Privacy Policy

1. Data controller and Data processor of Personal Data

Enel Global Trading S.p.A. Company which has its legal headquarter at 00198 Rome, viale Regina Margherita 125 - Register of Companies of Rome, Tax Code 05918271007 VAT No. 15844561009 and Economic and Administrative Index (REA) No. 936646, (hereinafter, “Enel Global Trading ” or the “Controller”), in its capacity as Data controller, will process your personal data delivered by means of the site globaltrading.enel.com (hereinafter “Site”) in compliance with the provisions of the governing law on privacy and protection of personal data and the present disclosure.

1.1. The names of further possible data controllers and processors of personal data will be communicated while subscribing or accessing the various services.

2. Data Protection Officer (DPO)

The controller has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address: dpo.eneltrade@enel.com.

3. Purpose and Method for data processing

3.1. Enel Global Trading will process the personal data you provided or legitimately found by the Controller ("Personal data"). In particular, the following Personal Data will be processed:

3.1.1. Contact data: the e-mail address and the content of the message you sent if you intend to ask questions to Enel Global Trading by writing to the e-mail addresses indicated on the Site. The processing of these data is necessary in order to provide feedback to the communication received. The grant of further data is to be considered absolutely as an optional.

3.1.2. Navigation data: IT and telematic systems and the software procedures responsible for the operation of the Site acquire, in the normal course of operation, some data (e.g., the access data and time, the visited pages, the name of the Internet Service Provider and the address of the Internet Protocol (IP) through which you access Internet, the Internet address from which you connected to our Site, etc.) whose transmission is implied in the use of the web communication protocols or is useful for improved management and optimization of the data and e-mail sending system.

3.2. The processing of Personal Data for the purposes of this disclosure implies any operation or set of operations, performed upon and applied on Personal Data by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by supply, dissemination or otherwise making available, alignment or combination, blocking, deletion or destruction.

3.3. We inform you that these Personal Data will be processed manually and/or with the aid of computerised and/or telematic means.

4. Purposes and legal basis for processing

4.1. Enel Global Trading will process your Personal Data in the pursuit of specific purposes and only in the presence of a specific legal basis provided for by the applicable law on privacy and protection of personal data. Specifically, Enel Global Trading will process your Personal Data only when one or more of the following legal basis occurs:

you gave your free, specific, informed, unambiguous and expressed consent to the processing;
the processing is necessary for the performance of a contract of which you are a party or for the performance of pre-contractual measures taken at your request;
in the presence of a legitimate interest of Enel Global Trading;
Enel Global Trading is bound by a legal obligation to process Personal Data.

4.2. The following table lists the purposes for which your Personal Data are processed by the Controller and the legal basis on which the processing is based.

Purposes for processing	Legal basis
To allow the use of all the functions of the site.	Performance of a contract
To check the site for proper operation.	Performance of a contract
In order to ascertain the responsibility in the event of computer crimes damaging the website; detection, prevention, mitigation and ascertainment of fraudulent or illegal activities in relation to the services provided on the Site; execution of the security checks required by law.	Legitimate interest
To give a feedback to a question from the concerned party.	Implementation of pre-contractual measures taken at the request of the party concerned
Enel Global Trading, a company of the Enel Group, parent companies, subsidiaries or affiliates or business partners of Enel Global Trading for carrying out market research, direct sales, for the placement of products or services, for commercial communications or marketing activity. These activities may be carried out by sending advertising, informative, promotional or invitation material, using traditional methods (eg paper mail) or automated contact systems (eg SMS, e-mail).	Consent of the interested party
Analysis of the propensity to use the products and services offered by Enel Global Trading, or by companies of the Enel Group, by parent companies, subsidiaries or affiliates or by business partners of Enel Global Trading, the definition of individual and group profiles, the proposition of individual offers prepared also through the use of instruments and applications designed to record the total consumption of energy as well as its hourly distribution or correlated with separate user devices.	Consent of the interested party

4.3. The grant of your Personal Data is necessary in all cases where processing is carried out on the basis of a legal obligation or to perform a contract of which you are a party or due to the implementation of pre-contractual measures taken at your request. Your possible refusal could entail for Enel Global Trading the impossibility to proceed with the purpose for which the Personal Data are collected.

4.4. The grant of your Personal Data is voluntary for the pursuit of additional purposes and the failure to provide your consent in relation to them will have no consequences on the conclusion of the contract. The mandatory or optional nature of the grant will be specified at the time of collection.

5. Recipients of Personal Data

5.1. Your Personal Data may be made accessible for the purposes mentioned above:

a) to the employees and collaborators of the Controller, appointed for this purpose, or to the companies of Enel Group present in the European Union for the performance of organizational, administrative, financial and accounting activities;

b) to third-party companies or other entities that carry out outsourced activities on behalf of the Controller to enable the Site to operate, as external data processors.

6. Transfer of Personal Data

6.1. Your Personal Data will be processed within the European Union and stored on servers located in Rome, within the European Union.

6.2. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognized by a specific decision of adequacy of the European Commission.

6.3. Any transfers of Personal Data to non-EU countries, in the absence of a European Commission adequacy decision, will only be possible if Data Controllers and Data Processors involved provide adequate guarantees of contractual nature, including Binding Corporate Rules and Standard Contractual Clauses.

6.4. The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will be made only if you have explicitly consented or in the cases provided for by the GDPR and will be processed in his interest. In these cases, we inform you that, despite the Enel Group adopting operational instructions common to all the countries in which it operates, the transfer of your Personal Data could be exposed to risks related to the peculiarities of local laws regarding the processing of Personal Data.

7. Personal data retention period

7.1. The Personal Data processed for the purposes set out above will be kept in compliance with the principles of proportionality and necessity, and in any case until the purposes of the processing have been pursued.

7.2. Your Personal Data will normally be stored for as long as you do not revoke your consent and in any case they will be deleted automatically after twelve months.

8. Rights of concerned parties

8.1. Pursuant to articles 15 - 21 of EU Regulation 2016/679 (GDPR), in relation to the Personal Data communicated, you have the right to:

a) access and request a copy;

b) request the rectification;

c) request the deletion;

d) obtain the restriction of processing;

e) object to the processing;

f) receive data in a structured format, commonly used and readable by an automatic device and to transmit them to another data controller, where technically feasible, without any impediment.

8.2. We inform you that you have the right to object at any time to the processing of Personal Data concerning you on the basis of the legitimate interest of Enel Global Trading.

8.3. If you object to the processing of your Personal Data as indicated in the article 8.2, the Controller will refrain from further processing the Personal Data, unless he demonstrates the existence of binding legitimate reasons to proceed with processing, or for the assessment, exercise or the defence of a right in court.

8.4. To exercise your rights and to revoke your consent you can send a notice to the email address gtportal.privacy@enel.com.

8.5. For further information regarding your Personal Data, you may contact Enel Data Protection Officer, who can be reached at the following e-mail address: dpo.eneltrade@enel.com, indicating in the subject "[Privacy]".

8.6. We remind you that it is your right to lodge a complaint before the competent authority for the protection of personal data.