4.3. The provision of your Personal Data is necessary in all instances in which processing is a legal requirement or necessary to the performance of a contract to which you are a party or to the implementation of pre-contractual measures adopted at your request. Any refusal on your behalf may make it impossible for Enel X to perform the task for which your Personal Data has been collected.
4.4. The provision of your Personal Data, however, is voluntary for any further purposes and failure to give your consent in such cases will have no effect on the completion of the contract. The obligatory or optional nature of the provision of data will be specified at the moment of its collection.
5. Marketing and/or Profiling Purposes
5.1. Through the appropriate forms, you may freely decide whether or not to consent to the use of your Personal Data and contact details also for market research, direct sales, including telephone sales, for the placement of products or services, for commercial communications or marketing activities relating to the products and/or services offered by Enel X or by other Companies in the Enel Group from time to time specifically identified in the data collection forms. Subject to your free and specific consent, for the purposes indicated above, your Personal Data may be processed by the Enel Group Companies identified, directly, as independent data controllers and/or by Enel X, as Data Processor, on their behalf.
5.2. The prior acquisition of your consent for the marketing purposes described above is not required when contact is made through telephone numbers (landline and/or mobile) and paper mail addresses belonging to subjects present in public telephone directories, in relation to which the regulations regarding the Registro Pubblico delle Opposizione (RPO) are applicable, allowing the processing of such contact data for those who have not exercised their right to oppose.
5.3. The acquisition of your consent for the purpose of "profiling" allows Enel X to process your Personal Data for profiling activities based on your consumption preferences and on the data and information acquired by the Data Controller through the purchase of its products or services also in order to receive offers specifically tailored to your needs. For the purpose of developing better services and products that correspond to your needs, Enel X may make use of partnerships with selected companies that integrate, on a statistical basis, census-type information relating to: personal preferences and interests, consumption preferences, economic and family situation, location or movements of the individual. In no case will your Personal Data be shared with third parties for profiling purposes.
5.4. The e-mail address provided by you as part of any contracts concluded with Enel Green Power may be used by the latter to send commercial offers relating to products and/or services similar to those previously purchased by you (so-called soft-spam). You may, however, at any time object to the processing of your Personal Data by sending a request to the dedicated mailbox referred to in paragraph 9 of this privacy policy.
5.5. Your personal and contact data may also be processed by Enel X in order to carry out, on the basis of its own legitimate interest and having first verified, with regard to each individual initiative, that the interests, rights or fundamental freedoms of the data subject do not prevail by means of a specific balancing test (Legitimate Interest Assessment), promotional activities for services and products offered by the Controller.
5.6. The processing of Personal Data for marketing purposes may be carried out using "traditional" methods (such as paper mail and/or operator calls), or through "automated" contact systems (such as SMS and/or MMS, phone calls without operator intervention, e-mail, fax, interactive applications).
5.7. Consent given by you for marketing purposes shall be understood to be given for both the methods indicated, without prejudice, however, to your right to object, even partially, in relation to the different communication channels through which the marketing purposes are carried out, in the manner indicated in paragraph 9 of this privacy policy.
5.8. Consent for marketing and profiling purposes is optional and does not prevent the possibility of benefiting from the products or services offered by Enel X. Any consent given may be withdrawn at any time by sending a written communication to the e-mail address indicated in paragraph 9 of this privacy policy.
6. Recipients of Personal Data
6.1. In order to pursue the purposes described in paragraph 4 of this Privacy policy, Enel X may need to communicate, in Italy and abroad, including countries not belonging to the European Union, its Personal Data to third parties, in order to execute the Contract, to fulfil legal obligations or to carry out activities instrumental to the provision of the requested services.
6.2. Your Personal Data may be made accessible for the abovementioned purposes, to:
a) to employees and contractors of Enel X, as persons authorised to process personal data;
b) the companies of the Enel Group in their capacity as autonomous data controllers or data processors as well as their employees and collaborators specifically appointed as Authorised Persons;
c) third party companies or other entities that carry out activities in outsourcing on behalf of the Data Controller, in their capacity as data processors, as well as their employees and associates specifically appointed as Authorised Persons.
6.3. Enel X provides instructions to the Data Processors and Authorised Persons, if any, for the adoption of adequate security measures in order to guarantee the confidentiality, security and integrity of the data.
7. Transfer of Personal Data
7.1. Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same Personal Data may be processed in countries outside the European Union, provided that an adequate level of protection is ensured, as recognized by the European Commission's adequacy decision.
7.2. Any transfer of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or pactual safeguards, including Binding Corporate Rules and standard contractual clauses, are provided by the data controllers and data processors involved.
7.3. The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be made where you have explicitly consented to it or in the cases provided for by the GDPR and will be processed in your interest. In these cases, we inform you that, although the Group adopts common operating instructions in all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local legislation on the processing of Personal Data.
8. Period of Retention of Personal Data
8.1. The Personal Data being processed for the above mentioned purposes will be conserved in observance of the principles of proportionality and necessity and, in any case, until the purposes of the processing have been achieved and in accordance with any legal obligations that may be provided for.
8.2. In case you have a contractual relationship with the Data Controller, Personal Data shall be stored and processed as long as there is such contractual relationship and, in any case, for a period of 10 years from the termination of the contractual relationship, after which they shall be deleted, without prejudice to the further storage of the same where necessary to comply with specific legal obligations, provisions of the Authority, for the collection of residual credits and for the management of disputes, complaints and legal actions.
8.3. Your free and specific consent is always required in order to process your Personal Data and contact details for market research, direct sales, including telephone sales, for the placement of products or services, for commercial communications or marketing activities relating to the products and/or services offered by Enel X or by other Companies in the Enel Group from time to time specifically identified in the data collection forms. Consent is optional. If you consent, your Data will be processed until the consent given is withdrawn.
8.4. Your free and specific consent is also required to process your Personal Data for profiling purposes by Enel X. Consent is optional. If you consent, your Data will be processed until the consent given is withdrawn.
9. Rights of the Data Subjects
9.1. Pursuant to articles 15 - 22 of the GDPR, in relation to the Personal Data communicated, you have the right, where applicable, to:
a) access and request a copy;
b) request any corrections;
c) request cancellation;
d) obtain limitations on the processing;
e) object to the processing;
f) receive such data in a structured, commonly used and machine-readable format and to transmit them without hindrance to another data controller; where technically feasible.
9.2. You also have the right not to be subjected to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of a contract with the Data Controller; b) is authorized by law or c) is based on explicit consent. In cases a) and c) you have the right to express your opinion, dispute the decision and obtain human intervention by the Controller.
9.3. We inform you that you have the right to object at any time to the processing of Personal Data that concern you that may be carried out on the basis of the legitimate interest of Enel Green Power. In this case, the Data Controller shall refrain from further processing your Personal Data, unless it demonstrates the existence of compelling legitimate reasons to proceed with the processing, or for the ascertainment, exercise or defense of legal claims.
9.4. We also inform you that you still have the right to object at any time to the processing of Personal Data concerning you carried out for marketing purposes, including profiling, insofar as it is related to such direct marketing. The right to object to such processing carried out through automated contact systems also extends to the processing of Personal Data through traditional contact methods, unless you wish to object only in part.
9.5. If you object to processing for marketing and profiling purposes, your Personal Data will no longer be processed for such purposes.
9.6. To exercise your rights and to withdraw your consent you may send a communication to the e-mail address: privacy.enelx@enel.com.
9.7. For further information regarding your Personal Data, you may contact the Data Protection Officer, who can be reached at the following e-mail address: dpo.enelx@enel.com.
9.8. Finally, we remind you that if you believe that the processing of your data has taken place in a manner that does not comply with European Regulation 679/2016 (GDPR), it is your right to lodge a complaint with the competent Supervisory Authority for the Protection of Personal Data. In Italy you can lodge your complaint before the Garante per la Protezione dei Dati Personali, by:
a) registered letter A/R addressed to Garante per la Protezione dei Dati Personali, Piazza Venezia, 11, 00187 Rome;
b) e-mail at: protocollo@gpdp.it, or protocollo@pec.gpdp.it.
