This Privacy policy illustrates the methods of management of the personal data of the users of the enelxway.it website (hereinafter the "Site") and of the personal data that may be subject to processing by Enel X Way S.r.l.

The information is provided pursuant to Article 13 of the EU Regulation 2016/679 ("GDPR").

1. Data Controller

Enel X Way S.r.l., with registered office at Via Ostiense 131/L – 00154 Rome RM, Group VAT No. 15844561009, – PEC enelxway@pec.enel.it (hereinafter, “Enel X Way” or the “Controller”), in its quality of Data Controller, will process your personal data provided through the Site in accordance with the provisions of the applicable Personal Data Protection legislation and this Privacy policy.

2. Data Protection Officer (DPO)

Enel X Way has appointed a Data Protection Officer (DPO) who can be contacted at the following email address: dpo.enelxway@enel.com.

3. Processing Purpose and Method

3.1 Enel X Way will process the personal data communicated by you or however legitimately obtained (hereinafter, the "Personal Data") in order to pursue the purposes for which they have been conferred, as the case may be. In particular, Enel X Way will process the following types of Personal Data:

• Common, Personal and Contact Data (e.g., name and surname; email address): it is specified that, should you ask Enel X Way questions by writing to the email addresses reported on the Site and/or request information by filling in the appropriate forms, such Personal Data, together with the content of the sent message, will be used to provide a reply to your request and/or, to contact you for the purpose of managing your request. The provision of further Personal Data is absolutely optional;
• Browsing data: the IT and telematic systems and software procedures used for the functioning and use of the Site made available by Enel X Way, acquire, during their normal operation, certain data (e.g., the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, the Internet address from which you connected to our Site, etc.), whose transmission is implicit in the use of web communication protocols or is useful for the better management and optimization of the data transmission and e-mail system.;
• Data acquired by Customer Service: data provided during interactions with Enel X Way Customer Service, including call recordings made to verify the quality of the provided service or in compliance with a legal obligation;
• Navigation Data: the computer and telematic systems and software procedures used for the operation and use of the Website made available by Enel X Way acquire, during their normal operation, certain data (e.g., date and time of access, pages visited, the name of the Internet Service Provider, and the Internet Protocol (IP) address through which you access the Internet, the Internet address from which you connected to the Website, etc.). The transmission of this data is implicit in the use of web communication protocols or is useful for the proper management and optimization of the data and email transmission system;

3.2 For the purposes of this privacy policy, the processing of Personal Data means any operation or series of operations carried out on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3.3 Please note that such Personal Data will be processed manually and/or with the support of IT or data transmission devices.

4. Processing Purpose and Legal Basis 

4.1 Enel X Way will process your Personal Data for the achievement of specific purposes and only when there is an appropriate legal basis provided by the applicable data protection law. Specifically, Enel X Way will process your Personal Data only when one or more of the following legal bases apply:

• free, specific, informed, unambiguous and express consent to the processing;
• performance of a contract to which you are party or the execution of pre-contractual measures adopted at your request;
• legitimate interest of Enel X Way, unless the interests or fundamental rights and freedoms of the data subject prevail;
• legal obligation to process Personal Data to which Enel X Way is bound.

4.2 The following table lists the purposes for which your Personal Data are processed by Enel X Way and the legal basis on which the processing is based.

4.3 The provision of your Personal Data is necessary in all cases where the processing is carried out on the basis of a legal obligation or in order to perform a contract to which you are a party or the execution of pre-contractual measures adopted at your request. Your refusal to provide your Personal Data may make it impossible for Enel X Way to process your request.

4.4 The provision of your Personal Data is voluntary for the pursuit of additional purposes, and the failure to provide your consent in relation to them will have no consequences on the conclusion of the contract. The mandatory or optional nature of the provision will be specified at the time of collection.

5. Marketing and/or Profiling purposes

5.1. The email address provided by you in the context of any contracts concluded with Enel X Way may be used by the latter for sending commercial offers related to products and/or services similar to those previously purchased by you (so-called soft-spam). However, you may oppose the processing of your Personal Data at any time by sending a request to the dedicated email address indicated in paragraph 9 of this Privacy Policy.

5.2. You are free to decide whether to consent to the use of your Personal Data, identification, and contact information for market research, direct sales, product or service placement, commercial communications, or marketing activities related to products and/or services offered by Enel X Way or by other specifically identified companies within the Enel Group. With your free and specific consent, for the purposes mentioned above, your Personal Data may be processed by the identified Enel Group companies, directly, as autonomous data controllers and/or by Enel X Way, as the data processor, on their behalf.

5.3. Prior consent for marketing purposes as described above is not required when the contact occurs through phone numbers (landline and/or mobile) and postal addresses belonging to individuals listed in public telephone directories, for which the regulations on the Public Register of Oppositions apply, allowing the processing of such contact data for those who have not exercised the right to object.

5.4. Your identification and contact data may also be processed by Enel X Way for conducting, based on its legitimate interest and after verifying, with respect to each individual initiative, that the interests, rights, or fundamental freedoms of the data subject do not prevail through an appropriate balancing test (Legitimate Interest Assessment), promotional activities for services and products offered by the Data Controller.

5.5. Obtaining your consent for the purpose of "profiling" allows Enel X Way to process your data for profiling activities based on your consumption preferences and the data and information acquired by the Data Controller through the purchase of its products or services, with the aim of providing you with offers specifically tailored to your needs.

For the study of better services and products that meet your needs, Enel X Way may collaborate with selected companies that statistically integrate census-type information related to: personal preferences and interests, consumption preferences, economic and family situation, physical location or movements. Under no circumstances will your personal data be shared with third parties for profiling purposes. 

5.6. The processing of Personal Data for marketing purposes may be carried out through "traditional" methods (such as postal mail and/or operator-assisted calls) or through "automated" contact systems (for example, SMS and/or MMS, unsolicited phone calls, email, fax, interactive application.

5.7. The consent you provide for marketing purposes will be considered valid for both of the mentioned methods, and you still retain the right to object, even partially, to the different communication channels through which marketing purposes are realized, as indicated in paragraph 9 of this Privacy Policy.

5.8. The consent for marketing and profiling purposes is optional and does not prevent you from enjoying the products or services offered by Enel X Way. Any consent given can be withdrawn at any time by sending a written communication to the email address indicated in paragraph 9 of this Privacy Policy.

6.  Recipients of Personal Data

For the purposes outlined in paragraph 4 of this Privacy Policy, Enel X Way may need to disclose your Personal Data to third parties in Italy and abroad, including countries outside the European Union, to fulfill the Contract, comply with legal obligations, or carry out activities instrumental to the provision of requested services.

Your Personal Data may be made accessible, for the aforementioned purposes, to:  

a) Employees and collaborators of Enel X Way, specifically designated as Authorized Persons for processing;

b) Enel Group companies located within the territory of the European Union, acting as autonomous data controllers or data processors, and their employees and collaborators specifically designated as Authorized Persons for processing;

c) Third-party companies or other entities that perform certain activities on behalf of the Data Controller as data processors, as well as their employees and collaborators specifically designated as Authorized Persons for processing.

Enel X Way provides instructions to the Data Processors and Authorized Persons, if designated, aimed at adopting adequate security measures to ensure the confidentiality, security, and integrity of the data.

7. Transfer of Personal Data

7.1. Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same Personal Data may be processed in countries outside the European Union, provided that an adequate level of protection is ensured, as recognized by the European Commission's adequacy decision.

7.2. Any transfer of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or pactual safeguards, including Binding Corporate Rules and standard contractual clauses, are provided by the data controllers and data processors involved.

7.3. The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be made where you have explicitly consented to it or in the cases provided for by the GDPR and will be processed in your interest. In these cases, we inform you that, although the Group adopts common operating instructions in all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local legislation on the processing of Personal Data.

8.   Period of Retention of Personal Data

8.1. The Personal Data being processed for the abovementioned purposes will be conserved in observance of the principles of proportionality and necessity and, in any case, until the purposes of the processing have been achieved and in accordance with any legal obligations that may be provided for.

8.2. In the event of a contractual relationship with the Data Controller, your Personal Data shall be stored and processed for the entire duration of the contractual relationship and in any case for a period of 10 years from the termination of the contractual relationship, after which they shall be deleted, without prejudice to further storage of the same where necessary to comply with specific legal obligations, provisions of the Authority, for the collection of residual credits and for the management of disputes, complaints and legal actions.

9.   Data Subject Rights

9.1. Pursuant to Articles 15 to 22 of the GDPR, in relation to the Personal Data provided, you have the right to:

a)   access them and request a copy;

b)   request amendment;

c)   request cancellation;

d)   obtain processing limitation;

e)   oppose processing;

f)    receive your data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance, where technically feasible.

9.2. We hereby inform you that you have the right not to be subject to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of a contract with the Controller; b) is authorised by law; or c) is based on explicit consent. In cases a) and c) you have the right to express your opinion, contest the decision and obtain human intervention by the Controller.

9.3. We inform you that you have in any case the right to object at any time to the processing of Personal Data concerning you that may be carried out on the basis of Enel X Way's legitimate interest. In this case, the Controller will refrain from further processing your Personal Data, unless he/she demonstrates the existence of compelling legitimate reasons to proceed with the processing, or for the establishment, exercise or defence of a legal claim.

9.4. In order to exercise your rights and to withdraw your consent, you may send a communication to the following e-mail address: enelxway.italy.privacy@enel.com.

9.5. For further information on your Personal Data, you may contact the Data Protection Officer, who can be reached at the following dedicated e-mail address: dpo.enelxway@enel.com.

9.6. Finally, we remind you that if you believe that the processing of your data has not been carried out in accordance with the European Regulation 679/2016 (GDPR), you have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) by:

a)   by registered mail with return receipt addressed to: Garante per la protezione dei dati personali, Piazza Venezia, 11 - 00187 Roma;

b)   by e-mail to: protocollo@pec.gpdp.it. or by registered e-mail to: protocollo@pec.gpdp.it;