Privacy policy
pursuant to Articles 13 and 14 of (EU) Regulation 2016/679 ('GDPR')
1. Personal Data Controller
1.1. 3Sun S.r.l, with registered office in Contrada Blocco Torrazze, 95121, Catania - Italy, VAT no. 15844561009 (hereinafter referred to as "3Sun" or the "Controller"), will process the personal data provided through its website www.3sun.com (hereinafter, the "Website") in compliance with the provisions of the applicable data protection regulation and this privacy policy.
1.2. The names of any other data controllers and data processors shall be disclosed upon subscribing and/or accessing the relevant services.
2. Data Protection Officer (DPO)
2.1. The Controller has appointed a Data Protection Officer (DPO), who can be contacted at the following e-mail address: dpoenelgreenpoweritalia@enel.com.
3. Processing Scope and Methods
3.1. 3Sun will process personal data you provided us, or legitimately collected by the Controller ('Personal Data'). More in detail, the following Personal Data may be processed:
Common Personal Data, personal information and contact data (e.g. name and surname, company, e-mail address, telephone number): in case you ask any question or make a request to 3Sun, by writing to the e-mail addresses provided on its Website or requesting information by filling in the relevant forms, such Personal Data, together with the content of the message sent, shall be used to reply to your request. The provision of any further Personal Data shall be regarded as optional.
Browsing data: during their normal operation, computer and electronic systems and software procedures used to operate and use the Website, made available by 3Sun, acquire certain data (e.g. access date and time, pages visited, name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, the Internet address from which you connected to the Website, etc.), the transmission of which is implicit in the use of web communication protocols or is useful for better managing and optimizing the data and e-mail sending system. For more information on the procedures used to collect the information you provide while browsing the Website, through cookies and/or other monitoring technologies, can be found in the cookie policy available on the Website
3.2. For the purposes of this privacy policy, the processing of Personal Data includes any operation or series of operations carried out on Personal Data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
3.3. Please be aware that such Personal Data shall be processed manually and/or with the support of computer or electronic means
3.4. The data Controller adopted technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, aimed at preventing and counteracting the loss of Personal Data, as well as any unlawful or incorrect use and unauthorised access.
4. Processing purpose and legal basis
4.1. The data Controller may process your Personal Data for fulfilling specific purposes and in the presence of an appropriate legal basis provided by applicable law on Personal Data protection. In particular, the data Controller shall only process your Personal Data if one or more of the following legal bases apply:
- you have given your free, specific, informed, unequivocal and express consent to the processing;
- processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract;
- legitimate interest of Data Controller, unless the interests or fundamental rights and freedoms of the data subject prevail;
- where there is a legitimate interest of the data Controller, provided that the interests or fundamental rights and freedoms of the data subject do not prevail.
4.2. The following table lists the purposes for which your Personal Data are processed by 3Sun and the legal basis on which the processing is based.
| Processing purposes | Legal basis |
|---|---|
| Allowing the use of all Website functions and controlling their proper operation | Performance of a contract |
| Carrying out security checks as well as ascertaining any possible liability in the event of cybercrime to the detriment of the Website; detecting, preventing, mitigating and ascertaining fraudulent or illegal activities in connection with the services provided on the Website; carrying out security checks as required by law | Legal obligation Legitimate interest |
| Responding to a question or request made by the Data Subject, including by filling in one of the forms available on the Website (the so-called "Follow-up lead form") | Executing of pre-contractual measures adopted at the request of the data subject |
| Sending communications related to initiatives, projects and events promoted by the data Controller; based on the scope of the initiatives carried out, your Personal Contact Information may be managed centrally and/or locally | Legitimate Interest |
| Following up on a request to subscribe to 3Sun's newsletter, to remain updated on the latest news in one or more of the sectors in which the company operates | Executing pre-contractual measures adopted at the request of the data subject |
| Allowing the Data Controller to comply with legal, regulatory or EU obligations | Legal obligation |
| Offering commercial, technical, and general customer care services | Executing pre-contractual measures adopted at the request of the data subject Performance of a contract |
| Quality control over the support services offered directly by the Data Controller or by its suppliers, in order to verify the effectiveness of the support service and adequately target the training actions of the persons authorised to process | Executing pre-contractual measures adopted at the request of the data subject Performance of a contract |
Allowing 3Sun to carry out market research, or direct sales (including via phone) for product/service placement, commercial communications, or marketing activities. These activities may be carried out by sending advertising, information, promotional material or invitations, by traditional means (e.g. paper mail) or automated contact systems (e.g. SMS, e-mail) | Data Subject's consent Legitimate interest |
Allowing selected Companies belonging to the Enel Group (e.g. Enel Energia S.p.a.; Enel X Italia S.r.l.; Enel Green Power S.p.A.) to carry out market research, or direct sales (including via phone) for product/service placement, commercial communications or marketing activities. These activities may be carried out by sending advertising, information, promotional material or invitations, by traditional means (e.g. paper mail) or automated contact systems (e.g. SMS, e-mail) | Data Subject's consent |
| Allowing 3Sun to carry out profiling activities for itself by processing your personal data relating, for instance, to your consumption preferences and/or your purchasing choices concerning products or services offered by the Data Controller. By assessing your preferences, the Data Controller may define individual and group profiles and also propose offers specifically tailored to your needs | Data Subject's consent |
4.3. The provision of Personal Data is necessary in all instances in which processing is based upon legal obligation for the Controller or is necessary to perform a contract to which you are a party, or to execute any pre-contractual measures adopted at your request. In the latter cases, your refusal to provide your Personal Data may not allow the Controller to process your request.
4.4. On the other hand, the provision of your Personal Data is optional for the pursuit of further purposes indicated in the table, and failure to give your consent in relation to them will in any case have no consequence on the conclusion of the contract. The mandatory or optional nature of consent will be specified when the Personal Data are collected.
5. Marketing and/or profiling purposes
5.1. Through the appropriate forms made available on the Website, you may freely decide whether or not to give consent to the processing of your Personal Data and contact details also for market research, or direct sales (including via phone) for product/service placement, commercial communications or marketing activities, related to the products and/or services offered by the Data Controller or by other Companies belonging to the Enel Group, as specifically identified from time to time in the data collection forms.
5.2. The prior acquisition of your consent for marketing purposes as described above is not required when contact is made through (fixed and/or mobile) telephone numbers and paper mail addresses belonging to persons listed in public telephone directories, in relation to which the rules on the 'Registro Pubblico delle Opposizioni' (Public Opt-Out Registry) are applicable, which allow the processing of such contact data against persons who have not exercised their right to object.
5.3. Acquiring your consent for 'profiling' purposes allows the Data Controller to process your data for profiling activities based on your consumption preferences and on the data and information acquired by the Data Controller through the purchase of its products or services, also for the purpose of enabling you to receive offers specifically tailored to your needs.
In order to come up with better services and products that match your needs, the Controller may resort to partnerships with selected companies that integrate census-type information on a statistical basis, relating to: personal preferences and interests, consumption preferences, economic and family situation, personal location or movements. Under no circumstances will your personal data be shared with third parties for profiling purposes.
5.4. The e-mail address provided by you in the context of any contracts concluded with the Data Controller may be used by the latter to send you commercial offers relating to products and/or services similar to those you have previously purchased (so-called soft-spam). However, you may object to the processing of your Personal Data at any time, by sending a request to the dedicated mailbox referred to in the Rights of Data Subjects section of this privacy policy.
5.5. Processing of Personal Data for marketing purposes may be carried out by means of 'traditional' methods (e.g. paper mail and/or operator calls), or by means of 'automated' contact systems (e.g. SMS and/or MMS, telephone calls without operator intervention, e-mail, fax, interactive applications).
5.6. Your consent to marketing purposes shall be deemed to have been given for both methods indicated, without prejudice to your right to object, even partially, in relation to the different communication channels through which the marketing purposes are carried out, in the manner indicated in the paragraph Rights of the Data Subjects of this policy.
5.7. Consent to marketing and profiling purposes is optional and does not prevent the possibility of using the products or services offered by the Data Controller. Any consent given may be withdrawn at any time by sending a written request to the e-mail address indicated in the Data Subjects’ Rights section of this policy.
6. Personal Data recipients
6.1. In order to pursue the purposes set out in paragraph 4 of this policy, the Data Controller may need to disclose your Personal Data to third parties, in Italy and abroad, including countries outside the European Union, in order to execute the Contract, to comply with legal obligations or to perform activities instrumental to the provision of the services requested.
Your Personal Data may be made accessible for the above-mentioned purposes to the following subjects:
a) 3Sun employees and collaborators, specifically appointed as Authorized Persons;
b) Companies belonging to the Enel Group within the EU territory, in their capacity as autonomous Data Controllers or Data Processors, as well as their employees and collaborators specifically appointed as Authorized Persons;
c) Third-party companies to carry out specific activities on behalf of 3Sun, in their capacity as Data Processors, as well as their employees and collaborators specifically appointed as Authorized Persons. These parties will process your Personal Data, for example, as part of customer communication management activities, customer care services, market research, direct sales, including by telephone, for the placement of products or services, for commercial communications, marketing and profiling activities;
d) Third-party companies that have contractual relationships with the Data Controller (e.g. distributors or installers of PV panels) in order to respond to a question or request made by the data subject, including by filling in one of the forms available on the Website (the so-called "Follow-up lead form"). In this case, the recipients will act as independent data controllers, and will provide adequate information to the data subject.
6.2. The Data Controller shall provide instructions for the adoption of appropriate security measures to any designated Data Processors and Authorised Persons to guarantee data confidentiality, security and integrity.
7. Personal Data transfer
7.1. Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, as recognised by a specific adequacy decision of the European Commission.
7.2. Possible transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or treaty guarantees are provided by the Data Controllers and Processors involved, including Binding Corporate Rules and standard contractual data protection clauses.
7.3. In the absence of an adequacy decision or other appropriate measures as described above, transfer of your Personal Data to third countries outside the European Union will only be carried out where you have explicitly consented to it, or in the cases provided for in the GDPR, and will be processed in your interest. In those cases, we inform you that, although the Enel Group adopts common operating instructions for all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local Personal Data processing laws.
8. Personal Data retention period
8.1. Personal Data processed for the above-mentioned purposes will be stored in accordance with the principles of proportionality and necessity, and in any case until the processing purposes have been pursued and in accordance with any legal obligations that may have been laid down.
8.2. In the event of a contractual relationship between the data subject and the Data Controller, your Personal Data shall be stored and processed for as long as such contractual relationship subsists, and in any case for a period of 10 years from the termination of the contractual relationship, after which it shall be deleted, without prejudice to the further storage of the same where necessary to comply with specific legal obligations, Authority orders, for the collection of outstanding debts and for the management of disputes, complaints and legal actions.
8.3. In case processing is carried out for market research purposes, or for direct sales purposes (including via phone) for product/service placement, commercial communications, or marketing activities, relating to products and/or services offered by 3Sun or other Companies belonging to the Group, your Data will be processed until the consent given is withdrawn.
8.4 In case your Personal Data are processed for profiling purposes by 3Sun, processing will be carried out until your consent is withdrawn.
9. Data Subject's rights
Pursuant to Articles 15 - 22 of the GDPR, in relation to the Personal Data disclosed, you have the right, where applicable, to:
a) access and request a copy;
b) request their amendment;
c) request their cancellation;
d) limit their treatment;
e) oppose to their processing;
f) receive them in a structured, commonly used, and machine-readable format and to transmit such data to another data controller without hindrance; where technically feasible.
9.2. You also have the right not to be subject to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of the contract; b) is authorised by law or c) is based on explicit consent. In cases a) and c) you have the right to express your opinion, challenge the decision and obtain human intervention by the Data Controller.
9.3. We inform you that you still have the right to object to the processing of Personal Data concerning you that may have been carried out based on the legitimate interest of the Data Controller at any time. In this case, the Data Controller shall refrain from further processing the Personal Data, unless it can prove the existence of compelling legitimate grounds for processing, or for the establishment, exercise or defence of legal claims.
9.4. In addition, we inform you that you still have the right to object to the processing of Personal Data relating to you carried out for marketing purposes, including profiling, at any time, insofar as it is related to such direct marketing. The right to object to such processing by automated contact systems also extends to the processing of Personal Data by traditional contact methods, unless you wish to object only partially. If you object to processing for marketing and profiling purposes, your Personal Data will no longer be processed for these purposes.
9.5. To exercise your rights and for further information concerning your Personal Data, you may contact the Data Protection Officer, who can be reached at the following e-mail address: dpoenelgreenpoweritalia@enel.com.
9.6. Lastly, we would like to remind you that if you deem your data has been processed in a way that does not comply with (EU) Regulation 2916/679 (GDPR), it is your right to lodge a complaint with the Garante per la Protezione dei Dati Personali, through:
registered letter with return receipt addressed to Garante per la Protezione dei Dati Personali, Piazza Venezia, 11, 00187 Rome;
e-mail to: protocollo@gpdp.it.