Privacy

1.        Controller and Manager of the Processing of Personal Data

1.1   Enel X s.r.l., with registered office in Rome, Viale Tor di Quinto 45/47, VAT no. 9945270966 and others Enel X Group Companies, as independent Data Controllers, will process your personal data in accordance with the provisions of the applicable legislation on privacy and the protection of personal data and this policy.

1.2   When registering for various services or accessing them, the names of any other data controllers and managers will be communicated.

2.       Data Protection Officer (DPO)

2.1   The Data Controller has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address: dpo.enelx@enel.com

3.       Processing Subject and Methods

3.1   The Controller will process the personal data you have communicated or it has legitimately obtained from the Controller ("Personal Data"). In particular, the following Personal Data is processed:

§  Contact details: name, surname, e-mail address, telephone number and the content of the message you have sent, and other Personal Data that may have been provided to us during communications. We will process this Personal Data if you ask us questions, request information or send us communications of various kinds.

§  Browsing data: the IT and telematic systems and software procedures used to operate the Site acquire, during their normal operation, certain data (e.g. the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, the Internet address from which you connected to our Site, etc.), whose transmission is implicit in the use of web communication protocols or is useful for the better management and optimisation of the data transmission and e-mail system.

3.2   For the purposes of this policy, the Processing of Personal Data is intended as any operation or set of operations performed with the aid of automated processes and applied to Personal Data, such as the collection, registration, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.

3.3   We inform you that this Personal Data will be processed manually and/or with the aid of computerised and/or telematic means.

4.       Purpose and legal basis of the processing

4.1   The Controller will process your Personal Data for the achievement of specific purposes and only in the presence of a specific legal basis provided for by the applicable law on privacy and protection of personal data. Specifically, the Controller will process your Personal Data only when one or more of the following legal bases occurs:

• you have given your free, specific, informed, unequivocal and express consent to the processing;
• the processing is necessary for the execution of a contract of which you are a party or for the execution of pre-contractual measures adopted at your request;
• in the presence of a legitimate interest of the Controller;
• the Controller is bound by a legal obligation to process Personal Data.

4.2   The following table lists the purposes for which your Personal Data is processed by the Data Controller and the legal basis of such processing.

4.3   The provision of your Personal Data is necessary in all cases where processing is carried out on the basis of a legal obligation or to execute a contract of which you are a party or due to the implementation of pre-contractual measures taken at your request. Your eventual refusal could entail the Controller's impossibility to proceed with the purpose for which the Personal Data is collected.

4.4   The provision of your Personal Data is voluntary for the pursuit of additional purposes and the failure to provide your consent in relation to them will have no consequences on the conclusion of the contract. The mandatory or optional nature of the provision will be specified at the time of collection.

5.       Recipients of Personal Data

5.1   Your Personal Data may be made accessible for the purposes mentioned above:

a.       to the employees and collaborators of the Controller, appointed for this purpose, or to the companies of the Enel X Group present in the European Union for the performance of organizational, administrative, financial and accounting activities;

b.       to third-party companies or other entities that carry out outsourced activities on behalf of the Controller to enable the Site to operate, as external data processor.

6.       Transfer of Personal Data

6.1   Your Personal Data will be processed within the European Union and stored on servers located within the European Union.

6.2   The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognized by a specific suitability decision of the European Commission.

6.3   The transfer of your Personal Data to third countries outside the European Union, in the absence of a suitability decision or other appropriate measures as described above, will be carried out only if you have explicitly consented to the same, or in the cases provided for by the GDPR, and will be processed in your interest. In these cases, we inform you that despite the fact that the Enel X Group adopts operational instructions that are common to all the countries in which it operates, the transfer of your Personal Data could be exposed to risks related to the peculiarities of local laws regarding the processing of Personal Data.

7.       Personal Data retention period

7.1   The Personal Data processed for the purposes set out above will be kept in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued.

8.       Rights of Data Subjects

8.1   In accordance with articles 15 - 21 of EU Regulation 2016/679 (GDPR), in relation to the Personal Data communicated, you have the right to:

a.       access and request a copy;

b.       request its correction;

c.       request its deletion;

d.       obtain a restriction of processing;

e.       object to the processing;

f.        receive data in a structured format, commonly used and readable by an automatic device and transmit them to another data controller, where technically feasible, without any impediment.

8.2   We inform you that you have the right to object to the processing of Personal Data concerning you at any time, on the basis of the legitimate interest of the Controller.

8.3   If you object to the processing of your Personal Data as indicated in article 8.2, the Controller will refrain from any further processing of your Personal Data, unless it demonstrates the existence of binding legitimate reasons to proceed with the processing, or for the for the establishment, exercise or defence of a right in court.

8.4   To exercise your rights and withdraw your consent, you can send a communication to the e-mail address privacy.enelx@enel.com.

8.5   For further information regarding your Personal Data, you can contact the Personal Data Protection Officer of Enel, who can be reached at the following e-mail address: dpo.enelx@enel.com.

8.6   We remind you that it is your right to lodge a complaint before the competent authority for the protection of personal data.