INFORMATION ON THE PROCESSING OF PERSONAL DATA Pursuant to art. 13 of Reg. 2016/679

Edison Next S.p.A. (“Edison Next”) and its subsidiaries, that operate as independent data controllers, inform that, pursuant to art. 13 of the European General Data Protection Regulation, n. 2016/679 GDPR ("Regulation"), the personal data provided by the Data Subject will be processed in accordance with the provisions of the Regulation, for the purposes set out below.

1. Source of the data

The personal data subject to processing is collected directly from the Data Subject.

2. Recipients

This Privacy Policy applies to:

• Website users

• Potential customers (at the stage of expression of interest in the service or in the contract phase)

In the following text the subjects listed above are defined as "Data Subjects" in the processing of personal data.

3. Types of data processed

The data, subject to processing, are:

- Personal data which allow for direct identification (personal and contact data).

- Navigation data (data provided through navigation, processed to allow the website to function correctly). In this regard, we invite you to read the cookie policy on the website.

4. Purpose, Legal basis of processing and data retention period

The above data will be used exclusively for the following purposes:

I. Processing purposes based on pre-contractual and/or contractual measures

• To carry out the procedures for replying to the requests received by Data Subjects that voluntarily fill in the online form.

II. Processing purposes whose legal basis lies in the consent expressed by the Data Subject

A. For promotional, commercial and marketing activities carried out by Edison Next including 1) sending advertising, informative and promotional material on new products/services relating to the integrated offer of Edison Next and its Business Units and/or its subsidiaries; 2) Direct sale by Edison Next and its subsidiaries of products/services through different sales channels; 3) verification of the degree of satisfaction with the quality of the product/service provided directly or through specialized companies, through interviews or other survey methods.

B. For the transfer of data to Edison Group companies so that they can carry out, in relation to their own services and/or products 1) promotional, commercial and marketing activities carried out directly for the sending of advertising, information and promotional material on new products / services of the company itself; 2) Direct sale by the company of products/services through different sales channels; 3) verification of the degree of satisfaction with the quality of the product/service provided directly or through specialized companies, through interviews or other survey methods.

C. For the transfer of data to third parties and commercial partners of Edison Next Spa in the fields of marketing, large-scale distribution, telecommunications, television entertainment, financial institutions, insurance institutions, car manufacturers, universities, companies linked to the world of energy and the environment, consultancy companies, so that they carry out, in relation to their own services and/or products, promotional, commercial and marketing activities and for the sending of their own advertising, information and promotional material.

The consent to the processing of personal data for the purposes referred to in point 4 Par. II letters A) B) and C) is optional and any refusal does not affect the supply of the requested products/services. In any case, the Data Subject may object to such processing at any time by making a request to Edison Next.

Data retention period

The data collected for the purposes referred to in Par. I will be used for a period of time not exceeding 24 months from their acquisition, unless revoked by the Data subject. The data collected for the purposes referred to in Par. II, letter A), B) and C) will be used for a period of time not exceeding 24 months from the acquisition of valid, current and updated consent, unless revoked by the Data subject.

5. Methods of the processing

In relation to the above-mentioned purposes, the data will be processed through manual, IT and telecommunication tools, and in any case through appropriate tools to ensure their security, confidentiality, integrity and availability through the adoption of appropriate security measures, as required by the Regulation.

6. Categories of recipients of data

The data of the Data subject may be known (i) by the employees and collaborators of Edison Next and its subsidiary companies due to the company function performed, who operate as subjects authorized and duly instructed by the Data Controller; (ii) by employees and collaborators of subsidiaries/parent companies/affiliated companies of the Edison Group, as subjects authorized and instructed by the Data Controller (iii) by third parties (suppliers of technical, technological, postal services and service providers instrumental to the provision of services/products covered by the contract; call centers, marketing and advertising services and market research companies for activities subject to the consent of the Data Subject) duly appointed as Data Processors by Edison Next.
The data will mainly be processed in Italy and in states that are part of the European Union, however some processing activities could be carried out in countries that are not part of the European Union, guaranteeing in any case the necessary standards of protection required by national and supranational legislation, such as the adoption of Standard Contractual Clauses approved by the European Commission. To obtain a copy of the data transferred abroad or to find out the geographical location of the data, it will be possible to contact the Data Protection Officer at the addresses indicated in this policy.

7. Dissemination of data

The personal data of the Data Subject without his specific authorization will not be disclosed in any way except as required by law.

8. Data Controller and Data Processors

The Data Controllers, i.e. the subject who determines the purposes, are Edison Next S.p.A. and its subsidiaries, that operate as independent processors. The Data Processors, that is the subjects that carry out the processing on behalf of the Data Controller, are the companies of the Edison Group and the service providers appointed as such pursuant to Regulation 2016/679 by the Data Controller.

9. Data Protection Officer

Edison Next has appointed the Data Protection Officer ("DPO") to which the Data Subject can turn to request any information concerning the processing of their personal data and exercise the rights referred to in point 10) below, as well as request a complete list of appointed data processors. This figure, provided for by the Regulation to protect the rights of data subjects, has been identified as a common reference of the Edison Group Companies subject to management and coordination or controlled by Edison S.p.A. and other companies within the corporate perimeter.

10. Exercise of rights

Pursuant to the Regulation, the Data Subject has the right to access their data, in particular to obtain at any time the confirmation of the existence or not of your data and to know its content and origin. You also have the right to verify their accuracy or request their integration, updating, rectification, limitation of processing, cancellation, transformation into anonymous form or blocking of data processed in violation of the law, and to object in any case, for legitimate reasons, to their processing. The Data Subject can exercise his rights by writing to the attention of the Data Protection Officer through:

Ordinary e-mail: privacy.edisonnext@gruppoedison.it

Certified e-mail: privacy.gruppoedison@pec.edison.it

Fax: 02/62229106

Postal mail: DPO c/o Edison Spa, Foro Buonaparte 31, 20121 Milano