This policy is provided pursuant to Article 13 of EU Regulation 2016/679 ("GDPR")
Enel X Way S.r.l. (hereinafter also "Enel X Way"), as Data Controller, informs you that the personal data provided and acquired at the time of registration for the chosen services, both for use on your own behalf and within the company, as well as the data necessary for the provision of such services, including navigation data, will be processed in compliance with the guarantees of confidentiality and the security measures provided for by the regulations in force through computer, telematic and manual tools, with logic strictly related to the purposes of processing.
The information contained in this document applies both to users who use the service in a personal capacity and to users who use the service as employees of a company that has signed a contract with Enel X Way.
In particular, the users who use Enel X JuicePass with a Non Private Profile authorize:
1) the registration to the service in their own name for the creation of the account with the insertion of personal data;
2) the use of the recharge service under the terms and conditions defined by the contract between Enel X Way and their company - employer;
3) the use of geolocation within the scope of this service;
4) the tracking of data relating to the recharges made and the display of such data by your company/employer;
5) the use of your data for the provision of Customer Care services;
6) the sending of "e-News" or similar newsletters of informative and educational nature on issues relating to electric mobility, recharging and related sustainability issues.
1. Data Controller
2. Data Protection Officer (DPO)
Enel X Way has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address: email@example.com.
3. Object and Processing Methods
Enel X Way may process the personal data communicated by you or in any case legitimately acquired by you ("Personal Data") in order to pursue the purposes for which they were provided, as the case may be. In particular, the following Personal Data may be processed:
- Common, personal and contact data (e.g., name and surname; e-mail address and telephone number);
- Economic and Financial Data: data necessary for payments (e.g., IBAN) or providing proof of payment (payment identification details) and any other data relating to the solvency and punctuality of the customer;
- Browsing data: the IT and telematics systems and software procedures used to operate and use of this APP acquire, during their normal operation, certain data (e.g., date and time of access, pages visited, name of the Internet Service Provider and the Internet Protocol (IP) address through which the Site is accessed). the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, the geographical position, etc.), the transmission of which is implicit in the use of web/app communication protocols or is useful for better management and optimization of the system for sending data and e-mails. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the APP and to check that it is functioning correctly; it is therefore stored anonymously for as long as the APP is active. The data could be used to establish liability in the event of computer crimes against the APP. This policy applies exclusively to this web and mobile application and does not apply in relation to Personal Data that may be acquired through links to other websites over which Enel X Way has no control and that are therefore not covered by this data protection statement. Enel X Way also collects technical information from the user's mobile device, such as location data or data relating to certain characteristics and performance of the device or of the telephone operator/operating system, including the type of device and connection, IP address, mobile payment methods, interaction with other retail technology (such as the use of NFC tags, QR codes or mobile vouchers);
- Data concerning location: Some APP services use technology that pinpoints the physical location of the user's device using data about the longitude and latitude at which the device is located, through native applications of the device (so-called "Location Data"). The Location Data is shared with the map service provider, Google, which converts the Location Data into a point on the map. This location on the map is used by the APP to provide the service requested by the user, e.g., finding the location of the user's device and the distance of the user's device to the identified charging station in order to enable the user to use the charging services and to book the charging infrastructure.
If the application is connected to the Internet and linked to his or her profile, the User agrees that Enel X Way may process the Location Data in the manner and for the purposes described above.
Users who deactivate the geolocation function will not be able to use the services described above.
- Data required to create a Unique ID: the APP may be accessed only by customers registered via the Enel Unique ID. When creating an Enel Unique ID, some Personal Data are required, such as name, surname, e-mail address, phone number and tax identification number (the latter only for consumer customers) - so-called "registration data" - necessary to successfully complete the registration, access the reserved area and to use the services offered by the individual companies of the Enel Group participating in the Unique ID. Registration data, as well as any data that may already be available to the Data Controller, having been acquired as part of other contractual relationships with the same, shall in no case be transferred to other Enel Group companies. Only registration data are also processed by those Enel Group companies that provide the authentication service, specifically appointed for this purpose as data processors (Enel Global Services S.r.l.).
We inform you that such Personal Data will be processed manually and/or with the support of computer or telematic means. The processing will be carried out with the logic of organization and elaboration of Personal Data, also related to the logs originated from the access and use of the services made available via the APP, related to the purposes indicated in this policy and, in any case, so as to ensure the security and confidentiality of data and information.
In the case of online transactions, the data being processed are protected by the use of appropriate technological solutions implemented to protect connections and store financial data (credit card, IBAN, etc.).
4. Purpose and Legal Basis of the Processing
Enel X Way will process your Personal Data for the achievement of specific purposes and in the presence of an appropriate legal basis provided by the applicable law on the protection of Personal Data. Specifically, Enel X Way shall be allowed to process your Personal Data only if one or more of the following legal bases apply:
- You have given your free, specific, informed, unambiguous and express consent to the processing;
- the processing is necessary for the performance of a contract to which you are a party or the execution of pre-contractual measures taken at your request;
- in the presence of a legitimate interest of Enel X Way, provided that the interests or fundamental rights and freedoms of the data subject do not prevail;
- by virtue of a legal obligation with which Enel X Way is required to comply.
The submission of your Personal Data is necessary in all cases in which the processing is carried out on the basis of a legal obligation or in order to execute a contract to which you are a party or for the implementation of pre-contractual measures taken at your request. In the latter cases, your refusal may make it impossible for Enel X Way to process your request.
The submission of your Personal Data is instead voluntary for the pursuit of the processing purposes for which your prior consent is required: in these cases, the lack of your consent in relation to them will not however have any consequence on the conclusion of the contract.
The obligatory or optional nature of consent will be specified at the time of collection of Personal Data.
In particular, pursuant to Article 13 of the GDPR, Enel X Way informs you that it may process your Personal Data, with the aid of tools, including electronic ones, including automated storage in its computer databases, for purposes related to the use of this APP and the related services offered and, in particular, for the following purposes:
a) Activities strictly related and necessary to the use of this APP and the use of related services. If Personal Data is not provided, it will not be possible to use the services requested by the user or by the company of which the user is an employee. The processing of Personal Data for the performance of these activities is therefore necessary to allow Enel X Way to perform its contractual obligations in order to allow you to use the APP.
It should also be noted that the use of some of the aforementioned services requires registration with the APP in the manner set out in letter b) below.
b) Unique ID - registration and access: Access to the APP is possible only through the Enel Unique ID. Users who were already registered for the digital services of the Enel Group Companies participating in the Unique ID service before the creation of the Unique ID itself, in order to continue to access the APP, must accept the Terms and Conditions for the creation of the Unique ID.
Please note that it is not possible to access the service with access credentials generated before September 9, 2019, the date on which the Unique ID was introduced.
First Registration: Personal registration data is collected at the time you create your Unique ID on one of the web portals or mobile apps that provide registration functionality. The creation of the Unique ID allows you to access, through a single username and password, the reserved area of the web portals and mobile App of the participating Enel Group companies.
Access after Registration: Access to the APP is possible only through the Enel Unique ID. For authentication purposes, the Unique ID system receives the encrypted credentials entered by the user for their verification and validation. Your Personal Data will therefore be processed for the sole purpose of verifying these credentials and allowing you to access them in a simple manner and without further charges from any country in which an authorized Enel Group company is present. It is understood that such data, for the purposes of access to the APP, are not in any case made available to other Enel Group companies authorized to use the Unique ID.
Access to the services available through JuicePass is provided in the following ways:
i. via the App after registering the Unique ID;
ii. through the use of credentials chosen for the identity created on social networks (so-called "social login"), in particular the identities created on AppleId, Facebook and Google, when the option is available. Following acceptance of the terms and conditions of the service, a Unique ID will be associated with the user.
Enel X Way will retain the identification code associated with your account with the social network service of reference when you use it to log in to Enel X Way or to share content hosted on the site; this will be retained for as long as necessary to provide the services requested. In any case, Enel X Way will have no knowledge of the credentials you use to access the social network.
c) Fulfilment of legal, regulatory or EU obligations.
d) The sending, by Enel X Way via e-mail, of commercial offers relating to products and/or services similar to those previously purchased (so-called soft-spam);
e) Sending out "e-News" or similar newsletters of informative and educational nature on issues relating to electric mobility, recharging and related sustainability topics;
f) Sending information and/or updates functional to the management and execution of the contract and for participation in any reward or loyalty programs;
g) Carrying out activities aimed at improving the quality of the services offered in connection with the contract (for example, by means of surveys carried out through e-mails or phone calls to assess customer satisfaction and understand how to improve the customer experience);
h) The carrying out, by Enel X Way, of market research, direct sales, including by telephone, for the placement of products or services, for commercial communications or marketing activities.
i) The carrying out, by identified companies of the Enel Group (such as Enel Energia S.p.a.; Enel X S.r.l.; Enel X Italia S.r.l., Enel X Financial Services S.r.l.; Paytipper S.p.a.), of market research, direct sales, including by telephone, for the placement of products or services, for commercial communications or marketing activities.
j) The carrying out by Enel X Way of profiling activities based on your consumption preferences and data and information relating to your purchase choices of products or services of the Data Controller also in order to receive offers specifically tailored to your needs.
k) Subject to the free and specific consent of the Customer, request from the energy trader the Personal Data and data relating to the electricity supply and relating to the tariff plan subscribed to by the Customer in order to provide a charging service corresponding to the tariff plan.
For the purposes set out in points 3.h), 3.i), 3.j) and 3.k) the provision of consent to the processing of Personal Data is optional and will not affect the use of the APP and the related service.
5. Marketing and/or Profiling Purposes
Through the appropriate forms, you may freely decide whether or not to consent to the use of your Personal Data and contact details also for market research, direct sales, including telephone sales, for the placement of products or services, for commercial communications or marketing activities relating to the products and/or services offered by Enel X Way or by other Companies in the Enel Group from time to time specifically identified in the data collection forms. Subject to your free and specific consent, for the purposes indicated above, your Personal Data may be processed by the Enel Group Companies identified, directly, as independent data controllers and/or by Enel X Way, as Data Processor, on their behalf.
The prior acquisition of your consent for the marketing purposes described above is not required when contact is made through telephone numbers (landline and/or mobile) and paper mail addresses belonging to subjects present in public telephone directories, in relation to which the regulations regarding the Registro Pubblico delle Opposizione (RPO) are applicable, allowing the processing of such contact data for those who have not exercised their right to oppose.
The acquisition of your consent for the purpose of "profiling" allows Enel X Way to process your Personal Data for profiling activities based on your consumption preferences and on the data and information acquired by the Data Controller through the purchase of its products or services also in order to receive offers specifically tailored to your needs.
For the purpose of developing better services and products that correspond to your needs, Enel X Way may make use of partnerships with selected companies that integrate, on a statistical basis, census-type information relating to: personal preferences and interests, consumption preferences, economic and family situation, location or movements of the individual. In no case will your Personal Data be shared with third parties for profiling purposes.
Your personal and contact data may also be processed by Enel X Way in order to carry out, on the basis of its own legitimate interest and having first verified, with regard to each individual initiative, that the interests, rights or fundamental freedoms of the data subjcet do not prevail by means of a specific balancing test (Legitimate Interest Assessment), promotional activities for services and products offered by the Controller.
The processing of Personal Data for marketing purposes may be carried out using "traditional" methods (such as paper mail and/or operator calls), or through "automated" contact systems (such as SMS and/or MMS, phone calls without operator intervention, e-mail, fax, interactive applications).
6. Recipients of Personal Data
Your Personal Data may be made available to:
a) the employees and collaborators of Enel X Way, specifically appointed as Persons Authorized to the processing;
b) to the companies of Enel Group present on the territory of the European Union in their capacity as autonomous data controllers or data processors as well as to their employees and collaborators specifically appointed as Persons Authorized to the Processing;
c) to third party companies or other subjects that carry out certain activities in outsourcing on behalf of Enel X Way, in their capacity as data processors as well as their employees and collaborators specifically appointed as Persons Authorized to the Processing.
These parties will process your Personal Data, for example, as part of:
- customer communication management activities;
- customer care services;
- invoicing and credit protection services;
d) to institutions, public and private authorities, supervisory and control bodies, banks, factoring companies and credit card companies when this is necessary for the granting of subsidies, contributions, financing, grants and facilities of any kind connected with the supply of the Controller's products and/or services or when required by specific provisions of law, regulations and authorizations;
e) to external companies, including foreign ones, operating in the insurance sector and in the granting of loans, including payment extensions, when permitted by current legislation, for the purposes of prevention and control of the risk of insolvency, fraud control and credit protection, as well as subjects operating in the field of credit collection, out-of-court and in court (Companies and/or Law Firms) in the event of the transfer of credits;
f) to companies that are joint data controllers, if any, that jointly determine the purposes and means of processing with Enel X Way.
Enel X Way shall issue instructions to the Data Processors and Authorized Persons for the purpose of adopting appropriate security measures in order to guarantee the confidentiality, security and integrity of the data.
7. Transfer of Personal Data
Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, as recognized by a specific adequacy decision of the European Commission.
Possible transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or covenant-based guarantees are provided by the Data Controllers and Processors involved, including binding corporate rules and standard contractual data protection clauses.
The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be made where you have explicitly consented to it or in the cases provided for in the GDPR and will be processed in your interest. In these cases, we inform you that, although the Enel Group adopts operating instructions common to all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local legislation on the processing of Personal Data.
8. Personal Data Retention Period
Personal Data shall be stored and processed as long as there is a contractual relationship with the Data Controller and, in any case, for a period of 10 years from the termination of the contractual relationship, after which they shall be deleted, without prejudice to the further storage of the same where necessary to comply with specific legal obligations, provisions of the Authority, for the collection of residual credits and for the management of disputes, complaints and legal actions.
Your free and specific consent is always required in order to process your Personal Data and contact details for market research, direct sales, including telephone sales, for the placement of products or services, for commercial communications or marketing activities relating to the products and/or services offered by Enel X Way or by other Companies in the Enel Group from time to time specifically identified in the data collection forms. Consent is optional. If you consent, your Data will be processed until the consent given is withdrawn.
Your free and specific consent is also required to process your Personal Data for profiling purposes by Enel X Way. Consent is optional. If you consent, your Data will be processed until the consent given is withdrawn.
9. Rights of the Data Subjects
Pursuant to articles 15 - 22 of the GDPR, in relation to the Personal Data communicated, you have the right, where applicable, to:
a) access and request a copy;
b) request any corrections;
c) request cancellation;
d) obtain limitations on the processing;
e) object to the processing;
f) receive such data in a structured, commonly used and machine-readable format and to transmit them without hindrance to another data controller; where technically feasible.
You also have the right not to be subjected to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of a contract with the Data Controller; b) is authorized by law or c) is based on explicit consent. In cases a) and c) you have the right to express your opinion, dispute the decision and obtain human intervention by the Controller.
We inform you that you have the right to object at any time to the processing of Personal Data that concern you that may be carried out on the basis of the legitimate interest of Enel X Way. In this case, the Data Controller shall refrain from further processing your Personal Data, unless it demonstrates the existence of compelling legitimate reasons to proceed with the processing, or for the ascertainment, exercise or defense of legal claims.
We also inform you that you still have the right to object at any time to the processing of Personal Data concerning you carried out for marketing purposes, including profiling, insofar as it is related to such direct marketing. The right to object to such processing carried out through automated contact systems also extends to the processing of Personal Data through traditional contact methods, unless you wish to object only in part.
If you object to processing for marketing and profiling purposes, your Personal Data will no longer be processed for such purposes.
To exercise your rights and to withdraw your consent you may send a communication to the e-mail address: firstname.lastname@example.org.
For further information regarding your Personal Data, you may contact the Data Protection Officer, who can be reached at the following e-mail address: email@example.com.
Finally, we remind you that if you believe that the processing of your data has taken place in a manner that does not comply with European Regulation 679/2016 (GDPR), it is your right to lodge a complaint with the Supervisory Authority for the Protection of Personal Data, by:
a) registered letter A/R addressed to Garante per la Protezione dei Dati Personali, Piazza Venezia, 11, 00187 Rome;
b) e-mail at: firstname.lastname@example.org, or email@example.com;
c) fax to: 06/69677.3785.