Privacy Policy of Enel X

Personal Data Controller

Personal Data Controller and Processor
Enel X Italia S.r.l., with registered office in Via Luigi Boccherini 15, 00198 – Rome, VAT reg. no. 15844561009 – PEC enelxitalia@pec.enel.it (hereinafter “Enel X Italia” or the “Controller”), as Data Controller, will process your personal data, provided through the site www.enel.it (hereinafter “Site”) in compliance with that established by the applicable law regarding the protection of personal data and by this policy statement.

Data protection officer

Enel X Way Italia has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address:dpo.enelxitalia@enel.com.

Purpose and Methods of Processing

Enel X Italia will process the personal data that you have communicated or that have been legitimately acquired ("Personal Data"). In particular, the following Personal Data may be processed:

• Common, personal and contact data (e.g. first and last names; email address and telephone number): please note that, should you ask Enel X Italia questions by writing to the email addresses reported on the Website or should you request information by filling in the appropriate forms, these Personal Data, together with the content of the message sent, will be used to provide a reply to your request. The provision of further Personal Data shall be regarded as absolutely optional.

• Browsing data: the computer and telematic systems and software procedures used to operate the Site acquire, in the course of their normal operation, certain data (e.g. the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address used to access the Internet, the Internet address used to connect to the site, etc.), the transmission of which is implicit in the use of web communication protocols or is useful for better management and optimisation of the system for sending data and emails. More information on the procedures performed to collect, by means of cookies and/or other tracking technologies, the information provided while browsing the Site can be found in the cookie policy available on the Site itself.

• Reserved area data: access to the reserved area of the Site is allowed only to customers registered through the Enel Single Profile Account.

At the time of creating the Enel Single Profile Account, certain Personal Data, such as first name, last name, email address, mobile phone number and tax code (the latter only for consumer customers) - so-called "registration data" - are required in order to successfully complete the registration, access the reserved area, and take advantage of the services offered by the individual Enel Group companies participating in the Single Profile Account. Registration data, like any data that may already be available to the Data Controller because they were acquired in the context of other contractual relations in place with the same, are in no case subject to transfer to other Enel Group companies. Registration data only are also processed by the Enel Group companies that provide the authentication service, which are specifically appointed as data processors for this purpose (Enel Italia S.p.A. and Enel Global Services S.r.l.).

Processing of Personal Data for the purposes of this Policy shall mean any operation or set of operations which is performed upon Personal Data, by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

We inform you that such Personal Data will be processed manually and/or with the support of computer or telematic means.

Purpose of processing

The following table lists the purposes for which your Personal Data may be processed by Enel X Italia and the legal basis on which the processing is based.

Marketing and/or Profiling Purposes

Through the appropriate forms made available on the Site, you will be able to freely decide whether or not to consent to the use of your Personal Data and contact details, also for market research, direct sales, including by telephone, for the placement of products or services, for commercial communications or marketing activities, relative to products and/or services offered by Enel X Way Italia or by other Enel Group Companies from time to time specifically identified in the data collection forms. Subject to your free and specific consent, for the purposes indicated above, your Personal Data may be processed by the Companies of the Enel Group identified, directly, as autonomous data controllers and/or by Enel X Italia, as Data Processor, on their behalf.

The prior acquisition of your consent for the marketing purposes as described above is not required when contact is made through telephone numbers (landline and/or mobile) and paper mail addresses belonging to persons listed in public telephone directories, in relation to which the rules on the Public Register of Oppositions are applicable, which permit the processing of such contact data regarding persons who have not exercised their right to object.

The acquisition of your consent for "profiling" purposes allows Enel X Italia to process your Personal Data for profiling activities based on your consumption preferences and on the data and information acquired by the Controller through the purchase of its products or services also for the purpose of receiving offers specifically tailored to your needs.

To study better services and products corresponding to its needs, Enel X Italia may make use of partnerships with selected companies that integrate census-type information on a statistical basis, relating to: personal preferences and interests, consumption preferences, economic and family situation, location or movements of the individual. Under no circumstances will your personal data be shared with third parties for profiling purposes.

The email address provided by you in the framework of possible contracts concluded with Enel X Italia may be used by this latter to send commercial offers relative to products and/or services similar to those previously purchased by you (so-called soft-spam). You may, however, at any time object to the processing of your Personal Data by sending a request to the dedicated mailbox referred to in paragraph Rights of the Data Subject of this notice.

Your personal and contact data may also be processed by Enel X Italia in order to carry out, on the basis of its own legitimate interest and having first verified, with regard to each single initiative, that the interests, rights or fundamental freedoms of the interested party do not prevail by means of a specific balancing test (Legitimate Interest Assessment), promotional activities for services and products offered by the Controller.

The processing of Personal Data for marketing purposes may be carried out by means of “traditional” methods (e.g. paper mail and/or operator calls), or by means of “automated” contact systems (e.g. text and/or MMS, telephone calls without operator intervention, email, fax, interactive applications).

The consent given by you for marketing purposes shall be deemed to have been given for both of the methods indicated, without prejudice, however, to your right to object, even partially, in relation to the different communication channels through which the marketing purposes are carried out, in the manner set out in paragraph Rights of the Data Subject of this notice.

Consent for marketing and profiling purposes is optional and does not prevent the possibility to use the products or services offered by Enel X Italia. Any consent given may be revoked at any time by sending a written notice to the email address given in the Rights of the Data Subject paragraph of this notice.

The provision of your Personal Data is necessary in all cases where the processing is carried out on the basis of a legal obligation or in order to perform a contract to which you are a party or the execution of pre-contractual measures taken at your request. In the latter cases, an eventual refusal may make it impossible for Enel X Italia to carry out your request.

The provision of your Personal Data is, on the other hand, voluntary for the pursuit of further purposes set out in the table, and failure to give your consent in relation to them shall in any event have no effect on the conclusion of a contract, if any. The mandatory or optional nature of consent will be specified at the time of collection of the Personal Data.

Legal Basis

Enel X Italia may process your Personal Data for the fulfilment of specific purposes and in the presence of a suitable legal basis provided by the applicable law on Personal Data protection. Specifically, Enel X Italia will only process your Personal Data when one or more of the following legal bases apply:

• you have given your free, specific, informed, unequivocal and express consent to processing;

• processing is necessary for the performance of a Contract to which you are party or the performance of pre-contractual measures taken at your request;

• in the presence of a legitimate interest of Enel X Italia, provided that the interests or fundamental rights and freedoms of the data subject do not prevail;

• by virtue of a legal obligation to which Enel X Italia is bound.

Access to the Reserved Area

The reserved area can only be accessed via the Enel Single Profile Account. Users who were already registered for the digital services of Enel Group Companies participating in the Single Profile Account service prior to the creation of the Single Profile Account itself must accept the Terms and Conditions for the creation of the Single Profile Account.

Please note that it is not possible to access the service with login credentials generated before 9 September 2019, the date on which the Single Profile Account was introduced.

First-time Registration: Personal registration data are collected at the time the Single Profile Account is created at one of the web portals or mobile apps that provide registration functionality. The creation of the Single Profile Account allows you to access the reserved area of the web portals and mobile apps of the Enel Group companies enabled, using a single username and password.

Access after Registration: The reserved area can only be accessed via the Enel Single Profile Account. For authentication purposes, the Single Profile Account system receives the encrypted credentials entered by the user for verification and validation. Your Personal Data will therefore be processed for the sole purpose of verifying these credentials and enabling you to access them easily and without further charge from any country in which an Enel Group company is present. It is understood that such data, for the purposes of access to the reserved area, are in no case made available to the other Enel Group Companies accessible to the Single Profile Account.

Access to the restricted area is permitted in the following ways:

a) Via portals or mobile apps of Enel Group companies accessible to the Single Profile Account;

b) through the use of credentials chosen for the identity created on a social network (so-called “social login”), in particular identities created on AppleId, Facebook and Google, when the option is available. Following acceptance of the terms and conditions of the service, a Single Profile Account will still be associated with the user.

If you decide to access the reserved area through the credentials of a social network, Enel X Italia will need to acquire some of your Personal Data (First and Last Names, email) in compliance with the authorisations you have given to the social network of reference. You are therefore obliged to check the settings provided by the relevant social network and to read the relevant privacy policy carefully. However, at any time you can update or change any information you have acquired through the social login.

Enel X Italia will keep the identification code associated to your account at the social network service of reference when you use it to log in to Enel X Italia or to share contents hosted by the Site; storage will take place for as long as necessary to provide the requested services. In any case, Enel X Italia will not be aware of the credentials used by you for the social network.

Data Recipients

For the pursuit of the purposes indicated in the Purposes of Processing section of this privacy policy, Enel X Italia may need to communicate your Personal Data to third parties, in Italy and abroad (including countries outside the European Union), in order to fulfil the Contract, to comply with legal obligations or to perform activities instrumental to the provision of the services requested.
Your Personal Data may be made accessible for the above-mentioned purposes:

a) to the employees and collaborators of Enel X Italia, specifically appointed as Data Processors;

b) the companies of the Enel Group present in the territory of the European Union in their capacity as autonomous data controllers or data processors, as well as their employees and collaborators specifically appointed as Data Processors;

c) to third party companies or other subjects carrying out certain outsourced activities on behalf of Enel X Italia, in their capacity as data controllers, as well as to their employees and collaborators specifically appointed as Data Processors.
These parties will process your Personal Data, for instance, in the context of:

• customer communication management activities;

• customer care services;

• market research, direct sales, also by telephone, for the placement of products or services, for commercial communications, marketing and profiling activities by Enel X Italia (on the basis of what is described in paragraphs 4 and 6 of this Information Notice);

(d) entities, public and private authorities, supervisory and control bodies;

f) the Co-processing Companies, where present, which jointly determine the purposes and means of the processing, together with Enel X Italia.

Data Transfer

Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, as recognised by a specific adequacy decision of the European Commission.

Possible transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or agreed guarantees are provided by the Controllers and Processors involved, including Binding Corporate Rules and standard contractual data protection clauses. The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be carried out where you have explicitly consented to it or in the cases provided for in the GDPR and will be processed in your interest. In these cases, we inform you that, although the Enel Group adopts common operating instructions for all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local legislation on the processing of Personal Data.

Data Retention Period

All your Personal Data processed for the purposes described above will be stored in accordance with the principles of proportionality and necessity, and in any case until the purposes of the processing and any legal obligations have been fulfilled.

If there is a contractual relationship in place with the Data Controller, your Personal Data will be stored and processed for the duration of said relationship and in any case, for a period of ten years after the termination of the contractual relationship, after which time it shall be deleted, without prejudice to further storage of the same where necessary to comply with specific legal obligations, Authority orders, for the collection of outstanding debts, and for the handling of disputes, claims and legal actions.

Your free and specific consent is requested in order to process your Personal Data and contact details for market research, direct sales, also by telephone, for the placement of products or services, for commercial communications or marketing activities, related to products and/or services offered by Enel X Italia or by other Companies of the Enel Group from time to time specifically identified in the data collection forms. Consent is optional. If you consent, your data will be processed until you revoke said consent.

Your free and specific consent is also required for Enel X Italia to process your Personal Data. Consent is optional. If you consent, your data will be processed until you revoke said consent.

Rights of the Data Subject

Pursuant to Art. 15 - 22 of the GDPR, in relation to the Personal Data disclosed, you have the right, where applicable, to:

a) access and request a copy;
b) request rectification;
c) request cancellation;
d) obtain restriction of processing;
e) oppose processing;
f) receive your data in a structured, commonly used and machine-readable format and to transmit such data to another data controller without hindrance; where technically feasible.

You also have the right not to be subject to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of a contract with the Controller; b) is authorised by law, or c) is based on explicit consent. In cases a) and c) you have the right to express your opinion, contest the decision and obtain human intervention by the Controller.
We inform you that you have in any case the right to object at any time to the processing of Personal Data concerning you that may be carried out on the basis of the legitimate interest of Enel X Italia. In this case, the Data Controller shall refrain from processing your Personal Data further, unless the former can demonstrate the existence of compelling lawful grounds for said processing, or for the establishment, exercise or defence of legal claims.
We also inform you that you still have the right to object at any time to the processing of Personal Data concerning you carried out for marketing purposes, including profiling, insofar as it is related to such direct marketing. The right to object to such processing by automated contact systems also extends to the processing of Personal Data by traditional methods of contact, unless you wish to object only in part.
If you object to processing for marketing or profiling purposes, your Personal Data will no longer be processed for such purposes.

In order to exercise your rights and to revoke your consent you may send written notification to the email address privacy.enelxitalia@enel.com.

Finally, we would like to remind you that if you consider that your data has been processed in a way that does not comply with European Regulation 679/2016 (GDPR), it is your right to lodge a complaint with the Privacy Authority, through:

a) registered letter with return receipt addressed to Garante per la Protezione dei Dati Personali, Piazza Venezia, 11, 00187 Rome;
b) email to: protocollo@gpdp.it, or protocollo@pec.gpdp.it;
c) fax to the number: 06/69677.3785.

Information updated to July 2025