Privacy Policy

1. RESPONSIBILITY FOR PROCESSING PERSONAL DATA

1.1. Enel S.p.A., with registered office in Viale Regina Margherita n. 137, 00198, Rome, VAT No. 15844561009, (hereinafter, “Enel” or the “Data Controller”), in its capacity as Data Controller, will collect your personal data and those of your sons or daughters, in accordance with current legislation governing privacy and the protection of personal data, and with this Privacy Policy.

2. DATA PROTECTION OFFICER (DPO)

2.1. The Data Controller has designated a Data Protection Officer (DPO), who can be contacted by e-mail at dpoenel@enel.com .

3. AIM AND METHOD OF DATA PROCESSING

3.1. Enel processes the personal data you have provided or that have been legitimately obtained by the Data controller (“Personal Data”). Specifically, the following Personal Data are processed: Data regarding participation in the “We Are Energy” project. Enel will process the parent’s data (including name, surname, email address, telephone number, etc.) needed to register on the platform and create an account in order to participate in the We Are Energy project. It will also process the data (name, surname, age, etc.) of the minor signed up for the project, to enable them to play and compete in the We are Energy project (hereafter also the “Participant”). If a profile photo is uploaded, the personal data relating to the uploaded photo may also be processed (optional choice). Data for participation in the campus. In the event of the minor winning the competition, Enel will also process the data of the parent and the participant, in order to manage their participation in the We are Energy Campus which will take place in Avigliano Umbro at the “I Ciclamini” venue. In any case, Enel will not process health data or data on the health status of the participants, unless doing so lies within the exclusive limits of liability prescribed by law. Navigation data. During their normal operation, the computer systems and software procedures used to operate the weareenergy.enel.com Site acquire various personal data (e.g. the date and time of access, pages visited, the name of the Internet Service Provider and the IP address from which you access the Internet, the IP address from which you connected to our Site, etc.), the transmission of which is implicit in the use of Internet communication protocols or is useful for the better management and optimization of the data transmission and e-mail system.

3.2. For the purposes of these privacy practices, processing of Personal Data is construed as any operation or combination of operations, carried out with the aid of automated processes and applied to Personal Data, such as collection, recording, organization, sorting, storage, adaptation or editing, retrieval, consultation, use, communication via transmission, diffusion, or any other form of provision, correlation or linking, limitation, erasure or destruction.

3.3. Please note that said Personal Data will be processed manually and/or with the aid of IT or digital communications means.

3.4. Processing of the personal data requested is indispensable for participation in the ‘We are Energy’ initiative and to join the community. If you do not provide your data, participation in the project will not be possible.

3.5. In the event of a win, further processing of the participants’ personal data is necessary to allow their participation in the We are Energy Campus which will be held at Avigliano Umbro at the “I Ciclamini” venue.

4. AIMS AND LAWFUL BASIS OF PROCESSING

4.1. Enel will process your Personal data, and that of your participating son or daughter, in order to pursue precise aims and only regarding a specific legal basis, as set down in the applicable law concerning privacy and the protection of personal data. More specifically, Enel will process your Personal Data and that of the Participant only in the presence of one or more of the following legal grounds:

you have freely provided your specific, informed, unequivocal and express consent for data processing; processing is necessary for performance of a contract to which you are a party or for the execution of pre-contractual measures adopted at your request; in the presence of a legitimate interest of Enel; Enel is legally obliged to process the Personal Data.

4.2. The following table contains a list of the aims for which your Personal Data are processed by the Controller and the legal basis on which processing is based.

Allow use of all the features of the Site (Performance of a contract); Check correct operation of the Site (Performance of a contract); Investigation of responsibility in the case of the commission of computer crime harming the Site; disclosure, prevention, mitigation and evaluation of fraudulent or illegal activities in relation to the services provided through the Site; execution of the security checks required by law (Legitimate interests); Answer a question or respond to a request made by the data subject (Execution of pre-contractual measures adopted at the request of the data subject); Participate in the We are Energy project (Implementation of pre-contractual measures taken in response to the data subject’s request and implementation); In the event of a win, to enable participation in the We are Energy campus (Performance of a contract)

4.3. Conferment of your Personal Data and that of the Participant is necessary in all cases where data processing occurs due to a legal obligation, or for the performance of a contract to which you are a party, or for the execution of pre-contractual measures adopted at your request. Refusal to give consent for data processing may make it impossible for Enel to pursue the aims for which the Personal Data are collected.

5. RECIPIENTS OF PERSONAL DATA

5.1. For the purposes set out above, your Personal Data and that of the Participant can be made accessible as follows:

a) To employees and collaborators of the Data Controller, expressly appointed as data processors, or Enel Group companies for the carrying out of organisational, administrative, financial and accounting activities, expressly named as being responsible for this end;

b) To third party companies or other entities who carry out outsourced activities on the behalf of the Data Controller to enable the Site to function properly, or who carry out other outsourced activities in their capacity as external data processors. In particular, for the selection of winners and participation in the We are Energy Campus, data will be shared with La Fabbrica Spa, with registered office in Viale Monza 259, Milan, appointed as Data Controller.

c) In the event of a win, personal data may be shared with the Company belonging to the Enel Group in the Participant’s country of origin, which could be outside the European Union; in this case, the data will be shared only with the aim of allowing the minor to participate in the We are Energy campus which will be held in Avigliano Umbro, Umbria, Italy, at the “I Ciclamini” venue.

In any case, personal data will not be visible to other users, but only to trained personnel authorized by the Data Controller.

6. PERSONAL DATA TREATMENT

6.1. Your Personal Data and that of the Participant will be processed within the European Union and stored on servers located within the European Union. Said data may be processed in countries outside the European Union, on condition that an adequate level of protection is guaranteed and recognised by a specific adequacy decision of the European Commission. Any transfer of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate guarantees of a contractual or covenant nature are provided by the Controllers and Processors involved, including binding corporate rules and contractual clauses concerning data protection. The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will be performed only if you have explicitly consented or in the cases provided for by the GDPR and will be processed in your interest. In these cases, we inform you that, despite the Enel Group adopting operating instructions common to all the countries in which it operates, the transfer of your Personal Data may possibly be exposed to risks related to the peculiarities of local laws regarding the processing of Personal Data.

7. PERIOD FOR WHICH THE PERSONAL DATA IS STORED

7.1. The Personal Data processed for the aforesaid aims will be retained in accordance with the principles of proportionality and necessity, and anyway until the aims of processing have been achieved. In any case, the data acquired will be deleted after 5 years from the date of completion of the registration form. Enel reserves the right to publish the list of winners in a private gallery at the end of the competition. Personal Data will be stored for the sole purpose of offering you the opportunity to take part in new We are Energy projects.

8. RIGHTS OF DATA SUBJECTS

8.1. Pursuant to art. 15 – 21 of EU Regulation 2016/679 (GDPR), in relation to the Personal Data communicated, you have the right to be able to carry out, on your behalf or on behalf of the minor Participant, the following activities:

a) to access and request a copy;

b) to request their correction;

c) to request their cancellation;

d) to obtain processing restrictions;

e) to withdraw consent for processing;

f) receive the data in a commonly used structured format that can be consulted using an automatic system, and transmit them without impediment to another data controller, where technically feasible.

8.2. You are anyway entitled to withdraw consent at any time to the processing of your Personal Data, carried out in accordance with the legitimate interest of Enel.

8.3. If you do not consent to the processing of your Personal Data in accordance with the matters indicated in article 8.2, the Controller will cease further processing of the Personal Data, unless the existence is demonstrated of legitimate cogent reasons to proceed with data processing, or for the assessment, exercise or defence of a right in a court of law.

8.4. To exercise your rights, you can send a communication to the email address privacy.communications@enel.com.

8.5. For more information on your Personal Data, contact the Enel Data Protection Officer by e-mail at dpoenel@enel.com and enter the word “Privacy” in the subject line.

8.6. Remember, it is your right to make a complaint to the competent Data Protection authority.

8.7. In the case of the Italian Data Protection Authority, you can file a complaint by the following means:

a) hand delivery to the offices of the Guarantor (at the address indicated below);

b) registered post addressed to: Guarantor for the protection of personal data, Piazza Venezia, 11 – 00187 Rome;

c) certified e-mail message addressed to: protocollo@pec.gpdp.it.