Privacy

Enel Energia S.p.A., with registered office in Viale Regina Margherita no. 125, 00198, Rome, and VAT Code 06655971007 (hereafter, “Enel Energia”), as Data Controller, will process your personal data provided via the website www.enel.it (hereinafter, the “Website”) in accordance with the provisions of the applicable legislation on privacy and the protection of personal data and by this Information.

Enel Energia has appointed a Personal Data Protection Officer (DPO) who can be contacted at the following email address: dpo.enelenergia@enel.com.

1.1. Enel Energia will process the personal data you have communicated or which it has legitimately obtained (“Personal Data”). In particular, the following Personal Data is processed:

• Data from the reserved area: upon creating an account, you will be asked to provide some Personal Data (such as name, surname, email address, mobile telephone number and user code), which is necessary to successfully complete the registration and for the use of the relative services. Enel Energia also allows you to access the reserved area via the app or through the use of credentials provided by a social network (so-called “Social Login”), in particular using profiles created on Facebook, Twitter and Google+.
• Payment data: if you purchase products or services, the payment data, including identification details, is also processed in compliance with current legislation.
• Contact data: if you intend to ask Enel Energia questions by writing to the email addresses listed on the website, your email address and the content of the message sent will be processed. The processing of this Personal Data is necessary in order to provide a response to the communication received. The provision of further data is to be considered absolutely optional.
• Browsing data: the IT and telematic systems together with the software procedures used to operate the website, or those dedicated to the operation and use of the apps made available by Enel Energia, acquire certain data during their normal operation (such as the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the internet, the internet address from which you connected to our website, etc.), the transmission of which is implicit in the use of web communication protocols or is useful for improved management and optimisation of the data transmission and email system.
• Data acquired from Customer Service: all data provided during interactions with Enel Energia’s Customer Service team, including telephone call recordings whereby consent is provided.

1.2. For the purposes of this policy, the Processing of Personal Data is intended as any operation or set of operations performed with the aid of automated processes and applied to Personal Data, such as the collection, registration, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.

1.3. We inform you that this Personal Data will be processed manually and/or with the aid of computerised and/or telematic means.

1.1. Enel Energia will process your Personal Data for the achievement of specific purposes and only in the presence of a specific legal basis provided for by the applicable law on privacy and protection of personal data. Specifically, Enel Energia will process your Personal Data only when one or more of the following legal bases applies:

• you have given your free, specific, informed, unequivocal and express consent to the processing;
• the processing is necessary for the execution of a contract of which you are a party or for the execution of pre-contractual measures adopted at your request;
• in the presence of a legitimate interest of Enel Energia;
• Enel Energia is bound by a legal obligation to process Personal Data.

1.2. In the table lists the purposes for which your Personal Data is processed by Enel Energia and the legal basis of such processing.

1.3. The provision of your Personal Data is necessary in all cases where processing is carried out on the basis of a legal obligation or to execute a contract to which you are a party or due to the implementation of pre-contractual measures undertaken at your request. Your eventual refusal could result in impeding Enel Energia from proceeding with the purpose for which the Personal Data is collected.

1.4. The provision of your Personal Data is voluntary for the pursuit of the additional purposes indicated in the table. Failure to provide your consent in relation to these latter purposes will have no consequences on the conclusion of the contract. The mandatory or optional nature of the provision will be specified at the time of collection. 

The reserved area can only be accessed via the Unique ID. To access the reserved area, even registered users must accept the Terms and Conditions to create a new Unique ID, as the previous one can no longer be used.

You can access the reserved area either by creating an account through the web portal and the Enel Energia mobile app or by using the other portals or mobile apps of Enel Group companies authorised to create unique profiles. 

1.1 Registration: Personal Data is collected when the unique profile is created on one of the authorised web portals or apps. By creating a Unique ID you can access the web portals and mobile apps of the authorized Enel companies using the same username and password.

1.2 Access after registration: The reserved area can only be accessed via the Unique ID.

After creating the Unique ID, some Personal Data may be made available to other authorised Group companies, if you wish to access the reserved areas of their web portals and mobile apps. The data will be processed only in order to verify your credentials and to allow you to access them easily, at no extra charge, from any country in which an authorised Enel company is present.

1.2.1. Access to the reserved area is available through the following methods:

a) by creating an account on this web portal, or using the other portals or mobile apps of authorised Enel Group companies.

b) by using social logins, in particular Facebook and Google+ credentials.      

If you decide to access the reserved area using social logins, Enel Energia will acquire some of your personal data (name, surname, email) in accordance with the authorisations issued by you to the social network. You are therefore required to verify the settings provided by the social network, and to read their privacy policies carefully, as they may authorise the social network to share your personal data with Enel Energia, thus authorising Enel Energia to collect information such as contacts, friends and other personal data. In any case, Enel Energia will not have knowledge of your registration details.

Enel Energia will store the identification code associated with your account on the social network service when you use it to log in to the Enel Energia website or to share content hosted by the Site; this code will be kept for as long as necessary to provide the required services.     

If you create an Enel Energia account or use Site services by logging on with the social login, Enel Energia may use the information on the originating account to complete your profile on the Site.

You may update or amend your profile information and contact details using the social login, at any time. 

1.1. The email address you provided in the context of the contractual relationship with Enel Energia may be used by the latter to send commercial offers relating to products and/or services similar to those previously purchased (so-called Soft Spam). You can oppose the processing at any time by sending a request to the dedicated email address referred to in paragraph 10 of this policy.

1.2. For anything not addressed in the previous article 1.1, within the reserved area you can freely decide whether to consent to the use of your Personal Data for sending advertising material, direct sales, commercial communications or for carrying out market research relating to products and/or services offered by Enel Energia, Enel Group companies, parent companies, subsidiaries, affiliates and/or commercial partners of Enel Energia.

1.3. Furthermore, within the reserved area you can freely decide whether to consent to the use of your Personal Data for the detection of consumption preferences by Enel Energia, Enel Group companies, parent companies, subsidiaries, affiliates or Enel Energia’s commercial partners and the analysis - also in personalised, automated or electronic form - of information acquired through the use of products and/or services.

1.4. The processing of Personal Data for the aforementioned purposes may be carried out using “traditional” methods (for example, paper mail and/or calls from an operator), or through “automated” contact system methods (for example, SMS and/or MMS, automated telephone calls, emails, faxes, interactive applications).

1.5. The consent you give for marketing purposes will be understood as being provided for the both methods stated, however without prejudice to your right to oppose such processing, even partially, in relation to the different communication channels with which the marketing purposes are carried out, using the same procedures indicated in paragraph 10 of this policy.

1.6. Consent for the aforementioned purposes is optional and does not prevent the possibility of using the services available in the same. In particular:

• Free and specific consent, to be issued within the reserved area in the “Consent Management” section, such Personal Data.
• Subject to free and specific consent, to be provided within the reserved area in the “Consent Management” section, such Personal Data may also be disclosed to Enel Group companies, as well as to third parties, being Enel Energia’s commercial partners, to which Enel Energia may communicate or cede the data acquired for the aforementioned marketing purposes.
• Lastly, subject to free and specific consent, to be provided within the reserved area in the “Consent Management” section, Enel Energia, Enel Group companies, parent companies, subsidiaries, affiliates or Enel Energia’s commercial partners can carry out analyses and processing, also nominative, of your profile and consumption habits in order to propose offers for personalised services and products, to render them more in line with and functional to your interests and needs.

Your Personal Data may be made accessible for the aforementioned purposes:

• to the employees and collaborators of Enel Energia, agents, persons directly authorised for the processing, or to companies of the Enel Group present in the European Union, which may act as independent Data Controllers or as Data Managers for the appointed purpose;
• to third-party companies or other parties (“Third Parties”) who perform certain outsourced activities on behalf of Enel Energia, in their capacity as external processors;
• to third parties, Enel Group companies, parent companies, subsidiaries, affiliates or Enel Energia’s commercial partners for purposes of direct marketing, in compliance with the provisions of the GDPR, subject to obtaining your consent. 

Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognised by a specific suitability decision of the European Commission.
Any transfers of Personal Data to non-EU countries, in the absence of a European Commission adequacy decision, will only be possible if adequate guarantees of a contractual or tactical nature are provided by the Holders and Managers involved, including Binding Corporate Rules and standard contractual clauses for data protection.
The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be carried out where you have explicitly consented or in the cases provided for by the GDPR and will be processed in your interest. In these cases, we inform you that, despite the fact that the Enel Group adopts common operating instructions in all the countries in which it operates, the transfer of your Personal Data may be exposed to risks connected with the particular nature of local legislation on the processing of Personal Data.

In the event that you access Enel Energia's services through your unique Enel profile outside of the European Union, your Personal Data may be transferred to third countries to allow you to use these services. In the absence of an adequacy decision or other appropriate measures, the Personal Data will be treated in your interest and only for the purpose of executing the contract or the pre-contractual measures requested by you.

1.1. The Personal Data processed for the purposes set out above will be stored in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued.

1.2. Your Personal Data will be generally kept as long as your relationship with the Data Controller exists, without prejudice to any requirements for the collection of residual credits and/or the management of data in the event of any disputes or complaints, such as for example those relating to invoices issued.

1.3. Your Personal Data will normally be kept as long as you do not revoke your consent and in any case will be deleted automatically after ten years from the termination of the contractual relationship, without prejudice to the possible preservation of the same, where necessary for the management of ongoing legal actions and to fulfil specific legal obligations.

Pursuant to Articles 15 - 22 of the GDPR, in relation to the Personal Data communicated, you have the right to:

• access and request a copy;
• request its correction;
• request its deletion;
• obtain a restriction of processing;
• object to the processing;
•  receive data in a format that is structured, commonly used and readable by an automatic device, to be transmitted to another data controller, where technically feasible, without any impediment.

1.2. We inform you that you have the right to object to the processing of Personal Data concerning you at any time for direct marketing purposes, including profiling, to the extent that it is connected to such direct marketing. The right to object to processing carried out through automated means of contact also extends to the processing of Personal Data through traditional means of contact, unless you wish to oppose only in part.

1.3. Where you object to processing for direct marketing means, your Personal Data shall no longer be processed for such purposes.

1.4. To exercise your rights and withdraw your consent, you can send communication to the email address privacy.enelenergia@enel.com

1.5. For more information regarding your Personal Data, you can contact the Personal Data Protection Officer, who can be reached at the email address dpo.enelenergia@enel.com.

1.6. We remind you that it is your right to lodge a complaint with the Guarantor for the Protection of Personal Data, via:

• registered mail with proof of receipt, addressed to the Authority for the Protection of Personal Data, Piazza di Monte Citorio, 121, 00186 Rome;
• email to: garante@gpdp.it, or protocollo@pec.gpdp.it;
• fax to the number: +39 06/69677.3785.

Information updated in September 2019

For more information see the page available here.