Pursuant to and for the purposes of Article 13 of the New European Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data (GENERAL DATA PROTECTION REGULATION – GDPR), as required by the European Union’s General Data Protection Regulation (GDPR 2016/679, Article 13), prior to any processing, the Data Subject (user of the caffeideal.com website) is informed that the personal data collected via the website is processed by the Company using IT and/or telecommunications tools, for the purposes set out in this notice.
To this end, the Data Subject is provided with the Privacy Notice drawn up by Ideal Caffe SRL (hereinafter also referred to as ‘Ideal’ or ‘the Company’ or ‘the Data Controller’), the creator and promoter of the activities available on the caffeideal.com website.

The Data Controller is Ideal Caffe SRL, with its registered office at Via Europa 1762/3 – 23010 – Berbenno di Valtellina (SO) – Italy – VAT number: IT04346820964. For further information regarding the data subject’s rights, please refer to the section entitled ‘Data Subjects’ Rights’ in this privacy notice.

The personal data provided by the user whilst browsing the caffeideal.com website is processed by the Data Controller in accordance with current legislation on the protection of personal data. The legal basis for the processing lies in the provision of the Company’s services, the management and operation of the website, as well as the formation, performance and possible termination of the online sales contract concluded between the parties, and the obligations connected to that contract and/or arising directly and/or indirectly therefrom. The processing of personal data by Ideal is carried out for the following purposes:

1) REGISTRATION ON CAFFEIDEAL.COM: should the user decide to register on the CAFFEIDEAL.COM website, personal data will be processed by the Data Controller for the purposes of registration on caffeideal.com only following the user’s specific consent. In particular, upon providing your first name, surname, email address and setting a login password, these details will be processed to create a personal account, to speed up the purchasing process, to enable you to view the status of your orders and receive updates on purchases made, to change your personal settings and update your account, to view your returns history and requests for exchanges, to save your favourite items to your Wishlist, and to offer you the option to join the loyalty programme at a later date, should you wish to do so.

2) ONLINE SHOPPING: The personal data provided will be used for the purposes of establishing, managing, fulfilling and/or concluding the online sales contract. The data provided will be processed by the Data Controller for the purposes of managing the purchase order, including, by way of example, payment processing, dispatch, handling any returns, customer support, carrying out administrative and accounting tasks related to order management, and complying with obligations under current legislation. In the case of payment by credit card, the essential information required to complete the transaction (credit/debit card number, expiry date, security code) will be processed by PayPal. Under no circumstances will this information be viewed or stored by the seller (Ideal).

3) PROFILING OF NATURAL PERSONS: only following the provision of explicit consent may the personal data provided be processed by the Data Controller for profiling purposes, namely the analysis of preferences with a view to creating personalised content and offers.

In relation to the purposes referred to in point 1) of the previous paragraph, the provision of personal data and consent to its processing is mandatory. Failure to provide consent will make it impossible for Ideal to allow registration on caffeideal.com, create a personal account, speed up the purchasing process, view the status of orders and receive updates on purchases made, and for the user to change their personal settings and update their account, view their returns history and requests for exchanges, and save their favourite items to their Wishlist.
In relation to the purposes referred to in point 2) of the previous paragraph, the provision of personal data and consent to its processing is mandatory. Failure to provide consent will make it impossible for Ideal to proceed with the establishment, management, performance and/or conclusion of the online sales contract, and will therefore make it impossible to carry out, by way of example, activities relating to payment, dispatch, the handling of any returns, customer support, the fulfilment of administrative and accounting purposes linked to order management, and compliance with obligations under current legislation.
With regard to the purposes referred to in point 3) of the previous paragraph, the provision of personal data and consent to its processing is optional. Failure to give consent will make it impossible for Ideal to carry out profiling activities, i.e. to analyse preferences with a view to creating personalised content and offers.

The personal data processed by the Data Controller are those provided by the user whilst browsing the caffeideal.com website, when registering for or subscribing to the services or programmes made available by Ideal, and/or when purchasing products made available by Ideal, such as, for example: name, surname and email address, as well as the data necessary for the provision of the online sales service, such as, for example, data required for processing payments and for the dispatch or exchange of purchased products.

The processing of personal data is carried out by the Data Controller in accordance with the provisions of current data protection legislation. The Data Controller processes personal data using IT and/or telecommunications tools and through organisational and logical procedures strictly related to the purposes set out in this privacy notice, whilst also adopting appropriate security measures to prevent unauthorised access, disclosure, alteration or destruction of personal data, as well as their loss and unlawful or improper use. However, the Company cannot guarantee to its users that the measures adopted to ensure the security of the website and the transmission of data and information on the website are capable of limiting or eliminating any risk of unauthorised access or data leakage from devices belonging to the user. For this reason, users of the website are advised to ensure that their computer is equipped with appropriate software to protect data transmission over the network (such as up-to-date antivirus software) and that their Internet Service Provider has implemented suitable measures to ensure the security of data transmission over the network. The Company also undertakes to process data in accordance with the principles of fairness, lawfulness and transparency, to collect data only to the extent necessary and appropriate for processing, and to allow its use only by authorised staff for the specified purpose. The management and storage of the personal data collected will take place in databases or on servers located within the European Union, owned by the Data Controller and/or by third-party companies appointed as External Data Processors, and, in any event, currently situated in Italy. Depending on the various purposes for which they are collected, personal data will be retained for the time strictly necessary to fulfil those purposes and, in any event, in accordance with the relevant regulations in force. In any case, the Company will take care to avoid the indefinite use of data by periodically verifying, as appropriate, whether the data subject’s interest in the data remains valid.

The data collected will not be disclosed in any way, but will be processed within the limits and for the purposes described by the Company’s employees on the basis of appropriate operational instructions (for example, administrative, sales, marketing and legal staff, system administrators, etc.). Certain data processing operations may also be carried out by third parties, appointed as External Data Processors, whom the Data Controller uses or may use in the context of managing the contractual relationship, providing the services offered and for the organisational needs of its business. In particular, the data may be disclosed to:
(a) public and private entities which may access the data pursuant to a provision of law, a regulation or EU legislation, within the limits laid down by such provisions; b) entities requiring access to the data for purposes related to the contractual relationship between the parties, within the limits strictly necessary for the performance of ancillary tasks (such as, for example, banks and credit institutions, technical service providers, hosting providers, IT companies, communications agencies, postal couriers and freight forwarders); c) consultants, within the limits necessary for the performance of their professional duties.
The up-to-date list of External Data Processors and authorised data processors is kept at the Data Controller’s registered office and is available to the Data Subject upon request, to be made by email to info@caffeideal.com.

Personal data will be processed and stored on servers belonging to the Data Controller and/or to third-party companies duly appointed as External Data Processors located within the European Union. Personal data may be transferred abroad, in accordance with the provisions of current legislation, including to countries outside the European Union. Transfers to non-EU countries, apart from cases where this is guaranteed by Commission Adequacy Decisions, are carried out in such a way as to provide appropriate and adequate safeguards in accordance with Articles 46, 47 or 49 of the Regulation.

As a data subject, you may, at any time, exercise the rights set out in Articles 15, 16, 17, 18, 20 and 21 of the GDPR, which confer, in particular, the right to:
a) obtain from the Data Controller, pursuant to Article 15, confirmation as to whether or not your personal data are being processed and, if so, to obtain access to the data themselves and to information such as: (i) the purposes of the processing; (ii) the categories of personal data; (iii) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular where such recipients are located in third countries or international organisations; (iv) where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period; b) to obtain from the Data Controller, in accordance with Article 16, the rectification of inaccurate personal data concerning him or her without undue delay; taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement; c) to obtain from the Data Controller, in accordance with Article 17, the erasure of personal data concerning him or her without undue delay. The Data Controller is obliged to erase personal data without undue delay if any of the grounds set out in paragraph 1 of Article 17 apply; d) to obtain from the Data Controller, in accordance with Article 18, the restriction of processing where any of the circumstances set out in paragraph 1 of Article 18 apply; e) to obtain from the Data Controller, in accordance with Article 20, data portability; that is to say, to receive, in a structured, commonly used and machine-readable format, the personal data concerning them that has been provided to a Data Controller. The data subject also has the right to transmit such data to another data controller without hindrance from the first data controller to whom they provided the data, provided that the conditions set out in Article 20(1) are met. Finally, the data subject has the right to obtain the direct transmission of personal data from one data controller to another, where technically feasible; f) to object, in whole or in part, in accordance with Article 21, to the processing of personal data concerning them.
To exercise their rights, users may submit their requests to info@caffeideal.com. It should also be noted that the data subject has the right to withdraw their consent at any time without affecting the lawfulness of processing based on the consent given prior to withdrawal, without prejudice to the consequences set out above regarding any refusal to provide such personal data. The data subject also has the right to lodge a complaint with a supervisory authority. They may submit requests regarding the exercise of these rights by contacting: info@caffeideal.com.
Ideal undertakes to respond to requests from the data subject within one month, except in particularly complex cases, in which case it may take up to three months. In any event, the Data Controller will inform the data subject of the reason for the delay within one month of the request. The outcome of the request will be provided in writing or in electronic form. In the event of a request for rectification, erasure or restriction of processing, the Data Controller undertakes to communicate the outcomes of the requests received from the data subject to each of the recipients of their data, unless this proves impossible or involves a disproportionate effort. The Company specifies that the Data Subject may be required to pay a fee if the requests are manifestly unfounded, excessive or repetitive; in this regard, the Data Controller will maintain a register to track requests for action.

The Data Controller reserves the right to make changes to this Privacy Policy at any time by publishing them on the caffeideal.com website. Please therefore check this page regularly, referring to the date of the last update shown at the end of the document. Should the data subject not accept the changes made to this Privacy Policy, they may request that the Data Controller delete their personal data. Unless otherwise specified, the previous Privacy Policy will continue to apply to personal data collected up to that point.