INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF REGULATION (UE) 2016/679 (“GDPR”)

La Marzocco S.r.l. (hereinafter, "Data Controller"), pursuant to Art. 13 of Regulation (EU) 2016/679 (hereinafter, "GDPR"), provides the following information regarding the processing of personal data (hereinafter, "Data") carried out in the context of the use of La Marzocco App (hereinafter, "App"). This privacy notice is provided to natural persons (hereinafter, "Data Subjects") who access the App to use its services.

1. Data Controller and related contact details

The Data Controller is La Marzocco S.r.l., with registered office in Firenze (FI), Via Luigi Salvatore Cherubini n. 14 and operating office in Scarperia (FI), Via La Torre, n. 14/H, P.IVA 04040140487. The Data Controller can be contacted at the following e-mail address: privacy@lamarzocco.com.

For the optional marketing and profiling purposes only, the processing is carried out under joint controllership between the companies of the La Marzocco Group and some premium resellers (hereinafter, the "Joint Controllers"), listed below:

La Marzocco S.r.l.
La Marzocco France Sas
La Marzocco Australasia Limited
La Marzocco Australasia PTY Limited
La Marzocco Thailand
La Marzocco UK Ltd
La Marzocco Spain SL
La Marzocco Deutschland GMBH
La Marzocco SEA PtE LtD
Studer Austria GMBH
Stealth Coffee Systems Inc.
Equipme Ltd
RREBEL COFFEE WORKS A/S Denmark
RRebel Coffeeworks Norway
RRebel Coffeeworks A/B Sweden
I.L.M Coffee Equipment Ltd
La Marzocco Korea Co. LTD
AIWazzan United Trading Company W.L.L.
ESPRESSO AFRICA Limited
Vettei Co. Limited
Kaffesa Gida Sanayi Ve Dis Tic AS

2. Contact details of the Data Protection Officer (DPO)

La Marzocco S.r.l. has appointed its own Data Protection Officer (DPO), who can be contacted at the following e-mail address: dpo@lamarzocco.com.

In accordance with Art. 26 of the GDPR, the Joint Controllers have designated the following point of contact for Data Subjects: privacy@lamarzocco.com.

3. Categories of personal data processed

The Data that may be collected and processed by the Data Controller in the context of registration and use of the App consist of common personal data directly relating to Data Subjects, including:

Identification Data: first name, last name, e-mail address and password. On an optional basis, if provided during registration on the App, telephone number and date of birth may also be processed;
Data of the device used for registration: technical information such as the device's MAC address, UUID, IP address and Bluetooth signals;
Approximate Location Data: the postal code (ZIP code) associated with the area where the device used to configure the coffee machine is located. The location is never precise: the device renders it approximate, and the Controller receives and retains only the corresponding ZIP code, without any address, exact coordinates or other more precise details;
Data for the management of support requests: covered by a dedicated privacy notice available at the following link: https://support-iot.lamarzocco.com/privacy-policy/.
Data for the management of security incident or vulnerability reports: covered by a dedicated privacy notice available at the following link: https://support-iot.lamarzocco.com/privacy-policy-data-breach/.
Coffee Machine Data: serial number, operating and configuration data (e.g., number, type and timing of coffee dispensing);
Data relating to the use of IT systems: data connected to the use of strictly necessary cookies, i.e. text files that the App installs on the device to ensure the proper delivery of the essential functionalities of the service, including the use of tracking tools for the detection of errors and malfunctions.
Data relating to interaction with e-mail communications: promotional communications sent by e-mail contain tracking pixels, i.e. very small, invisible images which, when the message is opened, make it possible to detect, by way of example, whether and when the e-mail was opened, the number of times it was opened, the type of device and e-mail client used, and the IP address.

The Data processed by the Joint Controllers for the optional marketing and profiling purposes only, subject to the Data Subjects' consent, correspond to the identification data already collected in the context of registration and use of the App (first name, last name, e-mail address and, where provided, telephone number and date of birth). Data relating to interaction with e-mail communications are processed solely for the marketing purpose set out in paragraph 5(h) below and are not used for any other purpose.

4. Source of the Data

The Data are collected directly from the Data Subject during the App registration process, as well as from third parties. The latter case may occur, for example, if the Data Subject chooses to log in to the App using the "Sign in with Apple" or "Sign in with Google" function.

For further details on the functioning, data sharing and management of "Login with Apple/Google", please refer to the privacy notices made available by each third party.

5. Why are your personal data processed and what is the legal basis that makes the processing lawful?

The Data are processed for the following purposes:

a) To register on the App: The legal basis for the processing is Art. 6(1)(b) of the GDPR, as the processing is necessary for the performance of a contract to which the data subject is party.
b) To pair the coffee machine with the user's App present on the personal device: The legal basis for the processing is Art. 6(1)(b) of the GDPR, as the processing is necessary for the performance of a contract to which the data subject is party.
c) To carry out activities aimed at verifying and preventing potential anomalies or fraudulent behaviour by distributors and to counter the phenomenon of unauthorized commerce: The lawful basis for processing is Art. 6(1)(f) of the GDPR, as the processing is necessary for the purposes of the legitimate interest pursued by the Data Controller to protect the integrity of its own distribution network, safeguard intellectual and industrial property rights, and ensure the quality and safety of marketed products.
d) To provide aggregated data to the Branches of the La Marzocco Group, through appropriate reports, and to optimize the distribution of technicians, for the purposes of planning the technical assistance service: The lawful basis for processing is Art. 6(1)(f) of the GDPR, as the processing is necessary for the purposes of the legitimate interest pursued by the Data Controller to ensure maximum efficiency of support and technical assistance services.
e) To draw up reports in the sales area, in order to verify the effectiveness of the sales network and evaluate the performance of individual geographic areas: The lawful basis for processing is Art. 6(1)(f) of the GDPR, as the processing is necessary for the purposes of the legitimate interest pursued by the Data Controller to analyze sales performance in the territory and improve commercial and marketing strategies.
f) To assert, exercise or defend a right in judicial proceedings: The lawful basis for processing is Art. 6(1)(f) of the GDPR, as the processing is necessary for the purposes of the legitimate interest pursued by the Data Controller in defending its rights in judicial proceedings.
g) To comply with legal obligations: The lawful basis for processing is Art. 6(1)(c) of the GDPR, as the processing is necessary to comply with a legal obligation to which the Data Controller is subject.
h) To send, via email by the Joint Controllers, informational and commercial communications regarding news, events, products, and promotional offers that may be relevant and of possible interest to the Data Subject and to detect, by means of tracking pixels, interactions with such communications, in order to measure their effectiveness and improve their content, subject line and sending frequency: The lawful basis for processing is Art. 6(1)(a) of the GDPR, as the processing is based on the data subject’s consent to the processing of their personal data. Consent to the use of tracking pixels is included in the consent to receive promotional communications. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
i) To analyse the Data Subject’s interests, habits, and consumption choices, as well as their preferences and purchasing behaviours concerning the products and services offered by the Joint Controllers, in order to personalise the informational and promotional communications sent to the Data Subject: The lawful basis for processing is Art. 6(1)(a) of the GDPR, as the processing is based on the data subject’s consent to the processing of their personal data. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

6. How long do we retain personal data?

The Data are retained according to the following timelines:

For the purpose referred to in paragraph 5(a) above, the Data are retained for 10 years after account closure;
For the purpose referred to in paragraph 5(b) above, the Data are retained for the time necessary to pursue the stated purpose;
For the purposes referred to in paragraph 5(c), (d) and (e) above, pursued through the processing of the postal code (ZIP code) only, associated with the area where the device used to configure the coffee machine is located, the ZIP code is retained respectively:
- for the time necessary to comply with requirements to verify and prevent recurring anomalies or fraudulent behaviour in the distribution network;
- for the period necessary for service planning in the territory;
- for the period necessary for report production.
For the purpose referred to in paragraph 5(f) above, the Data shall be retained for a period of 10 years from the termination of the contractual relationship or from the resolution of any related dispute;
For the purpose referred to in paragraph 5(g) above, the Data shall be retained for the period prescribed by applicable law;
For the purposes referred to in paragraph 5(h) and (i) above, the Data are retained for a period of 13 months from the user’s last activity.

Processing of Data is valid until the withdrawal of consent, which the Data Subject may exercise at any time:

by writing to the e-mail address privacy@lamarzocco.com;
through the "unsubscribe" button at the bottom of each e-mail communication sent;
by accessing the App directly, in the "My account" → "Privacy" section, where it is possible to modify and confirm your preferences;
limited to tracking pixels, via the link "unsubscribe" at the bottom of each communication sent by e-mail or from the "My account" → "Privacy" section of the App. In this case, the Data Subject will continue to receive communications without tracking tools and without any limitation. Withdrawing consent to receive promotional communications also stops the use of tracking pixels.

Once the retention periods indicated above have expired, the Data will be destroyed, deleted, or anonymised, in accordance with the technical procedures for deletion and backup.

7. Cookie and other tracking tools

With specific reference to the use of cookies and other tracking tools, through the App, we use only strictly necessary cookies, essential to ensure the correct functioning and security of the App, as detailed below:

Cookie Name	Cookie Description	Associated Data	Legal Basis	Duration	Third Parties to Whom Data May Be Disclosed	Place of Processing
Firebase Crashlytics	Tracker used only for technical functionalities: in particular for the tracking of errors and malfunctions.	A unique identifier of the App installation; technical information on the error that occurred (type of error and point of code where it was generated); device characteristics (model, operating system, available memory); App status at the time of crash (foreground/background, screen orientation)	The lawful basis for processing is Art. 6(1)(f) of the GDPR, as the processing is necessary for the purposes of the legitimate interest pursued by the Data Controller to ensure the indispensable functionalities for the use of the App	90 days	Google LLC	USA (United States of America)

8. Nature of the Data provision

The provision of the Data is optional but necessary in order to access the App and use the services offered. Any refusal to provide the aforementioned Data would therefore make it impossible to use the App.

The location data (ZIP code) is necessary to complete the pairing of the coffee machine with the user's App present on the personal device. Failure to provide it prevents the completion of such pairing. Once the aforementioned pairing is completed, Data Subjects may disable location from their device without any impact on the services already activated. The provision of optional Data possibly requested during registration (phone number and date of birth) as well as the provision of the Data for marketing and profiling purposes, is entirely optional, and any refusal to provide such Data does not in any way affect access to the App or the use of the service.

9. Persons authorised to process personal data

The Data may be processed by:

personnel and operators of the Data Controller appointed to pursue the purposes indicated above, who have been expressly authorized to process the Data by the Data Controller and have received appropriate operational instructions and are subject to confidentiality obligations;
personnel and operators of the Joint Controllers, who have been expressly authorized to process by the Joint Controllers, in relation to marketing and profiling purposes and have received appropriate operational instructions and are subject to confidentiality obligations.

10. Recipients of the Data

The Data may be disclosed to:

companies within the La Marzocco Group and premium resellers acting as Joint Controllers for marketing and profiling purposes, or as independent controllers to provide local assistance services;
entities, bodies or public authorities to whom Data must be disclosed in compliance with a legal obligation, an order or for the prevention and suppression of unlawful activities;
third-party companies (e.g., Google), acting as independent controllers, that provide cookies and tracking tools strictly necessary for the functioning of the App;
third-party companies acting as independent controllers, should the user decide to link the App to services or platforms offered by them.

The Data may also be processed by third parties, on behalf of the Data Controller and/or the Joint Controllers, designated as data processors pursuant to Art. 28 of the GDPR, to whom appropriate operational instructions are imparted, including:

providers of cloud computing services and technological infrastructure;
providers of platforms for managing support requests and customer relationship management (CRM);
companies offering legal, tax or administrative consulting services;
providers of platforms for managing and sending marketing communications.

11. Transfer of personal data to countries outside the European Economic Area

Certain Data may be transferred to recipients located outside the European Economic Area. The Data Controller and/or the Joint Controllers ensure that such transfers are carried out in compliance with the GDPR. In particular, transfers may be based on an adequacy decision, on standard contractual clauses approved by the European Commission, or on other appropriate safeguards.

Upon request by the Data Subject, the Controller and/or the Joint Controllers will make available the list of recipients located outside the European Economic Area.

12. Rights of the data subject

The Joint Controllers, in compliance with Art. 26 of the GDPR, have designated the following point of contact: privacy@lamarzocco.com to which Data Subjects may address requests at any time in order to exercise the following rights:

the right to access the personal data concerning them (Art. 15 GDPR);
the right to obtain rectification or completion of inaccurate or incomplete data (Art. 16 GDPR);
the right to erasure of personal data (Art. 17 GDPR);
the right to restriction of processing (Art. 18 GDPR);
the right to object to the processing where it is based on the Data Controller’s legitimate interest (Art. 21 GDPR);
the right to receive their personal data in a structured, commonly used and machine-readable format and, where technically feasible, to transmit those data to another controller without hindrance (“right to data portability”, Art. 20 GDPR);
the right to withdraw consent given for marketing and/or profiling purposes at any time, without affecting the lawfulness of the processing based on consent before its withdrawal.

Data Subjects also have the right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 of the GDPR if they believe that the processing of their personal data infringes the applicable data protection legislation.