Enel X Way Privacy Policy

This Information Notice illustrates the management methods for the personal data of users of the enel.it site (hereinafter referred to as "Site") and of the personal data that may be processed by Enel X Way Italia S.r.l.

The information is provided pursuant to Art. 13 of the EU Regulation 2016/679 (“GDPR”).

1. Data Controller

Enel X Way Italia S.r.l., with registered office in Via Ostiense 131/L – 00154 Rome, VAT number 15844561009 – PEC enelxwayitalia@pec.enel.it (hereinafter “Enel X Way Italia” or the “Data Controller”), as Data Controller, will process your personal data provided also through the Site in compliance with the provisions of the applicable legislation on the protection of personal data and this policy.
 

2. Data Protection Officer (DPO)

Enel X Way Italia has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address: dpo.enelxwayitalia@enel.com.

3. Purpose and Methods of Processing

3.1. Enel X Way Italia will process the personal data communicated by you or in any case legitimately acquired ("Personal Data") to pursue the purposes for which said data, as the case may be, have been conferred. In particular, the following Personal Data may be processed:

• Common, personal and contact data (e.g. first and last names; email address and telephone number): please note that, should you ask Enel X Way Italia questions by writing to the email addresses reported on the Site or should you request information by filling in the appropriate forms, such Personal Data, together with the content of the message sent, will be used to provide a reply to your request. The provision of further Personal Data shall be regarded as absolutely optional;

• Economic and financial data: data necessary for payments (e.g. IBAN) or proving the execution of payments (e.g. identification details of payments) and any other data relating to the Customer's solvency and punctuality.

• Data acquired by Customer Service: data supplied during interactions with Enel X Way Italia Customer Service, including recordings of phone calls, which will be carried out to verify the quality of the service supplied or by virtue of a legal obligation;

• Browsing data: the computer and telematic systems and software procedures used to operate the Site made available by Enel X Way Italia, acquire, in the course of their normal operation, certain data (e.g. the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address used to access the Internet, the Internet address used to connect to the site, etc.), the transmission of which is implicit in the use of web communication protocols or is useful for better management and optimisation of the system for sending data and emails. More information on the procedures performed to collect, by means of cookies and/or other tracking technologies, the information provided while browsing the Site can be found in the cookie policy available on the Site itself.

• Reserved area data: access to the reserved area of the Site is allowed only to customers registered through the Enel Single Profile Account. At the time of creating the Enel Single Profile Account, certain Personal Data, such as first name, last name, email address, mobile phone number and tax code (the latter only for consumer customers) - so-called "registration data" - are required in order to successfully complete the registration, access the reserved area and to take advantage of the services offered by the individual Enel Group companies participating in the Single Profile Account. Registration data, like any data that may already be available to the Data Controller because they were acquired in the context of other contractual relations in place with the same, are in no case subject to transfer to other Enel Group companies. Registration data only are also processed by the Enel Group companies that provide the authentication service, which are specifically appointed as data processors for this purpose (Enel Global Services S.r.l.).

3.2. Processing of Personal Data for the purposes of this Policy shall mean any operation or set of operations which is performed upon Personal Data, by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3.3. We inform you that such Personal Data will be processed manually and/or with the support of computer or telematic means.

3.4 The Controller has adopted technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 of the GDPR, aimed at preventing and counteracting the loss of Personal Data, as well as unlawful or incorrect use and unauthorised access.

4. Purpose and legal basis of processing

4.1 Enel X Way Italia may process your Personal Data for the fulfilment of specific purposes and in the presence of a suitable legal basis provided by the applicable law on Personal Data protection. Specifically, Enel X Way Italia will only process your Personal Data when one or more of the following legal bases apply:

• you have given your free, specific, informed, unequivocal and express consent to processing;
• processing is necessary for the performance of a Contract to which you are party or the performance of pre-contractual measures taken at your request;
• in the presence of a legitimate interest of Enel X Way Italia provided that the interests or fundamental rights and freedoms of the data subject do not prevail; 
• by virtue of a legal obligation to which Enel X Way Italia is bound.

4.2 The following table lists the purposes for which your Personal Data may be processed by Enel X Way Italia and the legal basis on which the processing is based.

4.3 The provision of your Personal Data is necessary in all cases where the processing is carried out on the basis of a legal obligation or in order to perform a contract to which you are a party or the execution of pre-contractual measures taken at your request. In the latter cases, an eventual refusal may make it impossible for Enel X Way Italia to carry out your request.

4.4 The provision of your Personal Data is, on the other hand, voluntary for the pursuit of further purposes set out in the table, and failure to give your consent in relation to them shall in any event have no effect on the conclusion of the contract. The mandatory or optional nature of consent will be specified at the time of collection of the Personal Data.

5. Single Profile Account: Registration and access to reserved area

5.1 The reserved area can only be accessed via the Enel Single Profile Account. Users who were already registered for the digital services of the Enel Group Companies participating in the Single Profile Account service prior to the creation of the Single Profile Account itself must accept the Terms and Conditions for the creation of the Single Profile Account in order to continue to access the reserved area.

Please note that it is not possible to access the service with login credentials generated before 9 September 2019, the date on which the Single Profile Account was introduced.

5.2 First-time Registration: Personal registration data are collected at the time the Single Profile Account is created at one of the web portals or mobile apps that provide registration functionality. The creation of the Single Profile Account allows you to access the reserved area of the web portals and mobile apps of the Enel Group companies enabled, using a single username and password.

5.3 Access after Registration The reserved area can only be accessed via the Enel Single Profile Account. For authentication purposes, the Single Profile Account system receives the encrypted credentials entered by the user for verification and validation. Your Personal Data will therefore be processed for the sole purpose of verifying these credentials and enabling you to access them easily and without further charge from any country in which an Enel Group company is present. It is understood that such data, for the purposes of access to the reserved area, are in no case made available to the other Enel Group Companies enabled to the Single Profile Account.

5.4 Access to the restricted area is permitted in the following ways:

• Via portals or mobile apps of Enel Group companies enabled to the Single Profile Account;
• through the use of credentials chosen for the identity created on a social network (so-called 'social login'), in particular identities created on AppleId, Facebook and Google, when the option is available. Following acceptance of the terms and conditions of the service, a Single Profile Account will still be associated with the user.

In case you decide to access the reserved area through the credentials of a social network, Enel X Way Italia will need to acquire some of your Personal Data (First and Last Names, email) in compliance with the authorisations you have given to the social network of reference. You are therefore obliged to check the settings provided by the relevant social network and to read the relevant privacy policy carefully. You may, however, at any time update or change any information you have acquired through the social login.

Enel X Way Italia will keep the identification code associated to your account at the social network service of reference when you use it to log in to Enel X Way Italia or to share contents hosted by the Site; storage will take place for as long as necessary to provide the requested services. In any case, Enel X Way Italia will not be aware of the credentials used by you at the social network.

6. Marketing and/or Profiling Purposes

 6.1. Through the appropriate forms available on the Site as well as within the reserved area, you will be able to freely decide whether or not to consent to the use of your Personal Data, personal and contact details, also for market research, direct sales, including by telephone, for the placement of products or services, for commercial communications or marketing activities, relative to products and/or services offered by Enel X Way Italia or by other Enel Group Companies from time to time specifically identified in the data collection forms. Subject to your free and specific consent, for the purposes indicated above, your Personal Data may be processed by the Companies of the Enel Group identified, directly, as autonomous data controllers and/or by Enel X Way Italia, as Data Processor, on their behalf.

6.2 The prior acquisition of your consent for the marketing purposes as described above is not required when contact is made through telephone numbers (landline and/or mobile) and paper mail addresses belonging to persons listed in public telephone directories, in relation to which the rules on the Public Register of Oppositions are applicable, which permit the processing of such contact data against persons who have not exercised their right to object.

6.3 The acquisition of your consent for "profiling" purposes allows Enel X Way Italia to process your Personal Data for profiling activities based on your consumption preferences and on the data and information acquired by the Controller through the purchase of its products or services also for the purpose of receiving offers specifically tailored to your needs.

To study better services and products corresponding to its needs, Enel X Way Italia may make use of partnerships with selected companies that integrate census-type information on a statistical basis, relating to: personal preferences and interests, consumption preferences, economic and family situation, location or movements of the individual. Under no circumstances will your personal data be shared with third parties for profiling purposes.

6.4 The email address provided by you in the framework of possible contracts concluded with Enel X Way Italia may be used by this latter to send commercial offers relative to products and/or services similar to those previously purchased by you (so-called soft-spam). You may, however, at any time object to the processing of your Personal Data by sending a request to the dedicated mailbox referred to in paragraph 10 of this notice.

6.5 Your personal and contact data may also be processed by Enel X Way Italia in order to carry out, on the basis of its own legitimate interest and having first verified, with regard to each single initiative, that the interests, rights or fundamental freedoms of the interested party do not prevail by means of a specific balancing test (Legitimate Interest Assessment), promotional activities for services and products offered by the Controller.

6.6 The processing of Personal Data for marketing purposes may be carried out by means of “traditional” methods (e.g. paper mail and/or operator calls), or by means of 'automated' contact systems (e.g. SMS and/or MMS, telephone calls without operator intervention, email, fax, interactive applications).

6.7 The consent given by you for marketing purposes shall be deemed to have been given for both of the methods indicated, without prejudice, however, to your right to object, even partially, in relation to the different communication channels through which the marketing purposes are carried out, in the manner set out in paragraph 10 of this notice.

The processing of Personal Data for marketing purposes may be carried out by means of “traditional” methods (e.g. paper mail and/or operator calls), or by means of “automated” contact systems (e.g. text and/or MMS, telephone calls without operator intervention, email, fax, interactive applications).

6.8 Consent for marketing and profiling purposes is optional and does not prevent the possibility of using the products or services offered by Enel X Way Italia. Any consent given may be revoked at any time by sending a written notice to the e-mail address given in paragraph 10 of this notice.

7. Recipients of Personal Data

For the pursuit of the purposes indicated in section 4 of this privacy policy, Enel X Way Italia may need to communicate, in Italy and abroad (including countries outside the European Union), your Personal Data to third parties in order to fulfil the Contract, to comply with legal obligations or to perform activities instrumental to the provision of the services requested.

Your Personal Data may be made accessible for the above-mentioned purposes:

a) to the employees and collaborators of Enel X Way Italia, specifically appointed as Data Processors;

b) the companies of the Enel Group present in the territory of the European Union in their capacity as autonomous data controllers or data processors, as well as their employees and collaborators specifically appointed as Data Processors;

c) to third party companies or other subjects carrying out certain activities in outsourcing on behalf of Enel X Way Italia, in their capacity as data processors, as well as to their employees and collaborators specifically appointed as Data Processors.

These parties will process your Personal Data, for instance, in the context of:

• customer communication management activities;
• customer care services;
• billing and credit protection services;
• market research, direct sales, also by telephone, for the placement of products or services, for commercial communications, marketing and profiling activities by Enel X Way Italia (on the basis of what is described in paragraphs 4 and 6 of this Information Notice).

d) entities, public and private authorities, supervisory and control bodies, banks, factoring companies and credit card issuers, or when required for the granting of subsidies, contributions, grants and facilities of any kind, connected with the supply of the Data Controller's products and/or provision of services, or when required by specific statutory, regulatory and authorisation provisions;

e) to external companies, including foreign ones, operating in the insurance sector and in the granting of loans, including payment extensions, when permitted by current law, for the purposes of insolvency risk prevention and control, fraud control and credit protection, as well as entities operating in the field of credit recovery, including out-of-court and in court (Companies and/or Law Firms), in the event of credit assignment;

f) the Co-processing Companies, where present, which jointly determine with Enel X Way Italia the purposes and means of the processing.

To the Data Processors and Authorised Persons who may be designated, Enel X Way Italia will issue instructions, aimed at implementing adequate security measures, in order to be able to guarantee the confidentiality, security and integrity of the data.

8. Transfer of Personal Data

8.1. Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, as recognised by a specific adequacy decision of the European Commission.

8.2. Possible transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or agreed guarantees are provided by the Controllers and Processors involved, including binding corporate rules (“Binding Corporate Rules”) and standard contractual data protection clauses.

8.3. The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be carried out where you have explicitly consented to it or in the cases provided for in the GDPR and will be processed in your interest. In these cases, we inform you that, although the Enel Group adopts common operating instructions for all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local legislation on the processing of Personal Data.

9. Data Retention period

9.1. All your Personal Data processed for the purposes described above will be stored in accordance with the principles of proportionality and necessity, and in any case until the purposes of the processing and any legal obligations have been fulfilled.

9.2. Your Personal Data will be stored and processed for as long as the contractual relationship with the Data Controller subsists, and in any case for a period of 10 years after the termination of the contractual relationship, after which it shall be deleted, without prejudice to further storage of the same where necessary to comply with specific legal obligations, Authority orders, for the collection of outstanding debts and for the handling of disputes, claims and legal actions.

 9.3. Your free and specific consent is requested in order to process your Personal Data and contact details for market research, direct sales, also by telephone, for the placement of products or services, for commercial communications or marketing activities, related to products and/or services offered by Enel X Way Italia or by other Companies of the Enel Group from time to time specifically identified in the data collection forms. Consent is optional. If you consent, your data will be processed until you revoke said consent.

9.4 Your free and specific consent is also required to process your Personal Data for profiling purposes by Enel X Way Italia. Consent is optional. If you consent, your data will be processed until you revoke said consent.

10. Data subjects’ Rights

10.1. Pursuant to Art. 15 - 22 of the GDPR, in relation to the Personal Data disclosed, you have the right, where applicable, to:

• access and request a copy;
• request rectification;
• request cancellation;
• obtain restriction of processing;
• oppose processing;
• receive your data in a structured, commonly used and machine-readable format and to transmit such data to another data controller without hindrance; where technically feasible.

10.2. You also have the right not to be subject to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of the contract; b) is authorised by law or c) is based on explicit consent. In cases a) and c) you have the right to express your opinion, contest the decision and obtain human intervention by the Controller.

10.3. We inform you that you have in any case the right to object at any time to the processing of Personal Data concerning you that may be carried out on the basis of the legitimate interest of Enel X Way Italia. In this case, the Data Controller shall refrain from processing the Personal Data further, unless the Data Controller demonstrates the existence of compelling legitimate grounds for said processing, or for the establishment, exercise or defence of legal claims.

10.4. We also inform you that you still have the right to object at any time to the processing of Personal Data concerning you carried out for marketing purposes, including profiling, insofar as it is related to such direct marketing. The right to object to such processing by automated contact systems also extends to the processing of Personal Data by traditional methods of contact, unless you wish to object only in part.
If you object to processing for marketing or profiling purposes, your Personal Data will no longer be processed for such purposes.

10.5. In order to exercise your rights and to revoke your consent you may send written notification to the email address: privacy.enelenergia@enel.com.

10.6. Finally, we would like to remind you that if you consider that your data has been processed in a way that does not comply with European Regulation 679/2016 (GDPR), it is your right to lodge a complaint with the Privacy Authority, through:

• registered letter with return receipt addressed to Garante per la Protezione dei Dati Personali, Piazza Venezia, 11, 00187 Rome;

• email at: protocollo@gpdp.it; or: protocollo@pec.gpdp.it;