This Privacy Notice describes how the personal data of users who create a digital identity (the so-called “Single Profile”) in order to access the App and the restricted areas of the Enel X S.r.l. portals, as well as those of other Enel Group companies enabled for the “Single Profile”, are processed.

This Notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”).

 

1. Data Controller

Enel X S.r.l., with registered office at Viale Tor di Quinto 45/47 – 00191 Rome, Italy, Group VAT No. 09945270966, certified email (PEC) enelx@pec.enel.it (hereinafter “Enel X” or the “Controller”), in its capacity as Data Controller, processes your personal data in accordance with applicable data protection laws and this Privacy Notice.

 

2. Data Protection Officer (DPO)

Enel X has appointed a Data Protection Officer (DPO), who can be contacted at: dpo.enelx@enel.com

 

3. Scope and Methods of Processing

3.1 Enel X processes the personal data you provide when creating your digital identity (“Personal Data”). In particular, when creating the Enel Single Profile, certain Personal Data are required, including first name, last name, email address, mobile phone number, and tax code (the latter only for consumer customers) (the “Registration Data”).

Such data are necessary to complete registration, access the App, and use the services provided by the Enel Group companies participating in the Single Profile.

Registration Data, as well as any data already held by the Controller in the context of existing contractual relationships, are not shared with other Enel Group companies. Registration Data are processed solely by Enel Group companies providing authentication services, duly appointed as data processors (Enel Global Services S.r.l.).

3.2 For the purposes of this Notice, “processing” means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure, or destruction.

3.3 Personal Data are processed both manually and by electronic or telematic means.

 

4. Purposes and Legal Basis of Processing

4.1 Enel X processes your Personal Data to enable you to register and access the App via the “Single Profile”, for the performance of a contract. Provision of such data is mandatory; failure to provide it will make registration and access impossible.

4.2 First Registration
Registration Data are collected when the Single Profile is created via a website or mobile App offering registration functionality. The Single Profile allows access, using a single username and password, to restricted areas of websites and mobile Apps of participating Enel Group companies.

Users already registered with Enel Group digital services prior to the introduction of the Single Profile must accept the relevant Terms and Conditions in order to continue accessing the App.

Please note that credentials created before 9 September 2019 are no longer valid.

4.3 Subsequent Access
Access to the App is only possible through the Enel Single Profile. For authentication purposes, the system processes encrypted credentials entered by the user solely to verify and validate access.

Your Personal Data are processed exclusively for authentication purposes and to enable seamless access from any country where participating Enel Group companies operate. Such data are not disclosed to other companies for access purposes.

4.4 Access Methods

Access to Enel X services is available through:

a) the App, after creating a Single Profile;
b) social login (e.g. Apple ID, Facebook, Google), where available.

Where you choose social login, Enel X will collect certain Personal Data (name, surname, email address) in accordance with the permissions you have granted to the relevant social network. You are encouraged to review the privacy settings and policies of such platforms.

Enel X will store the identifier associated with your social account for as long as necessary to provide the requested services. Under no circumstances will Enel X have access to your social login credentials.

 

5. Recipients of Personal Data

Your Personal Data may be made accessible, for the purposes described above, to:

a) employees and collaborators of Enel X duly authorised to process data;
b) Enel Group companies providing authentication services (Enel Global Services S.r.l.), as well as third-party service providers acting as data processors;
c) public or private entities, authorities, and supervisory bodies.

 

6. Transfer of Personal Data

6.1 Personal Data are processed within the European Union and stored on servers located within the EU. They may also be processed in countries outside the EU, provided that an adequate level of protection is ensured by a European Commission adequacy decision.

6.2 In the absence of an adequacy decision, transfers will only take place where appropriate safeguards are in place, such as Binding Corporate Rules or standard contractual clauses.

6.3 Transfers to third countries lacking adequate safeguards will occur only with your explicit consent or where permitted by the GDPR. In such cases, transfers may entail risks due to local legislation.

 

7. Data Retention

7.1 Personal Data are retained in accordance with the principles of proportionality and necessity, and in compliance with applicable legal obligations, for no longer than necessary to fulfil the purposes for which they were collected.

7.2 If the Single Profile is not used, Registration Data will be deleted after 5 years from the date of the last access.

 

8. Data Subject Rights

8.1 Pursuant to Articles 15–22 GDPR, you have the right to:

  • access your Personal Data and obtain a copy;

  • request rectification;

  • request erasure;

  • request restriction of processing;

  • object to processing;

  • receive your data in a structured, commonly used, machine-readable format and transmit them to another controller, where technically feasible.

8.2 You also have the right not to be subject to decisions based solely on automated processing, except where necessary for a contract, authorised by law, or based on your explicit consent. In such cases, you have the right to obtain human intervention and to contest the decision.

8.3 To exercise your rights or withdraw any consent given for marketing and/or profiling purposes, please contact: privacy.enelx@enel.com.

8.4 For further information, you may contact the Data Protection Officer at: dpo.enelx@enel.com.

8.5 You also have the right to lodge a complaint with the Italian Data Protection Authority:

 

 

 

Privacy Notice last updated: January 2023