Privacy Policy (English)

Introduction

MASSIMO CERUTTI SA is committed to protecting and respecting your privacy. This Privacy Policy is drafted in accordance with the Swiss Federal Act on Data Protection (nLPD) and the European General Data Protection Regulation (GDPR – EU Regulation 2016/679).

1. Data Controller and Data Protection Officer (DPO)

The data controller is MASSIMO CERUTTI SA

We have designated a contact point for privacy matters to ensure compliance with nLPD and GDPR. For any questions or requests regarding your personal data, you can reach us at info@caffe-cerutti.com

Postal contact for privacy requests: MASSIMO CERUTTI SA, Via casate 17/19, 6883 Novazzano, Switzerland

2. Types of Data Collected

We collect and process the following categories of personal data:

• Identification and contact data (first name, last name, address, email, phone number)
• Payment data (processed through secure providers)
• Browsing data (IP address, logs, browser type, visited pages) through Google Analytics and/or similar tools
• Marketing and communication preferences

Our services are intended for persons over 16 years old. We do not knowingly collect personal data from children.

3. Cookies and Similar Technologies

We use cookies and similar tools to optimize browsing experience.

Categories of cookies used:

• Technical cookies: necessary for the website's operation
• Analytical cookies: collect anonymous data on website usage
• Profiling/marketing cookies: used to personalize user experience and offers

Consent for non-essential cookies is requested through a dedicated banner, as required by the GDPR.

You may withdraw your consent at any time by adjusting your cookie settings via the "Cookie Preferences" link in the website footer.

4. Purposes and Legal Bases of Processing

Personal data is processed for the following purposes and legal bases under the GDPR:

• Performance of a contract: order and delivery management
• Legal obligations: storage of tax and accounting records
• Legitimate interest: service improvement, direct marketing to existing customers, and website security (users can object at any time)
• Explicit consent: newsletter subscriptions, promotional communications, and marketing activities

We do not carry out automated decision-making that produces legal or significant effects for users. Profiling is limited to personalized marketing, based only on user preferences with consent.

5. Data Retention

Personal data is retained only for as long as necessary to achieve the purposes for which it was collected:

• Billing data: up to 10 years
• Contact and account data: up to 5 years from last use
• Cookies and browsing data: according to the duration indicated in each cookie's settings (max. 24 months)

6. Data Sharing and Transfers Abroad

We share personal data with trusted third-party recipients strictly for the purposes outlined above:

• Payment providers for secure transactions
• Logistics and delivery partners for order shipment
• IT, hosting, and analytics providers (including Google Analytics)
• Marketing service providers (only where consent has been given)

Personal data may be transferred abroad only to countries that ensure an adequate level of protection according to nLPD and GDPR.

If transferred to countries without adequate protection, Standard Contractual Clauses approved by the European Commission or other suitable safeguards will be adopted.

7. Data Subject Rights

Users have the following rights:

• Access to processed personal data
• Rectification and updating of data
• Erasure of data ("right to be forgotten")
• Restriction or objection to processing (including marketing opt-out)
• Data portability in a structured electronic format

Requests can be sent to: info@caffe-cerutti.com or in writing to MASSIMO CERUTTI SA, Via casate 17/19, 6883 Novazzano, Switzerland

8. Data Breach and DPIA

In the event of personal data breaches, MASSIMO CERUTTI SA, will promptly notify the Swiss Federal Data Protection Authority (FDPIC) and, if applicable, the competent EU Supervisory Authority. If the breach poses a high risk to users' rights and freedoms, the affected individuals will be informed without undue delay.

We regularly review our data processing activities to ensure they comply with privacy regulations.

9. Contact details and competent court

For any questions and/or comments regarding this Privacy Policy, please contact us using the following contact details:

MASSIMO CERUTTI SA
Via Casate 17/19
CH - 6883 Novazzano
Tel. (+41) 091 640 70 00

The exclusive competent court for any disputes is:

Pretura di Mendrisio Sud
Mendrisio Sud
Via Beroldingen 11
Mendrisio Office
CH - 6850 Mendrisio
Tel. +41 91 816 43 51

10. Changes to this Privacy Policy

This Privacy Policy may be updated periodically in case of legislative changes or modifications in processing activities. Users will be informed through the website.