disse i et letforståeligt format;
b) Retten til enhver tid at tilbagetrække det samtykke til behandlingen, du har givet;
c) Retten til at tilgå, berigtige, slette eller begrænse behandlingen samt portabilitet af dine personoplysninger;
d) Retten til enhver tid at fremsætte indsigelse mod behandlingen, skulle du ønske dette;
e) Retten til at fremlægge en sag for den ansvarlige tilsynsmyndighed, såfremt du mener, at behandlingen af dine personoplysninger sker i modstrid med den gældende lovgivning.
11. METODER TIL UDØVELSE AF DINE RETTIGHEDER
Hvis du ønsker at udøve de tidligere beskrevne rettigheder eller gerne vil have mere information om behandlingen af dine personoplysninger, bedes du venligst sende en e-mail til: PrivacyDPO@lavazza.com eller rette henvendelse til den dataansvarliges registrerede kontor på adressen Via Bologna 32, 10152, Turin (TO), Italy.
INFORMATION ON PERSONAL DATA
DATA CONTROLLERS
Luigi Lavazza S.p.A., Torino, Italy – Via Bologna, n.32
PERSONAL DATA
Lavazza will process the following categories of personal data:
- Identity Data (includes first name, maiden name, last name, username or similar identifier);
- Contact details (email, telephone number, delivery address);
- Geo-location data and/or Internet browsing data processed through the use of cookies installed on your PC or mobile device (for any further information please check the Cookie Policy);
- Bank details useful for the management of the commercial relationship (includes bank account and payment card details);
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us;
- Marketing and Communications Data includes the data subject's preferences in receiving marketing from Lavazza and other third parties and its communication preferences.
PURPOSES OF PERSONAL DATA PROCESS
a) Site Sign-in: registration on the Website by creating an account or using a social network account.
b) Activation and handling of purchase orders, contractual and commercial relationships and related activities
c) Marketing sending of informative and promotional materials relating to the Lavazza Group products
d) Partaking in prize draw, competition or surveys
e) Profiling activities
Performing market analysis and data processing for statistical purposes as well as analyze or predict in order to offer products and services more and more suited to the customers’ interests and to develop customized promotions and commercial communications.
COMMUNICATION OF DATA TO THIRD PARTIES
The personal data will not be disclosed to third parties, except for the other companies belonging to the Lavazza Group, Italian and / or abroad.
The personal data may also be disclosed to third-party companies (business partners and service providers) if and as legitimately instructed by Lavazza as Data Processors to perform functional activities to achieve the purposes as indicated above.
The list of the Data Processors will be constantly updated and at your disposal by contacting the Data Controller at the addresses indicated below.
RIGHTS OF THE DATA SUBJECT
Right of access, right to rectification, right to erasure, right to restriction of processing ; right to data portability; right to object to processing and automated individual decision-making.
PRIVACY POLICY
Lavazza Coffee (UK) Limited is a wholly-owned subsidiary of Luigi Lavazza S.p.A. This privacy notice is issued on behalf of the Lavazza Group so when we mention "Lavazza", "we", "us" or “our” in this privacy notice, we are referring to the relevant company in the Lavazza Group responsible for processing your data. Luigi Lavazza S.p.A is the controller and responsible for this website.
Following the provision of the EU Regulation 679/2016 (“GDPR – General Data Protection Regulation”) Luigi Lavazza S.p.A. and the other affiliated companies inform that any personal data provided by the Data Subject (meaning the individual who is the subject of personal data) will be used in accordance with the applicable regulation and in compliance with the following criteria:
1) DATA PRIVACY MANAGER
We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.
2) PERSONAL DATA
Lavazza will process only the following categories of personal data:
- Identity (data includes first name, maiden name, last name, username or similar identifier)
- Contact details (email, telephone number, delivery address)
- Geo-location data and/or Internet browsing data processed through the use of cookies installed on your PC or mobile device (for any further information please check the Cookie Policy)
- Bank details useful for the management of the commercial relationship (includes bank account and payment card details);
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us;
- Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
Lavazza does not collect and does not process any Special Categories of Personal Data on the website, such as, for example, details of
racial and ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious, philosophical, political or trade union nature, as well as personal data capable of revealing the state of health and sexual life.
3) RIGHT TO WITHHOLD THE PERSONAL DATA
Providing personal data is optional, but may be necessary for the achievement of some of the purposes indicated (eg the activation of contractual and commercial relations, the management of competitions and prize operations, sending newsletters, etc.). If you do not provide personal data reported as mandatory, Lavazza will not be able to perform the abovementioned purposes.
The mandatory or optional nature of the personal data is from time to time marked using symbols (eg "*") placed alongside the mandatory information required for a particular purpose.
In any case, personal data will be processed by Lavazza only on the following lawful basis:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
- processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
- processing is necessary for compliance with a legal obligation to which the controller is subject; or
- processing is necessary for the purposes of the legitimate interests pursued by Lavazza.
4) PURPOSES OF PERSONAL DATA PROCESS
The personal data you provide will be collected and processed by Lavazza for the following purposes:
· Site Sign-in: registration on the Website by creating an account or using a social network account allows the use of the Website as a "Registered User"; the purchase procedure will thus be simplified without re-entering all the personal data required for the completion of an order during each purchase process, but only some of them. The provision of data is optional. The lawful basis for this activity is: the data subject has given its consent.
· Access to the Website to proceed with the purchase of products without registering: in this case, the personal data you provide will be used by Lavazza as the data controller, exclusively for the purpose of completing the purchase order. The provision of personal data is in fact optional but necessary for the management of the order and for the consequent administrative-accounting purposes. You can also be contacted for any communications regarding the purchase itself. Your data may not be disclosed to third parties, other than the couriers appointed by Lavazza for the delivery of the products purchased.
The lawful basis for processing is: the performance of a contract with the data subject.
· Activation managing purchase orders, contractual and commercial relationships and related activities (compliant with the Terms of Sale). - The lawful basis for processing is performance of a contract with the data subject.
· Manage Technical requests relating to the customers' purchases, such as information on the progress of their orders, and any other requests in a broad sense regarding the website and the goods and services accessible through it; The lawful basis for processing is performance of a contract with the data subject.
· Managing payments and deliveries of products purchased through the Site (compliant with the Terms of Sale) - The lawful basis for processing is: performance of a contract with the data subject.y
· Partaking in prize draws, competitions or surveys; - The lawful basis is: performance of a contract with the data subject.
4.1) Further Purposes
• If the data subject has expressly and given its consent, Lavazza may send informative and promotional materials relating to the Lavazza Group products.
• Lavazza may process personal data for profiling purposes, e.g. to perform market analysis and data processing for statistical purposes as well as analyze or predict, thanks to algorithms and other automated systems, tastes, potential habits and consumption choices, to offer products and services more and more suited to the customers’ real interests and to develop customized promotions and commercial communications. The aforesaid profiling activity could also be carried out using third-party cookies. In this regard, we invite you to read our Cookie Policy. This is necessary for Lavazza's legitimate interest (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy).
5) HOW WE TREAT YOUR DATA
Lavazza's processing of personal data is compliant with the provisions of the GDPR and with all the other relevant applicable law, and it is performed with the help of electronic and automated tools, all designed to ensure the maximum security and confidentiality . In addition, we limit access to your personal data to those employees, agents, contractors and other third parties such as service providers, suppliers, professional advisers. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
Lavazza has put in place appropriate security and technical measures to guarantee the protection of the personal data it holds.
6) HOW DO WE COMMUNICATE OR TRANSFER YOUR PERSONAL DATA
Personal data may be made accessible for the purposes above mentioned to:
- employees and personnel of the Data Controller in Italy and abroad, as persons in charge of processing and / or system administrators and / or administrators;
- third party companies or other legal entities (as an indication, credit institutes, professional firms, consultants, insurance companies for the provision of insurance services, etc.) that carry out outsourcing activities in Italy and abroad on behalf of the Data Controller, as external Data Processor
The personal data will not be disclosed to third parties, except for the other companies belonging to the Lavazza Group, Italian and / or abroad. We do not transfer any personal data outside the European Economic Area.
The personal data may also be disclosed to primary third-party companies (business partners and service providers) if and as legitimately instructed by Lavazza as Data Processors to perform functional activities to achieve the purposes as indicated above.
The list of the Data Processor will be constantly updated and at your disposal by contacting the Data Controller at the addresses indicated below
7) DATA RETENTION PERIOD
Personal Data useful for Site signing-in will be kept for the entire duration of its registration on the Site and for the further period provided for by law, in relation to the purpose of the collection.
Personal Billing Data will be kept for a period of time to guarantee the correct execution of the contract and the fulfillment of the related administrative and tax obligations up to 7 years.
Data collected for the purposes of sending promotional and advertising material and data collected for commercial profiling purposes will be retained for a period not exceeding 24 months [after you have notified us that you do not wish to receive marketing materials from us] or the period indicated by the relevant supervisory authority if it is shorter.
Personal data collected for the management of prize competitions and transactions will be kept for the entire duration of the premium transaction and for a period of time to ensure the correct execution of the contract and the fulfillment of the related administrative and tax obligations.
The data collected for profiling purposes will be kept for a period of time not exceeding 12 months or the period indicated by the relevant supervisory authority if it is shorter.
8) CHILDREN
We strongly recommend that parents take an active role in supervising the online activity of their children under the age of sixteen. Lavazza generally does not intend to collect personal data from and/or generally does not intentionally communicate with children. However, in case we need to communicate with a child, we will endeavor to give the parents or legal guardians a reasonable opportunity to consent before we use the personal data of the child, except where we merely answer the child’s question or service the child’s request
9) RIGHTS OF THE DATA SUBJECT
Data Subjects may at any time exercise the rights provided by the EU Regulation 679/2016, including:
a) the right for the data subject to obtain a copy of the personal data Lavazza holds concerning him or her, and their communication in an intelligible form;
b) the right to revoke at any time the consent given by the data subject where consent is relied on to process personal data;
c) the right to request rectification, erasure, and data portability.
d) the right to restrict or object to the data processing;
e) the right to appeal before the competent Authority.
10) EXERCISE OF THE RIGHTS – DPO CONTACTS
In the event the data subject wishes to exercise the aforementioned rights or wishes to receive further clarifications regarding the processing of personal data, data subject may write to the Data Controller at the following address:
LAVAZZA COFFEE (UK) LIMITED
LUIGI LAVAZZA S.p.A.
Via Bologna, 32
10152 Turin (TO)
5th Floor, The Charter Building, Vine Street,
P.I. IT00470550013
Uxbridge, Middlesex UB8 1JG
Tel. 011/2398863
E-mail: PrivacyDPO@lavazza.com