Privacy

1.     Controller of the Processing of Personal Data

1.1.     Enel X Brasil S.A., with registered office at Leoni Ramos Square, number 01, 4 floor, block 2, zip code 24210-205, Niteroi, RJ, CNPJ nº 08.317.250/0001-61(hereinafter "Data Controller" or “Enel X”), as Data Controller, will process your personal data provided through the site www.enelx.com/br (hereinafter "Site") in accordance with the provisions of the applicable legislation on privacy and protection of personal data and this policy.

2.      Data Protection Officer (DPO)

2.1.    Enel X has prepared a customer service channel, which can be contacted through the following email address: enelxbrasil@enel.com

3.      Personal Data Processed and Methods of the Processing

3.1.     Data Controller will process the personal data you have communicated or it has legitimately obtained ("Personal Data"). In particular, the following Personal Data is processed:

3.1.1.       Data from the reserved area: when creating an account you will be asked to provide some Personal Data (e.g. name, surname, e-mail address, mobile phone number and user code), necessary to successfully complete the registration and use the related services. The Controller also allows you to access the reserved area through the APP or through the use of credentials provided by a social network (so-called "social login"), in particular using identities created on Facebook and Google+.

3.1.2.       Payment data: if you purchase products or services, payment data, including identification details, those Personal Data are also processed in compliance with current legislation.

3.1.3.       Contact data: if you intend to ask to Enel X questions by writing to the e-mail addresses listed on the Site, your e-mail address and the content of the message sent will be processed. The processing of this Personal Data is necessary in order to provide feedback to the communication received. The provision of further data processing is to be considered absolutely optional.

3.1.4.       Browsing data:  the IT and telematics systems and software procedures used to operate the Site, or those dedicated to the operation and use of the APPs made available by Enel X [_____], acquire certain data during their normal operation (e.g. the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, the Internet address from which you connected to our Site, etc.), whose transmission is implicit in the use of web communication protocols or is useful for the better management and optimization of the data transmission and e-mail system.

3.2.     For the purposes of this policy, the Processing of Personal Data is intended as any operation or set of operations performed with the aid of automated processes and applied to Personal Data, such as the collection, registration, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.

3.3.     We inform you that this Personal Data will be processed manually and/or with the aid of computerized and/or telematics means.

4.      Purpose and legal basis of the processing

4.1.     The Controller will process your Personal Data for the achievement of specific purposes and only in the presence of a specific legal basis provided for by the applicable law on privacy and protection of personal data. Specifically, the Controller will process your Personal Data only when one or more of the following legal bases occurs:

-        you have given your free, specific, informed, unequivocal and express consent to the processing;

-        the processing is necessary for the execution of a contract of which you are a party or for the execution of pre-contractual measures adopted at your request;

-        in the presence of a legitimate interest of the Controller;

-        is bound by a legal obligation to process Personal Data.

The following table lists the purposes for which your Personal Data is processed by Enel X and the legal basis of such processing.

4.3     The provision of your Personal Data is necessary in all cases where processing is carried out on the basis of a legal obligation or to execute a contract of which you are a party or due to the implementation of pre-contractual measures taken at your request. Your eventual refusal could entail Enel X's impossibility to proceed with the purpose for which the Personal Data is collected.

4.4      The provision of your Personal Data is voluntary for the pursuit of the additional purposes indicated in the table. Failure to provide your consent in relation to these final purposes will have no consequences on the conclusion of the contract. The mandatory or optional nature of the provision will be specified at the time of collection.

5.      Registration in the reserved area via social login

5.1.   Access to the reserved area is allowed using the following methods:

a)      creating an account on the Site;

b)     through the APP;

c)      through the use of credentials provided by a social network (so-called "social login"), in particular the identities created on Facebook, Twitter and Google+.

5.2  If you decide to access the reserved area using the credentials of a social network, Enel X will have to acquire some of your personal data (Name, Surname, E-mail) in accordance with the authorizations you have given the relative social network. You are therefore required to check the settings envisaged by the relative social network and carefully read the related privacy policy, as they could authorize the social network to share your personal data with Enel X, thereby authorizing Enel X to collect information such as contacts, friends and other Personal Data. In any case, Enel X will not acquire the registration data you use.

5.3   Enel will keep the identification code associated with your account at the service of the relative social network when you use it to log in to the Enel X Site or share contents hosted by the Site; it will be kept for as long as necessary to provide the required services.

5.4   If you create an Enel X account or use the Site's services by connecting through the social login, Enel X may use the information contained in the account of origin to complete your profile on the Site. You may at any time update or modify your profile information and contact details via the social login.

6.      Purposes of Marketing and/or Profiling

6.1.           The e-mail address you provided in the context of the contractual relationship with Enel X may be used by the latter to send commercial offers relating to products and/or services similar to those previously purchased (so-called soft-spam). You can oppose the processing at any time by sending a request to the dedicated mailbox referred to in paragraph 10 of this policy.

6.2.           For everything not included in the previous article 6.1, within the reserved area you can freely decide whether to consent to the use of your Personal Data for sending advertising material, direct sales, commercial communications or for carrying out market research relating to products and/or services offered by Enel X, Enel Group companies, parent companies, subsidiaries, affiliates and/or commercial partners of Enel X.

6.3.           Furthermore, within the reserved area you can freely decide whether to consent to the use of your Personal Data for the detection of consumption preferences by Enel X, Enel Group companies, parent companies, subsidiaries, affiliates or Enel X's commercial partners and the analysis, even in personalized, automated or electronic form, of information acquired through the use of products and/or services.

6.4.           The processing of Personal Data for the aforementioned purposes may be carried out using "traditional" methods (for example, paper mail and/or calls from an operator), or through "automated" contact systems (for example SMS and/or MMS, automated telephone calls, e-mails, faxes, interactive applications).

6.5.           The consent you give for marketing purposes will be understood as provided for both methods indicated, however without prejudice to your right to oppose such processing, even partially, in relation to the different communication channels with which the marketing purposes are carried out, using the same procedures indicated in paragraph 10 of this policy.

6.6.           Consent for the aforementioned purposes is optional and does not prevent the possibility of using the services available in the same. In particular:

a)      Subject to free and specific consent, to be provided within the reserved area in the "Consent Management" section, such Personal Data may be processed for carrying out market research, direct sales, including telephone calls, for the placement of products or services, for commercial communications or marketing activities. These activities can be carried out by sending advertising, informative or promotional material or invitations using traditional methods (e.g. paper mail) or automated contact systems (e.g. SMS, e-mail).

b)     Subject to free and specific consent, to be provided within the reserved area in the "Consent Management" section, such Personal Data may also be disclosed to Enel Group companies, parent companies, subsidiaries or affiliates, as well as third parties, Enel X's commercial partners, to which the Data Controller may communicate or cede the data acquired for the aforementioned marketing purposes.

c)      Lastly, subject to free and specific consent, to be provided within the reserved area in the "Consent Management" section, Enel X, Enel Group companies, parent companies, subsidiaries, affiliates or Enel X 's commercial partners can carry out analyses and processing, also nominative, of your profile and consumption habits in order to propose offers for products and personalized services, to make them more in line with and functional to your interests and needs.

7.      Recipients of Personal Data

7.1.   Your Personal Data may be made accessible for the purposes mentioned above:

a)      to the employees and collaborators of Enel X, agents, persons directly authorized for the processing, or to companies of the Enel Group present in the Brazil, which may act as independent Data Controllers or as Data Managers for the appointed purpose;

b)     to third-party companies or other parties ("Third Parties") who perform certain outsourced activities on behalf of Enel X, in their capacity as external processors,

c)      to third parties, Enel Group companies, parent companies, subsidiaries, affiliates or Enel X's commercial partners for purposes of direct marketing, in compliance with the provisions of the GDPR, subject to obtaining your consent.

8.      Transfer of Personal Data

8.1   Your Personal Data will be processed within the  Brazil and stored on servers located within the  Brazil.

9.      Personal Data retention period

9.1   The Personal Data processed for the purposes set out above will be kept in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued.

9.2   Your Personal Data will normally be kept as long as your relationship with the Data Controller exists, without prejudice to any requirements for the collection of residual credits and/or the management of data in the event of any disputes or complaints, such as for example those relating to invoices issued.

9.3   Your Personal Data will normally be kept as long as you do not revoke your consent and in any case will be deleted automatically after ten years from the termination of the contractual relationship, without prejudice to the possible preservation of the same, where necessary for the management of ongoing legal actions and to fulfil specific legal obligations.

10.   Rights of Data Subjects

10.1 In accordance with articles 15 - 22 of the GDPR and 17-22 of the LGPD (Law  nº 13.709/2018), in relation to the Personal Data communicated, you have the right to:

a)      access and request a copy;

b)     request its correction;

c)      request its deletion;

d)     obtain a restriction of processing;

e)      object to the processing;

f)      receive data in a structured format, commonly used and readable by an automatic device and transmit them to another data controller, where technically feasible, without any impediment.

10.2 We inform you that you have the right to object to the processing of Personal Data concerning you at any time for direct marketing purposes, including profiling, to the extent that it is connected to such direct marketing. The right to object to such processing performed through automated contact means also extends to the processing of Personal Data through traditional contact means, unless you wish to oppose only in part.

10.3 Where you object to processing for direct marketing purposes, your Personal Data shall no longer be processed for such purposes.

10.4 To exercise your rights and withdraw your consent, you can send a communication to the e-mail address: enelxbrasil@enel.com.

10.5 For more information regarding your Personal Data, you can contact the Personal Data Protection Officer, who can be reached at the following e-mail address

10.6 We remind you that it is your right to lodge a complaint to the Competent Data Protection Authority.