Privacy policy

1. Data Controller

1.1. Enel X Advisory Services USA, LLC, which has its legal headquarter at 100 Brickstone Square, Suite 300, Andover, Massachusetts 01810 (hereafter referred to as “Enel X Advisory Services” or the “Controller”) will process the personal data you provided through the https://refreshalliance.com website (hereafter the “Website”) in compliance with applicable current privacy and personal data protection legislation, and this privacy policy.

2. Purpose and Method of Processing

2.1. Enel X Advisory Services will process the personal information you provide us, or which has been legitimately collected by the Controller (“Personal Data”). The following Personal Data in particular will be processed:  

• Personal Common and Contact Data: name, surname, email address, telephone number and content of the message sent by you and other Personal Data that you may have provided during the communication. We will process this Personal Data in the case in which you make enquiries, request information or send us communications of any type. You send us this Personal Data at the moment in which you contact us. The processing of this Personal Data is necessary for us to provide a response to the communications received from you or to the requests that you have made. The provision of any further Personal Data by you is completely voluntary.
• Browsing data: the IT and telematic systems and software procedures used for the functioning and use of the Website made available by Enel X Advisory Services,  acquire, during their normal operation, certain data (e.g. the date and time of access, the pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which you access the Internet, the Internet address from which you connected to our Website, etc.), whose transmission is implicit in the use of web communication protocols or is useful for the better management and optimisation of the data transmission and e-mail system.
• Cookies: No use is made of cookies for user profiling. We use technical session cookies, strictly limited to what is necessary for the safe and efficient navigation of the Website.

2.2. For the purposes of this privacy policy, the processing of Personal Data means any operation or series of operations carried out on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2.3. Please note that such Personal Data will be processed manually and/or with the support of IT or data transmission devices.

2.4. Enel X Advisory Services has adopted technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, aimed at preventing and counteracting the loss of Personal Data, as well as unlawful or incorrect use and unauthorised access to data.

3. Processing Purpose and Legal Basis

3.1. Enel X Advisory Services will process your Personal Data for the achievement of specific purposes and only when there is an appropriate legal basis provided by the applicable data protection law. Specifically, Enel X Advisory Services will process your Personal Data only when one or more of the following legal bases apply:

1. free, specific, informed, unambiguous and express consent to the processing;
2. performance of a contract to which you are party or the execution of pre-contractual measures adopted at your request;
3. legitimate interest of Enel X Advisory Services, unless the interests or fundamental rights and freedoms of the data subject prevail;
4. legal obligation to process Personal Data to which Enel X Advisory Services is bound.

3.2. The following table lists the purposes for which your Personal Data are processed by Enel X Advisory Services and the legal basis on which the processing is based:

3.3. The provision of your Personal Data is necessary in all instances in which processing is a legal requirement or necessary to the performance of a contract to which you are a party or to the implementation of pre-contractual measures adopted at your request. Any refusal on your behalf may make it impossible for Enel X Advisory Services to perform the task for which your Personal Data has been collected.

3.4. The provision of your Personal Data, however, is voluntary for any further purposes and failure to give your consent in such cases will have no effect on the completion of the contract.  The obligatory or optional nature of the provision of data will be specified at the moment of its collection.

3.5. Enel X Advisory Services is located in the United States and your personal data will be processed in United States.

4. Recipients of Personal Data

4.1. In order to pursue the purposes described in paragraph 3 of this Privacy policy, Enel X Advisory Services may need to communicate your Personal Data to third parties, in order to execute the Contract, to fulfil legal obligations or to carry out activities instrumental to the provision of the requested services.

4.2. Your Personal Data may be made accessible for the abovementioned purposes, to:  

1. to employees and contractors of Enel X Advisory Services, as persons authorised to process personal data;
2. the companies of the Enel Group in their capacity as autonomous data controllers or data processors as well as their employees and collaborators specifically appointed as Authorised Persons;
3. third party companies or other entities that carry out activities in outsourcing on behalf of the Data Controller, in their capacity as data processors, as well as their employees and associates specifically appointed as Authorised Persons.

4.3. Enel X Advisory Services provides instructions to the Data Processors and Authorised Persons, if any, for the adoption of adequate security measures in order to guarantee the confidentiality, security and integrity of the data.

5. Period of Retention of Personal Data

The Personal Data being processed for the abovementioned purposes will be conserved in observance of the principles of proportionality and necessity and, in any case, until the purposes of the processing have been achieved and in accordance with any legal obligations that may be provided for.

6. Rights of the Data Subjects

6.1. Pursuant to articles 15 – 22 of the GDPR, in relation to the Personal Data communicated, you have the right, where applicable, to:

1. access and request a copy;
2. request any corrections;
3. request cancellation;
4. obtain limitations on the processing;
5. object to the processing;
6. receive such data in a structured, commonly used and machine-readable format and to transmit them without hindrance to another data controller, where technically feasible.

6.2. To exercise your rights you may send a communication to the e-mail address:  dataprotectionoffice-northamerica@enel.com

6.3. Finally, we remind you that if you believe that the processing of your data has taken place in a manner that does not comply with European Regulation 679/2016 (GDPR), it is your right to lodge a complaint with the competent Supervisory Authority for the Protection of Personal Data.

USA & Canada

US & Canada Data Privacy

Click here to read privacy statements.