Courtesy translation. In the event of any discrepancy, the Italian version shall prevail.

Notice provided pursuant to Articles 13-14 of Regulation (EU) 2016/679 (GDPR). Last updated: 28 September 2026.

Data controller

ITALYCOFFE S.R.L.S. (“Molo Caffè” brand)
Via Puglia 5 – 84098 Pontecagnano Faiano (SA)
VAT No. (P.IVA) and Tax Code 06024160654 – REA SA-491605
PEC (certified email): italycoffe@pec.it – Email: info@molocaffe.com

What data we process

Account and order data: first name, last name, company name, address, email, telephone, billing details and, for business customers, VAT number and SDI recipient code/PEC.
Payment data: handled directly by the payment providers; we do not store card data on our servers.
Browsing data and cookies: IP address, device/browser type, pages visited and interactions with the site. See the Cookie Policy.
Communications: content of requests sent via forms or email.
Promotional initiatives: email address provided to receive a discount voucher (e.g. the “€10 Voucher” campaign advertised on TV) and data relating to participation in the “Become an Ambassador” program (personal code, invited friends, rewards accrued and IBAN for crediting the rewards).
Security data: IP address, date and time of failed login attempts and of form submissions blocked because they were automated (bots).

Purposes and legal bases

Performance of the contract (Art. 6.1.b): management of accounts, orders, shipments, returns and support; sending the requested discount voucher; management of the “Become an Ambassador” program and payment of rewards; sending one-time login codes by email.
Legal obligations (Art. 6.1.c): invoicing and tax/accounting obligations.
Consent (Art. 6.1.a): newsletters and promotional communications, non-technical cookies and analytics tools. Consent is optional and may be withdrawn at any time.
Legitimate interest (Art. 6.1.f): security of the site and of accounts, prevention of fraud and abuse (for example blocking repeated login attempts and forms submitted by bots).

Payments

Card payments are handled by PayPlug SAS (France), a payment institution that processes card data as an independent controller, in accordance with the PCI-DSS security standards. For bank transfer payments, we receive from the bank only the transaction data.

Browsing statistics

Only if you give your consent via the cookie banner, we use Microsoft Clarity (Microsoft Corporation) to understand, in aggregate form, how the site is used (pages visited, clicks, scrolling) and to improve it. Data entered in form fields is not recorded. You may withdraw your consent at any time from the cookie settings. With the same consent we also use Google Analytics (Google Ireland Ltd) for aggregated visit statistics.

Discount voucher and “Become an Ambassador” program

If you request a discount voucher (for example via the QR code of the TV campaign), we use your email to send you the code and a welcome message linked to the request. We will not use it for other promotional communications without your consent.

If you take part in the “Become an Ambassador” program, we process the data necessary to identify the purchases made by the friends you invited, calculate the rewards and credit them by bank transfer to the IBAN you provide.

Cart reminders

If you start an order and enter your email on the checkout page but do not complete it, we keep your email, name and cart contents to send you at most two reminders (after about 1 hour and after 24 hours). Legal basis: the controller's legitimate interest in completing the purchase you started (Art. 6(1)(f) GDPR). You can refuse straight away with the "No thanks" link below the email field or with the link in every reminder. The data is deleted when you complete the order and in any case within 30 days.

Emails after your purchase

If you have bought from us, we may use your email to ask you for a product review (about 7 days after the order is shipped) and to remind you to reorder when the coffee you bought is running out, only for products similar to those already purchased (Art. 130(4) Italian Privacy Code; Art. 6(1)(f) GDPR). You can object at any time, free of charge, using the link in every email or by writing to us. Reviews are published with the name you choose and your rating, marked as a verified purchase.

If you subscribe to the newsletter (via the checkbox at checkout or the form on the site), we use your email, name and site language to send you offers and news. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time using the link in every email. Emails are sent through Brevo (Sendinblue SAS, France), which processes the data as our processor within the European Union. We keep the data for as long as you remain subscribed.

Recipients of the data

Data may be disclosed to: couriers and shipping companies; payment service providers (PayPlug SAS, banks); hosting and email provider (Aruba S.p.A., Italy); analytics service providers (Microsoft, only subject to consent); tax and legal advisors; competent authorities where required by law. These parties act as data processors or independent controllers.

Transfers outside the EU

Data is stored on servers located in the European Union. The use of Microsoft Clarity, active only subject to consent, may involve the transfer of data to the United States: in that case the transfer takes place on the basis of the EU-U.S. Data Privacy Framework and/or the standard contractual clauses approved by the European Commission. The same applies to Google Analytics (Google LLC), which is also active only with your consent.

Retention

Orders and invoicing: for the period required by law (normally 10 years).
Account: until a request for deletion.
Email for the discount voucher: up to 24 months from the request, unless otherwise consented.
“Become an Ambassador” program: for the duration of participation; data on rewards paid for the period required by tax legislation.
Marketing: until consent is withdrawn.
Security data: for a maximum of 12 months.

Your rights

You may at any time exercise the rights of access, rectification, erasure, restriction, portability and objection, as well as withdraw the consent given, without affecting the lawfulness of processing based on consent before its withdrawal. You also have the right to lodge a complaint with the Italian Data Protection Authority (Autorità Garante per la protezione dei dati personali) (www.garanteprivacy.it).

How to exercise your rights

Write to info@molocaffe.com or by PEC (certified email) to italycoffe@pec.it.

Changes

This notice may be updated; the version in force is the one published on this page, with the date of the last update shown at the top.