Privacy Policy

Scope and regulatory references

This policy, provided pursuant to Articles 12 and 13 of Regulation (EU) 2016/679 (hereinafter “GDPR”), describes how Torrefazione Mokito S.p.A. processes the personal data of individuals who visit the website www.mokito.it, use the contact forms, register or make online purchases, and subscribe to the newsletter or other commercial communications.

The policy applies to the website indicated and not to third-party websites or services that may be accessible via external links, for which users are encouraged to consult their respective policies. Legislative Decree 196/2003 and subsequent amendments (“Privacy Code”) also apply, as do the provisions of Article 122 of the Privacy Code regarding tracking technologies.

Data Controller

Torrefazione Mokito S.p.A. (also “Mokito” or the “Controller”), Viale Ortles 17, 20139 Milan (MI), Italy, VAT No. 00735560153.

Telephone: +39 02 5357161    E-mail: amministrazione@mokito.it.

For information on the processing of personal data and to exercise the rights described in the following paragraph 10, the data subject may contact the Controller at the contact details provided above.

Categories of personal data processed

Browsing and technical data: data relating to requests made to the website, IP addresses, technical identifiers, logs, date and time of access, browser or device information, and data strictly necessary for the operation, security, and administration of the service, within the limits of what is actually collected by the systems.

Data transmitted via forms or communications: e-mail address, first and last name, optional telephone number, message content, and additional information voluntarily provided for commercial or support requests.

Account and purchase data: identifying and contact information, billing and delivery addresses, tax data, and order-related data, information necessary for managing payments, shipments, and after-sales support.

Newsletter data: e-mail address, optional contact data, date, source, and proof of consent choices, communication preferences, and subscription status.

Data relating to email interactions: where specific consent has been given, open and click events, message and campaign references, date and time of interactions, recipient technical identifiers, and, if collected by the technology used, additional technical data such as IP address or device characteristics.

Mokito advises against submitting personal data unnecessary to the request via the website forms, in particular special categories of data within the meaning of Article 9 of the GDPR.

Purposes of processing and relevant legal bases

Website browsing, operation, and security

Technical data may be processed to enable the display of pages, ensure the proper operation of the website, manage any malfunctions, prevent abuse, and protect system security. The legal basis is, depending on the activity, the need to provide the requested service (Article 6(1)(b) GDPR) or the Controller’s legitimate interest in ensuring the security and operation of the website (Article 6(1)(f) GDPR), without prejudice to the special rules applicable to cookies and other tracking tools.

Information requests and contacts

Data provided via forms, e-mail, or telephone is processed to respond to requests, provide information about products and services, and manage any subsequent contacts. The legal basis is the adoption of pre-contractual measures requested by the data subject (Article 6(1)(b) GDPR) or, for managing non-pre-contractual communications, the Controller’s legitimate interest in providing a response (Article 6(1)(f) GDPR).

Accounts, online purchases, and administrative obligations

Data necessary for creating and managing an account, concluding and executing orders, processing payments, making deliveries, and managing returns, complaints, and support is processed pursuant to Article 6(1)(b) GDPR. Administrative and tax data are also processed to comply with legal obligations pursuant to Article 6(1)(c) GDPR. Payments may involve payment service providers that process data in accordance with the privacy role applicable to them.

Newsletter, offers, and promotional communications

Subject to free and specific consent, Mokito uses contact data, in particular the e-mail address, to send newsletters, company news, offers, promotions, and information about its products, services, and commercial initiatives. The legal basis is the data subject’s consent pursuant to Article 6(1)(a) GDPR, in compliance with Article 130 of the Privacy Code.

Consent to marketing is optional; withholding consent does not prevent browsing the website or making purchases, but does not allow the receipt of the promotional newsletter. The newsletter subscription can be revoked at any time as set out in paragraph 9.

Monitoring email opens and clicks

Only where specific and separate consent has been given in addition to consent to the newsletter, Mokito may use tracking pixels (small images hosted on remote servers that may be loaded when the message is opened) and tracked links in promotional communications to detect interactions with the content.

Depending on the features actually enabled, these tools allow Mokito to determine whether a message has been opened, when and how many times an interaction occurred, which links were selected, and which recipient or campaign the events are associated with; technical connection data may also be collected if provided by the platform. The detection of opens may be affected by privacy protection features in email programs and does not necessarily indicate that the message has actually been read.

Processing is aimed at measuring individual interactions with communications, assessing campaign effectiveness, adapting the content or frequency of messages, and personalizing subsequent commercial communications based on interests inferred from interactions. This personalization may involve commercial segmentation or profiling limited to the behaviors observed in emails.

The legal basis for such processing is the data subject’s consent pursuant to Article 6(1)(a) GDPR and, for the activities to which it applies, Article 122 of the Privacy Code. The absence or revocation of consent to monitoring does not prevent the continued receipt of newsletters, provided that the separate consent to marketing remains valid. In such cases, individual monitoring pixels or tracked click links attributable to the recipient are not used for the aforementioned purposes.

This provision does not apply to operations strictly necessary for the security or transmission of communications, only to the extent and in the cases permitted by applicable law.

Website cookies and tracking tools

The website may use cookies and other technologies necessary for its operation and, only to the extent required by law, additional analysis or marketing tools. Specific information about the technologies used on the website, their purposes, and how preferences are managed is available in the Cookie Policy, which can be viewed at https://mokito.it/pages/cookie-policy. Consent to the website’s tools does not replace specific consent to email monitoring, and vice versa.

Nature of data provision

The provision of technically essential browsing data is necessary to use the website. Data requested to respond to a request or complete an order is necessary to obtain the desired response or service; failure to provide it may prevent the request or purchase from being processed. Providing an e-mail address and consent to the newsletter is optional. Consent to the monitoring of opens and clicks is additional, independent, and optional, and does not constitute a condition for receiving newsletters or any promotions available to subscribers under their respective commercial terms.

Processing methods and protection measures

Data is processed using electronic tools and, where necessary, organizational and manual procedures, in accordance with the principles of lawfulness, fairness, transparency, data minimization, and storage limitation. Access is restricted to authorized individuals in accordance with their respective duties. Mokito adopts technical and organizational measures appropriate to the risks of processing and requires its providers to adopt appropriate protection measures according to their role.

For monitoring promotional communications, configurations must be adopted that respect the choices of subscribers and, where possible, use pseudonymous identifiers separate from the e-mail address, excluding individual tracking in messages sent to users who have not provided consent.

Data recipients

Data may be accessed by Mokito employees and collaborators authorized to process it and, to the extent necessary for the activities performed, by providers and professionals who support the Controller, including hosting and IT infrastructure providers, website and e-commerce platform maintenance providers, customer and newsletter management systems, email sending and interaction analysis services, payment service providers, couriers, and administrative, tax, and legal advisors.

Depending on their respective activities and the applicable agreements, these parties act as data processors pursuant to Article 28 GDPR or as independent controllers. Data may also be disclosed to public bodies or authorities when required by law. Data is not disclosed to the public as a result of subscribing to the newsletter.

Data transfers to third countries

Providers operating outside the European Economic Area may be involved in the provision of digital and communication services. If personal data is transferred to a third country, the Controller ensures that one of the conditions provided for in Chapter V GDPR is met, such as an adequacy decision by the European Commission or, where applicable, standard contractual clauses accompanied by any additional necessary measures.

The data subject may request information from the Controller about the categories of recipients, the destination countries, and the safeguards adopted, using the contact details provided in paragraph 2.

Retention periods and revocation of consent

Contact data and requests: for the period necessary to manage the request and, generally, for no longer than 6 months after it is closed, unless a contractual relationship is established, there is a need to protect rights, or legal obligations apply.

Account, order, and tax documentation data: for the performance of the relationship and, for documentation subject to accounting or tax obligations, for up to 10 years or for the additional statutory periods that apply.

Newsletter data: for as long as the subscription and related consent remain valid, with deletion or exclusion from mailings upon revocation; the Controller periodically verifies the relevance and accuracy of the lists according to documented criteria.

Individual open and click data: for a period not exceeding 12 months from the recording of the interaction, after which it is deleted or anonymized, unless consent is revoked earlier.

Records of consent and revocations: for the period necessary to demonstrate compliance with legal obligations and to protect the Controller’s rights, according to documented criteria and terms, even after communications have ceased.

Technical and security data: for the period necessary to fulfill technical purposes and protect systems, in accordance with the retention periods defined for the services and infrastructure actually used.

Selective revocation: the data subject may revoke consent to the newsletter, thereby ceasing to receive promotional communications, or revoke only consent to monitoring, continuing to receive newsletters without individual tracking of opens and clicks. Revocation must be possible in a simple manner using the preference management tools provided in the emails or by contacting the Controller at the details provided. Revocation does not affect the lawfulness of processing carried out before it.

Data subject rights

In the cases and to the extent provided for by Articles 15–22 GDPR, the data subject may request access to data, rectification, erasure, restriction of processing, data portability, objection to processing, and information about any decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. The right to object to direct marketing may be exercised at any time.

When processing is based on consent, it may be revoked at any time, including selectively for email monitoring only. To exercise these rights, the data subject may write to amministrazione@mokito.it or use the other contact details provided in paragraph 2. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), without prejudice to any other administrative or judicial protection.

Policy updates

Mokito may update this policy to reflect changes in laws, organization, or technology. The current version is available on the website www.mokito.it; in the event of material changes to processing, data subjects will be informed using appropriate methods, and new consent will be obtained where necessary.