PRIVACY PRACTICES

PURSUANT TO ART. 13 OF EU REGULATION 2016/679 (“GDPR”)

This English translation is provided for the sake of convenience only. The Italian version shall be the only legally binding text. In the event of any conflict between the Italian version and this English translation, the Italian version shall prevail.

Enel X Italia S.r.l. (hereinafter also “Enel X Italia”), in its capacity as Data Controller, informs you that the personal data provided and acquired at the time of signing up for the selected services, regardless of whether you use the service in your own name or on behalf of a company, and the data necessary for providing these services, including browsing data, will be processed in accordance with the guarantees of confidentiality and the security measures laid down in the applicable regulations, using IT, telematic and manual means, in keeping with the criteria strictly associated with the purposes of processing.

In particular, Enel X Italia highlights that, as far as browsing data are concerned, the IT and digital communications systems and the software procedures that support the functionality and use of this app acquire certain items of data in the course of normal operation (e.g. access date and time, pages visited, name of Internet Service Provider and Internet Protocol (IP) address through which you access the Internet, Internet address from which you are connected to our Site, geographical location, etc.), the transmission of which is implicit when using web/app communication protocols or is useful for correct management and optimization of the system supporting the transmission of data and email. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct operation. It is therefore stored in anonymous form for the full period of activity of the app in question. The data may be used to ascertain responsibility in the event of computer crimes against the site. These practices apply exclusively to this web and mobile application and do not apply to any personal data that may be acquired through links to other web sites over which Enel X Italia has no control and to which this declaration on data security does not extend.

These indications and those appearing hereinafter apply both to users who use the service in a personal capacity and to users who use the service in their capacity as employees of a company that has signed a contract with Enel X Italia. In particular, Enel X JuicePass users with a Non-Private Account agree to:

1) Register for the service in their own name so as to set up an account by entering their personal data

2) Use the charging service in accordance with the terms and conditions laid down in the contract between Enel X Italia and their employer.

3) The use of geolocation within the framework of this service

4) The tracking of data relating to charging operations and the viewing of this data by their company

5) The use of their data for the purpose of providing Customer Support services

6) The transmission of “e-News” or similar newsletters, for the purpose of providing information and raising awareness on topics relating to electric mobility, charging and the sustainability associated therewith.

 

1.     Data Controller

 The Data Controller is Enel X Italia S.r.l., with registered office in Via Flaminia 970, 00189 Rome, VAT No. 13111961002.
 
2.     Data Protection Officer

 Enel X Italia has designated a Data Protection Officer (DPO), who can be contacted by email at:

dpo.enelxitalia@enel.com
 
3.       Purposes and lawful basis for processing

 Enel X Italia will process your Personal Data for specified purposes and only where the applicable law on personal data protection establishes a specific lawful basis for doing so. Specifically, Enel X Italia will process Personal Data only where one or more of the following lawful bases apply:

In particular, pursuant to art. 13 of the GDPR, Enel X Italia gives notice that it will process Personal Data with the aid of electronic and other means, including automated storage in its electronic databases, for purposes connected with the use of this app and the related services offered, with particular reference to the following purposes:

a) Activities strictly connected with and necessary to the use of this app and the use of the related services.  In the absence of such data, it will not be possible to provide the services requested by the user or by the company by which the user is employed.

To this end, Enel X Italia specifies that the use of some of the aforementioned services is conditional upon registration with the Reserved Area of Enel X, in accordance with the procedures described under letter b) below.

Enel X Italia collects technical information from the user’s mobile device, e.g. data relating to the location or to certain characteristics and performance features of the device or of the telephone operator/operating system, including type of device and connection, IP address, mobile payment methods and interaction with other retail technology (such as the use of NFC Tags, QR codes or mobile vouchers).

b) Single Account: registration and access to the reserved area

The reserved area can only be accessed using an Enel single account. In order to retain access to the reserved area, even users who are already registered are required to accept the Terms and Conditions for creating a new single account, since they will no longer be able to use their previous account.

Registration: Personal data is collected when you create your single account on one of the web portals or apps provided for the purpose. Setting up a single account enables you to access all web portals and mobile apps of authorized Enel companies, using a single username and password.

Logging in after first registration: The reserved area can only be accessed using an Enel single account.

After setting up your Enel single account, some Personal Data may be made available to other Group companies authorized to use the single account, should the Customer wish to access to the respective reserved areas of the web portals and mobile apps. The data will be processed for the sole purpose of verifying the credentials of the Customer and allowing easy access, with no additional requirements, from any country in which an authorized Enel company is based.

Access to the Reserved Area of Enel X Italia is granted as follows:

- by setting up an account using this web portal, or other portals or mobile apps of Enel Group companies authorized to set up single accounts;

- by using the credentials provided by a social media network (known as “social login”), for example to Facebook, Apple and Google+ accounts.

To this end, Enel X Italia informs data subjects that certain items of personal data (Name, Surname, Email Address) will be acquired in accordance with the permissions given to the relevant social network by the said data subject. The data subject is therefore required to check the settings established by the social network concerned and carefully read the related Privacy Policy. Enel X Italia will retain the identification code associated with the user account by the social network concerned. This code will be retained for the full duration necessary to provide the requested services. If a user sets up an Enel X JuicePass account or uses services provided by the website by logging in with their social login, Enel X Italia may use the information contained in the source account to complete their account on the website. Data subjects may update or change their account information and contact data at any time, using their social login credentials.

c) Compliance with legal obligations, regulations and other requirements established by EU legislation.

d) The performance of market research and direct sales by Enel X Italia, including by telephone, for the placement of products or services, for commercial communications or marketing activities. These activities may be carried out by sending advertising, informative or promotional material or invitations using traditional methods (e.g. paper mail) or automated contact systems (e.g. SMS, email);

e) The performance of market research and direct sales by Enel Group companies, parent companies, subsidiaries, associates and commercial partners of Enel X Italia, including by telephone, for the placement of products or services, for commercial communications or marketing activities. These activities may be carried out by sending advertising, informative or promotional material or invitations using traditional methods (e.g. paper mail) or automated contact systems (e.g. SMS, email);

f) Enel X Italia and Enel Group companies, parent companies, subsidiaries, associates and commercial partners of Enel X Italia may undertake profiling activities based on consumption habits and personal data and information acquired by observing the use of the products or services offered, with a view to providing information about customized offers.

g) The transmission of “e-News” or similar newsletters, for the purpose of providing information and raising awareness on topics relating to electric mobility, charging and the sustainability associated therewith.

  
4.      Nature of consent

For the purposes specified in points 3.d), 3.e) and 3.f), consent to the processing of personal data is optional and has no effect on the use of the app and the related service.

 
5.       Location data

Certain app services use a technology that identifies the physical location of the user’s device by using data relating to the longitude and latitude at which the device is located, by means of the device’s native applications (“Location Data”). Location data is shared with the mapping service provider, Google, which converts the Location Data into a point on the map. The app uses this location on the map to provide the service requested by the user, e.g. to identify the position of the user’s device and its distance from the desired charging point in order to enable them to use the charging service and charging point booking service.

If the application is connected to the Internet and connected to the user’s account, the user agrees to Enel X Italia processing their location data according to the procedures and for the purposes described above. If a user deactivates the geolocation function, they will not be able to use the services described above.

The Google Maps privacy policy is available at https://www.google.com/intl/it_it/help/terms_maps.html and is integrated into the Enel X Italia privacy practices by virtue of this reference to it, insofar as it concerns the processing of Location Data or the Search Address by Google.


6.       Methods and rationale for processing, retention periods and protective measures

Data will be processed in accordance with the rationale applicable to the organisation and processing of Personal Data, including in relation to logs originating from access to and use of the services made available via the web, and connected with the purposes indicated above and, in any event, in such a way as to ensure the security and confidentiality of the data.

In the case of online transactions, processed data is protected by the use of appropriate technological solutions, both for the protection of connections and for the storage of financial data (credit card, IBAN, etc.). The personal data processed will be retained for the necessary time established for the specific purpose by the applicable legislation.

The Personal Data processed for the aforesaid aims will be retained in accordance with the principles of proportionality and necessity, and anyway until the aims of processing have been achieved.

Personal Data will normally be stored for as long as the Data Subject’s relationship with the Controller exists, without prejudice to requirements for the collection of outstanding debts and/or the management of data in the event of any disputes or complaints, such as for example those relating to invoices issued.

Personal Data will be automatically deleted 10 years after the termination of the contractual relationship, without prejudice to the possible preservation of said data where necessary for the management of ongoing legal actions and the fulfilment of specific legal obligations.


7.       Categories of entities to which data may be disclosed

Enel X Italia may need to disclose Customers’ Personal Data to third parties, in Italy and abroad, including countries not belonging to the European Union, in order to fully execute the contract, fulfil legal obligations and carry out all activities connected with or instrumental to the use of the app and the related services. Data recipients may be employees, consultants, contractors, temporary workers and/or any other natural person, who carry out their activity based on instructions received from Enel X Italia, specifically designated as Persons Authorized to process personal data.


In addition, data recipients may be entities belonging to the following categories:


Entities falling into the categories set out above will process the data as independent data controllers or as Processors or Persons Authorized to process personal data, specifically designated by Enel X Italia. Where appropriate, Enel X Italia will issue appropriate operating instructions to Processors and to Persons Authorized to process personal data, aimed at adopting the appropriate security measures in order to guarantee the confidentiality, security and integrity of the data.


8.       Transfer of Personal Data

Personal Data will be processed within the European Union and stored on servers located within the European Union. Said data may be processed in countries outside the European Union, on condition that an adequate level of protection is guaranteed and recognized by a specific adequacy decision of the European Commission. Any transfer of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate guarantees of a contractual or pactional nature are provided by the Controllers and Processors involved, including binding corporate rules and contractual clauses concerning data protection. The transfer of Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will be performed only if the data subject has explicitly consented or in the cases provided for by the GDPR and will be processed in the data subject’s interest. In these cases, Enel X Italia gives notice that, despite the fact that the Enel Group adopts operating instructions common to all the countries in which it operates, the transfer of Personal Data may be exposed to risks relating to the peculiarities of local laws regarding the processing of Personal Data.
If Enel X Italia’s services are accessed from an Enel single account outside the European Union, the Personal Data may be transferred to third countries in order to enable the said services to be used. In the absence of an adequacy decision or other appropriate measures aimed at protecting the above data, said data will be processed in the interest of the Customer and only in order to implement the contract or the required pre-contractual measures.

 
9.       Use of Cookies

Cookies are used by websites to recognize users within a work session and are not used to collect their personal data, but only to facilitate browsing on the site and the correct use of the related services.
Cookies only collect anonymous data and have a limited duration. All information collected is used, for example, to monitor and analyse site usage, improve the functionality of the site and target the content and graphics more accurately in order to meet the needs of visitors. If the user refuses to accept cookies, the quality of the pages visited could be impaired.

Enel X Italia websites may host, by agreement with third parties, advertising messages that may contain cookies that belong to the third-party owner of the message. Enel X Italia does not control or have access to these cookies or to the content of these sites.

To find out more about how Enel X Italia uses cookies, obtain details of them or find out how to deactivate them, go to https://www.enelx.com/it/it/legal-statements/cookie-policy.


10.       Rights of the data subject

Pursuant to articles 15 – 22 of the GDPR, with regard to the Personal Data processed, the data subject is entitled, where applicable, to:

a) access their data and request a copy of it;

b) request its rectification;

c) request its erasure;

d) obtain the restriction of its processing;

e) object to its processing;

f) receive their data in a structured, commonly used and machine-readable format, and transmit it without impediment to another data controller, where technically feasible.

 
For processing operations connected with the activities referred to in points 3.d), 3.e) and 3.f), the data subject may withdraw their consent at any time.

Data subjects may exercise their rights or withdraw their consent by sending an email to:

privacy.enelxitalia@enel.com.
The data subject has the right to lodge a complaint with the competent authority for personal data protection by:


The full privacy practices are available at www.enelx.com

Document last updated in July 2020