Information on processing of personal data

Controller

Enel S.p.A., with registered office in Rome, Viale Regina Margherita no. 137, VAT code no. 15844561009 (hereinafter, “Enel” or the “Controller”), in its capacity as Controller, will process Personal Data (as defined hereinafter) in compliance with the provisions of the applicable laws on protection of personal data (articles 13 and 14 of the Regulation (EU) No. 679/2016 – “GDPR” and Legislative Decree no. 196 of June 30, 2003) as well as with this information.

 

Data Protection Officer (DPO)

The Controller appointed a DPO which can be reached at the following email address: dpoenel@enel.com.

 

Object and Modalities of Processing

The Controller will process your identifier personal data (such as name, surname, residence) provided by you or the personal data concerning third parties (e.g., sub-delegated or substitutes of proxy holders) provided by you (“Personal Data”) with respect to the right to attend the Shareholders’ meeting (hereinafter, the “Meeting”) and to the further activities related to the latter, for example voting and intervening.

Processing of Personal Data under this information means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Processing of Personal Data will be carried out manually and/or with the use of computerized mechanisms and by means of information technology systems.

 

Purposes and legal basis for processing

Enel will process the Personal Data in relation to the attendance to the Meeting, in particular with respect to the attendance to the latter in person or by proxy, to the right to supplement the agenda and to ask questions before the Meeting.

The legal basis for the processing is represented by the Controller’s obligation under applicable laws to grant the exercise by you – also through proxy holders or sub-delegated – of the rights granted by the applicable law in relation to the attendance to the Meeting.

Transmission and processing of the Personal Data are necessary for the abovementioned purposes. The failure to transmit such Personal Data determines the impossibility to accept the request made from time to time.

 

Recipients of Personal Data

In compliance with the principle of data minimisation, the Personal Data, for the purposes described above, may be disclosed to:

a) employees and partners of the Controller which are entrusted with the data processing before, during and after the Meeting;
b) third companies or other persons in their capacity as autonomous Controllers or that carry out activities on behalf of the Controller in their capacity as Processors;
c) Computershare S.p.A., a company not belonging to Enel Group, appointed as processor for the purposes of ensuring protection of the Shareholders’ rights provided for by the applicable laws.

 

Transfer of Personal Data

Your Personal Data will be processed within the European Union and stored on server located within the European Union. The same data may be processed in Countries outside the European Union, provided that an adequate level of protection is ensured, recognized by a specific adequacy decision of the European Commission.

Any transfer of Personal Data to non-EU Countries, in the absence of an adequacy decision by the European Commission, will be possible only if the involved Controllers and Processors provide adequate guarantees based on contracts or agreements, including binding corporate rules and standard contractual clauses on data protection.

The transfer of Personal Data to third countries outside the European Union, in the absence of an adequacy decision or other appropriate measures as described above, will be carried out only in the cases provided for by GDPR.

 

Period for which the Personal Data will be stored

The Personal Data provided will be stored pursuant to the proportionality principle until the purposes of the processing are pursued and, in any case, for a period not exceeding 10 years and will not be communicated to third parties, except for the purpose of complying with the applicable laws or regulations. Such period, besides being consistent with the provisions on the challenge of shareholders’ meetings resolutions, takes into account the provisions of the Issuers’ regulation adopted by Consob through Resolution no. 11971 of May 14, 1999 on the disclosure of regulated information on issuers’ internet (see, in particular, Article 77, paragraph 1-bis, Article 84-quarter, paragraph 1).

 

Rights of data subjects

In accordance with Articles 15 - 21 of the GDPR, with reference to the Personal Data provided, it is possible to exercise the following rights:

(i)         right to access to and obtain copy;
(ii)        right to request rectification;
(iii)       right to request erasure;
(iv)       right to obtain the restriction of processing;
(v)        right to object processing;
(vi)       right to receive the personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

For the exercise of the above-mentioned rights please refer to the following email address: privacy.ca@enel.com.

Please note that it is possible to obtain additional information on Personal Data by the Enel’s Data Protection Officer, as indicated above, indicating mandatorily in the subject “Shareholders’ Meeting of Enel S.p.A.”.

We remind you that the applicable laws provide for the right to lodge a complaint with the Italian Data Protection Authority, with registered office in Rome, Piazza Venezia no. 11; Tel. (+39) 06.696771, CEM: protocollo@pec.gpdp.it.