Privacy Policy of the Plenitude On The Road App 

Pursuant to Regulation (EU) 2016/679 ("GDPR" or "Regulation") Plenitude On The Road S.r.l. ("Plenitude On The Road" or "Data Controller") provides below the information note regarding the processing of personal data of users ("Users") of the "Plenitude On The Road" application managed by Plenitude On The Road ("App"), which will take place in compliance with the provisions of the Regulation. In particular, this information note is addressed to:

a) users registered on the App, i.e. users who have completed the registration process on the App within 30 days and have created an account on the App (“Registered User”);

b) users not registered on the App who top up in so-called guest mode without having created an account (“Unregistered User” or “Guest”);

c) users who have downloaded the App without completing the registration process or using the App in guest mode (“Downloader”).

1. DATA CONTROLLER

The data controller is Plenitude On The Road S.r.l., with registered office in Via Carlo Bo 11, 20143 Milan (MI), which can be contacted at the email address: privacy@service.emob.eniplenitude.com.

2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)

Plenitude On The Road has appointed a Data Protection Officer, who can be contacted at the following email address: dpo@eniplenitude.com.

3. PURPOSE, LEGAL BASIS OF THE PROCESSING, NATURE OF THE PROVISION OF DATA AND STORAGE OF PERSONAL DATA

A) Registered Users

The personal data of Registered Users will be processed by Plenitude On The Road for the following purposes:

I. provision and use of the services offered through the App;

II. management of the assistance service and requests for information;

III. fulfilment of legal obligations, regulations, provisions of Authorities legitimated by law;

IV. assessment, exercise or defence of a right of Plenitude On The Road or of third parties and corporate transactions;

V. sending by the Data Controller of editorial communications concerning electric mobility and related topics via email;

VI. sending by the Data Controller of promotional and commercial communications relating to products and services of Plenitude On The Road, Group companies or its partners;

VII. sending by the Data Controller of personalised promotional and commercial communications relating to Plenitude On The Road products and services;

VIII. communication of Registered Users' data to Plenitude On The Road's business partners for the latter to send promotional and/or commercial communications relating to their products and services;

IX. implementation of aggregated statistical analyses.

I. Provision and use of the services offered through the App

The personal data of Registered Users will be processed by the Data Controller to allow the provision of the various services accessible to Registered Users via the App ("Services") requested by the latter by registering on the App, for example:

a. creation of the account;

b. provision of charging services;

c. purchase of products such as, for example, RFID cards, subscriptions, prepaid cards;

d. participation in the Loyalty Be Together program ("Loyalty Be Together").

In addition to the data requested from the Registered User to provide the aforementioned Services, the Data Controller may request further personal data in the event that these are necessary for the provision of specific services or products requested by the User.

In the event that the Registered User should create an account associating the billing profile of a third party (for example, the employer), the Data Controller may have to share with the third party the data relating to the top-ups carried out, on the basis of special agreements between the third party and Plenitude On The Road for the management of the service provided by the Data Controller.

The legal basis of the processing is the performance of the contract to which the Registered User is a party and/or of the pre-contractual measures adopted at the request of the same (art. 6, par. 1, letter b) GDPR) and therefore to ensure the provision of the Services to the Registered User as provided for in the Terms and Conditions of the App.

In the event that the Registered User adheres to Loyalty Be Together, the data processing will be carried out in accordance with the provisions of the specific information note.

The provision of data is mandatory for the use of the Services; therefore, failure to 2 provide data will not allow the use of the App's features reserved for Registered Users.

The personal data of Registered Users collected to guarantee the use of the Services will be kept for the entire duration of the contractual relationship with the Registered User and for 10 years from the termination of the contractual relationship, in order to allow Plenitude On The Road to defend itself against possible claims made in relation to the contractual relationship itself.

In the event that the User does not complete the registration process to the App within 30 days, and therefore does not become a Registered User, the data provided by the User up to that point will be deleted.

II. Management of the assistance service and requests for information

The personal data of Registered Users will be processed by the Data Controller to allow the correct management of requests for information and assistance sent to customer care by Registered Users.

The legal basis of the processing is the performance of the contract to which the Registered User is a party and/or of the pre-contractual measures adopted at the request of the same (art. 6, par. 1, letter b) GDPR) and therefore to ensure that the Registered User receives feedback from Plenitude On The Road regarding their requests for assistance and/or information.

The provision of data is not mandatory; failure to provide them will not allow Plenitude On The Road to take charge of requests for information and assistance.

The personal data of Registered Users provided by sending requests to customer care will be kept for the entire duration of the contractual relationship with the Registered User and for 10 years from the termination of the contractual relationship, in order to allow Plenitude On The Road to defend itself against possible claims made in relation to the contractual relationship itself.

III. Fulfilment of legal obligations, regulations, provisions of Authorities legitimated by law

The personal data of Registered Users will be processed by the Data Controller for the purposes of fulfilling legal obligations, regulations and provisions of Authorities legitimated by law.

The legal basis of the processing is therefore the fulfilment of legal obligations, regulations and provisions of Authorities legitimised by law to which Plenitude On The Road is subject (art. 6, par. 1, letter c) GDPR), as Data Controller.

The personal data of Registered Users will be kept for the time necessary for the fulfilment of these obligations and in particular for 10 years from the end of the fiscal 3 year following the issuance of invoices for administrative-accounting purposes.

IV. Assessment, exercise or defence of a right of Plenitude On The Road or of third parties and corporate transactions

The personal data of Registered Users will be processed by the Data Controller:

a) for the purposes of verifying, exercising or defending a right of Plenitude On The Road or of third parties (for example, for the management of legal disputes and/or transactions);

b) for the performance of preparatory activities for, and in the context of, any corporate transactions (for example, due diligence, merger, demerger, acquisition, transfer of assets and/or business units, etc.);

c) for the management of any complaints and/or disputes.

The legal basis for the processing is the legitimate interest of the Data Controller and/or of third parties to exercise the right to defend and protect the rights and/or interests of Plenitude On The Road and/or of third parties and to carry out any corporate transactions (art. 6, par. 1, letter f) GDPR).

The personal data of Registered Users will be kept for the time necessary to protect the rights and/or interests of Plenitude On The Road and/or of third parties and to carry out any corporate operations, in compliance with the ordinary limitation periods.

V. Sending by the Data Controller of editorial communications concerning electric mobility and related topics via email

The personal data of Registered Users will be processed by Plenitude On The Road for the purpose of sending editorial communications via e-mail, including insights on topics such as news related to the world of electric mobility, travel itineraries, and sustainability.

The legal basis of the processing is the legitimate interest of Plenitude On The Road to keep Registered Users updated on the topic of electric mobility and on the related topics (art. 6, par. 1, letter f) GDPR).

Registered Users may at any time request not to receive such communications (so-called opt-out), by clicking on the appropriate link present in each communication sent via email by Plenitude On The Road.

The personal data of Registered Users will be kept until they object.

VI. Sending by the Data Controller of promotional and commercial communications relating to products and services of Plenitude On The Road, of companies of the Group or of its partners

The personal data of Registered Users may be processed for the sending by the Data Controller, by email and/or through notifications via App, of promotional and commercial communications concerning:

a) Plenitude On The Road products and services; and/or

b) products and services of the companies of the group to which Plenitude On The Road belongs (Eni Plenitude S.p.A. Società Benefit; Plenitude Energy Services S.p.A.; ENI S.p.A.; Enilive S.p.A.); and/or

c) products and services of other Plenitude On The Road partners (e.g. relating to automotive, travel, tourism and hospitality, energy).

The legal basis of the processing is the specific and freely provided consent of the Registered User (art. 6, par. 1, letter a) GDPR.

Consent to the processing of data for this purpose is optional and may be revoked by the Registered User at any time in the manner described below. Failure to consent or its revocation will not have any consequence on the possibility of using the Services by the Registered User.

The personal data provided for this purpose will be kept for 24 months from the granting consent, unless the Registered User revokes his/her consent:

a) by entering his/her personal area of the App in the "Profile" > "Contractual Documents and Privacy" section; or

b) by clicking on the appropriate link in each communication sent by email from Plenitude On The Road. Any revocation of consent will not affect the lawfulness of processing based on consent prior to withdrawal.

VII. Sending by the Data Controller of personalised promotional and commercial communications relating to Plenitude On The Road products and services

The personal data of Registered Users may be processed for the sending by the Data Controller, by email and through notifications via the App, of personalised communications of a promotional and/or commercial nature, relating to Plenitude On The Road products and services and to Loyalty Be Together.

Personalisation of communications is determined in light of the following criteria:

a) purchasing and/or charging behaviour of the Registered User in the App (for example, preferred charging stations, purchase of RFID cards);

b) interaction with the App (for example, sections visited);

c) personal and preference data (for example, address of the Registered User, prevailing country, selected language).

The legal basis of the processing is the specific and freely provided consent of the Registered User (art. 6, par. 1, letter a) GDPR).

Consent to the processing of data for this purpose is optional and may be revoked by the Registered User at any time in the manner described below.

Failure to consent or its revocation will not have any consequence on the possibility of using the Services by the Registered User.

The personal data provided for this purpose will be kept for 24 months from the granting consent, unless the Registered User revokes his consent:

a) by entering his/her personal area of the App in the "Profile" > "Contractual Documents and Privacy" section; or

b) by clicking on the appropriate link in each communication sent by email from Plenitude On The Road.

Any revocation of consent shall not affect the lawfulness of the processing based on consent before revocation.

VIII. Communication of Registered Users' data to Plenitude On The Road's commercial partners for the latter to send promotional and/or commercial communications relating to their products and services

The personal data of Registered Users will be communicated by Plenitude On The Road to its business partners for the sending of promotional and/or commercial communications relating to their products or services. In particular, the data may be communicated by Plenitude On The Road to the following business partners:

a) companies of the group to which Plenitude On The Road belongs (Eni Plenitude S.p.A. Società Benefit; Plenitude Energy Services S.p.A.; ENI S.p.A.; Enilive S.p.A.); or

b) other Plenitude On The Road business partners (e.g. automotive, travel, tourism and hospitality, energy).

The legal basis of the processing is the specific and freely provided consent of the Registered User (art. 6, paragraph 1, letter a) GDPR).

Consent to the processing of data for this purpose is optional and may be revoked by the Registered User at any time in the manner described below. Failure to consent or its revocation will not have any consequence on the possibility of using the Services by the Registered User.

The personal data provided for this purpose will be kept for 24 months from the granting consent, unless the Registered User revokes his consent:

a) by entering his/her personal area of the App in the "Profile" > "Contractual Documents and Privacy" section; or

b) by clicking on the appropriate link in each communication sent by email from Plenitude On The Road.

Any revocation of consent shall not affect the lawfulness of the processing based on consent before revocation.

IX. Carrying out aggregate statistical analyses

The personal data of Registered Users collected during the use of the App, also through the tracking tools it uses (such as, for example, Appsflyer and Firebase SDKs), will be processed to generate aggregated and anonymous statistics relevant or pertinent to the activity carried out by Plenitude On The Road within the App.

The legal basis of the processing is the legitimate interest of Plenitude On The Road to evaluate the Services offered through the App, in order to improve its functionality and features based on its use (art. 6, par. 1, letter f) GDPR).

In any case, personal data processed for statistical purposes will not be used to make decisions or measures aimed at individual Users, nor to pursue other purposes.

B) Unregistered Users

The personal data of Unregistered Users will be processed by Plenitude On The Road for the following purposes:

I. provision and use of the charging service through the App;

II. management of the assistance service and requests for information;

III. fulfilment of legal obligations, regulations, provisions of Authorities legitimated by law;

IV. assessment, exercise or defence of a right of Plenitude On The Road or of third parties and corporate transactions;

V. implementation of aggregated statistical analyses.

I. Provision and use of the recharging service via the App

The personal data of Unregistered Users will be processed by the Data Controller to allow the provision of the top-up service to Unregistered Users, who use the App as guests (not having completed registration and not having created an account but having exclusively created a billing profile).

The legal basis of the processing is the performance of the contract to which the Unregistered User is a party and/or of the pre-contractual measures adopted at the request of the same (art. 6, par. 1, letter b) GDPR) and therefore to guarantee the provision of the charging service to Unregistered Users in accordance with the provisions of the Terms and Conditions of the App.

The provision of data is mandatory for the use of the services offered by the App as an Unregistered User; therefore, failure to provide data will not allow the use of the App's 7 features provided for Unregistered Users.

The personal data of Unregistered Users collected to guarantee the use of the charging service offered through the App (billing data) will be kept for 10 years from the date of issue of each invoice, in order to allow Plenitude On The Road to defend itself against possible claims made in relation to the provision of the charging service by Plenitude On The Road.

II. Management of the assistance service and requests for information>

The personal data of Unregistered Users will be processed by the Data Controller to allow the correct management of requests for information and assistance sent to customer care.

The legal basis of the processing is the performance of the contract to which the Registered User is a party and/or of the pre-contractual measures adopted at the request of the same (art. 6, par. 1, letter b) GDPR) and therefore to ensure that the Unregistered User receives feedback from Plenitude On The Road regarding their requests for assistance and/or information.

The provision of data is not mandatory; failure to provide these will not allow Plenitude On The Road to take charge of requests for information and assistance.

The personal data of Unregistered Users provided by sending requests to customer care will be kept according to the following criteria:

a) in the case of requests for information, the data will be kept for the time necessary to provide feedback on the request and for one year from the last interaction with the Unregistered User;

b) in the case of requests for assistance and complaints and/or reports, the data will be kept for 10 years from the last recharge made, in order to allow Plenitude On The Road to defend itself against possible claims made in relation to the provision of the recharging service by Plenitude On The Road.

III. Fulfilment of legal obligations, regulations, provisions of Authorities legitimated by law

The personal data of Unregistered Users will be processed by Plenitude On The Road for the purposes of fulfilling legal obligations, regulations and provisions of Authorities legitimised by law.

The legal basis of the processing is therefore the fulfilment of legal obligations, regulations and provisions of Authorities legitimised by law to which Plenitude On The Road is subject (art. 6, par. 1, letter c) GDPR), as Data Controller.

These include, in particular, the obligation to retain the billing data relating to each 8 top-up made by the Unregistered User.

For each refill made, the data will be kept for 10 years from the end of the fiscal year following the issuance of the invoice for administrative-accounting purposes.

IV. Assessment, exercise or defence of a right of Plenitude On The Road or of third parties and corporate transactions

The personal data of Unregistered Users will be processed by the Data Controller:

a) for the purposes of verifying, exercising or defending a right of Plenitude On The Road or of third parties (for example, for the management of legal disputes and/or transactions);

b) for the performance of preparatory activities for, and in the context of, any corporate transactions (for example, due diligence, merger, demerger, acquisition, transfer of assets and/or business units, etc.);

c) for the management of any complaints and/or disputes.

The legal basis for this processing is the legitimate interest of the Data Controller and/or of third parties to exercise the right to defend and protect the rights and/or interests of Plenitude On The Road and/or of third parties and to carry out any corporate transactions (art. 6, par. 1, letter f) GDPR).

The personal data of Unregistered Users will be kept for the time necessary to protect the rights and/or interests of Plenitude On The Road and/or third parties and to carry out any corporate operations, in compliance with the ordinary limitation periods.

V. Conducting aggregated statistical analyses

The personal data of Unregistered Users collected during the use of the App, including the tracking tools it uses (such as, for example, Appsflyer and Firebase SDKs), will be processed to generate aggregated and anonymous statistics related or relevant to the activity carried out by Plenitude On The Road within the App.

The legal basis of the processing is the legitimate interest of Plenitude On The Road to evaluate the services offered through the App, in order to improve its functionality and features based on its use (art. 6, par. 1, letter f) GDPR).

In any case, personal data processed for statistical purposes will not be used to make decisions or measures aimed at individual Users, nor to pursue other purposes.

C) Downloader

The personal data of Users who have downloaded the App, without registering for the App or using the App in guest mode, will not be processed by Plenitude On The Road.

No personal data relating to the Downloader will be stored or processed, except for the following cases:

a) the Downloader agrees to receive push notifications from the App via their device settings, or

b) the Downloader clicked on an ad on Google or Meta that directed them to the app store on their device to download the App.

In these cases, Plenitude On The Road will associate each Downloader exclusively with an ID, which will make the Downloader's device identifiable and, only where the Downloader has activated the location in the App on his/her device, the area of origin of the connection.

4. SCOPE OF COMMUNICATION AND RECIPIENTS OF PERSONAL DATA

The processing of personal data will be carried out, for the purposes described above, by Plenitude On The Road's internal staff, expressly authorised and instructed in the processing of personal data. Personal data may also be disclosed for the purposes outlined to the following entities:

a. subjects who perform services on behalf of Plenitude On The Road, appointed data processors (for example, IT service providers);

b. public or private entities (for example, insurers, banks, legal advisers, public authorities, judicial bodies, revenue agencies), who will process them as independent data controllers;

c. subjects who carry out promotional and advertising activities through advertising banners included in the App;

d. with prior consent, to third parties, as independent data controllers, for sending commercial communications relating to their products and services.

The Users' personal data will not be disclosed.

5. TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA (“EEA”)

Users' personal data will be transferred outside the European Economic Area; in particular, the data will be stored on the servers of the provider HubSpot, Inc., based in the United States, which has adhered to the Data Privacy Framework.

6. RIGHTS OF THE DATA SUBJECT

Pursuant to the Regulation and in the cases provided for by the Regulation, Users may exercise the rights referred to in Articles 15 et seq. of the GDPR and in particular:

• right of access: ask the Data Controller for confirmation as to whether or not data processing is in progress and, where that is the case, ask the Data 10 Controller for access to information relating to the processing itself;
• right to rectification: ask the Data Controller to rectify inaccurate or incomplete data;
• right to erasure: ask the Data Controller to erase the data;
• right to restriction of processing: ask the Data Controller to restrict the processing;
• right to data portability: ask the Data Controller to receive, in a commonly used and machine-readable format, the data concerning them or to obtain direct transmission to another data controller, where technically feasible;
• right to object: Users also have the right to object in whole or in part, for legitimate reasons and in the cases provided for by the GDPR, to the processing of data concerning them.

Without prejudice to any other administrative or judicial remedy, the data subject who considers that the processing concerning him/her violates the GDPR has the right to lodge a complaint with the supervisory authority of the Member State in which he/she usually resides or works, or of the State in which the alleged violation occurred.

Users may exercise the rights listed above:

• by sending an email to the email address: privacy@service.emob.eniplenitude.com;
• by contacting the DPO at the following address: dpo@eniplenitude.com.