Enel Energia privacy statement pursuant to Article 13 of EU Regulation 2016/679 (“GDPR”)
Enel Energia S.p.A., with registered office in Viale Regina Margherita no. 125, 00198, Rome, and VAT Code 06655971007 (hereafter, “Enel Energia”), as Data Controller, will process your personal data provided via the website www.enel.it (hereinafter, the “Website”) in accordance with the provisions of the applicable legislation on privacy and the protection of personal data and by this Information.
1.1. Enel Energia will process the personal data you have communicated or which it has legitimately obtained (“Personal Data”). In particular, the following Personal Data is processed:
- Data from the reserved area: upon creating an account, you will be asked to provide some Personal Data (such as name, surname, email address, mobile telephone number and user code), which is necessary to successfully complete the registration and for the use of the relative services. Enel Energia also allows you to access the reserved area via the app or through the use of credentials provided by a social network (so-called “Social Login”), in particular using profiles created on Facebook, Twitter and Google+.
- Payment data: if you purchase products or services, the payment data, including identification details, is also processed in compliance with current legislation.
- Contact data: if you intend to ask Enel Energia questions by writing to the email addresses listed on the website, your email address and the content of the message sent will be processed. The processing of this Personal Data is necessary in order to provide a response to the communication received. The provision of further data is to be considered absolutely optional.
- Browsing data: the IT and telematic systems together with the software procedures used to operate the website, or those dedicated to the operation and use of the apps made available by Enel Energia, acquire certain data during their normal operation (such as the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the internet, the internet address from which you connected to our website, etc.), the transmission of which is implicit in the use of web communication protocols or is useful for improved management and optimisation of the data transmission and email system.
- Data acquired from Customer Service: all data provided during interactions with Enel Energia’s Customer Service team, including telephone call recordings whereby consent is provided.
1.2. For the purposes of this policy, the Processing of Personal Data is intended as any operation or set of operations performed with the aid of automated processes and applied to Personal Data, such as the collection, registration, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.
1.3. We inform you that this Personal Data will be processed manually and/or with the aid of computerised and/or telematic means.
1.1. Enel Energia will process your Personal Data for the achievement of specific purposes and only in the presence of a specific legal basis provided for by the applicable law on privacy and protection of personal data. Specifically, Enel Energia will process your Personal Data only when one or more of the following legal bases applies:
- you have given your free, specific, informed, unequivocal and express consent to the processing;
- the processing is necessary for the execution of a contract of which you are a party or for the execution of pre-contractual measures adopted at your request;
- in the presence of a legitimate interest of Enel Energia;
- Enel Energia is bound by a legal obligation to process Personal Data.
1.2. In the table lists the purposes for which your Personal Data is processed by Enel Energia and the legal basis of such processing.
1.3. The provision of your Personal Data is necessary in all cases where processing is carried out on the basis of a legal obligation or to execute a contract to which you are a party or due to the implementation of pre-contractual measures undertaken at your request. Your eventual refusal could result in impeding Enel Energia from proceeding with the purpose for which the Personal Data is collected.
1.4. The provision of your Personal Data is voluntary for the pursuit of the additional purposes indicated in the table. Failure to provide your consent in relation to these latter purposes will have no consequences on the conclusion of the contract. The mandatory or optional nature of the provision will be specified at the time of collection.
1.1. Access to the reserved area is permitted using the following methods:
- creating an account on the website;
- through the app;
- through the use of credentials provided by a social media network (so-called “Social Login”), in particular the profiles created on Facebook, Twitter and Google+.
1.3. Enel Energia will store the identification code associated with your account to service the relative social media network when used to login to the Enel Energia website or share content hosted by the website. This code will be kept for as long as necessary to provide the required services.
1.4. If you create an Enel Energia account or use the website’s services by connecting via a Social Login, Enel Energia may use the information contained in the account of origin to complete your profile on the website. At any time, you may update or modify the information in your profile and contact details via the Social Login.
1.1. The email address you provided in the context of the contractual relationship with Enel Energia may be used by the latter to send commercial offers relating to products and/or services similar to those previously purchased (so-called Soft Spam). You can oppose the processing at any time by sending a request to the dedicated email address referred to in paragraph 10 of this policy.
1.2. For anything not addressed in the previous article 6.1, within the reserved area you can freely decide whether to consent to the use of your Personal Data for sending advertising material, direct sales, commercial communications or for carrying out market research relating to products and/or services offered by Enel Energia, Enel Group companies, parent companies, subsidiaries, affiliates and/or commercial partners of Enel Energia.
1.3. Furthermore, within the reserved area you can freely decide whether to consent to the use of your Personal Data for the detection of consumption preferences by Enel Energia, Enel Group companies, parent companies, subsidiaries, affiliates or Enel Energia’s commercial partners and the analysis - also in personalised, automated or electronic form - of information acquired through the use of products and/or services.
1.4. The processing of Personal Data for the aforementioned purposes may be carried out using “traditional” methods (for example, paper mail and/or calls from an operator), or through “automated” contact system methods (for example, SMS and/or MMS, automated telephone calls, emails, faxes, interactive applications).
1.5. The consent you give for marketing purposes will be understood as being provided for the both methods stated, however without prejudice to your right to oppose such processing, even partially, in relation to the different communication channels with which the marketing purposes are carried out, using the same procedures indicated in paragraph 10 of this policy.
1.6. Consent for the aforementioned purposes is optional and does not prevent the possibility of using the services available in the same. In particular:
- Free and specific consent, to be issued within the reserved area in the “Consent Management” section, such Personal Data.
- Subject to free and specific consent, to be provided within the reserved area in the “Consent Management” section, such Personal Data may also be disclosed to Enel Group companies, as well as to third parties, being Enel Energia’s commercial partners, to which Enel Energia may communicate or cede the data acquired for the aforementioned marketing purposes.
- Lastly, subject to free and specific consent, to be provided within the reserved area in the “Consent Management” section, Enel Energia, Enel Group companies, parent companies, subsidiaries, affiliates or Enel Energia’s commercial partners can carry out analyses and processing, also nominative, of your profile and consumption habits in order to propose offers for personalised services and products, to render them more in line with and functional to your interests and needs.
Your Personal Data may be made accessible for the aforementioned purposes:
- to the employees and collaborators of Enel Energia, agents, persons directly authorised for the processing, or to companies of the Enel Group present in the European Union, which may act as independent Data Controllers or as Data Managers for the appointed purpose;
- to third-party companies or other parties (“Third Parties”) who perform certain outsourced activities on behalf of Enel Energia, in their capacity as external processors;
- to third parties, Enel Group companies, parent companies, subsidiaries, affiliates or Enel Energia’s commercial partners for purposes of direct marketing, in compliance with the provisions of the GDPR, subject to obtaining your consent.
Your Personal Data will be processed within the European Union and stored on servers located within the European Union.
1.1. The Personal Data processed for the purposes set out above will be stored in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued.
1.2. Your Personal Data will be generally kept as long as your relationship with the Data Controller exists, without prejudice to any requirements for the collection of residual credits and/or the management of data in the event of any disputes or complaints, such as for example those relating to invoices issued.
1.3. Your Personal Data will normally be kept as long as you do not revoke your consent and in any case will be deleted automatically after ten years from the termination of the contractual relationship, without prejudice to the possible preservation of the same, where necessary for the management of ongoing legal actions and to fulfil specific legal obligations.
Pursuant to Articles 15 - 22 of the GDPR, in relation to the Personal Data communicated, you have the right to:
- access and request a copy;
- request its correction;
- request its deletion;
- obtain a restriction of processing;
- object to the processing;
- receive data in a format that is structured, commonly used and readable by an automatic device, to be transmitted to another data controller, where technically feasible, without any impediment.
1.2. We inform you that you have the right to object to the processing of Personal Data concerning you at any time for direct marketing purposes, including profiling, to the extent that it is connected to such direct marketing. The right to object to processing carried out through automated means of contact also extends to the processing of Personal Data through traditional means of contact, unless you wish to oppose only in part.
1.3. Where you object to processing for direct marketing means, your Personal Data shall no longer be processed for such purposes.
1.4. To exercise your rights and withdraw your consent, you can send communication to the email address email@example.com
1.5. For more information regarding your Personal Data, you can contact the Personal Data Protection Officer, who can be reached at the email address firstname.lastname@example.org.
1.6. We remind you that it is your right to lodge a complaint with the Guarantor for the Protection of Personal Data, via:
- registered mail with proof of receipt, addressed to the Authority for the Protection of Personal Data, Piazza di Monte Citorio, 121, 00186 Rome;
- email to: email@example.com, or firstname.lastname@example.org;
- fax to the number: +39 06/69677.3785.
Information updated in May 2018
Enel Italia privacy statement pursuant to Article 13 of EU Regulation 2016/679 (“GDPR”)
1.2. When you subscribe to the various services or to gain access to the aforementioned, you will be given the names of any further Data Controllers or Data Processors.
1.1. Enel will process the personal information you provide us or which has been legitimately collected by the Controller (“Personal Data”). The following Personal Data in particular will be processed:
- Contact information: name, surname, email address, telephone number and content of the message sent by you and other Personal Data that you may have provided during the communication. We will process this Personal Data in the case in which you make enquiries, request information or send us communications of any type.
- You send us this Personal Data at the moment in which you contact us. The processing of this Personal Data is necessary for us to provide a response to the communications received from you or to the requests that you have made. The provision of any further Personal Data by you is completely voluntary.
- Navigation data: the IT and electronic communications systems and software procedures put in place to allow the Website to function, will, in the course of their normal work, collect certain data (e.g. access date and time, pages visited, name of the Internet Service Provider and Internet Protocol (IP) address you use to access the internet, the internet address from which you connect to our Website, etc.), the transmission of which is implicit in the use of web communications protocols or is pertinent to effective management or optimisation of the data or email sending system.
1.3. Please be informed that this Personal Data will be processed manually and/or using IT or electronic support.
1.1. Enel will process your Personal Data for very specific purposes and only if there is a specific legal basis provided for under applicable personal data protection and privacy legislation. Specifically, Enel will process your Personal Data only when one or more of the following legal requirements has been met:
- you have freely given your specific, informed, unambiguous and affirmative consent to the processing of said data;
- the processing is necessary to the performance of a contract to which you are a party or to take pre-contractual measures at your request;
- for the purposes of the pursuit of Enel’s legitimate interests;
- Enel has a legal obligation to process said Personal Data.
1.2. The table list the purposes for which your Personal Data can be processed by the Controller and the legal bases for said processing.
1.3. The provision of your Personal Data is necessary in all instances in which processing is a legal requirement or necessary to the performance of a contract to which you are a party or to the implementation of pre-contractual measures adopted at your request. Any refusal on your behalf may make it impossible for Enel to perform the task for which your Personal Data has been collected.
1.4. The provision of your Personal Data, however, is voluntary for any further purposes and failure to give your consent in such cases will have no effect on the completion of the contract. The obligatory or optional nature of the provision of data will be specified at the moment of its collection.
Your Personal Data may be made accessible for the abovementioned purposes, to:
- employees and staff of the Controller who, for that purpose, have been tasked with data processing, or to Enel Group companies in the European Union for the implementation of organisational, administrative, financial and accounting activities.
- to third party companies or other subjects to which the Controller outsources work required to allow the Website to function, in their role as external data processors.
Your Personal Data will be processed within the European Union and stored on servers located within the European Union.
Personal Data processed for the purposes described above will be held in compliance with the principles of proportionality and necessity, and, in all cases, until the purposes of the processing have been completed.
1.1 Under articles 15 – 21 of EU Regulation 2016/679 (GDPR), you have the right in relation to the Personal Data you provide:
- To access and request a copy;
- To request rectification;
- To request erasure;
- To obtain restriction of data processing;
- To object to the processing;
- To receive in a commonly-used structured form readable on an automatic device and to transmit without impediment said data to another Data Controller in the case that this is technically feasible.
1.2. Please be informed that you have the right to object at any time to the processing of Personal Data relating to you that is carried out in the pursuit of Enel’s legitimate interests.
1.3. When you object to the processing of your Personal Data as per article 8.2, the Controller will refrain from further processing your Personal Data, except where convincing legitimate reasons for continuing with the processing have been established or for the verification, exercising or defence of a right in a court of law.
1.4. For further information relating to your Personal Data and to exercise your rights and withdraw your consent, you can contact Enel’s Personal Data Protection Officer at this email address email@example.com. It is essential to insert the following subject line “Privacy” also.
1.5. Please note that you have the right to make a complaint to the relevant Personal Data protection authority.
1.6. If you are making your complaint to the Personal Data Protection Authority, you may do so in one of the following ways: