PURSUANT TO ART. 13 OF EU REGULATION 2016/679 (“GDPR”)
This English translation is provided for the sake of convenience only. The Italian version shall be the only legally binding text. In the event of any conflict between the Italian version and this English translation, the Italian version shall prevail.
Enel X Italia S.r.l. (hereinafter also “Enel X Italia”), in its capacity as Data Controller, informs you that the personal data provided and acquired at the time of signing up for the selected services, regardless of whether you use the service in your own name or on behalf of a company, and the data necessary for providing these services, including browsing data, will be processed in accordance with the guarantees of confidentiality and the security measures laid down in the applicable regulations, using IT, telematic and manual means, in keeping with the criteria strictly associated with the purposes of processing.
In particular, Enel X Italia highlights that, as far as browsing data are concerned, the IT and digital communications systems and the software procedures that support the functionality and use of this app acquire certain items of data in the course of normal operation (e.g. access date and time, pages visited, name of Internet Service Provider and Internet Protocol (IP) address through which you access the Internet, Internet address from which you are connected to our Site, geographical location, etc.), the transmission of which is implicit when using web/app communication protocols or is useful for correct management and optimization of the system supporting the transmission of data and email. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct operation. It is therefore stored in anonymous form for the full period of activity of the app in question. The data may be used to ascertain responsibility in the event of computer crimes against the site. These practices apply exclusively to this web and mobile application and do not apply to any personal data that may be acquired through links to other web sites over which Enel X Italia has no control and to which this declaration on data security does not extend.
These indications and those appearing hereinafter apply both to users who use the service in a personal capacity and to users who use the service in their capacity as employees of a company that has signed a contract with Enel X Italia. In particular, Enel X JuicePass users with a Non-Private Account agree to:
1) Register for the service in their own name so as to set up an account by entering their personal data
2) Use the charging service in accordance with the terms and conditions laid down in the contract between Enel X Italia and their employer.
3) The use of geolocation within the framework of this service
4) The tracking of data relating to charging operations and the viewing of this data by their company
5) The use of their data for the purpose of providing Customer Support services
6) The transmission of “e-News” or similar newsletters, for the purpose of providing information and raising awareness on topics relating to electric mobility, charging and the sustainability associated therewith.
1. Data Controller
The Data Controller is Enel X Italia S.r.l., with registered office in Via Flaminia 970, 00189 Rome, VAT No. 13111961002.
2. Data Protection Officer
Enel X Italia has designated a Data Protection Officer (DPO), who can be contacted by email at: email@example.com.
3. Purposes and lawful basis for processing
Enel X Italia will process your Personal Data for specified purposes and only where the applicable law on personal data protection establishes a specific lawful basis for doing so. Specifically, Enel X Italia will process Personal Data only where one or more of the following lawful bases apply:
• The Customer has freely provided their specific, informed, unequivocal and express consent for data processing;
• Processing is necessary for the purposes of executing a contract to which the Data Subject is a party or for the purpose of implementing pre-contractual measures adopted at the latter’s request;
• Enel X Italia has a legitimate interest in doing so;
• Enel X Italia is legally obliged to process the Personal Data.
In particular, pursuant to art. 13 of the GDPR, Enel X Italia gives notice that it will process Personal Data with the aid of electronic and other means, including automated storage in its electronic databases, for purposes connected with the use of this app and the related services offered, with particular reference to the following purposes:
a) Activities strictly connected with and necessary to the use of this app and the use of the related services. In the absence of such data, it will not be possible to provide the services requested by the user or by the company by which the user is employed.
To this end, Enel X Italia specifies that the use of some of the aforementioned services is conditional upon registration with the Reserved Area of Enel X, in accordance with the procedures described under letter b) below.
Enel X Italia collects technical information from the user’s mobile device, e.g. data relating to the location or to certain characteristics and performance features of the device or of the telephone operator/operating system, including type of device and connection, IP address, mobile payment methods and interaction with other retail technology (such as the use of NFC Tags, QR codes or mobile vouchers).
b) Single Account: registration and access to the reserved area
The reserved area can only be accessed using an Enel single account. In order to retain access to the reserved area, even users who are already registered are required to accept the Terms and Conditions for creating a new single account, since they will no longer be able to use their previous account.
Registration: Personal data is collected when you create your single account on one of the web portals or apps provided for the purpose. Setting up a single account enables you to access all web portals and mobile apps of authorized Enel companies, using a single username and password.
Logging in after first registration: The reserved area can only be accessed using an Enel single account.
After setting up your Enel single account, some Personal Data may be made available to other Group companies authorized to use the single account, should the Customer wish to access to the respective reserved areas of the web portals and mobile apps. The data will be processed for the sole purpose of verifying the credentials of the Customer and allowing easy access, with no additional requirements, from any country in which an authorized Enel company is based.
Access to the Reserved Area of Enel X Italia is granted as follows:
- by setting up an account using this web portal, or other portals or mobile apps of Enel Group companies authorized to set up single accounts;
- by using the credentials provided by a social media network (known as “social login”), with particular reference to Facebook, Twitter and Google+ accounts.
c) Compliance with legal obligations, regulations and other requirements established by EU legislation.
d) The performance of market research and direct sales by Enel X Italia, including by telephone, for the placement of products or services, for commercial communications or marketing activities. These activities may be carried out by sending advertising, informative or promotional material or invitations using traditional methods (e.g. paper mail) or automated contact systems (e.g. SMS, email);
e) The performance of market research and direct sales by Enel Group companies, parent companies, subsidiaries, associates and commercial partners of Enel X Italia, including by telephone, for the placement of products or services, for commercial communications or marketing activities. These activities may be carried out by sending advertising, informative or promotional material or invitations using traditional methods (e.g. paper mail) or automated contact systems (e.g. SMS, email);
f) Enel X Italia and Enel Group companies, parent companies, subsidiaries, associates and commercial partners of Enel X Italia may undertake profiling activities based on consumption habits and personal data and information acquired by observing the use of the products or services offered, with a view to providing information about customized offers.
g) The transmission of “e-News” or similar newsletters, for the purpose of providing information and raising awareness on topics relating to electric mobility, charging and the sustainability associated therewith.
4. Nature of consent
For the purposes specified in points 3.d), 3.e) and 3.f), consent to the processing of personal data is optional and has no effect on the use of the app and the related service.
5. Location data
Certain app services use a technology that identifies the physical location of the user’s device by using data relating to the longitude and latitude at which the device is located, by means of the device’s native applications (“Location Data”). Location data is shared with the mapping service provider, Google, which converts the Location Data into a point on the map. The app uses this location on the map to provide the service requested by the user, e.g. to identify the position of the user’s device and its distance from the desired charging point in order to enable them to use the charging service and charging point booking service.
If the application is connected to the Internet and connected to the user’s account, the user agrees to Enel X Italia processing their location data according to the procedures and for the purposes described above. If a user deactivates the geolocation function, they will not be able to use the services described above.
6. Methods and rationale for processing, retention periods and protective measures
Data will be processed in accordance with the rationale applicable to the organisation and processing of Personal Data, including in relation to logs originating from access to and use of the services made available via the web, and connected with the purposes indicated above and, in any event, in such a way as to ensure the security and confidentiality of the data.
In the case of online transactions, processed data is protected by the use of appropriate technological solutions, both for the protection of connections and for the storage of financial data (credit card, IBAN, etc.). The personal data processed will be retained for the necessary time established for the specific purpose by the applicable legislation.
The Personal Data processed for the aforesaid aims will be retained in accordance with the principles of proportionality and necessity, and anyway until the aims of processing have been achieved.
Personal Data will normally be stored for as long as the Data Subject’s relationship with the Controller exists, without prejudice to requirements for the collection of outstanding debts and/or the management of data in the event of any disputes or complaints, such as for example those relating to invoices issued.
Personal Data will be automatically deleted 10 years after the termination of the contractual relationship, without prejudice to the possible preservation of said data where necessary for the management of ongoing legal actions and the fulfilment of specific legal obligations.
7. Categories of entities to which data may be disclosed
Enel X Italia may need to disclose Customers’ Personal Data to third parties, in Italy and abroad, including countries not belonging to the European Union, in order to fully execute the contract, fulfil legal obligations and carry out all activities connected with or instrumental to the use of the app and the related services. Data recipients may be employees, consultants, contractors, temporary workers and/or any other natural person, who carry out their activity based on instructions received from Enel X Italia, specifically designated as Persons Authorized to process personal data.
In addition, data recipients may be entities belonging to the following categories:
- public and private entities and authorities, and supervisory and control bodies for the fulfilment of obligations established by the law;
- entities that carry out tasks of a technical or organisational nature or provide support services on behalf of Enel X Italia;
- domestic and international external companies operating in the insurance industry or that provide financing, including deferred payment, to prevent and monitor the risk of delinquency, monitor fraud and protect credit, and entities that provide debt recovery services, including of an extrajudicial and judicial nature (law companies and/or firms), banks and factoring companies in the case of credit factoring;
- Enel Group companies, parent companies, subsidiaries and associates for administrative and accounting purposes relating to management and control, and partners of Enel X Italia, based in either national or foreign territory.
Entities falling into the categories set out above will process the data as independent data controllers or as Processors or Persons Authorized to process personal data, specifically designated by Enel X Italia. Where appropriate, Enel X Italia will issue appropriate operating instructions to Processors and to Persons Authorized to process personal data, aimed at adopting the appropriate security measures in order to guarantee the confidentiality, security and integrity of the data.
8. Transfer of Personal Data
Personal Data will be processed within the European Union and stored on servers located within the European Union. Said data may be processed in countries outside the European Union, on condition that an adequate level of protection is guaranteed and recognized by a specific adequacy decision of the European Commission. Any transfer of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate guarantees of a contractual or pactional nature are provided by the Controllers and Processors involved, including binding corporate rules and contractual clauses concerning data protection. The transfer of Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will be performed only if the data subject has explicitly consented or in the cases provided for by the GDPR and will be processed in the data subject’s interest. In these cases, Enel X Italia gives notice that, despite the fact that the Enel Group adopts operating instructions common to all the countries in which it operates, the transfer of Personal Data may be exposed to risks relating to the peculiarities of local laws regarding the processing of Personal Data.
If Enel X Italia’s services are accessed from an Enel single account outside the European Union, the Personal Data may be transferred to third countries in order to enable the said services to be used. In the absence of an adequacy decision or other appropriate measures aimed at protecting the above data, said data will be processed in the interest of the Customer and only in order to implement the contract or the required pre-contractual measures.
Cookies are used by websites to recognize users within a work session and are not used to collect their personal data, but only to facilitate browsing on the site and the correct use of the related services.
Cookies only collect anonymous data and have a limited duration. All information collected is used, for example, to monitor and analyse site usage, improve the functionality of the site and target the content and graphics more accurately in order to meet the needs of visitors. If the user refuses to accept cookies, the quality of the pages visited could be impaired.
Enel X Italia websites may host, by agreement with third parties, advertising messages that may contain cookies that belong to the third-party owner of the message. Enel X Italia does not control or have access to these cookies or to the content of these sites.
10. Rights of the data subject
Pursuant to articles 15 – 22 of the GDPR, with regard to the Personal Data processed, the data subject is entitled, where applicable, to:
a) access their data and request a copy of it;
b) request its rectification;
c) request its erasure;
d) obtain the restriction of its processing;
e) object to its processing;
f) receive their data in a structured, commonly used and machine-readable format, and transmit it without impediment to another data controller, where technically feasible.
For processing operations connected with the activities referred to in points 3.d), 3.e) and 3.f), the data subject may withdraw their consent at any time.
Data subjects may exercise their rights or withdraw their consent by sending an email to: firstname.lastname@example.org.
The data subject has the right to lodge a complaint with the competent authority for personal data protection by:
- registered letter with proof of receipt addressed to Garante per la protezione dei Dati Personali, Piazza Venezia, 11, 00187 Roma;
- email to the following address: email@example.com, or firstname.lastname@example.org;
- fax to: 06/69677.3785.
The full privacy practices are available at www.enelx.com
Document last updated in March 2020