ENEL ENERGIA APP

PRIVACY POLICY


Data controller and manager of processing personal data

1.1. Enel Energia S.p.A., with registered office in viale Regina Margherita n. 125, 00198, Rome, Group VAT number 15844561009 (hereinafter "Enel Energia" or "Owner"), as Data Controller, will process your personal data provided through the website www.enel.it (hereinafter "Website") in compliance with the provisions of the applicable legislation on the protection of personal data and this policy.

 

The data protection officer (DPO)

2.1. Enel Energia has appointed a Personal Data Protection Officer (DPO) who can be contacted at the following email address: dpo.enelenergia@enel.com.

Purposes and methods of processing

3.1. Enel Energia will process the personal data communicated by you or legitimately collected ("Personal Data"). In particular, the following Personal Data may be processed:

3.1.1. Identification Data: data that allow direct identification, such as personal data (such as name, surname, tax code, VAT number, address, etc. .), given to the Data Controller and processed for the purpose of signing and managing the contract;

3.1.2. Consumption data: data relating to the supply and consumption levels recorded, collected and processed during the duration of the contract;

3.1.3. Economic and Financial Data: data necessary for payments (eg IBAN) or that prove the execution of payments (payment identification details) and any other data relating to the solvency and punctuality of the customer;

3.1.4. Contact details: contact information such as telephone numbers, landline and / mobile, email address, provided to the Data Controller during the signing phase or during the duration of the contract or acquired by the Data Controller himself, which allow you to contact you for the purpose of managing the contractual relationship and/or to provide you with services suited to your needs;

3.1.5. Restricted area data: access to the restricted area of ​​the Site is permitted only to customers registered through the Enel Single Profile. When creating the Enel Single Profile, some Personal Data are required, such as name, surname, email address, mobile phone number and social security number (the latter only for consumer customers) - so-called “registration data” - necessary to successfully complete the registration, access your private area and use the services offered by the individual companies of the Enel Group adhering to the Single Profile. The registration data, as well as any data already in the availability of the Data Controller because acquired in the context of other contractual relationships with the same, are in no case transferred to other companies of the Enel Group. The registration data alone are also processed by the companies of the Enel Group that provide the authentication service, specifically appointed as data processors for this purpose (Enel Italia S.p.A. and Enel Global Services S.r.l.);

3.1.6. Navigation data: the IT and telematic systems and the software procedures used to operate and use the Site, made available by Enel Energia, acquire, during their operation, some data (eg the date and time of access, the pages visited, the name of the Internet Service Provider and the address of the Internet Protocol (IP) through which you access the Internet, the Internet address from which you connected to the Site, etc.), the transmission of which is implicit in the use of web communication protocols or is useful for better management and optimization of the data and e-mail sending system;

3.1.7. Data acquired by Customer Service: data provided during interactions with Enel Energia's Customer Service, including phone call recordings, if you have consented to their registration or in cases in which the registration is carried out in accordance with a legal obligation.

3.2. The processing of Personal Data for the purposes of this information is to be understood as any operation or set of operations, carried out with the aid of automated processes and applied to Personal Data, such as collection, registration, organization, structuring, storage , adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction.

3.3. We inform you that such Personal Data will be processed manually and/or with the support of IT or telematic means.
 

The purpose and legal basis of the processing

4.1. Enel Energia will process its Personal Data for the achievement of precise purposes, of which you will be informed from time to time, and only when there is a specific legal basis provided by the applicable law on data protection. Specifically, Enel Energia will process its Personal Data only when one or more of the following legal bases apply:
 

4.2. In the table lists the purposes for which your Personal Data is processed by Enel Energia and the legal basis of such processing.
 

4.3. The provision of your Personal Data is necessary in all cases where the processing takes place on the basis of a legal obligation or to execute a contract or to fulfill pre-contractual obligations. In the latter cases, your refusal could make it impossible for Enel Energia to process your requests and the inability to provide you with the requested services.
 

4.4. The provision of your Personal Data is instead voluntary for the pursuit of further purposes indicated in the table and failure to consent in relation to them will in any case have no consequence on the conclusion and management of the contract. Consent for these purposes is always optional and, where given, may be revoked at any time, in the manner described in the "Rights of the interested party" section of this policy.
 

Single profile: registration and access to the reserved area

5.1. The restricted area can only be accessed through the Enel Single Profile. Even users already registered for the digital services of the Enel Group companies adhering to the Unique Profile service, in order to continue to access the reserved area, must accept the Terms and Conditions for creating the Unique Profile.

It is not possible to access the service with the previous access credentials generated before 9 September 2019, the date on which the Unique Profile was introduced.

5.2.  First Registration : Personal registration data are collected when the Unique Profile is created at one of the web portals or App. of the Unique Profile allows you to access, using a single username and password, the reserved area of ​​the web portals and the mobile App of the Enel Group companies enabled.

Users who were already registered to the digital services of the Enel Group companies adhering to the Unique Profile service before creating the Unique Profile itself, in order to continue to access the reserved area, must accept the Terms and Conditions for creating the Profile Unique.

We inform you that it is not possible to access the service with access credentials generated before 9 September 2019, the date on which the Unique Profile was introduced.

5.3.  Access after Registration : You can access the reserved area only through the Enel Unique Profile.

For authentication purposes, the Unique Profile system receives the encrypted credentials entered by the user for their verification and validation. Your Personal Data will therefore be processed for the sole purpose of verifying these credentials and allowing you to access them easily and without further charges from any country in which an authorized Enel Group company is present. It is understood that such data, for the purpose of accessing the reserved area, are in no case made available to other Enel Group companies enabled for the Single Profile.

5.4. Access to the reserved area is allowed in the following ways:

a) through the web portal or mobile app of the Enel Group companies enabled for the Single Profile.

b) through the use of credentials chosen for the identity created on a social network (so-called "social login"), in particular the identities created on AppleId, Facebook and Google+. Following acceptance of the terms and conditions of the Unique Profile service, a Unique Profile will still be associated with the user.

In the event that you decide to access the reserved area using the credentials of a social network , Enel Energia will have to acquire some of your Personal Data (Name, Surname, Email) in compliance to the authorizations issued by you to the social network of reference. You are therefore required to check the settings provided by the social network of reference, as well as to carefully read the related privacy policies, you may in any case, at any time, update or modify any information acquired. through the social login. Enel Energia will keep the identification code associated with its account at the service of the social network of reference when it is used for the login to Enel Energia or to share content hosted by the Site; storage will take place for as long as necessary to provide the requested services. In any case, Enel Energia will not be aware of the credentials you use on the social network.

Marketing and/or profiling purposes

6.1. The e-mail address you provide as part of any contracts concluded with Enel Energia may be used by the latter to send commercial offers relating to products and/or services similar to those previously purchased (so-called soft-spam). However, you may at any time oppose the processing of your Personal Data by sending a request to the dedicated mailbox referred to in paragraph 10 of this policy.

6.2. For anything not included in the previous article 6.1, through the appropriate forms made available on the Site and in the reserved area of ​​the Site, you can freely decide whether to consent to the use of your Personal, personal and contact data, also for searches of market, direct sales, including telephone, for the placement of products or services, for commercial communications or marketing activities, relating to the products and / or services offered by Enel Energia or by other companies of the Enel Group from time to time specifically identified in the forms of data collection. Subject to your free and specific consent, for the purposes indicated above, your Personal Data may be processed by the Enel Group Companies identified, directly, as independent data controllers and / or by Enel Energia, as Data Processor, on their behalf.

6.3. The prior acquisition of your consent for the marketing purposes described above is not required when contact is made through telephone numbers (landline and / or mobile) and paper mail addresses belonging to subjects present in public telephone directories, in relation to which is in fact applicable the discipline on the subject of the Public Register of Oppositions which allows the processing of such contact data in respect of those who have not exercised the right of opposition.

6.4. The acquisition of your consent for "profiling" purposes allows Enel Energia to process your data for profiling activities based on your consumption preferences and on the data and information acquired by the Data Controller through the purchase of its products or services also in order to receive offers specifically suited to your needs.

For the study of better services and products corresponding to its needs, Enel Energia will be able to make use of partnerships with selected companies that integrate, on a statistical basis, census-type information and which are related to: personal preferences and interests, consumption, economic and family situation, location or movement of the natural person. In no case will your personal data be shared with third parties for profiling purposes.
 

6.5. The processing of Personal Data for marketing purposes may be carried out using "traditional" methods (by way of example: paper mail and / or calls from an operator), or through "automated" contact systems (by way of example, SMS and / or MMS , telephone calls without operator intervention, e-mails, faxes, interactive applications).
 

6.6. The consent you have given for marketing purposes will be deemed to have been given for both of the methods indicated, however, without prejudice to your right to object, even partially, in relation to the different communication channels with which the marketing purposes are carried out, in the manner indicated. in paragraph 10 of this policy.

6.7. Consent for marketing and profiling purposes is optional and does not prevent the possibility of using the products or services offered by Enel Energia: any consent given can be revoked at any time by sending a written communication to the e-mail address indicated, in the manner described in the "Rights of the interested party" section of this policy.
 

Recipients of Personal Data

7.1. For the pursuit of the purposes referred to in paragraph 4, Enel Energia may need to communicate, in Italy and abroad, including countries outside the European Union, your Personal Data to third parties, to implement the Contract, in fulfillment of legal obligations or for the performance of activities instrumental to the provision of the requested services.

Your Personal Data may be made accessible, for the purposes mentioned above:

a) to employees and collaborators of Enel Energia, specifically appointed as Authorized Persons for processing;

b) to the companies of the Enel Group present in the territory of the European Union as independent data controllers or data processors as well as to their employees and collaborators specifically appointed as Authorized Persons for processing;

c) to third-party companies or other subjects who carry out some outsourcing activities on behalf of Enel Energia, in their capacity as data processors, as well as their employees and collaborators specifically appointed as Authorized Persons for processing. These subjects will process your Personal Data, for example, in the context of:

d) entities, public and private authorities and supervisory and control bodies, when this is necessary for the granting of grants, contributions, subsidies and facilitations of any kind, connected to the supply of products and / or provision of services by Enel Energy, or when required by specific legislative, regulatory and authorization provisions;

e) subjects who perform tasks of a technical or organizational nature on behalf of Enel Energia carry out acquisition, data entry, archiving and processing services of the data necessary for the use of the services offered; provide services for the management of the technological infrastructure of Enel Energia; carry out transmission, enveloping, transport and sorting of communications to the Customer; carry out customer assistance activities; carry out checks, audits and certification of the activities carried out by Enel Energia also in the interest of its Customers; Banking institutions and credit card companies; other operators in the sector for the management of related relationships; firms and companies in the field of assistance and consultancy relationships, including legal ones;

f) external companies, including foreign companies, operating in the insurance sector and in the granting of loans, including deferred payments, when permitted by current legislation, for the purposes of preventing and controlling the risk of insolvency, fraud control and protection of credit, as well as subjects operating in the field of out-of-court and judicial credit recovery (Companies and / or Law Firms), Banking Institutions or Factoring Companies, in case of credit assignment;

g) to the Joint Data Controllers, where present, which jointly determine the purposes and means of the processing with Enel Energia.

The subjects belonging to the above categories will process the data as independent Data Controllers or as Data Processors or Authorized Persons, specifically designated by Enel Energia.

Enel Energia will give adequate instructions to the Managers and Authorized Persons for processing, possibly designated, with the aim of adopting adequate security measures, in order to guarantee the confidentiality, security and integrity of the data.
 

Transfer of Personal Data

8.1. Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognized by a specific adequacy decision of the European Commission.

8.2 Any transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will be possible only if adequate guarantees of a contractual or contractual nature are provided by the Controllers and Managers involved, including binding corporate rules ("Binding Corporate Rules ") and standard contractual clauses of data protection.

8.3 The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other adequate measures as described above, will be carried out only if you have explicitly consented to it or in the cases provided for by the GDPR and will be treated in your interest. In these cases, we inform you that, although the Enel Group adopts operating instructions common to all the countries in which it operates, the transfer of your Personal Data could be exposed to risks associated with the peculiarities of local legislation on the processing of Personal Data.
 

Personal data retention period

9.1. The Personal Data processed for the aforementioned purposes will be kept in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued.

9.2. Personal Data will also be stored in compliance with any legal obligations envisaged.

9.3. Your free and specific consent is always required to process your Personal, personal and contact data, for market research, direct sales, including telephone, for the placement of products or services, for commercial communications or marketing activities, relating to products and / or services offered by Enel Energia or by other Enel Group companies from time to time specifically identified in the data collection forms.
Consent is optional.
If you consent to it, your data will be processed until the consent given is revoked.

9.4. Your free and specific consent is always required to process your Personal Data for profiling purposes by Enel Energia. Your free and specific consent is always required to process your Personal Data for market research.
 

Rights of data subjects

10.1 Pursuant to art. 15 - 22 of the GDPR, in relation to the Personal Data processed, you have the right, where applicable, to:

a) Access and request a copy;
b) Request rectification;
c) Request cancellation;
d) Obtain the limitation of processing;
e) oppose the treatment;
f) Receive their data in a structured format, commonly used and readable by an automatic device and to transmit such data without hindrance to another data controller; where technically feasible.

10.2 You also have the right not to be subjected to a decision based solely on automated processing unless the decision is necessary: ​​a) for the conclusion or execution of a contract with the Data Controller; b) is authorized by law or c) is based on explicit consent. In cases a) and c) the interested party has the right to express their opinion, contest the decision and obtain human intervention from the Data Controller.

10.3 We inform you that you still have the right to object at any time to the processing of your Personal Data that may be carried out on the basis of Enel Energia's legitimate interest. In this case, the Data Controller will refrain from further processing his Personal Data, unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing, or to ascertain, exercise or defend a right in court.
 

10.4. We also inform you that you still have the right to object at any time to the processing of your Personal Data for direct marketing purposes, including profiling, to the extent that it is connected to such direct marketing. The right to object to such processing carried out through automated means of contact also extends to the processing of Personal Data through traditional means of contact, unless you wish to object only in part.

10.5 If you object to the processing for direct marketing purposes, your Personal Data will no longer be processed for these purposes.

10.6. To exercise your rights, you can send a communication to the dedicated email address: privacy.enelenergia@enel.com. To revoke your consent (s) you can contact us at any time on the toll-free number 800 900 860, access the private area of ​​the website www.enel.it, modifying the previous setting, send a communication to the dedicated email address: privacy.enelenergia@enel.com.

10.7. For more information relating to your Personal Data, you can contact the Personal Data Protection Officer, who can be reached at the following dedicated e-mail address: dpo.enelenergia@enel.com.

10.8. We remind you that it is your right to lodge a complaint with the Guarantor for the Protection of Personal Data, by:

a) registered letter with return receipt addressed to the Guarantor for the protection of personal data, Piazza Venezia, 11, 00187 Rome;
b) e-mail to the address: protocollo@gpdp.it, or protocollo@pec.gpdp.it;
c) fax to the number: 06 / 69677.3785.

Policy updated in July 2021