Privacy Policy Enel X

1.Data Controller

1.1 Enel X Brasil SA, with registered office in Praça Leoni Ramos 1, 4º andar, bloco 2, CEP 24210-205, Niterói, RJ, CNPJ nº 08.317.250 / 0001-61 (“Data Controller” or “Enel X”), as a Data Controller, it will process your data provided through the website https://www.enelx.com/br/pt (“Site”) in accordance with the applicable privacy and personal data protection legislation, especially with Law 13.709 / 18, the Brazilian General Personal Data Protection Law (LGPD) and EU Regulation 2016/679 (GDPR), in addition to this policy.

2. Data Protection Officer (DPO)

2.1 Enel x has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address: dpoenel.br@enel.com

3. Processing Subject and Methods

3.1 The Controller will process the personal data you have communicated or legitimately obtained ("Personal Data"). In particular, the following Personal Data is processed:

3.1.1 Reserved area data: when creating an account we will ask you to provide some Personal Data (such as name, surname, e-mail address, mobile number and user code), necessary to successfully complete the registration and use the related services. The Controller also allows you to access the reserved area through the application or through credentials provided by a social network (the so-called “social login”), especially using identities created on Facebook and Google+.

3.1.2 Payment data: if you purchase products or services, payment data, including identification details, will be considered Personal Data and will be processed in accordance with current legislation.

3.1.3 Contact details: if you intend to answer questions with Enel X by writing to the emails listed on the Site, your email address and message content will be processed. The processing of this Personal Data is necessary to provide a response to the communication received. The provision of additional data will be considered optional.

3.1.4 Navigation data: the IT systems and software procedures used to operate the Site, or those dedicated to the operation and use of the applications made available by Enel x, collect certain data during its normal operation (such as the date and time of access, the pages visited, the name of the internet provider and the IP address through which you access the internet, at the internet address from which you connected to our Site, etc.), whose transmission is implicit in the use of web communication protocols or is useful for better management and optimization of the data and email transmission system.

3.1.5.Data collected by the Customer Service (SAC): all data offered during interactions with Enel X's SAC team, including recordings of phone calls where authorization is given.

3.2 For the purposes of this policy, the Processing of Personal Data is intended as any operation or set of operations performed with the aid of automated processes and applied to Personal Data, such as the collection, registration, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.

3.3 We inform you that this Personal Data will be processed manually and/or with the aid of computerised and/or telematic means.

3.4 In addition to the processing of your personal data when accessing our digital platforms and channels, we will also process your personal data in our relationship as customers and consumers. These assumptions are more detailed in item 4.2 below.

4. Purpose and Legal Basis

4.1.     The Controller will process your Personal Data to achieve specific purposes and only in the presence of a specific legal basis (or requirement for processing) provided for by the applicable legislation on privacy and protection of personal data. Specifically, the Controller will process your Personal Data only when one or more of the following legal bases apply:

 - you have authorized, consenting to processing in a free, specific, informed and unambiguous way;

- processing is necessary for the performance of a contract to which you are a party or for the execution of pre-contractual measures adopted at your request;

- in the presence of a legitimate interest of the Controller;

- if there is a legal or regulatory obligation to process Personal Data;

- in the regular exercise of rights in judicial, administrative or arbitration proceedings;.

4.2. The following table lists the purposes for which your Personal Data is processed by Enel X and the legal basis for such processing.

4.3      The provision of your Personal Data is required in all cases where processing is performed based on a legal obligation or to perform a contract to which you are a party or for the implementation of pre-contractual measures taken at your request. Your eventual refusal may result in Enel X being unable to proceed with the purpose for which Personal Data is collected.

4.4.      The provision of your Personal Data is voluntary for the pursuit of additional purposes indicated in the table. Your non-authorization in relation to these final purposes will have no consequences on the conclusion of the contract. The mandatory or optional nature of the provision will be specified at the time of collection.

5.      Access and Registration in the reserved area via Social Media

5.1.   Access to the reserved area is allowed using the following methods:

a)      creating an account on the Site;

b)     through the application;

c)      through the use of credentials provided by a social network (the so-called “social login”), in particular the identities created on Facebook, Twitter or Google+. 

5.2  If you decide to access the reserved area using the credentials of a social network, Enel X will be obliged to acquire some of your personal data (First name, Last name, E-mail), according to the authorizations you have given to the respective social network. It is therefore your obligation to check the settings provided by the respective social network and carefully read the respective privacy policy, since they could authorize the social network to share your personal data with Enel X, thus authorizing Enel X to collect information including contacts, friends and other Personal Data. In any case, Enel X will not acquire the registration data you use.

5.3   Enel X will maintain the identification code associated with your account on the respective social network service when you use it to access the Enel X Site or to share content hosted on the Site; it will be kept for as long as necessary to provide the required services.

5.4   If you create an Enel X account or use the services of the Site when connecting via a social login, Enel X may use the information contained in the originating account to complete your profile on the Site. You can at any time update or modify your profile information and contact details through social login.

6.      Marketing and / or Profiling Purposes

6.1.           The email address given by you in the context of the contractual relationship with Enel X can be used by the Controller to send commercial offers related to products and / or services similar to those previously purchased (the so-called soft spam), in the case of specific authorization . You can oppose or withdraw this authorization at any time.

6.2.           For anything not included in the previous article 6.1, within the reserved area you can freely decide if you want to consent to the use of your Personal Data for sending advertising material, direct sales, commercial communications or for conducting relative market research. to products and / or services offered by Enel X, companies of the Enel Group, parent companies, subsidiaries, affiliates and / or business partners of Enel X.

6.3.           In addition, in the reserved area you can freely decide whether you want to consent to the use of your Personal Data for the detection of consumption preferences by Enel X, companies of the Enel Group, parent companies, subsidiaries, affiliates and / or business partners of Enel X , and for the analysis, even in a personalized, automated or electronic way, of information acquired through the use of products and / or services.

6.4.           The processing of Personal Data for the purposes above can be performed using “traditional” methods (for example, letters and / or phone calls), or through “automated” contact systems (such as SMS and / or MMS, automated phones, and- mails, faxes, interactive applications).

6.5.           The authorization given by you for marketing purposes will be understood as offered for both methods indicated, but without prejudice to your right to oppose such processing, even partially, in relation to the different communication channels with which the marketing purposes executed, using the same procedures indicated in paragraph 10 of this policy.

6.6.           Authorization for the purposes mentioned above is optional and does not prevent the possibility of using the services available therein. In particular:

a)      Subject to free and specific authorization, to be given within the reserved area in the “Authorization Management” section, such Personal Data may be processed for the execution of market research, direct sales, including by telephone, for the offer of products or services. , for commercial communication or marketing activities. These activities can be conducted by sending advertising, informational, promotional materials or invitations, using traditional methods (such as letters) or automated contact systems (such as SMS and e-mail).

b)     Subject to free, informed, unambiguous and specific authorization, to be given within the reserved area in the “Authorization Management” section, such Personal Data may also be disclosed to companies of the Enel Group, parent companies, subsidiaries, affiliates and / or business partners. of Enel X, to which the Data Controller may communicate or assign the acquired data for the aforementioned marketing purposes.

c)      Finally, subject to free, informed, unambiguous and specific authorization, to be given within the reserved area in the “Authorization Management” section, Enel X, companies of the Enel Group, parent companies, subsidiaries, affiliates and / or business partners of Enel X will be able to conduct analysis and processing, also nominative, of your profile and consumption habits to suggest offers of personalized products and services, to make them more aligned with and functional in relation to your interests and needs.

7.      Recipients of Personal Data

7.1 Your Personal Data may be made accessible for the purposes mentioned above:

a) to the employees and collaborators of the Controller, appointed for this purpose, or to the companies of the Enel X Group present in Brazil and in the European Union for the performance of organizational, administrative, financial and accounting activities;

b) to third-party companies or other entities that carry out outsourced activities on behalf of the Controller to enable the Site to operate, as external data processor.

c) the communication of Personal Data is carried out based on the obligations established by law or regulation, as well as on specific authorizations granted by the consumer;

d) ENEL X's obligation to communicate data to public authorities remains valid whenever a specific request is made in this regard;

e) anonymously, the data held by the Controller may be the subject of communication and disclosure to Bodies and Institutes for the purposes of scientific or statistical research or for public information.

8. International Transfer of Personal Data

Consumer Personal Data will be processed in Brazil, stored on servers located in Brazil, the European Union or the USA.

In the case of data transfer to third countries, Enel X will verify (i) whether these third parties operate in countries where the National Personal Data Protection Authority (ANPD) has recognized an adequate level of protection or (ii) negotiate appropriate protection clauses with those third parties.

If your registration involves the transfer of your Personal Data to third countries where the ANPD has not recognized an adequate level of protection or other appropriate data protection measures, your Personal Data will be processed in your interest and according to your own consent.

Keep in mind that, although Enel X issues common operating instructions for all countries in which the group operates, the transfer of your Personal Data may be exposed to some risks related to specific local legislation on processing personal data.

9.     Personal Data retention period

9.1   The Personal Data processed for the purposes set out above will be kept in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued.

9.2   Personal Data will be stored in a way that allows the identification of the respective data subject for a period that does not exceed what is necessary for the purposes for which it was collected and processed.

9.3   The Personal Data of consumers will be processed while their relationship with the Controller is maintained and will also be maintained for the applicable statutory terms. Personal Data may also be kept for longer periods to comply with regulatory obligations or, in the case of existence and for defense in legal, administrative or arbitration proceedings.

10.   Rights of Data Subjects

10.1 In accordance with articles 15-22 of the General Data Protection Regulation 2016/679 and articles 17 to 22 of the LGPD, in relation to the personal data communicated, you have the right to:

a) Confirm, access and request a copy, including information related to the shared use of data;

b) Request rectification of the data, as well as anonymization, blocking and elimination of unnecessary, excessive or non-compliant data;

c) Request elimination or portability;

d) Limit the processing of data;

e) Oppose to the processing of data;

f) Request information regarding the hypotheses of consent, their revocation and the resulting effects;

g) Revoke their consent, within the limit of the established by the applicable legislation;

h) Request a review of automated decisions.

10.2 To exercise your rights as a data subject, you can contact us by calling 0800 600 0560.

10.3 For more information about your Personal Data, contact the DPO, who can be reached at the following e-mail address:dpoenel.br@enel.com, specifying the content of your request in the subject.

10.4 We remind you that it is your right to file a complaint with the National Data Protection Authority - ANDP, as soon as it is constituted by the competent authorities.