Informativa Privacy App Enel On Your Way

Important Notice 

Dear Customer, we inform you that, following the corporate transaction that became effective on September 1, we are updating our systems and that, until November 8, 2026, the consents provided and viewable in the dedicated section of the Enel On Your Way App will not automatically be aligned with any consents provided/revoked through other Enel Energia channels. 

Therefore, during the same period, marketing activities for electric mobility services will be carried out on the basis of the preferences you expressed on the Enel On Your Way App, while for all other services and products they will be carried out on the basis of the preferences expressed through other Enel Energia channels. 

PRIVACY NOTICE 

PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679 (“GDPR”) 

Enel Energia S.p.A. (hereinafter also referred to as “Enel Energia”), as Data Controller, informs you that the personal data provided and acquired through the Enel On Your Way App (hereinafter the “App”) at the time of registration for the selected services, both for personal use and for business purposes, as well as the data necessary to provide such services, including browsing data, will be processed in compliance with the confidentiality guarantees and security measures required by applicable law, through IT, telematic and manual tools, using procedures strictly related to the purposes of the processing. 

The information contained in this document is valid both for users who use the service for personal purposes and for users who use the service as employees of a company that has entered into a contract with Enel Energia. 

In particular, in this context, users who use the Enel On Your Way App with a Non-Private Profile consent to: 

1. registering for the service in their own name to create an account by entering their personal data; 

2. using the charging service under the terms and conditions defined by the contract between Enel Energia and their company/employer; 

3. using geolocation as part of the service; 

4. tracking data relating to charging sessions carried out and allowing such data to be viewed by their company/employer; 

5. using their data to provide Customer Assistance services; 

6. receiving the “Electric Bites” Newsletter or similar communications, in order to stay updated on the world of electric mobility and related initiatives of Enel Energia companies. 

Before accessing the various services or features made available through the App that involve the processing of personal data, we invite you, from time to time, to review any additional and specific privacy notices provided pursuant to the GDPR. 

1. Data Controller 

Enel Energia, with registered office at Via Luigi Boccherini 15 – 00198 Rome, Italy, Group VAT number 15844561009 (hereinafter “Enel Energia” or the “Controller”), as Data Controller, will process your personal data in accordance with the applicable legislation on personal data protection and this Privacy Notice. 

2. Data Protection Officer 

Enel Energia has appointed a Data Protection Officer (DPO), who may be contacted at the following email address: dpo.enelenergia@enel.com. 

3. Subject Matter and Methods of Processing 

Enel Energia may process the personal data communicated by you or otherwise lawfully acquired (“Personal Data”) for the purposes for which such data were provided, depending on the circumstances. In particular, the following Personal Data may be processed: 

• Common, personal and contact data: such as first name and surname, tax identification number, email address and telephone number; 

• Economic and Financial Data: data necessary for payments (e.g. IBAN) or proving the execution of payments (payment identification details), as well as any other data relating to the customer’s solvency and punctuality in making payments; 

• Browsing Data: the IT and telematic systems and software procedures responsible for the operation and use of the App acquire, during their normal operation, certain data (e.g. the date and time of access, pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, geographical location, etc.), the transmission of which is implicit in the use of web/app communication protocols or is useful for better management and optimization of the system for sending data and emails. The data may also be used to obtain statistical information regarding the use of the App and to monitor its correct operation, as well as the general performance of the service provided through the App during the period of activity within it. The data may be used to establish liability in the event of cybercrime against the App. This notice applies exclusively to this web and mobile application and does not apply to Personal Data that may be acquired through links to other websites over which Enel Energia has no control and to which this data security statement does not extend. Enel Energia also collects technical information from the user’s mobile device, such as location data or data relating to certain characteristics and performance of the device or mobile operator/operating system, including the type of device and connection, IP address, mobile payment methods, and interaction with other retail-sector technology (such as the use of NFC Tags, QR Codes or mobile vouchers); 

• Location Data: some App services use technology that identifies the physical location of the user’s device using longitude and latitude data indicating the location of the device, through native applications on the device (so-called “Location Data”). Location Data is shared with the map service provider, Google, which converts the Location Data into a point on the map. This map location is used by the App to provide the service requested by the user, for example, to identify the location of the user’s device and the distance between the device and the desired charging station, allowing the user to use charging and charging-infrastructure reservation services. 

If the application is connected to the Internet and linked to the user’s profile, the user consents to Enel Energia processing Location Data in the manner and for the purposes described above. Users who disable the geolocation function will not be able to use the services described above. Google Maps’ privacy notice is available at the following address: https://www.google.com/intl/it_it/help/terms_maps.html and is incorporated into Enel Energia’s Privacy Notice by reference insofar as it concerns the processing of Location Data or Search Address by Google. 

• Data for registration of the Enel Single Profile Account: access to the App is permitted only to customers registered through an Enel Single Profile Account. When creating an Enel Single Profile Account, certain Personal Data are required, such as first name, surname, email address, mobile phone number and tax identification number (the latter only for consumer customers) — so-called “registration data” — which are necessary to successfully complete registration and use the services offered by the individual companies of the Enel Group participating in the Enel Single Profile Account. Registration data, as well as any data already held by the Controller because they were acquired in connection with other contractual relationships in place with the same, are in no case transferred to other companies of the Enel Group. Registration data alone are also processed by Enel Group companies that provide the authentication service, which have been specifically appointed as Data Processors (Enel Global Services S.r.l.). For details regarding the Enel Single Profile Account, please see the dedicated section below. 

• Vehicle Data: in order to provide certain features, the App uses certain data relating to the vehicles you configure, such as VIN (Vehicle Identification Number), license plate number, battery state of charge and odometer reading. Depending on the features you choose to activate, some of this data may be entered by you during the vehicle configuration process or may be made available to us by third parties, such as vehicle manufacturers or their partners. 

For the purposes of this Privacy Notice, the processing of Personal Data means any operation or set of operations performed with or without the aid of automated processes and applied to Personal Data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, erasure or destruction. We inform you that such Personal Data will be processed manually and/or with the support of IT or telematic means. Processing will be carried out using procedures for the organization and processing of Personal Data, including data relating to logs generated by access to and use of the services made available through the App, in accordance with the purposes indicated in this Privacy Notice and, in any event, in such a way as to ensure the security and confidentiality of data and information. 

In the case of online transactions, the processed data are protected through appropriate technological solutions for both connection security and the storage of financial data (credit card, IBAN, etc.). 

Please note that if the App contains links to other websites, web pages or platforms, access to and use of such websites, pages and platforms, as well as the processing of your personal data by them, are subject to their respective terms and conditions and privacy policies, which we invite you to review. 

4. Purposes and Legal Basis of Processing 

Enel Energia will process your Personal Data for specific purposes and where an appropriate legal basis is present as provided by applicable personal data protection legislation. Specifically, Enel Energia may process your Personal Data only where one or more of the following legal bases applies: 

• You have given your free, specific, informed, unequivocal and express consent to the processing; 

• the processing is necessary for the performance of a contract to which you are a party or for the implementation of pre-contractual measures taken at your request; 

• there is a legitimate interest of Enel Energia, provided that the interests or fundamental rights and freedoms of the data subject do not override it; 

• pursuant to a legal obligation to which Enel Energia is subject. 

Providing your Personal Data is necessary in all cases where processing is based on a legal obligation or is necessary to perform a contract to which you are a party or to implement pre-contractual measures taken at your request. In these cases, any refusal on your part may make it impossible for Enel Energia to fulfil your request. 

Providing your Personal Data is instead voluntary for processing purposes for which your prior consent is required. In such cases, failure to provide consent will in no way affect the conclusion of the contract. 

Whether consent is mandatory or optional is specified when the Personal Data are collected. 

In particular, pursuant to Article 13 of the GDPR, Enel Energia informs you that it may process your Personal Data, including through electronic tools and automated storage in its IT databases, for purposes connected with the use of this App and the related services offered, and in particular for the following purposes: 

a) Activities strictly connected with and necessary for the use of the App and the related services. Without providing the Personal Data, it will not be possible to use the services requested by the user or by the company of which the user is an employee. The processing of Personal Data for carrying out such activities is therefore necessary to enable Enel Energia to fulfil its contractual obligations and allow you to use the App. 

It is also specified that use of some of the aforementioned services requires registration with the App according to the procedures described in point b) below. 

b) Enel Single Profile Account — registration and access: it is possible to access the App only through an Enel Single Profile Account. Users who were already registered for digital services of Enel Group companies participating in the Enel Single Profile Account service before the creation of the Enel Single Profile Account itself must accept the Terms and Conditions for creating the Enel Single Profile Account in order to continue accessing the App. 

Please note that it is not possible to access the service using login credentials generated before September 9, 2019, the date on which the Enel Single Profile Account was introduced. 

First Registration: registration Personal Data are collected when the Enel Single Profile Account is created through one of the web portals or mobile Apps that provide the registration function. Creating an Enel Single Profile Account allows you to access, using a single username and password, the reserved areas of the web portals and mobile Apps of enabled Enel Group companies. 

Subsequent Access after Registration: it is possible to access the App only through the Enel Single Profile Account. For authentication purposes, the Enel Single Profile Account system receives the encrypted credentials entered by the user for verification and validation. Your Personal Data will therefore be processed solely to verify such credentials and allow you to access, easily and without additional charges, from any country in which an enabled Enel Group company is present. It is understood that, for the purpose of accessing the App, such data are in no case made available to other Enel Group companies enabled for the Enel Single Profile Account. 

Access to services available through Enel Energia is permitted through the following methods: 

i. Through the App, after registering the Enel Single Profile Account; 

ii. By using credentials selected for an identity created on a social network (so-called “social login”), in particular identities created on Apple ID, Facebook and Google, where the option is available. Following acceptance of the service’s terms and conditions, an Enel Single Profile Account will nevertheless be associated with the user. 

If you decide to access the service using social network credentials, Enel Energia will need to acquire some of your Personal Data (First Name, Surname, Email) in accordance with the authorizations you have granted to the relevant social network. You are therefore required to check the settings provided by the relevant social network and carefully read its privacy policies. You may, at any time, update or modify the information acquired through social login. Enel Energia will retain the identification code associated with your account on the relevant social network when it is used to log in to Enel Energia or to share content hosted on the website; such retention will take place for as long as necessary to provide the requested services. In any event, Enel Energia will not become aware of the credentials you use with the social network. 

c) Compliance with obligations under laws, regulations or European Union legislation. 

d) Sending by Enel Energia by email of commercial offers relating to products and/or services similar to those previously purchased (so-called soft spam); 

e) Sending the “Electric Bites” Newsletter or similar communications, in order to keep you updated on the world of electric mobility and related initiatives of Enel Energia companies; 

f) Sending information and/or updates necessary for the management and performance of the contract and for participation in any reward or loyalty programs; 

g) Carrying out activities aimed at improving the quality of the services offered in connection with the contractual relationship (for example, through surveys sent by email or telephone contacts to assess customer satisfaction and understand how to improve their experience); 

h) Carrying out, by Enel Energia, market research, direct sales, including by telephone, for the placement of products or services, commercial communications or marketing activities; 

i) Carrying out, by designated Enel Group companies (such as Enel X S.r.l.; Enel X Way Italia S.r.l.), market research, direct sales, including by telephone, for the placement of products or services, commercial communications or marketing activities; 

j) Carrying out by Enel Energia S.p.A. of profiling activities involving the processing of your personal data relating, for example, to your consumption preferences and/or your choices regarding the purchase of products or services offered by the Controller. By assessing your preferences, individual and group profiles may be created and offers specifically suited to your needs may also be proposed to you; 

k) Subject to the customer’s free and specific consent, requesting from the electricity trader Personal Data and data relating to the electricity supply and the tariff plan subscribed to by the Customer in order to provide a charging service linked to the tariff plan. 

l) Tracking activities carried out in the App through the collection and processing of Device data, for the purpose of performing statistical analyses and offering personalized advertisements. If you do not consent, only technical and equivalent-to-technical tracking tools will be used to enable the App’s basic functionalities and generate aggregated statistics on visits to and navigation of the App, in order to optimize its content. 

For the purposes referred to in points 4.h), 4.i), 4.j), 4.k) and 4.l), providing consent to the processing of Personal Data is optional and will have no consequences on the use of the App and the related service.

5. Marketing and Profiling Purposes 

Through the appropriate forms, you may freely decide whether to consent to the use of your Personal Data, personal and contact data, also for market research, direct sales, including by telephone, placement of products or services, commercial communications or marketing activities relating to products and/or services offered by Enel Energia or by third-party companies collaborating with Enel Energia, as further detailed in section 4, letter i, of this Privacy Notice. Subject to your free and specific consent, for the purposes indicated above, your Personal Data may be processed by third-party companies collaborating with Enel Energia, directly, acting as independent Data Controllers, and/or by Enel Energia, acting as Data Processor, on their behalf. 

Prior consent for the marketing purposes described above is not required when contact is made through telephone numbers (landline and/or mobile) and postal addresses belonging to persons included in public telephone directories, in relation to which the rules governing the Public Register of Oppositions apply, allowing such contact data to be processed with respect to persons who have not exercised their right to object. 

Obtaining your consent for “profiling” purposes allows Enel Energia to process your Personal Data for profiling activities based on your consumption preferences and on data and information acquired by the Controller through the purchase of its products or services, also for the purpose of receiving offers specifically suited to your needs. 

In order to study better services and products corresponding to your needs, Enel Energia may enter into partnerships with selected companies that statistically integrate census-type information relating to: personal preferences and interests, consumption preferences, economic and family situation, location or movements of the individual. Under no circumstances will your Personal Data be shared with third parties for profiling purposes. 

The email address you provide in connection with any contracts concluded with Enel Energia may be used by Enel Energia to send commercial offers relating to products and/or services similar to those previously purchased by you (so-called soft spam). You may, at any time, object to the processing of your Personal Data by sending a request to the dedicated email address referred to in section 9 of this Privacy Notice or by using the appropriate unsubscribe function. 

Your personal and contact data may also be processed by Enel Energia to carry out, on the basis of its legitimate interest and after having verified, for each individual initiative, that the interests, rights or fundamental freedoms of the data subject do not prevail through an appropriate balancing test (Legitimate Interest Assessment), activities promoting products and services offered by the Controller. 

The processing of Personal Data for marketing purposes may be carried out using “traditional” methods (for example, postal mail and/or calls by an operator), or through “automated” contact systems (for example, SMS and/or MMS, telephone calls without operator intervention, email, fax and interactive applications). 

Consent given for marketing purposes will be deemed to cover both of the methods indicated above, without prejudice to your right to object, including partially, in relation to the different communication channels through which marketing purposes are carried out, according to the procedures indicated in section 9 of this Privacy Notice. 

Consent for marketing and profiling purposes is optional and does not prevent you from using the products or services offered by Enel Energia. Any consent given may be withdrawn at any time by sending a written communication to the email address indicated in section 9 of this Privacy Notice. 

6. Recipients of Personal Data 

In pursuit of the purposes mentioned above in this Privacy Notice, Enel Energia may need to disclose your Personal Data, in Italy and abroad, including to countries outside the European Union, to third parties in order to perform the Contract, comply with legal obligations or carry out activities instrumental to the provision of the requested services. 

Your Personal Data may be made accessible to: 

a) Enel Energia employees and collaborators, specifically appointed as Authorized Persons for processing; 

b) Enel Group companies located within the European Union acting as independent Data Controllers or Data Processors, as well as their employees and collaborators specifically appointed as Authorized Persons for processing; 

c) third-party companies or other entities that perform certain activities outsourced by Enel Energia, acting as Data Processors, as well as their employees and collaborators specifically appointed as Authorized Persons for processing. 

Such entities may process your Personal Data, for example, in connection with: 

• customer communication management activities; 

• customer care services; 

• billing and credit protection services; 

• market research, direct sales, including by telephone, placement of products or services, commercial communications, marketing and profiling activities by Enel Energia (based on the provisions described in sections 4 and 5 of this Privacy Notice). 

d) public and private entities, public authorities, supervisory and control bodies, banks, factoring companies and credit card issuing companies where necessary for the granting of subsidies, contributions, financing, aid and benefits of any kind connected with the supply of the Controller’s products and/or provision of services, or where required by specific legal, regulatory and authorization provisions; 

e) external companies, including foreign companies, operating in the insurance and financing sector, including payment extensions, where permitted by applicable legislation, for the purposes of preventing and controlling the risk of insolvency, fraud prevention and credit protection, as well as entities operating in the area of extrajudicial and judicial debt collection (companies and/or law firms) in the event of assignment of receivables; 

f) Joint Controllers, where applicable, who jointly with Enel Energia determine the purposes and means of processing. 

Enel Energia provides any designated Data Processors and Authorized Persons with instructions aimed at adopting appropriate security measures in order to guarantee the confidentiality, security and integrity of the data. 

7. Transfer of Personal Data 

Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognized by an adequacy decision of the European Commission. 

Any transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible where the relevant Controllers and Processors provide appropriate contractual or other safeguards, including Binding Corporate Rules and standard contractual data protection clauses. 

The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate safeguards as described above, will only take place where you have explicitly consented to it or in the cases provided for by the GDPR, and will be carried out in your interest. In these cases, we inform you that, despite the Enel Group adopting common operating instructions in all countries in which it operates, the transfer of your Personal Data may be exposed to risks connected with the specific characteristics of local legislation concerning the processing of Personal Data. 

8. Retention Period for Personal Data 

The Personal Data processed for the purposes described in this Privacy Notice will be retained in compliance with the principles of proportionality and necessity and, in any event, until the purposes of the processing have been fulfilled and in accordance with any applicable legal obligations. 

Personal Data will be retained and processed for as long as a contractual relationship with the Controller exists and, in any event, for a period of 10 years following termination of the contractual relationship, after which they will be deleted, without prejudice to any further retention where necessary to comply with specific legal obligations, orders issued by authorities, collection of outstanding debts, and management of disputes, complaints and legal proceedings. 

Your free and specific consent is required for the processing of your personal and contact data for market research, direct sales, including by telephone, placement of products or services, commercial communications or marketing activities relating to products and/or services offered by Enel Energia or by other Enel Group companies specifically identified from time to time in the data collection forms. Consent is optional. If you consent, your Data will be processed until you withdraw the consent given. 

Your free and specific consent is also required for Enel Energia to process your Personal Data for profiling purposes. Consent is optional. If you consent, your Data will be processed until you withdraw the consent given. 

9. Data Subject Rights 

Pursuant to Articles 15–22 of the GDPR, with regard to the Personal Data provided, you have the right, where applicable, to: 

a) access your data and request a copy; 

b) request rectification; 

c) request erasure; 

d) obtain restriction of processing; 

e) object to processing; 

f) receive the data in a structured, commonly used and machine-readable format and transmit such data to another Data Controller without hindrance, where technically feasible. 

You also have the right not to be subject to a decision based solely on automated processing unless the decision is necessary: a) for entering into or performing a contract with the Controller; b) is authorized by law; or c) is based on your explicit consent. In cases a) and c), you have the right to express your opinion, challenge the decision and obtain human intervention from the Controller. 

Please note that you have the right at any time to object to the processing of your Personal Data concerning you where such processing is carried out on the basis of Enel Energia’s legitimate interest. In this case, the Controller will refrain from further processing your Personal Data unless it demonstrates compelling legitimate grounds for the processing, or the processing is necessary for the establishment, exercise or defense of a legal claim. 

You also have the right at any time to object to the processing of your Personal Data concerning you where such processing is carried out for marketing purposes, including profiling insofar as it is related to such direct marketing. The right to object to such processing carried out through automated contact systems also extends to the processing of Personal Data through traditional contact methods, unless you wish to object only in part. 

If you object to processing for marketing and profiling purposes, your Personal Data will no longer be processed for those purposes. 

To exercise your rights or withdraw your consent, you may send a communication to the following email address: e-mobility.privacy@enel.com, attaching a copy of a valid identity document in the event of a request for access to or portability of your personal data. 

For further information regarding your Personal Data, you may contact the Data Protection Officer at the following email address: dpo.enelenergia@enel.com. 

Finally, please note that if you believe that your data have been processed in a manner that does not comply with European Regulation 679/2016 (GDPR), you have the right to lodge a complaint with the Data Protection Authority by: 

a) registered letter with return receipt addressed to the Data Protection Authority (Garante per la Protezione dei Dati Personali), Piazza Venezia, 11, 00187 Rome; 

b) email at: protocollo@gpdp.it, or protocollo@pec.gpdp.it. 

Document updated September 2026