Privacy policy

4.3. The provision of Personal Data is necessary in all instances in which processing is based upon legal obligation for the Controller or is necessary to perform a contract to which you are a party, or to execute any pre-contractual measures adopted at your request. In the latter cases, your refusal to provide your Personal Data may not allow the Controller to process your request.

4.4. On the other hand, the provision of your Personal Data is optional for the pursuit of further purposes indicated in the table, and failure to give your consent in relation to them will in any case have no consequence on the conclusion of the contract. The mandatory or optional nature of consent will be specified when the Personal Data are collected.

5. Marketing and/or profiling purposes

5.1. Through the appropriate forms made available on the Website, you may freely decide whether or not to give consent to the processing of your Personal Data and contact details also for market research, or direct sales (including via phone) for product/service placement, commercial communications or marketing activities, related to the products and/or services offered by the Data Controller or by other Companies belonging to the Enel Group, as specifically identified from time to time in the data collection forms. 

5.2. The prior acquisition of your consent for marketing purposes as described above is not required when contact is made through (fixed and/or mobile) telephone numbers and paper mail addresses belonging to persons listed in public telephone directories, in relation to which the rules on the 'Registro Pubblico delle Opposizioni' (Public Opt-Out Registry) are applicable, which allow the processing of such contact data against persons who have not exercised their right to object.

5.3. Acquiring your consent for 'profiling' purposes allows the Data Controller to process your data for profiling activities based on your consumption preferences and on the data and information acquired by the Data Controller through the purchase of its products or services, also for the purpose of enabling you to receive offers specifically tailored to your needs.

In order to come up with better services and products that match your needs, the Controller may resort to partnerships with selected companies that integrate census-type information on a statistical basis, relating to: personal preferences and interests, consumption preferences, economic and family situation, personal location or movements. Under no circumstances will your personal data be shared with third parties for profiling purposes.

5.4. The e-mail address provided by you in the context of any contracts concluded with the Data Controller may be used by the latter to send you commercial offers relating to products and/or services similar to those you have previously purchased (so-called soft-spam). However, you may object to the processing of your Personal Data at any time, by sending a request to the dedicated mailbox referred to in the Rights of Data Subjects section of this privacy policy.

5.5. Processing of Personal Data for marketing purposes may be carried out by means of 'traditional' methods (e.g. paper mail and/or operator calls), or by means of 'automated' contact systems (e.g. SMS and/or MMS, telephone calls without operator intervention, e-mail, fax, interactive applications). 

5.6. Your consent to marketing purposes shall be deemed to have been given for both methods indicated, without prejudice to your right to object, even partially, in relation to the different communication channels through which the marketing purposes are carried out, in the manner indicated in the paragraph Rights of the Data Subjects of this policy.

5.7. Consent to marketing and profiling purposes is optional and does not prevent the possibility of using the products or services offered by the Data Controller. Any consent given may be withdrawn at any time by sending a written request to the e-mail address indicated in the Data Subjects’ Rights section of this policy.

6. Personal Data recipients

6.1. In order to pursue the purposes set out in paragraph 4 of this policy, the Data Controller may need to disclose your Personal Data to third parties, in Italy and abroad, including countries outside the European Union, in order to execute the Contract, to comply with legal obligations or to perform activities instrumental to the provision of the services requested.

Your Personal Data may be made accessible for the above-mentioned purposes to the following subjects:

a) 3Sun employees and collaborators, specifically appointed as Authorized Persons;

b) Companies belonging to the Enel Group within the EU territory, in their capacity as autonomous Data Controllers or Data Processors, as well as their employees and collaborators specifically appointed as Authorized Persons;

c) Third-party companies to carry out specific activities on behalf of 3Sun, in their capacity as Data Processors, as well as their employees and collaborators specifically appointed as Authorized Persons. These parties will process your Personal Data, for example, as part of customer communication management activities, customer care services, market research, direct sales, including by telephone, for the placement of products or services, for commercial communications, marketing and profiling activities;

d) Third-party companies that have contractual relationships with the Data Controller (e.g. distributors or installers of PV panels) in order to respond to a question or request made by the data subject, including by filling in one of the forms available on the Website (the so-called "Follow-up lead form"). In this case, the recipients will act as independent data controllers, and will provide adequate information to the data subject.

6.2. The Data Controller shall provide instructions for the adoption of appropriate security measures to any designated Data Processors and Authorised Persons to guarantee data confidentiality, security and integrity.

7. Personal Data transfer

7.1. Your Personal Data will be processed within the European Union and stored on servers located within the European Union. The same data may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, as recognised by a specific adequacy decision of the European Commission.

7.2. Possible transfers of Personal Data to non-EU countries, in the absence of an adequacy decision by the European Commission, will only be possible if adequate contractual or treaty guarantees are provided by the Data Controllers and Processors involved, including Binding Corporate Rules and standard contractual data protection clauses.

7.3. In the absence of an adequacy decision or other appropriate measures as described above, transfer of your Personal Data to third countries outside the European Union will only be carried out where you have explicitly consented to it, or in the cases provided for in the GDPR, and will be processed in your interest. In those cases, we inform you that, although the Enel Group adopts common operating instructions for all the countries in which it operates, the transfer of your Personal Data may be exposed to risks related to the peculiarities of local Personal Data processing laws. 

8. Personal Data retention period

8.1. Personal Data processed for the above-mentioned purposes will be stored in accordance with the principles of proportionality and necessity, and in any case until the processing purposes have been pursued and in accordance with any legal obligations that may have been laid down.

8.2. In the event of a contractual relationship between the data subject and the Data Controller, your Personal Data shall be stored and processed for as long as such contractual relationship subsists, and in any case for a period of 10 years from the termination of the contractual relationship, after which it shall be deleted, without prejudice to the further storage of the same where necessary to comply with specific legal obligations, Authority orders, for the collection of outstanding debts and for the management of disputes, complaints and legal actions.

8.3. In case processing is carried out for market research purposes, or for direct sales purposes (including via phone) for product/service placement, commercial communications, or marketing activities, relating to products and/or services offered by 3Sun or other Companies belonging to the Group, your Data will be processed until the consent given is withdrawn.

8.4 In case your Personal Data are processed for profiling purposes by 3Sun, processing will be carried out until your consent is withdrawn.

9. Data Subject's rights

Pursuant to Articles 15 - 22 of the GDPR, in relation to the Personal Data disclosed, you have the right, where applicable, to:

a) access and request a copy;

b) request their amendment;

c) request their cancellation; 

d) limit their treatment;

e) oppose to their processing;

f) receive them in a structured, commonly used, and machine-readable format and to transmit such data to another data controller without hindrance; where technically feasible.

9.2. You also have the right not to be subject to a decision based solely on automated processing unless the decision is necessary: a) for the conclusion or performance of the contract; b) is authorised by law or c) is based on explicit consent. In cases a) and c) you have the right to express your opinion, challenge the decision and obtain human intervention by the Data Controller.

9.3. We inform you that you still have the right to object to the processing of Personal Data concerning you that may have been carried out based on the legitimate interest of the Data Controller at any time. In this case, the Data Controller shall refrain from further processing the Personal Data, unless it can prove the existence of compelling legitimate grounds for processing, or for the establishment, exercise or defence of legal claims.

9.4. In addition, we inform you that you still have the right to object to the processing of Personal Data relating to you carried out for marketing purposes, including profiling, at any time, insofar as it is related to such direct marketing. The right to object to such processing by automated contact systems also extends to the processing of Personal Data by traditional contact methods, unless you wish to object only partially. If you object to processing for marketing and profiling purposes, your Personal Data will no longer be processed for these purposes.

9.5. To exercise your rights and for further information concerning your Personal Data, you may contact the Data Protection Officer, who can be reached at the following e-mail address:  dpoenelgreenpoweritalia@enel.com.

9.6. Lastly, we would like to remind you that if you deem your data has been processed in a way that does not comply with (EU) Regulation 2916/679 (GDPR), it is your right to lodge a complaint with the Garante per la Protezione dei Dati Personali, through:

• registered letter with return receipt addressed to Garante per la Protezione dei Dati Personali, Piazza Venezia, 11, 00187 Rome;

• e-mail to: protocollo@gpdp.it.