Enel Energia privacy statement pursuant to Article 13 of EU Regulation 2016/679 (“GDPR”)
This policy illustrates how to manage the personal data of users of the www.enel.it site (hereinafter the "Website") and the personal data that may be the subject of the contractual relationship with Enel Energia S.p.A.
1.1. Enel Energia S.p.A., with registered office in viale Regina Margherita n. 125, 00198, Rome, Group VAT number 15844561009 (hereinafter "Enel Energia" or "Owner"), as Data Controller, will process your personal data provided through the website www.enel.it (hereinafter "Website") in compliance with the provisions of the applicable legislation on the protection of personal data and this policy.
3.1. Enel Energia will process the personal data communicated by you or legitimately collected ("Personal Data"). In particular, the following Personal Data may be processed:
3.1.1. Identification Data: data that allow direct identification, such as personal data (such as name, surname, tax code, VAT number, address, etc. .), given to the Data Controller and processed for the purpose of signing and managing the contract;
3.1.2. Consumption data: data relating to the supply and consumption levels recorded, collected and processed during the duration of the contract;
3.1.3. Economic and Financial Data: data necessary for payments (eg IBAN) or that prove the execution of payments (payment identification details) and any other data relating to the solvency and punctuality of the customer;
3.1.4. Contact details: contact information such as telephone numbers, landline and / mobile, email address, provided to the Data Controller during the signing phase or during the duration of the contract or acquired by the Data Controller himself, which allow you to contact you for the purpose of managing the contractual relationship and/or to provide you with services suited to your needs;
3.1.5. Restricted area data: access to the restricted area of the Site is permitted only to customers registered through the Enel Single Profile. When creating the Enel Single Profile, some Personal Data are required, such as name, surname, email address, mobile phone number and social security number (the latter only for consumer customers) - so-called “registration data” - necessary to successfully complete the registration, access your private area and use the services offered by the individual companies of the Enel Group adhering to the Single Profile. The registration data, as well as any data already in the availability of the Data Controller because acquired in the context of other contractual relationships with the same, are in no case transferred to other companies of the Enel Group. The registration data alone are also processed by the companies of the Enel Group that provide the authentication service, specifically appointed as data processors for this purpose (Enel Italia S.p.A. and Enel Global Services S.r.l.);
3.1.7. Data acquired by Customer Service: data provided during interactions with Enel Energia's Customer Service, including phone call recordings, if you have consented to their registration or in cases in which the registration is carried out in accordance with a legal obligation;
3.2. The processing of Personal Data for the purposes of this information is to be understood as any operation or set of operations, carried out with the aid of automated processes and applied to Personal Data, such as collection, registration, organization, structuring, storage , adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction.
3.3. We inform you that such Personal Data will be processed manually and/or with the support of IT or telematic means.
4.1. Enel Energia will process its Personal Data for the achievement of precise purposes, of which you will be informed from time to time, and only when there is a specific legal basis provided by the applicable law on data protection. Specifically, Enel Energia will process its Personal Data only when one or more of the following legal bases apply:
- You have given your free, specific, informed, unequivocal and express consent to the processing
- The processing is necessary for the performance of a contract to which you are a party or for the performance of pre-contractual measures taken at your request
- In the presence of a legitimate interest of Enel Energia, provided that the interests or fundamental rights and freedoms of the data subject which require the protection of personal data do not prevail
- By virtue of a legal obligation.
4.2. In the table lists the purposes for which your Personal Data is processed by Enel Energia and the legal basis of such processing.
4.3. The provision of your Personal Data is necessary in all cases where the processing takes place on the basis of a legal obligation or to execute a contract or to fulfill pre-contractual obligations. In the latter cases, your refusal could make it impossible for Enel Energia to process your requests and the inability to provide you with the requested services.
4.4. The provision of your Personal Data is instead voluntary for the pursuit of further purposes indicated in the table and failure to consent in relation to them will in any case have no consequence on the conclusion and management of the contract. Consent for these purposes is always optional and, where given, may be revoked at any time, in the manner described in the "Rights of the interested party" section of this policy.
5.1. The restricted area can only be accessed through the Enel Single Profile. Even users already registered for the digital services of the Enel Group companies adhering to the Unique Profile service, in order to continue to access the reserved area, must accept the Terms and Conditions for creating the Unique Profile.
It is not possible to access the service with the previous access credentials generated before 9 September 2019, the date on which the Unique Profile was introduced.
5.2. First Registration : Personal registration data are collected when the Unique Profile is created at one of the web portals or App. of the Unique Profile allows you to access, using a single username and password, the reserved area of the web portals and the mobile App of the Enel Group companies enabled.
Users who were already registered to the digital services of the Enel Group companies adhering to the Unique Profile service before creating the Unique Profile itself, in order to continue to access the reserved area, must accept the Terms and Conditions for creating the Profile Unique.
We inform you that it is not possible to access the service with access credentials generated before 9 September 2019, the date on which the Unique Profile was introduced.
5.3. Access after Registration : You can access the reserved area only through the Enel Unique Profile.
For authentication purposes, the Unique Profile system receives the encrypted credentials entered by the user for their verification and validation. Your Personal Data will therefore be processed for the sole purpose of verifying these credentials and allowing you to access them easily and without further charges from any country in which an authorized Enel Group company is present. It is understood that such data, for the purpose of accessing the reserved area, are in no case made available to other Enel Group companies enabled for the Single Profile.
5.4. Access to the reserved area is allowed in the following ways:
a) through the web portal or mobile app of the Enel Group companies enabled for the Single Profile.
b) through the use of credentials chosen for the identity created on a social network (so-called "social login"), in particular the identities created on AppleId, Facebook and Google+. Following acceptance of the terms and conditions of the Unique Profile service, a Unique Profile will still be associated with the user.
In the event that you decide to access the reserved area using the credentials of a social network , Enel Energia will have to acquire some of your Personal Data (Name, Surname, Email) in compliance to the authorizations issued by you to the social network of reference. You are therefore required to check the settings provided by the social network of reference, as well as to carefully read the related privacy policies, you may in any case, at any time, update or modify any information acquired. through the social login. Enel Energia will keep the identification code associated with its account at the service of the social network of reference when it is used for the login to Enel Energia or to share content hosted by the Site; storage will take place for as long as necessary to provide the requested services. In any case, Enel Energia will not be aware of the credentials you use on the social network.
6.1. For anything not included in the previous article 6.1, through the appropriate forms made available on the Site and in the reserved area of the Site, you can freely decide whether to consent to the use of your Personal, personal and contact data, also for searches of market, direct sales, including telephone, for the placement of products or services, for commercial communications or marketing activities, relating to the products and/or services offered by Enel Energia or by other companies of the Enel Group from time to time specifically identified in the forms of data collection. Subject to your free and specific consent, for the purposes indicated above, your Personal Data may be processed by the Enel Group Companies identified, directly, as independent data controllers and/or by Enel Energia, as Data Processor, on their behalf.
6.2. The prior acquisition of your consent for the marketing purposes described above is not required when contact is made through telephone numbers (landline and / or mobile) and paper mail addresses belonging to subjects present in public telephone directories, in relation to which is in fact applicable the discipline on the subject of the Public Register of Oppositions which allows the processing of such contact data in respect of those who have not exercised the right of opposition.
It is possible to register your telephone number, both landline and mobile, in this register, by filling out a special electronic form on the website www.registrodelleopposizioni.it, or by calling 800 957 766 for fixed users and 06 42986411 for mobile phones, or by sending a special digital form by e-mail to email@example.com.
6.3. The acquisition of your consent for "profiling" purposes allows Enel Energia to process your data for profiling activities based on your consumption preferences and on the data and information acquired by the Data Controller through the purchase of its products or services also in order to receive offers specifically suited to your needs.
For the study of better services and products corresponding to its needs, Enel Energia will be able to make use of partnerships with selected companies that integrate, on a statistical basis, census-type information and which are related to: personal preferences and interests, consumption, economic and family situation, location or movement of the natural person. In no case will your personal data be shared with third parties for profiling purposes.
6.4. Your personal and contact data may also be processed by Enel Energia to carry out, on the basis of the legitimate interest of the Data Controller and having first checked in relation to each individual initiative that the interests, rights or fundamental freedoms of the interested party do not prevail through a specific balancing test (Legitimate Interest Assessment), promotion of services and products offered by the Owner.
6.5. The processing of Personal Data for marketing purposes may be carried out using "traditional" methods (by way of example: paper mail and/or calls from an operator), or through "automated" contact systems (by way of example, SMS and/or MMS , telephone calls without operator intervention, e-mails, faxes, interactive applications).
6.6. The consent you have given for marketing purposes will be deemed to have been given for both of the methods indicated, however, without prejudice to your right to object, even partially, in relation to the different communication channels with which the marketing purposes are carried out, in the manner indicated. in paragraph 10 of this policy.
6.7. Consent for marketing and profiling purposes is optional and does not prevent the possibility of using the products or services offered by Enel Energia: any consent given can be revoked at any time by sending a written communication to the e-mail address indicated, in the manner described in the "Rights of the interested party" section of this policy.
7.1. For the pursuit of the purposes referred to in paragraph 4, Enel Energia may need to communicate, in Italy and abroad, including countries outside the European Union, your Personal Data to third parties, to implement the Contract, in fulfillment of legal obligations or for the performance of activities instrumental to the provision of the requested services.
Your Personal Data may be made accessible, for the purposes mentioned above:
a) to employees and collaborators of Enel Energia, specifically appointed as Authorized Persons for processing;
b) to the companies of the Enel Group present in the territory of the European Union as independent data controllers or data processors as well as to their employees and collaborators specifically appointed as Authorized Persons for processing;
c) to third-party companies or other subjects who carry out some outsourcing activities on behalf of Enel Energia, in their capacity as data processors, as well as their employees and collaborators specifically appointed as Authorized Persons for processing. These subjects will process your Personal Data, for example, in the context of:
- billing and credit protection services;
- customer communication management activities;
- customer care services;
- market research, direct sales, including telephone, for the placement of products or services, for commercial communications or marketing and / or profiling activities by Enel Energia (if you have freely consented);
d) entities, public and private authorities and supervisory and control bodies, when this is necessary for the granting of grants, contributions, subsidies and facilitations of any kind, connected to the supply of products and / or provision of services by Enel Energy, or when required by specific legislative, regulatory and authorization provisions;
e) subjects who perform tasks of a technical or organizational nature on behalf of Enel Energia carry out acquisition, data entry, archiving and processing services of the data necessary for the use of the services offered; provide services for the management of the technological infrastructure of Enel Energia; carry out transmission, enveloping, transport and sorting of communications to the Customer; carry out customer assistance activities; carry out checks, audits and certification of the activities carried out by Enel Energia also in the interest of its Customers; Banking institutions and credit card companies; other operators in the sector for the management of related relationships; firms and companies in the field of assistance and consultancy relationships, including legal ones;
f) external companies, including foreign companies, operating in the insurance sector and in the granting of loans, including deferred payments, when permitted by current legislation, for the purposes of preventing and controlling the risk of insolvency, fraud control and protection of credit, as well as subjects operating in the field of out-of-court and judicial credit recovery (Companies and / or Law Firms), Banking Institutions or Factoring Companies, in case of credit assignment;
g) to the Joint Data Controllers, where present, which jointly determine the purposes and means of the processing with Enel Energia.
The subjects belonging to the above categories will process the data as independent Data Controllers or as Data Processors or Authorized Persons, specifically designated by Enel Energia.
Enel Energia will give adequate instructions to the Managers and Authorized Persons for processing, possibly designated, with the aim of adopting adequate security measures, in order to guarantee the confidentiality, security and integrity of the data. .
8.1. Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognized by a specific adequacy decision of the European Commission.
8.2 Any transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will be possible only if adequate guarantees of a contractual or contractual nature are provided by the Controllers and Managers involved, including binding corporate rules ("Binding Corporate Rules ") and standard contractual clauses of data protection. The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other adequate measures as described above, will be carried out only if you have explicitly consented to it or in the cases provided for by the GDPR and will be treated in your interest. In these cases, we inform you that, although the Enel Group adopts operating instructions common to all the countries in which it operates, the transfer of your Personal Data could be exposed to risks associated with the peculiarities of local legislation on the processing of Personal Data.
9.1. The Personal Data processed for the aforementioned purposes will be kept in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued and in compliance with any legal obligations envisaged.
9.2. If there is a contractual relationship with the Data Controller, your Personal Data will be stored and processed for the entire duration of the same and in any case for a period of 10 years from the termination of the contractual relationship, after which they will be deleted, without prejudice to further conservation. of the same where necessary to fulfill specific legal obligations, to provisions of the Authority, for the collection of residual credits and for the management of disputes, complaints and judicial actions.
9.3. Your free and specific consent is required to process your Personal, personal and contact data, for market research, direct sales, including telephone, for the placement of products or services, for commercial communications or marketing activities, relating to products and / or services offered by Enel Energia or by other Enel Group companies from time to time specifically identified in the data collection forms. If you consent to it, your data will be processed until the consent given is revoked.
10.1 Pursuant to art. 15 - 22 of the GDPR, in relation to the Personal Data processed, you have the right, where applicable, to:
a) Access and request a copy;
b) Request rectification;
c) Request cancellation;
d) Obtain the limitation of processing;
e) oppose the treatment;
f) Receive their data in a structured format, commonly used and readable by an automatic device and to transmit such data without hindrance to another data controller; where technically feasible.
10.2 You also have the right not to be subjected to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or execution of a contract with the Data Controller; b) is authorized by law or c) is based on explicit consent. In cases a) and c) the interested party has the right to express their opinion, contest the decision and obtain human intervention from the Data Controller.
10.3 We inform you that you still have the right to object at any time to the processing of your Personal Data that may be carried out on the basis of Enel Energia's legitimate interest. In this case, the Data Controller will refrain from further processing his Personal Data, unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing, or to ascertain, exercise or defend a right in court.
10.4. We also inform you that you still have the right to object at any time to the processing of your Personal Data for direct marketing purposes, including profiling, to the extent that it is connected to such direct marketing. The right to object to such processing carried out through automated means of contact also extends to the processing of Personal Data through traditional means of contact, unless you wish to object only in part.
10.5. To exercise your rights, you can send a communication to the dedicated email address: firstname.lastname@example.org. To revoke your consent (s) you can contact us at any time on the toll-free number 800 900 860, access the private area of the website www.enel.it, modifying the previous setting, send a communication to the dedicated email address: email@example.com.
10.6. For more information relating to your Personal Data, you can contact the Personal Data Protection Officer, who can be reached at the following dedicated e-mail address: firstname.lastname@example.org.
10.7. We remind you that it is your right to lodge a complaint with the Guarantor for the Protection of Personal Data, by:
a) registered letter with return receipt addressed to the Guarantor for the protection of personal data, Piazza Venezia, 11, 00187 Rome;
b) e-mail to the address: email@example.com.
Enel Italia privacy statement pursuant to Article 13 of EU Regulation 2016/679 (“GDPR”)
1.2. When you subscribe to the various services or to gain access to the aforementioned, you will be given the names of any further Data Controllers or Data Processors.
1.1. Enel will process the personal information you provide us or which has been legitimately collected by the Controller (“Personal Data”). The following Personal Data in particular will be processed:
- Contact information: name, surname, email address, telephone number and content of the message sent by you and other Personal Data that you may have provided during the communication. We will process this Personal Data in the case in which you make enquiries, request information or send us communications of any type.
- You send us this Personal Data at the moment in which you contact us. The processing of this Personal Data is necessary for us to provide a response to the communications received from you or to the requests that you have made. The provision of any further Personal Data by you is completely voluntary.
- Navigation data: the IT and electronic communications systems and software procedures put in place to allow the Website to function, will, in the course of their normal work, collect certain data (e.g. access date and time, pages visited, name of the Internet Service Provider and Internet Protocol (IP) address you use to access the internet, the internet address from which you connect to our Website, etc.), the transmission of which is implicit in the use of web communications protocols or is pertinent to effective management or optimisation of the data or email sending system.
1.3. Please be informed that this Personal Data will be processed manually and/or using IT or electronic support.
1.1. Enel will process your Personal Data for very specific purposes and only if there is a specific legal basis provided for under applicable personal data protection and privacy legislation. Specifically, Enel will process your Personal Data only when one or more of the following legal requirements has been met:
- you have freely given your specific, informed, unambiguous and affirmative consent to the processing of said data;
- the processing is necessary to the performance of a contract to which you are a party or to take pre-contractual measures at your request;
- for the purposes of the pursuit of Enel’s legitimate interests;
- Enel has a legal obligation to process said Personal Data.
1.2. The table list the purposes for which your Personal Data can be processed by the Controller and the legal bases for said processing.
1.3. The provision of your Personal Data is necessary in all instances in which processing is a legal requirement or necessary to the performance of a contract to which you are a party or to the implementation of pre-contractual measures adopted at your request. Any refusal on your behalf may make it impossible for Enel to perform the task for which your Personal Data has been collected.
1.4. The provision of your Personal Data, however, is voluntary for any further purposes and failure to give your consent in such cases will have no effect on the completion of the contract. The obligatory or optional nature of the provision of data will be specified at the moment of its collection.
Your Personal Data may be made accessible for the abovementioned purposes, to:
- employees and staff of the Controller who, for that purpose, have been tasked with data processing, or to Enel Group companies in the European Union for the implementation of organisational, administrative, financial and accounting activities.
- to third party companies or other subjects to which the Controller outsources work required to allow the Website to function, in their role as external data processors.
Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognised by a specific suitability decision of the European Commission.
Any transfers of Personal Data to non-EU countries, in the absence of a European Commission adequacy decision, will only be possible if adequate guarantees of a contractual or tactical nature are provided by the Holders and Managers involved, including Binding Corporate Rules and standard contractual clauses for data protection.
The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be carried out where you have explicitly consented or in the cases provided for by the GDPR and will be processed in your interest. In these cases, we inform you that, despite the fact that the Enel Group adopts common operating instructions in all the countries in which it operates, the transfer of your Personal Data may be exposed to risks connected with the particular nature of local legislation on the processing of Personal Data.
Personal Data processed for the purposes described above will be held in compliance with the principles of proportionality and necessity, and, in all cases, until the purposes of the processing have been completed.
1.1 Under articles 15 – 21 of EU Regulation 2016/679 (GDPR), you have the right in relation to the Personal Data you provide:
- To access and request a copy;
- To request rectification;
- To request erasure;
- To obtain restriction of data processing;
- To object to the processing;
- To receive in a commonly-used structured form readable on an automatic device and to transmit without impediment said data to another Data Controller in the case that this is technically feasible.
1.2. Please be informed that you have the right to object at any time to the processing of Personal Data relating to you that is carried out in the pursuit of Enel’s legitimate interests.
1.3. When you object to the processing of your Personal Data as per article 8.2, the Controller will refrain from further processing your Personal Data, except where convincing legitimate reasons for continuing with the processing have been established or for the verification, exercising or defence of a right in a court of law.
1.4. For further information relating to your Personal Data and to exercise your rights and withdraw your consent, you can contact Enel’s Personal Data Protection Officer at this email address firstname.lastname@example.org. It is essential to insert the following subject line “Privacy” also.
1.5. Please note that you have the right to make a complaint to the relevant Personal Data protection authority.
1.6. If the Guarantor for the Protection of Personal Data is referred to, you may submit a complaint:
- By registered, return-receipt post, addressing your letter to: Garante per la Protezione dei Dati Personali, Piazza Venezia, 11, 00187, Rome, ITALY;
- By e-mail: email@example.com.