/apps/enel-x-digital-ecosystem/templates/page-content

Privacy

This Privacy Policy explains the methods for managing the personal data of users who consult the website of the Company Enel X Italia S.r.l. and is provided pursuant to Article 13 of EU Regulation 2016/679 ("GDPR").

 

1. Data Controller

Enel X Italia S.r.l., with registered office in Via Flaminia 970, 00189 - Rome, VAT number 15844561009 – PEC (certified mail): enelxitalia@pec.enel.it (hereinafter "Enel X Italia" or the "Controller" or the “Data Controller”), as Data Controller, will process your personal data provided through the site www.enelx.com (hereinafter "Site") in accordance with the provisions of the applicable legislation on the protection of personal data and this Privacy Policy.

 

2. Data Protection Officer (DPO)

 

2.1 Enel X Italia has appointed a Data Protection Officer (DPO) who can be contacted at the following email address: dpo.enelxitalia@enel.com.

 

3. Processing Subject and Methods

 

3.1 Enel X Italia will process the personal data communicated by you or legitimately obtained ("Personal Data"). In particular, the following Personal Data is processed:

 

- Common personal data, identification and contact data (e.g. name and surname; email address and telephone number): if you ask Enel X Italia questions by writing to the email addresses given on the Site or request information by filling in the appropriate forms, this Personal Data, together with the content of the message sent, will be used to respond to your request. The submission of further Personal Data is to be considered absolutely optional.

 

- Browsing data: the IT and telematics systems and software procedures used to operate and use the Site made available by Enel X Italia acquire, during their normal operation, certain data (e.g. date and time of access, pages visited, name of the Internet Service Provider and the Internet Protocol (IP) address through which the Site is accessed, the Internet address from which you connected to the Site, etc.), the transmission of which is implicit in the use of web communication protocols or is useful for better management and optimization of the system for sending data and e-mails.

- Data in the reserved area: Access to the reserved area of the Site is permitted only to business customers already registered through the Enel Unique ID (Profilo Unico). Domestic customers (so-called consumer customers) can instead register and access the reserved area through the site www. https://www.enelxstore.com/it/it.

 

In this regard it should be noted that, in general, at the time of creation of the Enel Unique ID, some Personal Data are required, such as name, surname, email address, cell phone number and tax code (the latter only for consumer customers) - so-called "registration data" - necessary to successfully complete the registration, access the reserved area and to use the services offered by the individual companies of the Enel Group participating in the Unique Profile. The registration data, as well as any data already in the availability of the Data Controller, having been acquired in the context of other contractual relationships with the same, are in no case subject to transfer to other companies of the Enel Group. Only registration data are also processed by the companies of the Enel Group that provide the authentication service, specifically appointed for this purpose as data processors (Enel Italia S.p.A. and Enel Global Services S.r.l.).

3.2 Processing of Personal Data for the purposes of this Privacy Policy means any operation or set of operations, carried out with the aid of automated processes and applied to Personal Data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making it available, comparison or interconnection, limitation, deletion or destruction.

 

3.3 We inform you that such Personal Data will be processed manually and/or with the support of computer or telematics means.

 

4. Purpose and Legal Basis of the Processing

 

4.1 Enel X Italia will process your Personal Data for the achievement of specific purposes and in the presence of an appropriate legal basis provided by the applicable law on the protection of Personal Data. Specifically, Enel X Italia will process your Personal Data only if one or more of the following legal bases apply:

 

- You have given your free, specific, informed, unambiguous and express consent to the processing;

 

- the processing is necessary for the performance of a contract to which you are a party or the execution of pre-contractual measures taken at your request;

 

- in the presence of a legitimate interest of Enel X Italia, provided that the interests or fundamental rights and freedoms of the data subject do not prevail;

 

- by virtue of a legal obligation with which Enel X Italia is required to comply.

 

4.2 The following table lists the purposes for which your Personal Data is processed by Enel X Italia and the legal basis on which the processing is based.

Purposes of the processing

Legal basis

To allow the use of all the functionalities of the Site.
Performance of a contract
To check the correct functioning of the Site.
Performance of a contract
Ascertaining responsibility in case of computer crimes against the Site

Legitimate interest

Legal obligation

 

Detection, prevention, mitigation and investigation of fraudulent or illegal activities in relation to the services provided on the Site
Legitimate interest

The carrying out, by Enel X Italia, of market research, direct sales, including telephone calls, for the placement of products or services, for commercial communications or marketing activities.

 

These activities may be carried out by sending advertising, informative, promotional material or invitations, using traditional methods (e.g. paper mail) or automated contact systems (e.g. SMS, e-mail)

Consent of the data subject

 

(optional)

 

Legitimate interest

 

The carrying out, by identified companies of the Enel Group ( such as Enel Energia S.p.a.; Enel X S.r.l.; Enel X Financial Services S.r.l.; Paytipper S.p.a.), of market research, direct sales, including telephone calls,for the placement of products or services, for commercial communications or marketing activities. 

 

These activities may be carried out by sending advertising, informative, promotional material or invitations, using traditional methods (e.g. paper mail) or automated contact systems (e.g. SMS, e-mail)

Consent of the data subject 

(optional)

 

To allow Enel X Italia to carry out profiling activities for itself by processing your personal data relating, for example, to your consumption preferences and/or your purchase choices for products or services offered by the Data Controller.  By evaluating your preferences, the Data Controller will be able to define individual and group profiles and also propose offers that specifically meet your needs

 

Consent of the data subject

 

(optional)

 

Sending commercial offers by e-mail about products and/or services similar to those previously purchased (so-called soft-spam).
Legitimate interest
Allowing access to the reserved area through the Enel Unique ID
Performance of a contract
Responding to a question or request made by the data subject also by filling out the forms available on the Site (so-called "Lead for contact")
Execution of pre-contractual measures adopted at the request of the data subject
Fulfillment of a request to subscribe to the Enel X Italia newsletter in order to be updated on the latest news in one or more of the sectors in which Enel X Italia operates
Execution of pre-contractual measures adopted at the request of the data subject
To offer commercial, technical and, more generally, customer care services

Execution of pre-contractual measures adopted at the request of the data subject

 

Performance of a contract

 

To allow Enel X Italia to fulfill its obligations under the law, regulations or Community legislation
Legal obligation
Control of the quality of the support services offered directly by Enel X Italia or by its suppliers, in order to verify the effectiveness of the support service and adequately direct the training actions of the persons authorized to process the personal data
Performance of a contract

4.3 The submission of your Personal Data is necessary in all cases in which the processing is carried out on the basis of a legal obligation or in order to execute a contract to which you are a party or for the implementation of pre-contractual measures taken at your request. In the latter cases, your refusal may make it impossible for Enel X Italia to process your request.

 

 4.4 The submission of your Personal Data is instead voluntary for the pursuit of further purposes indicated in the table and the lack of consent in relation to them will not however have any consequence on the conclusion of a possible contract. The obligatory or optional nature of consent will be specified at the time of collection of Personal Data.

 

5. Marketing and/or Profiling Purposes

 

 5.1 Through the appropriate forms, you may freely decide whether or not to consent to the use of your Personal Data and contact details also for market research, direct sales, including telephone sales, for the placement of products or services, for commercial communications or marketing activities relating to the products and/or services offered by Enel X Italia or by other Companies in the Enel Group from time to time specifically identified in the data collection forms. Subject to your free and specific consent, for the purposes indicated above, your Personal Data may be processed by the Enel Group Companies identified, directly, as independent data controllers and/or by Enel X Italia, as Data Processor, on their behalf.

 

5.2 The prior acquisition of your consent for the marketing purposes described above is not required when contact is made through telephone numbers (landline and/or mobile) and paper mail addresses belonging to subjects present in public telephone directories, in relation to which the regulations regarding the Registro Pubblico delle Opposizione (RPO) are applicable, allowing the processing of such contact data for those who have not exercised their right to oppose.

 

5.3 The acquisition of your consent for the purpose of "profiling" allows Enel X Italia to process your Personal Data for profiling activities based on your consumption preferences and on the data and information acquired by the Data Controller through the purchase of its products or services also in order to receive offers specifically tailored to your needs.

 

For the purpose of developing better services and products that correspond to your needs, Enel X Italia may make use of partnerships with selected companies that integrate, on a statistical basis, census-type information relating to: personal preferences and interests, consumption preferences, economic and family situation, location or movements of the individual. In no case will your Personal Data be shared with third parties for profiling purposes.

 

5.4 The e-mail address provided by you as part of any contracts concluded with Enel X Italia may be used by the latter to send commercial offers relating to products and/or services similar to those previously purchased by you (so-called soft-spam). You may, however, at any time object to the processing of your Personal Data by sending a request to the dedicated mailbox referred to in paragraph 10 of this privacy policy.

 

5.5 Your personal and contact data may also be processed by Enel X Italia in order to carry out, on the basis of its own legitimate interest and having first verified, with regard to each individual initiative, that the interests, rights or fundamental freedoms of the data subjcet do not prevail by means of a specific balancing test (Legitimate Interest Assessment), promotional activities for services and products offered by the Controller.

 

5.6 The processing of Personal Data for marketing purposes may be carried out using "traditional" methods (such as paper mail and/or operator calls), or through "automated" contact systems (such as SMS and/or MMS, phone calls without operator intervention, e-mail, fax, interactive applications).

 

5.7 Consent given by you for marketing purposes shall be understood to be given for both the methods indicated, without prejudice, however, to your right to object, even partially, in relation to the different communication channels through which the marketing purposes are carried out, in the manner indicated in paragraph 9 of this privacy policy.

 

5.8 Consent for marketing and profiling purposes is optional and does not prevent the possibility of benefiting from the products or services offered by Enel X Italia. Any consent given may be revoked at any time by sending a written communication to the e-mail address indicated in paragraph 10 of this privacy policy. 

 

6. Unique Profile: Registration and Access to the Reserved Area

 

6.1 Access to the reserved area is possible only through the Enel Unique ID. Users who were already registered for the digital services of the Enel Group Companies participating in the Unique Profile service before the creation of the Unique Profile itself, in order to continue to access the reserved area, must accept the Terms and Conditions for the creation of the Unique Profile.

 

Please note that it is not possible to access the service with access credentials generated before September 9, 2019, the date on which the Unique Profile was introduced.

 

6.2 First Registration: Personal registration data is collected at the time you create your Unique Profile on one of the web portals or mobile apps that provide registration functionality. The creation of the Unique Profile allows you to access, through a single username and password, the reserved area of the adhering web portals and mobile App of the Enel Group companies.

 

6.3 Access after Registration: Access to the reserved area is possible only through the Enel Unique ID. For authentication purposes, the Unique Profile system receives the encrypted credentials entered by the user for their verification and validation. Your Personal Data will therefore be processed for the sole purpose of verifying these credentials and allowing you to access them in a simple manner and without further charges from any country in which an authorized Enel Group company is present. It is understood that such data, for the purposes of access to the reserved area, are not in any case made available to other Enel Group companies authorized to use the Unique Profile.

 

6.4 Access to the reserved area is permitted by the following means:

 

a) Through portals or mobile App of the Enel Group Companies authorized to use the Unique Profile;

 

b) Through the use of credentials chosen for the identity created on social networks (so-called "social login"), such as the identities created using Apple ID, Facebook and Google, when the option is available. Following acceptance of the terms and conditions of the service, a Unique Profile will still be associated with the user.

 

In the event that you decide to access the reserved area using the credentials of a social network, Enel X Italia shall acquire your Personal Data (First Name, Last Name, Email) in accordance with the authorizations you have issued to the social network of reference. You are therefore required to verify the settings provided by the social network of reference, as well as to carefully read the relevant privacy policy. You may, however, at any time, update or modify any information acquired through the social login.

 

Enel X Italia will retain the identification code associated with your account with the social network service of reference when you use it to log in to Enel X Italia or to share content hosted on the Site; this will be retained for as long as necessary to provide the services requested. In any case, Enel X Italia will have no knowledge of the credentials you use to press the social network.

 

7. Recipients of Personal Data

 

For the pursuit of the purposes set out in paragraph 4 of this Privacy Policy, Enel X Italia may need to communicate, in Italy and abroad, including countries outside the European Union, your Personal Data to third parties, in order to execute the Contract, to fulfill legal obligations or to carry out activities instrumental to the provision of the services requested.

 

Your Personal Data may be made available, for the purposes mentioned above:

 

 

a) to the employees and collaborators of Enel X Italia, specifically appointed Persons Authorized to the processing;

 

b) to the companies of Enel Group present on the territory of the European Union in their capacity as autonomous data controllers or data processors as well as to their employees and collaborators specifically appointed as Persons Authorized to the processing;

 

c) to third party companies or other subjects that carry out certain activities in outsourcing on behalf of Enel X Italia, in their capacity as data processors as well as their employees and collaborators specifically appointed as Persons Authorized to the Processing.

 

These parties will process your Personal Data, for example, as part of:

  • customer communication management activities;

  • customer care services;

  • market research, direct sales, including telephone sales, for the placement of products or services, for commercial communications, marketing and profiling activities by Enel X Italy (if you have freely consented).

     

d) to institutions, public and private authorities, supervisory and control bodies;

 

e) to companies that are joint data controllers, if any, that jointly determine the purposes and means of processing with Enel X Italia.

 

8. Transfer of Personal Data

 

8.1 Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, as recognized by a specific adequacy decision of the European Commission.

 

8.2 Possible transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or covenant-based guarantees are provided by the data controllers and data processors  involved, including binding corporate rules and standard contractual data protection clauses.

 

8.3 The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be made where you have explicitly consented to it or in the cases provided for in the GDPR and will be processed in your interest. In these cases, we inform you that, although the Enel Group adopts operating instructions common to all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local legislation on the processing of Personal Data.

 

9. Personal Data retention period 

 

9.1.  Personal Data processed for the purposes described in this privacy policy will be kept in accordance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued and in accordance with any legal obligations that may apply.

 

9.2 Personal Data shall be stored and processed as long as there is a contractual relationship with the Data Controller and, in any case, for a period of 10 years from the termination of the contractual relationship, after which they shall be deleted, without prejudice to the further storage of the same where necessary to comply with specific legal obligations, provisions of the Authority, for the collection of residual credits and for the management of disputes, complaints and legal actions.

 

9.3 Your free and specific consent is always required in order to process your Personal Data and contact details for market research, direct sales, including telephone sales, for the placement of products or services, for commercial communications or marketing activities relating to the products and/or services offered by Enel X Italia or by other Companies in the Enel Group from time to time specifically identified in the data collection forms. Consent is optional. If you consent, your Data will be processed until the consent given is withdrawn.

 

9.4 Your free and specific consent is also required to process your Personal Data for profiling purposes by Enel X Italia. Consent is optional. If you consent, your Data will be processed until the consent given is withdrawn. 

 

10. Rights of Data Subjects 

 

10.1 Pursuant to articles 15 - 22 of the GDPR, in relation to the Personal Data communicated, you have the right, where applicable, to:

 

a) Access and request a copy;

 

b) Request any corrections;

 

c) Request its deletion ;

 

d) Obtain a restriction of processing;

 

e) Object to the processing;

 

f) Receive such data in a structured, comprehensive, and machine-readable format and to transmit them without hindrance to another data controller; where technically feasible.

 

10.2 You also have the right not to be subjected to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of a contract with the Data Controller; b) authorized by law or c) based on explicit consent. In cases a) and c) you have the right to express your opinion, dispute the decision and obtain human intervention by the Controller.

 

10.3 We inform you that you have the right to object at any time to the processing of Personal Data that concern you that may be carried out on the basis of the legitimate interest of Enel X Italia. In this case, the Data Controller shall refrain from further processing your Personal Data, unless it demonstrates the existence of compelling legitimate reasons to proceed with the processing, or for the ascertainment, exercise or defense of legal claims.

 

We also inform you that you still have the right to object at any time to the processing of Personal Data concerning you carried out for marketing purposes, including profiling, insofar as it is related to such direct marketing. The right to object to such processing carried out through automated contact systems also extends to the processing of Personal Data through traditional contact methods, unless you wish to object only in part.

 

 If you object to processing for marketing and profiling purposes, your Personal Data will no longer be processed for such purposes.

 

10.4 To exercise your rights and to withdraw your consent you may send a communication to the email address: privacy.enelxitalia@enel.com.

 

10.5 For further information regarding your Personal Data you may contact the Data Protection Officer, who can be reached at the following e-mail address: dpo.enelxitalia@enel.com.

 

10.6 Finally, we remind you that if you believe that the processing of your data has taken place in a manner that does not comply with European Regulation 2016/679 (GDPR), it is your right to lodge a complaint with the Supervisory Authority for the Protection of Personal Data, by:

 

a) Registered letter A/R addressed to Garante per la Protezione dei Dati Personali, Piazza Venezia, 11, 00187 Rome;

 

b) E-mail: protocollo@gpdp.it, or protocollo@pec.gpdp.it;

 

c) Fax: 06/69677.3785.

 

Information notice updated as of September 2021.