1. Controller and Manager of the Processing of Personal Data

1.1. Any personal data provided or collected through operations carried out on www.enelx.com  (hereinafter the "Site") will be processed by:

Enel X s.r.l., with registered office in Rome, Viale Tor di Quinto 45/47, VAT no. 15844561009;

Enel X Italia S.p.A. with registered office in Rome, Viale Tor di Quinto 45/47, VAT no. 15844561009;

Enel X Mobility S.r.l. with registered office in Rome, Viale Tor di Quinto 45/47, VAT no. 15844561009

ENEL SOLE S.r.l. with registered office in Rome, Via Flaminia 970, VAT no. 0 15844561009

Enel X International S.r.l. with registered office in Rome, Viale Tor di Quinto 45/47, VAT no. 15844561009

Athonet S.r.l. with registered office in Trieste, Via Padriciano 99, Area Science Park, VAT no. 1067590321

I-EM S.r.l. with registered office in Turin, Corso Ferrucci 77/9, VAT no. 10835280016

Activation Energy Limited with registered office in Dublin, 70 Sir John Rogerson's Quay, VAT no. 95810340

EnerNOC GmbH with registered office in Darmstadt, Berliner Allee 65, VAT no. HR 02249838

EnerNOC Ireland Holding Limited with registered office in Dublin, 70 Sir John Rogerson's Quay

EnerNOC Ireland Limited with registered office in Dublin, 70 Sir John Rogerson's Quay

EnerNOC Polska Sp. Z.o.o. Province (Wojewòdztwo): MAZOVIAN, County (Powiat): Warsaw, District (Gmina): Warsaw, Town/City: Warsaw VAT no. 5252701584

EnerNOC UK II Limited - 360-364 City Road, London, EC1V 2PY United Kingdom VAT no. 752076437

EnerNOC UK Limited - 360-364 City Road, London, EC1V 2PY United Kingdom VAT no. 680 31116 23228

JuiceNet GmbH Sonnerburger St 73, Berlin

JuiceNet Ltd 160 City Road, London, EC1V 2NX

Enel Energie SA Registered Office: Bucharest, District 1, 41-43 Ion Mihalace Blvd., building A, Trade Register Registration Number: J40/12303/26.06.2007

Unique Registration Code: 22000460

The operator Enel Energie S.A. is registered under number 10583 in the ANSPDCP register for monitoring the processing of personal data.

Enel Energie Muntenia SA

Registered Office: Bucharest, District 1, 41-43 Ion Mihalace Blvd., building A

Trade Register Registration Number: J40/14506/2008

Unique Registration Code: 24387371

The operator Enel Energie Muntenia S.A. is registered under number 10585 in the ANSPDCP register for monitoring the processing of personal data.

Enel Romania SRL

Registered Office: Buftea, Calea Bucuresti-Targovişte, nr. 117, Jud. Ilfov

Trade Register Registration Number : J23/1964/20.06.2007

Unique Registration Code: 17043219

E-Distributie Banat SA

Registered Office: Timisoara, 3-5 Pestalozzi Street, Timis County

Trade Register Registration Number: J35/274/04.03.2002

Unique Registration Code: 14490379

E-Distributie Dobrogea SA

Registered Office: Constanta, 89A Nicolae Iorga Street, Constanta County

Trade Register Registration Number: J13/791/06.03.2002

Unique Registration Code: 14500308

ENDESA ENERGÍA SA, Single-shareholder Company

Registered address: Calle Ribera del Loira Número 60 Madrid- 28042

Registered at the Commercial Registry of Madrid: Volume 12797, Page 208, Sheet number M-205381

Tax identification number: A-81948077

(hereinafter the "Controller"), as independent Data Controllers, will process your personal data in accordance with the provisions of the applicable legislation on privacy and the protection of personal data and this policy.

1.2.  When registering for various services or accessing them, the names of any other data controllers and managers will be communicated.

2. Data Protection Officer (DPO)

The Data Controller has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address: dpo.enelx@enel.com

3. Processing Subject and Methods

3.1. The Controller will process the personal data you have communicated or it has legitimately obtained from the Controller ("Personal Data"). In particular, the following Personal Data is processed:

3.1.1. Contact details: name, surname, e-mail address, telephone number and the content of the message you have sent, and other Personal Data that may have been provided to us during communications. We will process this Personal Data if you ask us questions, request information or send us communications of various kinds.

3.1.2. Browsing data: the IT and telematic systems and software procedures used to operate the Site acquire, during their normal operation, certain data (e.g. the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, the Internet address from which you connected to our Site, etc.), whose transmission is implicit in the use of web communication protocols or is useful for the better management and optimisation of the data transmission and e-mail system.

3.2. For the purposes of this policy, the Processing of Personal Data is intended as any operation or set of operations performed with the aid of automated processes and applied to Personal Data, such as the collection, registration, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.

3.3. We inform you that this Personal Data will be processed manually and/or with the aid of computerised and/or telematic means.

4. Purpose and legal basis of the processing

4.1. The Controller will process your Personal Data for the achievement of specific purposes and only in the presence of a specific legal basis provided for by the applicable law on privacy and protection of personal data. Specifically, the Controller will process your Personal Data only when one or more of the following legal bases occurs:

• you have given your free, specific, informed, unequivocal and express consent to the processing;
• the processing is necessary for the execution of a contract of which you are a party or for the execution of pre-contractual measures adopted at your request;
• in the presence of a legitimate interest of the Controller;
• the Controller is bound by a legal obligation to process Personal Data.

4.2. The following table lists the purposes for which your Personal Data is processed by the Data Controller and the legal basis of such processing.

4.3. The provision of your Personal Data is necessary in all cases where processing is carried out on the basis of a legal obligation or to execute a contract of which you are a party or due to the implementation of pre-contractual measures taken at your request. Your eventual refusal could entail the Controller's impossibility to proceed with the purpose for which the Personal Data is collected.

4.4. The provision of your Personal Data is voluntary for the pursuit of additional purposes and the failure to provide your consent in relation to them will have no consequences on the conclusion of the contract. The mandatory or optional nature of the provision will be specified at the time of collection.

5. Recipients of Personal Data

5.1. Your Personal Data may be made accessible for the purposes mentioned above:

a) to the employees and collaborators of the Controller, appointed for this purpose, or to the companies of the Enel Group present in the European Union for the performance of organisational, administrative, financial and accounting activities;

b) to third-party companies or other entities that carry out outsourced activities on behalf of the Controller to enable the Site to operate, as external data controllers.

6.  Transfer of Personal Data

6.1 Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognized by a specific adequacy decision of the European Commission.

Any transfers of Personal Data to non-EU countries, in the absence of a European Commission adequacy decision, will only be possible if Data Controllers and Data Processors involved provide adequate guarantees of contractual nature, including Binding Corporate Rules and Standard Contractual Clauses.

The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will be made only if you have explicitly consented to it or in the cases provided for by the GDPR and will be processed in your interest. In these cases, we inform you that, although the Enel Group adopts operating instructions common to all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local legislation regarding the processing of Personal Data.

7. Personal Data retention period

7.1.  The Personal Data processed for the purposes set out above will be kept in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued.

8. Rights of Data Subjects

8.1.  In accordance with articles 15 - 21 of EU Regulation 2016/679 (GDPR), in relation to the Personal Data communicated, you have the right to:

a) access and request a copy;

b) request its correction;

c) request its deletion;

d) obtain a restriction of processing;

e)  object to the processing;

f) receive data in a structured format, commonly used and readable by an automatic device and transmit them to another data controller, where technically feasible, without any impediment.

8.2. We inform you that you have the right to object to the processing of Personal Data concerning you at any time, on the basis of the legitimate interest of the Controller.

8.3. If you object to the processing of your Personal Data as indicated in article 8.2, the Controller will refrain from any further processing of your Personal Data, unless it demonstrates the existence of binding legitimate reasons to proceed with the processing, or for the for the establishment, exercise or defence of a right in court.

8.4. To exercise your rights and withdraw your consent, you can send a communication to the e-mail address privacy.enelx@enel.com.

8.5. For further information regarding your Personal Data, you can contact the Personal Data Protection Officer of Enel, who can be reached at the following e-mail address: dpo.eneltx@enel.com, indicating in the subject "[Privacy]".

8.6. We remind you that it is your right to lodge a complaint before the competent authority for the protection of personal data.

8.7.  If the Personal Data Protection Authority is brought to court, you may lodge a complaint by:

a) registered return receipt mail addressed to the Authority for the Protection of Personal Data, Piazza di Monte Citorio, 121 00186 Rome;

b) e-mail to: garante@gpdp.it, or protocollo@pec.gpdp.it;

c)  fax to the number: +39 06/69677.3785.