Sacca Società Anonima Caffé Coloniali Alimentari (VAT CHE-105.753.596), in the person of its legal representative pro tempore, with registered office at Via Angelo Maspoli, 4 6850 Mendrisio (Switzerland), in its capacity as Data Controller, hereby informs you that, in compliance with the Federal Act on Data Protection (FADP) and European Regulation 2016/679 (GDPR) which govern the protection of personal data and their free movement, your personal data will be processed in accordance with the aforementioned regulations, based on principles of correctness, lawfulness, proportionality of interests, and transparency, as well as the protection of your privacy and your rights, for the purposes, methods, and terms specified below.

-1- Purposes, methods, and legal bases of data processing

If you grant us your consent, your personal data will be processed exclusively for the following promotional purposes:

• collection and storage of data for sending periodic promotional newsletters by post and/or email and/or SMS;
• making contact by telephone, email, or via social media platforms to promote our products/services and events;
• profiled marketing through the collection of data regarding your personal profile, your habits, behaviors, socio-demographic characteristics, preferences, and opinions via telephone, in-person, or online interviews, through your web browsing behavior, interviews, and questionnaires in order to send you personalized commercial communications and execute targeted promotional campaigns;
• market research and surveys;

The Data Controller will not collect, gather, or carry out any type of processing on data of particular sensitivity (formerly “sensitive data”), such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data concerning health, sex life, or sexual orientation, or data relating to criminal convictions, offenses, or security measures. Personal data processing is carried out by means of operations including collection, recording, organization, storage, consultation, elaboration, alteration, selection, extraction, comparison, use, interconnection, restriction, communication, erasure, and destruction. Personal data processing will be carried out using paper and/or digital media by the controller, the data processor(s), and authorized personnel (designated representatives) while observing every precautionary measure that guarantees security and confidentiality.

Your data will be subject to profiling; processing is in no way carried out through automated decision-making processes.

Data will be stored with the Data Controller and with the Data Processors designated by it. In any case, your personal data will be stored and processed within the borders of the European Economic Area.

Explicit acceptance of this privacy notice by means of a paper signature, electronic acceptance (opt-in) carried out online, fulfillment of contractual obligations, and other conditions set forth in Article 6 of European Regulation 2016/679 and Article 31 of the FADP constitutes the legal basis for the processing of personal data.

-2- Nature of data collection and consequences of failure to provide data

Consent to the use of your data for marketing and/or advertising purposes (sending emails and/or communications with promotional offers) is entirely optional. Failure to provide consent will make it impossible for us to perform any of the activities specified in Section 1 of this notice.

-3- Retention periods and terms

The Data Controller, Data Processors, and authorized handlers will process personal data for the time necessary to fulfill the aforementioned purposes or until you withdraw your consent.

-4- Communication and dissemination of data

Your personal data, for the purposes set forth above, may be disclosed:

• to all natural and legal persons (by way of example and without limitation: legal, administrative, and tax consulting firms, auditing firms, couriers and freight forwarders, data processing centers, IT consultants, suppliers, advisors, etc.) in cases where disclosure is necessary for the purposes illustrated above;
• to our collaborators and employees specifically assigned to this task within the scope of their respective duties;
• to hospitality establishments with which we organize events (by way of example and without limitation: hotels, restaurants, conference halls, etc.);
• advertising agencies, marketing agencies, web designers, event management agencies, and research institutes;
• to bulk mailing service providers (SMTP providers) for sending newsletters;

The D.P.O., where appointed by the Data Controller on a mandatory or voluntary basis, as well as the names and number of data processors, may be subject to change; therefore, it is recommended to check our website where up-to-date information is available on the dedicated page at: www.mokaefti.ch or by using the following contact details: info@mokaefti.ch, +4191 646 39 06.

-5- Rights of the data subject

By calling +4191 646 39 06 or writing to info@mokaefti.ch, you may exercise your rights at any time with respect to the Data Controller pursuant to European Regulation 2016/679, which are summarized below for your convenience. The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed, even if not yet recorded, and to have such data communicated in an intelligible form.

The data subject has the right to obtain details concerning:

• the origin of the personal data (with particular regard to cases where data are not collected directly from the data subject and, in the event of data transfers to a third country, the existence of adequate safeguards pursuant to Article 46 of the Regulation and Article 16 of the FADP);
• the purposes and methods of processing;
• the logic applied in the case of processing carried out with the aid of electronic tools;
• the identification details of the controller, processors, and designated representative;
• the entities or categories of entities to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative in the territory of the State, processors, or authorized personnel;
• the categories of personal data undergoing processing;
• the retention period of the data or the criteria used to determine this period;
• the existence of automated decision-making processes, with particular reference to profiling, and the logic applied;
• the right to obtain a copy of the personal data undergoing processing;

The data subject also has the right to obtain:

• the updating, rectification, or, where interested, completion of the data;
• the erasure, transformation into anonymous form, or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;
• confirmation that the above operations have been brought to the attention of those to whom the data have been communicated, including their content, unless this fulfillment proves impossible or involves a manifestly disproportionate effort compared to the protected right;
• data portability to other entities, for which an explicit request must be addressed to +4191 646 39 06, info@mokaefti.ch;
• the erasure of data from our archives pursuant to Art. 17, para. 1, letters a) through f) of the Regulation (right to be forgotten) and Art. 25 of the FADP by communication to +4191 646 39 06, info@mokaefti.ch;
• the restriction of data processing pursuant to Art. 18, para. 1, letters a) through d) of the Regulation and Arts. 25 and 32 of the FADP.

The data subject has the right to object, in whole or in part, to the processing of data:

• for legitimate reasons connected to their particular situation, even if relevant to the purpose of collection;
• to the processing of personal data concerning them for the purpose of sending advertising material, direct sales, or carrying out market research or commercial communication;
• to data processing pursuant to Art. 6, para. 1, letters e) and f) and Arts. 30 and 31 of the FADP, including profiling on the basis of such provisions.

Where data processing is based on the consent of the data subject, the latter has the right to withdraw such consent at any time by making an explicit request to +4191 646 39 06, info@mokaefti.ch.

Furthermore, the data subject has the right to lodge a complaint with the Supervisory Authority.

The exercise of the aforementioned rights may be carried out by addressing a request to the Data Controller or Data Processor via telephone, by email to the addresses specified above, or by registered letter with return receipt.

Consent of the Data Subject

In requesting your express manifestation of consent to processing (which we will in any event consider granted verbally in the absence of a signed return of this document), we consider you, as of now, informed regarding the processing activities carried out by us pursuant to and for the purposes of European Regulation 2016/679 and the Swiss Federal Act on Data Protection (FADP).