Effective Date  01-08- 2022

Thank you for visiting our website.  Jacobs Douwe Egberts (“JDE”) is dedicated to protecting the privacy of those who visit our website. We ask that you read the policy below carefully.

JDE (Jacobs Douwe Egberts IE Limited,  2nd Floor, Block F1, East Point Business Park, Alfie Byrne Road, Dublin 3) (“WE”) with brands (L'Or, Tassimo, Illy, Kenco) is the Controller of your personal information, which means that we are responsible for how and why your personal information is being processed. "We", "Us" "Our" and JDE", whether capitalized or not, means JDE on behalf of itself and its affiliates and related entities operating as a JDE brand, and each of their respective officers, directors, members, employees, agents, representatives, successors and assigns.

This Privacy Policy sets out how and why we collect, store, process, and share your personal data. It applies to all the personal information we collect about you on our website, when you visit our corporate offices, communicate with us (including through customer service, social media platforms, and other means) or interact with us in other ways.

This Privacy Policy contains references to the EU General Data Protection Regulation (GDPR) and may thus contain references that may not apply to your specific country or jurisdiction. Where corresponding provisions exist under your national law, these may be assumed for the purposes of this Privacy Policy.

In addition, certain jurisdictions may prohibit or limit the collection, use, or sharing of specific categories of personal data; accordingly, this Privacy Policy describing our practices may be limited by those laws and/or further clarified in any country-specific sections applicable to you within this Privacy Policy.

We may amend this Privacy Policy from time to time. Please refer to this Privacy Policy regularly to be updated on our processing activities.

Table of contents

1. Collection and use of your personal data
2. How we share and disclose personal data
3. Advertising and marketing
4. Retention periods
5. Cookies
6. Embedded videos
7. Captcha
8. Social Media data processing
9. Data security
10. Your rights as data subjects
11. Contact details of our data protection officer

Collection and use of your personal data

In the following section, you will find information on how we collect your personal data, for which purposes we process your data, on which legal basis we do so, and for how long we retain your data.

A legal basis for processing your data will arise when one or more of the following conditions apply:

• Consent: You have given us your consent to the use of your information which you can revoke at any time, Art. 6 (1) (a) GDPR.
• Contract: You have/or are about to enter into an agreement with us and your information is needed to provide you with the requested products or services, Art. 6 (1) (b) GDPR.
• Legal obligation: We may be required to process your information to comply with certain legal obligations such as tax and employment law-related reporting, Art. 6 (1) (c) GDPR.
• Legitimate interest: We might use your information because we have—or a third party has—a legitimate interest in doing so. This happens only in cases where we think the way we are using your data doesn’t significantly impact your privacy, that you might expect such processing or there is a compelling reason to do so, Art. 6 (1) (f) GDPR.

For JDE Professional Customers, see the “JDE Professional Data Processing” table below for additional information on how we process your data.

ADDITIONAL JDE PROFESSIONAL DATA PROCESSING INFORMATION

To object to the processing of your data in case of legitimate interest processing OR to withdraw your consent to the processing of your data, please visit the JDE Preference Center, click on the unsubscribe link in any marketing email or contact us via the e-mail address stated in the imprint.

1.   How we share and disclose personal data

We will not share, sell, transfer or otherwise disseminate your Personal Data to third parties, unless this is:

• required by law according to Art. 6(1)(c) GDPR;
• required for the purpose of your contract according to Art. 6(1)(b) GDPR,
• the third-party acts as a data processor on our behalf according to Art. 28 GDPR, as a Joint Controller according to Art 26 GDPR, or you have given us express consent to do so according to Art. 6(1)(a) GDPR or Art. 49(1)(a) GDPR where applicable.

1.1. Transfers of Data

We may transfer your data due to legal reasons or in the case of a merger or acquisition. In the event that a JDE entity or its assets are acquired by, or merged with, another company including through bankruptcy, we will share your personal data with any of our legal successors.

We will also disclose your personal data to third parties (i) when required by applicable law; (ii) in response to legal proceedings; (iii) in response to a request from a competent law enforcement agency; (iv) to protect our rights, privacy, safety or property, or the public; or (v) to enforce the terms of any agreement or the terms of our website.

1.1.1. All transfers of personal data will be carried out in accordance with the applicable privacy regulations and in adherence to JDE internal policies.

Transfers to service providers:

We use third-party service providers to offer or facilitate services on our behalf and share your Personal Data with such providers to the extent necessary for such providers to perform their services on our behalf. 

- Payment processing: we use payment service providers to bill you for goods and services and for credit card processing;

- Order fulfillment: we use several shipping and delivery companies to fulfill orders depending on the product and location;

 - Customer Service: we use several customer service providers to facilitate customer service;

-  Cloud Provider: for our CRM system and an external provider for the hosting of our websites;

- Marketing and Advertising: we work with media agencies such as Havas Media to deliver our social media and other advertising campaigns.   

We partner with companies for interest-based advertising and also use identity facilitators to help us recognize our consumers across our websites, our partner websites, and their shops. We also partner with ad networks and other ad serving providers (“Advertising Providers”) that serve advertising on our behalf and other non-affiliated companies on the internet. Some of those advertisements may be tailored to your interests based on information collected on JDE sites or on non-affiliated websites over time.

The privacy policies for all the above can be found on their corporate websites. JDE is not responsible for the policies of third-party providers.

1.2. Transfers outside the EU and EEA

Please note that with regards to transfers of personal data outside the EU or European Economic Area (EEA), there is a risk that local authorities may access the data for security and surveillance purposes without informing you or allowing you to take legal action.

In order to grant sufficient protection of your personal data in this context, all data transfers above are covered under an appropriate legal transfer mechanism such as an adequacy decision according to Art 45 GDPR or standard data protection clauses adopted by the European Commission according to Art. 46(2)(c) GDPR.

Where you consent to the transfer of your data according to Art 49 GDPR, to our vendors or partners (such as Google, Facebook, YouTube) in the USA, please note that there is a risk of unauthorized processing or access to your data by local authorities and that you may not be able to effectively enforce your rights in the US.  You can revoke your consent to this transfer and data processing at any time by changing your cookie preferences via our cookie banner or through the JDE Preference Center.

2.    Advertising and marketing   

If we have your consent, where required, we use your personal data for advertising, remarketing, and (re)targeting.  We may serve ads to target partner websites and their shops, and also use digital agencies to manage our social media and other advertising campaigns.

We may share your hashed email address and other identifiers such as name, location, phone number, and browsing behavior with our marketing partners, publishers, and other third-party service providers to assist with our targeting advertising on their sites, apps, or social networks.  We may also use this service to reach new target audience groups which are similar to our existing customers based on their characteristics and other identifiers.

Custom Audiences: We and our partners may also compare demographic information including interests and social connections to segment groups based on an automated advanced matching technique of similarities in their profiles. This process can happen in real-time and the matching can be performed independently of the device you are using.  

This is done by uploading an encrypted customer list to a third party, or by incorporating a tracking technology from a third party onto our website. The third party then matches individuals who appear in both our data and their data. Because of how this matching process works, the third party can’t read our encrypted customer list if they don’t already have it.

We use the custom audience functionalities of Facebook, Google, LinkedIn, and other social networks to match personal data against platform user data that the social network already controls to target ads to the relevant audiences.

JDE has no influence on the advanced matching processes or which data is evaluated by the 3rd party for the purposes of creating these reference groups

You can opt-out of these custom audiences, pixels, and similar technologies via our website cookie banner, by using browser-based ad blockers or by managing your privacy settings within your social media platforms.

If you decide that you no longer wish to receive such custom audience-based communications, you can unsubscribe by following the instructions provided in each such communication or by adjusting your privacy settings within the relevant digital media platform.

Personalization (offline and online). With your consent (where required), we may use your personal data (including your JDE transactions and online interests) to analyze your preferences, and habits, anticipate your needs based on our analysis of your profile, improve and personalize your experience on our websites and provide you with targeted advertising and content.

You may opt-out of the processing of your personal data for this purpose by changing your cookie preferences via our cookie banner or by following the instructions provided in any such marketing communication.

2.1. Affiliate and Partner Advertising

We use your personal data to send you information (e.g., marketing communications or advertisements) about our goods and services and those of our partners. Some of these communications or advertisements are run on third-party websites and/or on social networks. When required, we will collect your consent prior to sending or showing you such information, e-mails, or advertisements.

You can withdraw your consent or object to the processing of your personal data for these purposes by changing your cookie preferences via our cookie banner or by following the instructions provided in any such marketing communication.

The advertising and marketing processing as provided above may be done by marketing affiliates, partners, or other 3rd parties.  Some of these companies and 3rd parties may be located in the USA and other countries outside of the European Union (EU)/ European Economic Area (EEA).  In order to grant sufficient protection of your personal data in this context, all data transfers above are covered under the appropriate legal transfer mechanisms such as Standard Data Protection Clauses adopted by the European Commission according to Art. 46(2)(c) GDPR, a European Commission Adequacy Decision or your consent according to Art 49 GDPR.

Where the data is processed outside the EU/EEA based on your consent (according to Art. 49(1)(a) GDPR), please note that there is a risk of unauthorized processing or access to your data by local authorities and that you may not be able to effectively enforce your rights.  You can revoke your consent to this transfer and data processing at any time by changing your cookie preferences via our consent banner, accessible via manage cookies, or through the JDE Preference Center.

Further information on the advertising and targeting cookie and tracker processing can be found in our Cookie Section below or in the Privacy Policy of the corresponding provider.

3.   Retention periods

Unless otherwise specified in this policy, we will delete your personal data if they are no longer required for the relevant processing purposes and no legal retention obligations oppose deletion.

4.    Cookies

How to manage your cookie preferences OR withdraw your consent

You may withdraw your consent or object (“opt-out”) to the placing of any cookies by adjusting your cookie settings through our consent banner at any time, accessible via manage cookies.

4.1. Cookies and tracking technologies

JDE and our third-party partners use cookies and similar technologies like pixels, tags, web beacons and similar technologies (“cookies”), and other identifiers to provide you with the best possible service and optimize our website performance. These cookies may also help us remember your preferences, understand user interactions as well as personalize our website and marketing communications.

Please note that the use of third-party content and functions may result in your data being processed outside the EU or the EEA. In some countries such as the US, there is a risk that authorities may access the data for security and surveillance purposes without informing you or allowing you to take legal action.

Where we use providers or work with third parties in countries outside the EU or the EEA, without an adequate level of protection and you give your consent to the processing, the transfer to this non-EU/EEA country is based on Art. 49(1)(a) GDPR.

More information about our cookie usage and that of the third-party partners and /or providers we work with is available in the Cookie Information section below.

4.2. Cookie Information

Updated information on cookies and corresponding vendors is available on the cookie banner.  

4.2.1. Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you that amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will no longer work.

These cookies usually do not store any personal data. In the exceptional case that these cookies allow a personal reference, the processing is based on legitimate interest.

4.3. Functional Cookies

 Functional cookies allow our website to remember choices you make, enhance your experience, and improve response speed and efficiency by storing certain frequently-accessed information. For example, they help to remember your display preferences (e.g., language, font size), the contents of your shopping basket, store your login details, make the website perfectly fitted for your device, or to remember a search term or filter you used.  You can choose not to allow some of these cookies; however, this may impact your experience of the site and the services we can offer.

The legal basis is your consent in accordance with Art. 6 (1)(a) of the GDPR or our legitimate interest where applicable.

4.4. Analytical Cookies

These cookies collect aggregated information about how you use our website. We use them for web analytics, to recognize and measure returning visitors, to help us improve our online offerings, as well as to test different design ideas for particular pages. These cookies help us to see how effective our advertising is and help to make our marketing more relevant and improve your experience.

This works by allowing us to store temporary and/or session cookies on your end device which we can access to recognize your browser or device (e.g., a browser fingerprint or your unabridged IP address).

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) of the GDPR if you have given your consent via our consent banner, accessible via manage cookies.  

Where permitted by national law, this data processing is carried out on the basis of our legitimate interests according to Art. 6 (1)(f) GDPR or other applicable local regulations.  You can opt out of this processing at any time through our cookie banner.

Some of these analytical cookies may be set by third-party companies located in the USA as stated in the table below. Where you consent to the transfer of your data (according to Art 49 GDPR), to our vendors or partners (such as Google) in the USA, please note that there is a risk of unauthorized processing or access to your data by local authorities and that you may not be able to effectively enforce your rights in the US.  You can revoke your consent to this transfer and data processing at any time by changing your cookie preferences via our cookie banner or through the JDE Preference Center (retail only).

4.5. Advertising Cookies & Tracking Technologies

We use these cookies to show you relevant advertising based on a profile of your interests. These may be set through our site by our advertising partners. Advertising cookies do not directly store personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

The legal basis for this data processing is your consent which you can withdraw at any time in accordance with Art. 6 (1)(a) of the GDPR.

We also use cross-device tracking technologies to help us carry out marketing analytics, create custom audiences and show you targeted advertising on other websites based on your visit to our websites. 

We are not responsible for any third party’s failure to comply with opt-out requests.

What does cross-device tracking mean?

If you log on to the third-party provider with your user data, the respective identification characteristics of different browsers and end devices can be linked with each other. For example, if the third-party provider has created a unique identifier for each laptop, desktop personal computer, smartphone, or tablet you use, these individual identifiers can be associated with each other as soon as you log in to a third-party service using your login credentials. This allows the third party to target our advertising campaigns across multiple devices.

Behavioral advertising

We also use technology to understand and map your interest in our products/track your interest in our products. We may use these to understand what most appeals to you, so we can make our offers as appropriate as possible. This may include browsing behavior to create ads with product recommendations that we believe are best related to items you may have viewed on our website. These ads are then served /shown across other websites that you may visit, typically news sites, video sites, and blogs.  This process is called behavioral advertising and, although the adverts seem to be individually tailored to you, the data is based on anonymized analytic data and insights that are stored temporarily.

Some of these cookies and technologies may be set by third-party companies located in the USA as stated in the table below. Where you consent to the transfer of your data (according to Art 49 GDPR), to our vendors or partners (such as Google, Facebook, and YouTube) in the USA, please note that there is a risk of unauthorized processing or access to your data by local authorities and that you may not be able to effectively enforce your rights in the US.  You can revoke your consent to this transfer and data processing at any time by changing your cookie preferences via our cookie banner or through the JDE Preference Center

5.   Embedded videos

On our websites, we embed videos that are not hosted on our servers. To ensure that accessing our websites containing embedded videos does not automatically lead to the download of third-party content, we only show locally hosted preview images of the videos as a first step. As a result, the third-party provider does not receive any information.

Only after you click on the preview image, is content from the third-party provider downloaded. This provides the third party with information that you have accessed our site and with the usage data technically required for this purpose. Furthermore, the third-party provider is then able to implement tracking technologies. We have no influence on further data processing by the third-party provider. By clicking on the preview image, you give us your consent to download content from the third-party provider.

The embedding is based on your consent in accordance with Art. 6 (1)(a) GDPR, provided that you have given your consent by clicking on the preview image. Please note that the embedding of many videos leads to your data being processed outside the EU or EEA. In some countries such as the US, there is a risk that authorities may access the data for security and surveillance purposes without informing you or allowing you to take legal action. Where we use providers in third countries without an adequate level of protection and you give your consent, the transfer to this third country is based on Art. 49(1)(a) GDPR.

6.   Captcha

To protect our web forms from automated requests, we use the system Google reCAPTCHA by Google LLC. Within the captcha function, you may be asked to carry out a specific task or click on certain checkboxes. The user input required in this context and, if necessary, the mouse movements are used to determine whether the input comes from a person or an automated program.

As the Captcha function is provided by a third party, displaying the captcha will cause third-party content to be downloaded. This provides the third party with information that you have accessed our site and with the usage data technically required for this purpose. We have no influence on further data processing by the third-party provider.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR. You declare your consent by using our web forms that are protected by reCAPTCHA. A corresponding indicator is displayed on these pages.

Please note that the use of the Captcha function may result in your data being processed outside the EU or EEA. In some countries, there is a risk that authorities may access the data for security and surveillance purposes without informing you or allowing you to take legal action. Where we use providers in third countries without an adequate level of protection and you give your consent, the transfer to this third country is based on Art. 49(1) (a) GDPR.

7.   Social media data processing

7.1. Plugins

We may enable the usage of social media plugins such as Facebook, Twitter, Instagram, and YouTube on our website. However, for data protection reasons, we only integrate these social media plugins in a deactivated form. Therefore, when you visit our websites, no data is transmitted to social media services unless you activate the respective social plugin by clicking on the preview image or icon connected to the desired social media platform.

If you click on a plugin, the social media platform receives information about your visit to our websites. This happens regardless of whether you have registered an account with the respective social media service. If you are logged in, the data can be directly assigned to your social media profile. They may also use this information to create user profiles based on your data and use them for personalized advertising.

JDE is not responsible for the privacy policies and/or practices of third parties. When activating or linking to another website or platform, you should read the privacy policy on that site or platform.

The legal basis for this integration is your consent according to Art. 6 (1) (a) GDPR if you have given your consent by clicking on the preview image. Please note that the integration of many social plugins means that your data is processed outside the EU or EEA. In some countries, there is a risk that authorities may access the data for security and surveillance purposes without you being informed or having the right to appeal.

If we use providers in third countries without an adequate level of protection and you give your consent, the transfer to this third country is based on Art. 49 (1) (a) GDPR.

If you no longer wish your personal data to be processed by the activated social plugins, you can prevent future processing by not clicking on the preview image or icon of the respective Social Plugin.

7.2. Social Media Pages

JDE, in addition to the provider of the social media platform (platform provider), is jointly responsible as data controllers for the processing activities concerning your data. The platform provider in this respect primarily determines the purposes and means of the processing activities, which we can influence only to a limited extent. To the extent that we can exert influence over or set parameters regarding the processing of your data, we will, within our means, take actions to ensure that the platform provider processes your data in compliance with applicable data protection regulations.

We operate the following social media sites:

- Twitter: [https://twitter.com/

- Facebook: [https://www.facebook.com/

- YouTube: [https://www.youtube.com/user/

- Pinterest: [https://www.pinterest.com/

- Instagram: [https://www.instagram.com

- Snapchat: https://www.snap.com

-LinkedIn: https://www.linkedin.com

- TikTok: https://www.tiktok.com

Some of these social media platforms are located outside the EU or EEA and therefore there is a risk that the non- EU or EEA authorities may access your data for security and monitoring purposes without you being informed or having the right to appeal. Where these platforms are in third countries without an adequate level of protection and you give your consent to the processing, the transfer to this third country is based on Art. 49(1)(a) GDPR.

7.2.1. Social Media Data Processing

The data you provide directly on our social media pages such as comments, videos, pictures, likes, tweets, etc. is published by the social media platform. The processing by us is based on Art. 6 (1) (f) GDPR which refers to processing that is done in our legitimate interest.

As part of this processing, we may:

• Communicate with you via the social media platform;
• Share your content on any of our social media pages as well as on our website;
• Allow you to participate in contests and/or raffles.

7.2.2. Data processing by the provider of the social media platform

We use several social media platforms and functionalities on our websites. In particular, we use Facebook Connect which is a single sign-on application that allows users to interact on other websites through their Facebook accounts.

The provider of the social media platform uses web tracking methods. Web tracking may also take place independently of whether or not you are logged in or registered on the social media platform. Unfortunately, we cannot influence or restrict the web tracking methods of the social media platform.

Please be aware that the platform provider may use your profile and behavioral data to evaluate, among other things, your habits, personal relationships, and preferences. We have no influence on the processing of your data by the platform provider.

Please refer to the privacy policies of the platform provider for more information on the purpose and scope of data collection and data analysis undertaken by the social network as well as your options to modify settings and how to protect your privacy.

• Twitter: https://twitter.com/en/privacy
• Facebook: https://www.facebook.com/privacy/explanation
• YouTube: https://www.youtube.com/intl/en-GB/about/policies/#community-guidelines
• Pinterest: https://policy.pinterest.com/en
• Instagram: https://help.instagram.com/519522125107875
• TikTok: https://www.tiktok.com/legal/privacy-policy

8.    Data Security

We take technical and organizational measures to protect your personal data as comprehensively as possible from unauthorized access. These measures include encryption procedures on our web pages. Your data is transferred from your computer to our server and vice versa via the internet using TLS encryption.

You can recognize this by the lock symbol in the status bar of your browser and the address line beginning with https://.

9.   Your rights as a data subject

The GDPR grants you certain rights as a data subject including:

Asserting your rights

You can assert the above-mentioned rights by contacting us at the contact details provided in our website imprint with company details or via privacy@JDEcoffee.com.

You may also contact our Customer or Consumer Service via the local phone number and the local email address provided on the website.

10.   Contact details of our data protection officer

Our Global Compliance Officer and external data protection officer are available to provide further information on data protection.  

JDE Global Compliance Officer  

privacy@JDEcoffee.com 

FIRST PRIVACY GmbH,  

Konsul-Smidt-Str. 88,

28217 Bremen, Germany 

www.first-privacy.com 

office@first-privacy.com