This Privacy policy illustrates the methods of management of the personal data of the users of the enelxway.it website (hereinafter the "Site") and of the personal data that may be subject to processing by Enel X Way S.r.l.

The information is provided pursuant to Article 13 of the EU Regulation 2016/679 ("GDPR").

1. Data Controller

Enel X Way S.r.l., with registered office at Via Flaminia, 970, 00189, Roma RM, Group VAT No. 15844561009, – PEC enelxway@pec.enel.it (hereinafter, “Enel X Way” or the “Controller”), in its quality of Data Controller, will process your personal data provided through the Site in accordance with the provisions of the applicable Personal Data Protection legislation and this Privacy policy.

2. Data Protection Officer (DPO)

Enel X Way has appointed a Data Protection Officer (DPO) who can be contacted at the following email address: dpo.enelxway@enel.com.

3. Processing Purpose and Method

3.1 Enel X Way will process the personal data communicated by you or however legitimately obtained (hereinafter, the "Personal Data") in order to pursue the purposes for which they have been conferred, as the case may be. In particular, Enel X Way will process the following types of Personal Data:

• Common, Personal and Contact Data (e.g., name and surname; email address): it is specified that, should you ask Enel X Way questions by writing to the email addresses reported on the Site and/or request information by filling in the appropriate forms, such Personal Data, together with the content of the sent message, will be used to provide a reply to your request and/or, to contact you for the purpose of managing your request. The provision of further Personal Data is absolutely optional;
• Browsing data: the IT and telematic systems and software procedures used for the functioning and use of the Site made available by Enel X Way, acquire, during their normal operation, certain data (e.g., the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, the Internet address from which you connected to our Site, etc.), whose transmission is implicit in the use of web communication protocols or is useful for the better management and optimization of the data transmission and e-mail system.

3.2 For the purposes of this privacy policy, the processing of Personal Data means any operation or series of operations carried out on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3.3 Please note that such Personal Data will be processed manually and/or with the support of IT or data transmission devices.

4. Processing Purpose and Legal Basis

4.1 Enel X Way will process your Personal Data for the achievement of specific purposes and only when there is an appropriate legal basis provided by the applicable data protection law. Specifically, Enel X Way will process your Personal Data only when one or more of the following legal bases apply:

• free, specific, informed, unambiguous and express consent to the processing;
• performance of a contract to which you are party or the execution of pre-contractual measures adopted at your request;
• legitimate interest of Enel X Way, unless the interests or fundamental rights and freedoms of the data subject prevail;
• legal obligation to process Personal Data to which Enel X Way is bound.

4.2 The following table lists the purposes for which your Personal Data are processed by Enel X Way and the legal basis on which the processing is based.

4.3 The provision of your Personal Data is necessary in all cases where the processing is carried out on the basis of a legal obligation or in order to perform a contract to which you are a party or the execution of pre-contractual measures adopted at your request. Your refusal to provide your Personal Data may make it impossible for Enel X Way to process your request.

4.4 The provision of your Personal Data is voluntary for the pursuit of additional purposes, and the failure to provide your consent in relation to them will have no consequences on the conclusion of the contract. The mandatory or optional nature of the provision will be specified at the time of collection.

5. Recipients Of Personal Data

In order to pursue the purposes described in paragraph 4 of this Privacy policy, Enel X Way may need to communicate, in Italy and abroad, including countries not belonging to the European Union, its Personal Data to third parties, in order to execute the Contract, to fulfill legal obligations or to carry out activities instrumental to the provision of the requested services.

Your Personal Data may be made accessible for the purposes mentioned above:

a) to employees and contractors of Enel X Way, as persons authorised to process personal data;

b) the companies of the Enel Group located in the territory of the European Union in their capacity as autonomous data controllers or data processors, as well as their employees and collaborators specifically appointed as Authorised Persons;

c) third party companies or other entities that carry out activities in outsourcing on behalf of the Data Controller, in their capacity as data processors, as well as their employees and associates specifically appointed as Authorised Persons.

Enel X Way provides instructions to the Data Processors and Authorised Persons, if any, for the adoption of adequate security measures in order to guarantee the confidentiality, security and integrity of the data.

6. Transfer of Personal Data

6.1. Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same Personal Data may be processed in countries outside the European Union, provided that an adequate level of protection is ensured, as recognized by the European Commission's adequacy decision.

6.2. Any transfer of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or pactual safeguards, including Binding Corporate Rules and standard contractual clauses, are provided by the data controllers and data processors involved.

6.3. The transfer of your Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will only be made where you have explicitly consented to it or in the cases provided for by the GDPR and will be processed in your interest. In these cases, we inform you that, although the Group adopts common operating instructions in all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local legislation on the processing of Personal Data.

7. Period of Retention of Personal Data

7.1. The Personal Data being processed for the abovementioned purposes will be conserved in observance of the principles of proportionality and necessity and, in any case, until the purposes of the processing have been achieved and in accordance with any legal obligations that may be provided for.

7.2. In the event of a contractual relationship with the Data Controller, your Personal Data shall be stored and processed for the entire duration of the contractual relationship and in any case for a period of 10 years from the termination of the contractual relationship, after which they shall be deleted, without prejudice to further storage of the same where necessary to comply with specific legal obligations, provisions of the Authority, for the collection of residual credits and for the management of disputes, complaints and legal actions.

8. Data Subject Rights

8.1. Pursuant to Articles 15 to 22 of the GDPR, in relation to the Personal Data provided, you have the right to:

a) access them and request a copy;

b) request amendment;

c) request cancellation;

d) obtain processing limitation;

e) oppose processing;

f) receive your data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance, where technically feasible.

8.2. We hereby inform you that you have the right not to be subject to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of a contract with the Controller; b) is authorised by law; or c) is based on explicit consent. In cases a) and c) you have the right to express your opinion, contest the decision and obtain human intervention by the Controller.

8.3. We inform you that you have in any case the right to object at any time to the processing of Personal Data concerning you that may be carried out on the basis of Enel X Way's legitimate interest. In this case, the Controller will refrain from further processing your Personal Data, unless he/she demonstrates the existence of compelling legitimate reasons to proceed with the processing, or for the establishment, exercise or defence of a legal claim.

8.4. In order to exercise your rights and to withdraw your consent, you may send a communication to the following e-mail address: enelxway.italy.privacy@enel.com.

8.5. For further information on your Personal Data, you may contact the Data Protection Officer, who can be reached at the following dedicated e-mail address: dpo.enelxway@enel.com.

8.6. Finally, we remind you that if you believe that your personal data has been processed in a manner that does not comply with the EU Regulation 679/2016 (GDPR), you have the right to submit a complaint to the competent Data Protection Authority. Please be informed that in Italy you you can submit a complaint to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), by one of the following procedures:using the method you consider most appropriate among the following:

a) by registered mail with return receipt addressed to: Garante per la protezione dei dati personali, Piazza Venezia, 11 - 00187 Roma;

b) by e-mail to: protocollo@pec.gpdp.it. or by registered e-mail to: protocollo@pec.gpdp.it;

c) by fax to: 06/69677.3785.