illycaffè S.p.A. (hereinafter referred to as “the Company” or “illycaffè”) hereby communicates the purposes and methods of processing the data in its possession. The data will be requested and communicated at the moment of enrolment and later during the courses. The Company will request and process only the data required to achieve the purposes described in this privacy policy statement. 1. Please note that the data will be processed by illycaffè manually, by the means of paper, computer and electronic devices (thus illycaffè will retain and process data on paper and computer). Specific security measures will be observed by illycaffè to prevent loss of data, illicit or incorrect use and unauthorized access. All the above data will be stored and processed by illycaffè in full respect of confidentiality and in compliance with all current law provisions and regulations (and therefore in accordance with the principles of correctness, lawfulness, transparency and protection of personal privacy and rights) and strictly related to the purposes indicated in this privacy statement. illycaffè will use the data to perform only the operations necessary to achieve the purposes specified in this statement. The data will be stored at the premises of illycaffè and of authorized subjects (as well as of third parties defined under point 4 of this statement) and will be organized in databases, also electronic. 2. Data shall be processed by illycaffè (which will process only the data required to achieve the individual purposes and will use them only for the operations, which are necessary for the pursuit of these same purposes): A. in order to register you to the course and allow illycaffè to carry out the activities related to the enrolment, organization and management of the same courses; B. in order to enforce or guarantee illycaffè rights in the appropriate courts and to comply with any obligation imposed by law, regulation or legislation (for these purposes the processing can be carried out without the consent of the subject under art. 24, letters a, f, of the Legislative Decree no. 196/03); C. in order for illycaffè to be able to statistically process the data about the frequency of your participation to the courses and the general courses attendance and in order to contact you to understand the reasons for non-participation or low participation. This activity will allow illycaffè to assess the quality of the service and to understand whether or not it should introduce other free courses. 3. The provision of the data required for the purposes referred to under point 2, letter A of this statement is optional, but if the data are not provided, illycaffè may not be able to guarantee your participation to the courses. The provision of the data required for the purposes referred to under point 2, letter B of this statement is mandatory, and if the data are not provided, illycaffè may not be able to guarantee your participation to the courses. The provision of the data for the purposes referred to under point 2, letter C of this statement is optional and failure to provide them will cause only the inability to carry out the activities referred to under point 2, letter C of the same statement, while there will be no effects on your enrolment and participation to the courses. 4. Without prejudice to any further communications that may be necessary for legal, fiscal and contractual purposes and the notices to the subjects indicated in other parts of this statement, the data may be communicated by illycaffè for the purposes referred to under point 2, letter A of this statement to: carriers-shippers-post offices (for the delivery of communications and material), to public bodies or police authorities (in case of justified requests or law provision) and external consultants (e.g. legal). For the purposes stated under point 2, letter B of this statement, the data may be communicated by illycaffè to: carriers-shippers-post offices, judicial bodies or police authorities (in case of justified requests or law provision), public authorities and legal consultants. For the purposes stated under point 2, letter C of this statement, the data will not be disclosed to third parties by illycaffè. It shall be recalled that illycaffè will communicate only the information needed for pursuing the individual purposes. Data may be processed (and therefore acknowledged on behalf of illycaffè) by the persons in charge appointed by illycaffè (administrative, legal and logistical employees, envelope filling and mailing staff also external to the Company, marketing staff also external to the Company, executives, managers, board members and auditors, IT technicians also external to the Company and IT staff, that can also carry out tasks of system administrators being appointed as such in this case, call center employees, consultants also external to the Company, including quality certification consultants, computer, legal and tax consultants, trainees, internal auditors, employees of Data Processor referred to under point 7 and collaborators of other Data Processor as specified later, employees of the University of Coffee and organizers and teachers of courses, also external) and external Data Processor (such as shipping companies, marketing and promotional companies, external companies and firms or professionals, who perform functional activities in support of illycaffè – e.g. legal consultants -, information outsourcers that may host illycaffè servers, call centers) as well as internal Data Processors. External Data Processors may process the data for the purposes related to their assignments also by the means of those responsible for the activities, that these external subjects perform on behalf of illycaffè and as well as for the conservation and management of servers/computers that may contain illycaffè data. Persons in charge and Data Processor shall process the data only if they are necessary for carrying out their assignments and only by the means of the operations that are required by the same assignments. The undersigned company will ensure maximum privacy by the above mentioned third parties and persons in charge and Data Processor and will inform them of the purposes for which the data were communicated. 5. Data will be retained for the time required to achieve the purposes of the processing and in compliance with the applicable regulations. 6. The Data Controller is the undersigned company illycaffè S.p.A. located in Via Flavia 110 in Trieste, telephone +39 040 3890 111, fax +39 040 3890 490, email infoprivacy@illy.com. 7. The Data Processor who can be contacted for anything concerning data processing and the rights prescribed by law under Art. 7 of the Legislative Decree no. 196/03, and to receive the full list of other data processors, is the Corporate Human Resources, Organization, Processes and IT Director, who can be contacted at illycaffè address in Via Flavia 110 in Trieste (tel. +39 040 3890 111, fax +39 040 3890 490, email infoprivacy@illy.com). On our website www.illy.com, under "Privacy Policy", we may communicate any changes regarding the above mentioned Data Processor and the updates to this statement. Therefore, we invite you to visit our website without prejudice to the possibility of requesting the necessary information also in the manner stated under Art. 9 of the Legislative Decree no. 196/03 (by indicating the subject "Information about privacy request" to the Data Processor, the Corporate Human Resources, Organization, Processes and IT Director). 8. The data subject shall at any time exercise the rights under Art. 7 of the Legislative Decree no. 196/03, which is stated below: Art. 7 (Right to access personal data and other rights) 1. A data subject shall have the right to obtain confirmation as to whether or not personal data concerning him exist, regardless of their being already recorded, and communication of such data in intelligible form. 2. A data subject shall have the right to be informed a) of the source of the personal data; b) of the purposes and methods of the processing; c) of the logic applied to the processing, if the latter is carried out with the help of electronic means; d) of the identification data concerning data controller, data processors and the representative designated as per Section 5(2); e) of the entities or categories of entity to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated representative(s) in the State’s territory, data processor(s) or person(s) in charge of the processing. 3. A data subject shall have the right to obtain a) updating, rectification or, where interested therein, integration of the data; b) erasure, anonymization or blocking of data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed; c) certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected. 4. A data subject shall have the right to object, in whole or in part, a) on legitimate grounds, to the processing of personal data concerning him/her, even though they are relevant to the purpose of the collection; b) to the processing of personal data concerning him/her, where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of market or commercial communication surveys. 9. Extended privacy policy statement for third parties: if you communicate us the name of the bar in which you are employed, you also agree to inform your employer that the information about the same bar will be passed on to illycaffè and that illycaffè will process the same information as described in this statement for the purposes referred to under point 2 letter A and B of this statement. Information updated on 30 July 2015. Any updates carried out inside of policy of constant review of the informative ones will be shown in this page. The versions of the previous policy statements are available writing to infoprivacy@illy.com.