ITENDE
Sign in to the portal

Privacy policy

Notice pursuant to Art. 13 of Regulation (EU) 2016/679. Last updated: 5 October 2026.

This privacy policy describes how Energy S.p.A. collects and processes your personal data when you use the zeroCO2 portal (the "Application"), including access through third-party artificial intelligence assistants, in compliance with Regulation (EU) 2016/679 (GDPR) and national legislation.

We reserve the right to update this policy. Please check this page regularly for the latest information.

1. Data controller

The data controller is Energy S.p.A., with registered office in Piazza Manifattura n. 1, 38068 Rovereto (TN), Italy, operational headquarters in via Zona Industriale n. 10, 35020 Sant'Angelo di Piove di Sacco (PD), Italy, VAT number IT02284640220, phone +39 049 2701296, e-mail amministrazione@energysynt.com, certified e-mail (PEC) energy@pec.energysynt.com ("Energy" or the "Controller").

2. Data collected, purposes and legal bases

We collect and process your personal data exclusively for the following purposes.

Data provided directly by the User

Registration and profile data: for example name, surname, username, password, address, serial number of the User's machine. Providing these data is necessary to create the profile and to deliver the services related to the Application.

  • Purposes: to enable access to the Application, create and manage your account, provide the Application's features, and deliver the requested assistance, support and machine update services.
  • Legal basis: performance of a contract to which the User is a party (Art. 6(1)(b) GDPR).

Data collected automatically

Consumption data: data on the consumption of the User's property where the machine is installed.

  • a) Purposes: to collect data, display information, allow the User to monitor their consumption, analyse data and generate alerts in case of anomalies. Legal basis: performance of a contract to which the User is a party (Art. 6(1)(b) GDPR).
  • b) Purposes: analysis of aggregated consumption data of the property where the machine is installed, to verify consumption trends and improve the efficiency of Energy products with the energy management system. The data are processed in aggregated form, without linking consumption to individual users. Legal basis: the Controller's legitimate interest in improving its products (Art. 6(1)(f) GDPR).

Usage and technical data: for example device type, device identifiers, features used.

  • Purposes: to ensure the technical functioning of the Application, resolve technical issues, improve its performance, develop new features and keep our systems secure. This processing is carried out on aggregated or pseudonymised data.
  • Legal basis: the Controller's legitimate interest in providing the User with a secure and efficient service (Art. 6(1)(f) GDPR).

We may also process your data to comply with legal obligations or requests from judicial or administrative authorities. The legal basis is compliance with the legal obligations to which the Controller is subject (Art. 6(1)(c) GDPR).

3. Access through third-party artificial intelligence assistants

The User may connect a third-party artificial intelligence assistant (for example Anthropic's Claude or OpenAI's ChatGPT) to their account to consult the data of their own plants in natural language. The connection is made on the User's initiative, with the User's credentials, and can be revoked at any time from the settings of the chosen provider.

When the User asks the assistant a question, the provider sends our systems a data request (User identifier, serial number and request parameters) and receives in response the plant data the User is entitled to see (for example production, consumption, battery status, plant registry data). The assistant provider processes these data and the text of the conversation as an independent data controller, under its own privacy notice. The Controller does not receive the text of the conversation and does not transmit data to assistant providers except at the User's request, through the activated connection.

For each assistant request we record, for security and traceability purposes, the identifier of the user and of the authorised application, the tool used, the serial number of the device consulted, a fingerprint (hash) of the parameters, the outcome and the duration. We do not record the text of conversations, the other parameters, personal registry data or the IP address.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

4. Processing methods

Data are collected electronically, protected against destruction, alteration, deletion and unauthorised access through appropriate physical, logical and organisational security measures, and processed, also manually, only to the extent and for the time strictly necessary for the purposes stated.

Data may be processed, for the purposes of points 2 and 3, by people within the Controller's internal organisation, authorised and instructed according to their duties, and by external parties necessary for the functioning of the Application and the delivery of the requested services, appointed as data processors under Art. 28 GDPR. There is no automated profiling.

5. Data recipients

Data may be disclosed to people within the Controller's organisation authorised to process them and to providers of services connected to the operation of the Application or otherwise necessary to deliver the services requested by the User, acting as data processors or independent controllers depending on the processing and context. Data may be disclosed to authorities where required by law or by a lawful order of a judicial or administrative authority. Data are not disseminated or transferred to countries outside the EU or to international organisations.

In particular, data may be disclosed to:

  • cloud hosting and infrastructure providers with servers located in the European Union;
  • the artificial intelligence assistant providers chosen by the User, within the limits of point 3;
  • authorised installers and distributors, limited to the plants they installed or distribute, for assistance and maintenance purposes.

6. Retention period

Data are retained for the period necessary to achieve each purpose. Account data are retained for the whole life of the account and for a short period afterwards for administrative needs. Technical and usage data are retained for shorter periods, for analysis and improvement.

Technical logs of requests to our systems, including those coming from artificial intelligence assistants, are retained for 30 days and then deleted automatically.

7. Nature of the provision of data

Providing the requested personal data is necessary to access and use the Application. Refusing to provide them, in whole or in part, may make it impossible to access the Application's services.

8. Your rights

You have the right to access your data, to request their rectification, erasure or restriction of processing, to object to processing and to data portability. You can exercise your rights by writing to amministrazione@energysynt.com or to the certified e-mail energy@pec.energysynt.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).