To manage your relations with us, CaixaBank Payments & Consumer will process your personal data for different purposes, always in accordance with the applicable laws, respecting your rights and with complete transparency.
For this purpose, in this Privacy Policy, which you can access at any time at https://www.caixabankpc.com/politicaprivacidad, you can see complete details on how we will use your data in the relationships we establish with you.
The main regulations that regulate our processing of your personal data are:
> Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the GDPR)
> Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (hereinafter the LOPD)
Data controller: The data controller for your personal data for contractual relations and business with us (''Contractual Relations'') is CaixaBank Payments & Consumer, E.F.C., E.P., S.A. (''CaixaBank Payments & Consumer' or "Entity"'), with tax ID A-08980153 and registered address at Avenida de Manoteras No. 20. Edificio Paris. 28050 Madrid.
Joint data controllers: furthermore, for certain processing, detailed information for which is provided in this policy, CaixaBank Payments & Consumer will jointly process your data with other companies, jointly deciding on the purposes (''what the data is used for'') and the resources used (''how the data is used''), which thus makes them the joint data controllers.
The purposes for which CaixaBank Payments & Consumer will jointly process your data with other companies are described in detail in heading 6 ''Types of data processing''.
In addition, you will find the list of companies that process your data, as well as the essential aspects of the joint data controller agreements at www.caixabank.es/empresasgrupo.
You can exercise your rights to access, rectify, object to processing, delete, restrict processing, transfer your personal data, withdraw consent and not be subject to automated decision-making in accordance with law.
You can exercise these rights through any of the following channels:
> at CaixaBank, S.A. branches open to the public;
> by using the options provided in your private space on the website www.caixabankpc.com and in our mobile applications;
> at the website: www.caixabankpc.com/ejerciciodederechos; and
> by sending a letter to Apartado de Correos nº 209, Valencia 46080.
Additionally, if you have any complaints related to the processing of your data, you may address them to the Spanish Data Protection Agency (www.aepd.es).
CaixaBank Payments & Consumer and the CaixaBank Group companies have appointed a Data Protection Officer, who will deal with any matters related to the processing of your personal data and the exercise of your rights.
You can contact the Data Protection Officer to send your suggestions, queries, questions or claims at this address: https://www.caixabank.es/particular/general/dpo_es.html
The following data will be used in the processing operations outlined in this Policy.
Not all the data we inform you about is used for all data processing. You can consult the specific type of data processed for each processing operation in section 6, detailing the data processing operations that we perform.
Regarding processing operations subject to your consent, we will also inform you of the details of the specific data used.
The types and details of the data used in the different processing operations described in section 6 are as follows:
Data you provided when registering for a service or during your relationship with us, through interviews or forms.
The data types and details are as follows:
Data observed during the contracting and maintenance of marketed products and services (own or third-party).
The data types and details are as follows:
Data inferred or deduced by analysing and processing other data.
The data types and details are as follows:
Data obtained from public access sources, public records or external sources.
The data types and details are as follows:
These databases have been authorised in advance to contain this information.
We process your data for various purposes and legal reasons:
In addition to the general processing detailed below, we may carry out specific processing operations not mentioned in this policy in response to your requests for products or services. Detailed information on these processing operations will be provided to you at the time of processing the specific request.
PROCESSING BASED ON YOUR CONSENT
The legal basis for this processing is your consent, as laid out in Article 6.1.a) of the General Data Protection Regulation (GDPR).
We may have requested this consent through different channels during your customer registration interview, through your adviser (remotely or in person), through digital channels or mobile applications, through any company with which we maintain a collaboration agreement ("Advisors"), through any channel of Bankia, S.A. prior to its merger with CaixaBank, or any CaixaBank Group company that is a joint data controller of the specific processing operation.
If, for any reason, we have never asked you for your consent, this processing will not apply to you.
You can view the consent you have given or denied and change your decision at any time and for free at CaixaBank branches, on the CaixaBank Payments & Consumer website (www.caixabank.es) and on the websites of each of the companies jointly responsible for the specific processing, or through your online account or the CaixaBank Payments & Consumer mobile apps.
Processing based on your consent is indicated below from (A) to (E). For each item, we will provide: a description of the purpose (Purpose), the details of the processed data (types of data processed), if applicable, information on the use of profiles (Use of profiles), other relevant processing information (Other relevant information) and whether or not the processing is carried out jointly with other CaixaBank Group companies (Joint data controllers/Data controller).
In the event that you gave Bankia your consent to process your data for commercial purposes, and not CaixaBank, prior to their merger, CaixaBank will carry out processing operations A, B and C, as indicated below, in accordance with the preferences you indicated to Bankia at that time.
Specifically, the processing described in items A and B below will only be carried out by CaixaBank Group companies as joint controllers when you have consented to the communication of data between Bankia group companies (now CaixaBank).
A. Personalisation of products and services offered based on the analysis of your data
Purpose: If we have your consent, we will use the data indicated below to create a commercial profile for you, which will allow us to define your preferences or needs and offer you, through your adviser (in-person or virtual), products and services marketed by companies acting as joint data controllers that we believe may interest you according to those preferences and needs.
By processing your data, we can make customised offers that may be of more interest to you than generic offers.
In addition, if you authorise us to "Inform you of the products and services available through channels" (Section 6.1.B), we will offer you products and services from joint data processors that we believe may interest you based on the preferences and needs we deduce for you, through any other channel that you authorise us to
Data processed: We will not process data that contains information that reveals your ethnicity or race, your political opinions, religious or philosophical convictions, union membership, the processing of genetic data, biometric data intended to uniquely identify you, health data or data relating to your sex life or orientation.
For this purpose, we will process the following data:
Use of profiling: For this processing, we will create a business profile that we will use exclusively to customise the products and services we offer you:
We do not use this profiling, under any circumstances, to refuse any product or service, or to set credit limits. Refusal to accept this processing will not prevent, limit or condition your access to our full catalogue of products and services, which is always available to you.
If you apply for any product or service, your application will be assessed in accordance with our regular procedures. The acceptance or non-acceptance of the analysis of your data for the purpose of customising the products or services offered will not affect this assessment.
Your non-acceptance of this processing will not prevent us from contacting you to manage the products and services you have with us.
These data are applied to mathematical formulas obtained from past behaviours observed in clients of similar characteristics to infer the customer's future behaviour. These mathematical formulae allow us to determine the importance of all the data processed in the final result of the applicant's profile.
This final result is the probability that the customer will be interested in a product or service.
Other relevant information: The following section includes other relevant data processing information:
We will carry out this check by means of the processing outlined in section 6.2.B of this Privacy Policy, with the aim of offering you a credit limit and repayment term suited to our knowledge of your financial situation, in accordance with the principle of responsibility regarding the offer of financing products required by the Bank of Spain, under regulations on the oversight and solvency of credit institutions and responsible lending.
Not accepting this processing does not prevent, limit or condition your access to our catalogue of financing products and services. If you request them, we will evaluate them with you in accordance with our standard procedures.
Joint data controllers: The following CaixaBank Group companies will process your data jointly.
You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.
B. Notification of products and services through channels
Purpose: If we have your consent, we will make our range of products and services available to you only via the following channels authorised by you: mobile applications, digital environments and electronic channels, letter or telephone.
The data we will use to communicate through the channels that you authorise will vary depending on whether you have authorised us to customise our product offerings by analysing your data:
Data processed: We will not process data that contains information that reveals your ethnicity or race, your political opinions, religious or philosophical convictions, union membership, the processing of genetic data, biometric data intended to uniquely identify you, health data or data relating to your sex life or orientation.
For this purpose, we will process the following data:
- Data relating to the personalisation of products and services offered according to analysis of your data: if you have given us your consent to personalise our commercial offer to you (processing A above), we will also use your commercial profile information as detailed in processing 6.1. A of our Privacy Policy to inform you of personalised offers.
Other relevant information: The following section includes other relevant data processing information:
Joint data controllers: The following CaixaBank Group companies will process your data jointly:
You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.
C. Disclosure of data to other companies so they can send you advertising.
Purpose: If we have your consent, we will transfer the data indicated below to companies with which we have agreements so that they may send you offers of their products and services.
If you do not consent to this processing, we will not transfer your data; if you do consent, the data we transfer to other companies will vary depending on whether you have authorised us to customise our product offerings by analysing your data:
These third-party companies to which we may transfer your data undertake the following activities:
Data processed: We will not process data that contains information that reveals your ethnicity or race, your political opinions, religious or philosophical convictions, union membership, the processing of genetic data, biometric data intended to uniquely identify you, health data or data relating to your sex life or orientation.
For this purpose, we will process the following data:
- Data relating to the personalisation of products and services offered according to analysis of your data: if you have given us your consent to personalise our commercial offer to you (processing A above), we will also use your commercial profile information as detailed in processing 6.1. A of the Privacy Policy, so that we can send you personalised offers.
Other relevant information: The following section includes other relevant data processing information:
Joint data controllers: The following CaixaBank Group companies will process your data jointly:
You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.
D. Identification of customers and signing documents using biometrics
Purpose: With your consent, we will employ technical tools using biometrics to confirm your identity and sign transactions or contracts with CaixaBank Payments & Consumer.
Data processed: For this purpose, we will process the following data:
Other relevant information: The following section includes other relevant data processing information:
Data Controller: The data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.
PROCESSING REQUIRED FOR CONTRACTUAL RELATIONSHIPS
The legal basis of this data processing is that it is necessary to manage contracts that you request or to which you are a party, or to apply precontractual measures if you request them, as established in art. 6.1.b) of the General Data Protection Regulation (GDPR).
Therefore, this processing is necessary for you to establish and maintain Contractual Relations with us. If you object to it, we will end these relations, or we cannot establish them if they have not yet started.
The types of processing required to establish contractual relations are listed below, arranged from (A) to (B).For each item, we will provide: a description of the purpose (Purpose), the type of data processed (Type of data processed), if applicable, information on the use of profiles (Use of profiles), other relevant processing information (Other relevant information) and whether or not the processing is carried out jointly with other CaixaBank Group companies (Joint data controllers/Data controller).
A. Signing, maintenance and performance of Contractual Relations
Purpose: The purpose of this data processing is to formalise and maintain the Contractual Relationships established between you and us, including the processing of your requests or orders, the steps prior to entering into a contract (pre-contractual relationships), processed with us directly or through one of our intermediaries (such as our agent CaixaBank, S. A. or any of our advisors, who have commercial establishments of which you may be a customer), and the implementation of measures to ensure compliance with the contracts you sign with us and, where appropriate, the management of debt recovery.
This data processing involves collecting the information necessary to establish or to manage the application, to evaluate the suitability of the product and to process the information needed to properly maintain and execute the contracts.
The processing activities involved in signing, maintaining and performing the Contractual Relations are:
Other relevant information: The following section includes other relevant data processing information:
The establishment of these objective criteria derives from regulatory obligations regarding the governance of financial products and instruments and is included in the bank's internal product design policies.
If the product is deemed to be unsuitable, the applicant may not contract it, and the application will be automatically rejected as the applicant's objective criteria are incompatible with those of the specific requested product or service.
You may challenge the automated decision or exercise your right not to be subject to a decision based solely on automated processing by contacting CaixaBank Payments & Consumer directly through the channels set out in section 4 of this policy.
For example, if you take out a product or service that gives you the right to receive discounts because you belong to a specific professional group, such as healthcare or law enforcement, we will verify during our contractual relationship that you still belong to said group. In addition, if you share a product or service with other account holders, they may realise that you satisfy this characteristic when they see these discounts applied to the account.
Data Controller: The data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.
Furthermore, if the product or service you apply for is marketed by CaixaBank Payments & Consumer but issued by another company, said other company will be responsible for processing your data in relation to that contract.
This means that if you take out through CaixaBank Payments & Consumer, as the associated banking-insurance operator, an insurance plan issued by VidaCaixa or SegurCaixa, these companies will be the controllers of your data as the issuers of the products.
We will inform you about this in detail in the contractual documentation for each product or service.
B. Analysis of creditworthiness and repayment capacity for the granting and monitoring of credit risk.
Purpose: The purpose of this data processing is to assess whether applicants and/or holders for products or services that involve the repayment of loans or credits, or deferred instalments, have the solvency and repayment capacity needed to make the payments required as part of the operations in question.
Detailed information on the solvency and repayment capacity analysis process that will be carried out when you apply for or have already been granted transactions involving the repayment of loans or credits, or the deferred payment of instalments, will be provided in the transaction request you will be required to sign when you apply for these products.
The processing activities carried out to analyse the solvency or repayment capacity of applicants and/or holders of products involving financing are:
Types of data processed: The types of data we will process for this purpose (the content of which is detailed in heading 5) are:
Use of profiling: For this processing, we will create a risk profile that will be used exclusively to analyse the solvency and repayment capacity of applicants and/or holders of products involving financing.
Transactions requested through electronic channels may involve automated decisions on whether to grant the transaction, as detailed in the section "Other relevant information".
This basic information is used to assign a specific value to each piece of data on the applicant, the sum of which produces a score indicating the probability of default or non-compliance with monetary obligations.
The importance of each variable and its influence on the final result is calculated in advance using mathematical models and is included in the institution's internal risk policies.
Other relevant information: The following section includes other relevant data processing information:
If the requested financing is deemed unsuitable for your repayment capacity according to the profile calculations employed, you will not be able to contract the product, and your application will be rejected automatically in this channel.
You may resubmit an application for the transaction at one of our branches, where the analysis does not include automated decisions, challenge the automated decision or exercise your right not to be subject to a decision based solely on automated processing by contacting CaixaBank Payments & Consumer directly through the channels set out in section 4 of this policy.
Joint data controllers: Sector regulations on the prudential and solvency requirements that apply to the financial sector require that a credit operation be granted to customers and monitored jointly by all the companies that comprise the same consolidated group of credit institutions.
The following CaixaBank Group companies will process your data jointly.
You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.
PROCESSING REQUIRED TO COMPLY WITH REGULATORY OBLIGATIONS
The legal basis of this processing is the requirement to comply with a legal obligation that is required of us, as laid out in Article 6.1.c) of the General Data Protection Regulation (GDPR).
Therefore, it is necessary for you to establish and maintain Contractual Relations with us. If you do not want us to carry out this processing, we will have to end this relationship, or we will not be able to establish the relationship if not already in place.
The types of processing required to satisfy the regulatory requirements are listed below, arranged from (A) to (D). For each item, we will provide: a description of the purpose (Purpose), the type of data processed (Type of data processed), if applicable, information on the use of profiles (Use of profiling), other relevant processing information (Other relevant information) and whether or not the processing is carried out jointly with other CaixaBank Group companies (Joint data controllers/Data controller).
Processing to comply with anti-money laundering and terrorist financing regulations
Purpose: The purpose of this processing is to adopt the measures imposed on our activity by Law 10/2010, on the Prevention of Money Laundering and Terrorist Financing.
The processing operations that are carried out to comply with anti-money laundering and terrorist financing regulations are:
Types of data processed: The types of data we will process for this purpose (the content of which is detailed in heading 5) are:
Use of profiling: This processing involves creating a profile that we use exclusively for adopting the necessary measures in accordance with the provisions of Law 10/2010 on the Prevention of Money Laundering and the Financing of Terrorism.
Joint data controllers: The following CaixaBank Group companies will process your data jointly.
You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.
B. Processing to comply with tax regulations
Purpose: The purpose of this processing is to adopt the measures imposed on our activity by Law 58/2003, of 17 December, the General Tax Law, Royal Decree 1021/2015, of 13 November, establishing the obligation to identify the tax residence of persons who own or control certain financial accounts and to report on them in the field of mutual assistance, and other current tax regulations.
The processing operations carried out to comply with tax regulations are:
Types of data processed: The types of data we will process for this purpose (the content of which is detailed in heading 5) are:
Data Controller: The data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.
C. Processing to comply with obligations arising from sanctions policies and international financial countermeasures
Purpose: The purpose of this processing is to adopt the measures imposed on our activity by the international financial sanctions and countermeasures programmes adopted by the European Union and the Kingdom of Spain.
In order to comply with international financial sanctions or countermeasures programmes, we will check if your name is on the lists of people or entities included in laws, regulations, guidelines, resolutions, programmes or restrictive measures regarding international economic and financial sanctions imposed by the United Nations, the European Union and/or the Kingdom of Spain.
Types of data processed: The types of data we will process for this purpose (the content of which is detailed in heading 5) are:
Other relevant information: The following section includes other relevant data processing information:
Joint data controllers: The following CaixaBank Group companies will process your data jointly:
You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.
D. Processing for handling complaints and claims.
Purpose: The purpose of this processing is to handle queries, complaints and claims submitted to CaixaBank Payments & Consumer, in accordance with the regulations applicable to its capacity as a financial institution; specifically, Law 44/2002 of 22 November and Order ECO/73/2004, requiring CaixaBank to have a customer service department in place to respond to complaints and claims submitted by financial users.
Furthermore, Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights requires the data controller (in this case CaixaBank Payments & Consumer) to handle any complaints submitted to its Data Protection Officer and respond to any data protection rights exercised by data subjects.
The following processing operations are carried out to comply with regulations on the processing of complaints and claims:
Types of data processed: The types of data we will process for this purpose (the content of which is detailed in heading 5) are:
Data Controller: The data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.
PROCESSING BASED ON THE LEGITIMATE INTEREST OF CAIXABANK PAYMENTS & CONSUMER
The legal basis of this processing is the legitimate interest pursued by CaixaBank Payments & Consumer or a third party, provided that these interests do not take precedence over your interests, or your fundamental rights and freedoms, as per art. 6.1. f) of the General Data Protection Regulation (GDPR).
This processing will imply that we have considered your rights and our legitimate interest and we have concluded that the latter prevails. Otherwise, we would not process the data. You can ask about the analysis that is done to weigh the legitimate interest of a processing operation at any time by emailing your enquiry to delegado.proteccion.datos@caixabank.com.
We also remind you that you have the right to object to processing based on a legitimate interest. If you believe that CaixaBank and, where applicable, joint data controller companies should be aware of any particular situation or other justifiable reasons for us to stop processing your data, you may submit a request to this effect simply and free of charge through the channels indicated in heading 4.
This processing is indicated below from (A) to (F). For each item, we will provide: CaixaBank Payments & Consumer's Legitimate Interest (CaixaBank Payments & Consumer's legitimate interest), a description of the purpose (Purpose), the type of data processed (Type of data processed), if applicable, information on the use of profiles (Use of profiles), other relevant processing information (Other relevant information) and whether or not the processing is carried out jointly with other CaixaBank Group companies (Joint data controllers/Data controller).
A. Management of the performance of employees, agents and suppliers
Legitimate interest of CaixaBank Payments & Consumer: CaixaBank Payments & Consumer's legitimate interest in this process is to manage its relations with employees, agents, suppliers and brokers based on their professional performance.
Purpose: The purpose of this processing is to monitor the performance, objectives and professional challenges of employees, agents, suppliers and brokers by analysing the operations and contracts that they maintain with customers.
Types of data processed: The types of data we will process for this purpose (the content of which is detailed in heading 5) are:
Other relevant information: The following section includes other relevant data processing information:
Data controller: The data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.
B. Fraud prevention
Legitimate interest of CaixaBank Payments & Consumer: The legitimate interest of CaixaBank Payments & Consumer and the joint data controller companies listed in this section for carrying out this processing is to prevent fraud that could lead to financial or reputational damage to the institution or its customers.
Purpose: The purpose of this processing is to adopt the necessary measures to prevent malicious transactions or conduct before they occur or to mitigate their impact if they do occur by identifying suspicious transactions or conduct that could involve an attempt to defraud the institution or its customers.
The processing operations carried out to prevent fraud are:
Types of data processed: The types of data we will process for this purpose (the content of which is detailed in heading 5) are:
Use of profiling: This processing involves creating a profile of your usual operations and activities, which we use exclusively to detect irregular situations that may indicate an attempt to commit fraud.
Other relevant information: The following section includes other relevant data processing information:
In the case of transactions that cannot be reversed once executed, such as immediate payments or transfers, the automated processes will block any suspicious transactions and prevent them from being executed.
You may request the transaction again, challenge the automated decision or exercise your right not to be subject to a decision based solely on automated processing by contacting CaixaBank Payments & Consumer directly through the channels set out in section 4 of this policy.
This service aims to minimise the levels of fraud related to movements between accounts by detecting, investigating, monitoring and reporting, where applicable, suspicious and fraudulent transactions involving customers' current or savings accounts. The legal basis for the processing is the legitimate interest in preventing the type of fraudulent activity that could affect these transactions.
CaixaBank may include in the PAYGUARD Fraud Prevention Service data related to the IBAN number and identifying details of the holder of the account where the suspicious or fraudulent transaction has been detected. You can consult the updated list of participating companies at:
https://www.iberpay.es/es/servicios/servicios/prevenci%C3%B3n-del-fraude/
The data will be stored for a maximum of thirty days for suspicious transactions, and one year for confirmed fraudulent transactions.
The institutions participating in the PAYGUARD Fraud Prevention Service are the joint controllers of your data. You can request the main aspects of the joint data controller agreement at www.caixabank.com/delegadoprotecciondedatos and also exercise your rights regarding the processing of your data through any of the channels indicated in section 4. Exercising rights and filing complaints through the Spanish Data Protection Agency (AEPD).
Joint data controllers: The following CaixaBank Group companies will process your data jointly:
You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.
C. Consultation and communication with credit reporting systems as part of the application for and subsequent management of products that involve financing.
Legitimate interest of CaixaBank Payments & Consumer: The legitimate interest of CaixaBank Payments & Consumer to carry out this processing is to avoid non-payment and defaults by applicants or account holders of those products that involve financing.
Purpose: The purpose of this processing is to assess the solvency and repayment capacity to (i) ensure adequate compliance by the interested parties with their payment obligations resulting from the transactions granted, (ii) to monitor and manage the transactions granted, and (iii) to prevent and manage defaults and non-performing loans.
The processing operations carried out when checking solvency records are:
Types of data processed: The types of data we will process for this purpose are:
Other relevant information: The following section includes other relevant data processing information:
Data Controller: CaixaBank Payments & Consumer is responsible for the part of the processing related to consulting credit information systems. CaixaBank Payments & Consumer and the Asnef and Badexcug databases are jointly responsible for the part of the processing related to communication to credit information systems. The contact details for the credit reporting agencies are provided below:
D. Collection of additional contact details for default management
Legitimate interest of CaixaBank Payments & Consumer: CaixaBank Payments & Consumer's legitimate interest is to collect the debt in non-payment situations, which requires having up-to-date contact details on its customers.
Purpose: The purpose of this processing is to obtain additional customer contact information to contact them in the event they breach their contractual obligations.
Additional contact details are obtained from public lists (white pages, yellow pages and Lleida.net) and private lists (Equifax or Detectives) through debt collection agencies, ensuring that the data collected complies with the quality principle and is obtained legally.
Types of data processed: The types of data we will process for this purpose are:
Other relevant information: The following section includes other relevant data processing information:
Data Controller: The data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.
E. Preparation of management reports and mathematical models
Legitimate interest of CaixaBank Payments & Consumer: CaixaBank Payments & Consumer's legitimate interest in carrying out this process is to design, organise and optimise its corporate and commercial activity as efficiently as possible, which requires having reports on the management and activity of the company and the market, as well as advanced information analysis mathematical algorithms.
Purpose: The purpose of this processing is to prepare reports on the company's activity and its relationship with the market, on the composition and evolution of its customer base and on the convenience and effectiveness of its products and services. These reports are used to manage said products/services and to create and maintain statistical and mathematical models that allow for the processing detailed in this policy to be carried out and that require advanced calculations and analysis of the information.
Types of data processed The data we will process for this purpose is that which has been identified previously for each processing type. We will apply, whenever possible, anonymisation or pseudonymisation techniques to ensure that this processing does not have an impact on the rights of the data subjects, and that the result of the processing is reports with statistical or aggregated information, or mathematical or algorithmic formulas.
Other relevant information: The following section includes other relevant data processing information:
This data processing is necessary, but accessory, to the main purpose of preparing management reports, or algorithmic or mathematical formulas, and is thus carried out using, whenever possible, anonymising techniques or, failing that, pseudonymisation and minimising the information processed.
This processing has no effects or consequences on the individual data subject.
Data Controller: The data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.
F. Sending of commercial communications based on a basic commercial profile
Who does this processing apply to? We will only process your data in this way if:
Legitimate interest of CaixaBank Payments & Consumer: CaixaBank Payments & Consumer's legitimate interest in processing this data is to promote the marketing of the products and services in its portfolio and to ensure customer loyalty.
Purpose: The purpose of this processing is to send commercial communications on products and services similar to those you have with CaixaBank Payments & Consumer, based on a basic commercial profile that we will create using your data.
Types of data processed: the types of data we will process for this purpose are:
Use of profiling: For this processing, we will only prepare a basic commercial profile using the data specified previously:
Your refusal to accept this processing will not prevent, limit or condition your access to our full catalogue of products and services, which is always available to you.
If you apply for any product or service, your application will be assessed in accordance with our regular procedures. Your objection to this processing will not affect this assessment.
Failure to accept this processing will not prevent us from contacting you to manage the products and services you have with us.
This data is processed using mathematical formulas obtained from past behaviours observed in customers of similar characteristics so as to infer the customer's propensity to consume. These mathematical formulas allow us to determine the importance of all the data processed in the final result of the customer's profile.
This final result is the probability that the customer will be interested in a product or service.
Other relevant information: The following section includes other relevant data processing information:
You can do it simply and free of charge at the following link https://www.caixabank.es/apl/particulares/gdpr/index_es.html?empresa=6&derecho=oposicioncomunicaciones
You can also use the normal channels described in section 4.
If you decide to exercise your right of objection, we inform you that we will stop processing the data without requiring you to provide a reason for us to stop processing your data.
We will carry out this check by means of the processing outlined in section 6.2.B of this Privacy Policy, with the aim of offering you a credit limit and repayment term suited to our knowledge of your financial situation, in accordance with the principle of responsibility regarding the offer of financing products required by the Bank of Spain, under regulations on the oversight and solvency of credit institutions and responsible lending.
We will stop processing this data, with no other additional requirements, in either of these two circumstances:
Data Controller: The data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.
G. OFSI and OFAC international financial sanctions policies and countermeasures.
Legitimate interest of CaixaBank Payments & Consumer: The legitimate interest of CaixaBank Payments & Consumer and the joint data controller companies listed in this section for carrying out this processing is to comply with international financial sanctions and countermeasures programmes of the United States and the United Kingdom, with a view to carrying out their business activities in those countries.
Purpose: The purpose of this processing is to adopt the measures envisaged in the international financial sanctions and countermeasures programmes adopted by the Office of Financial Sanctions Implementation (OFSI) of the His Majesty’s Treasury (HMT) of the United Kingdom and/or the US Department of the Treasury’s Office of Foreign Assets Control (OFAC).
In order to comply with these international financial sanctions and countermeasures programmes, we will check whether you are included on lists of persons or entities subject to the restrictive measures of these two bodies.
Types of data processed: The types of data we will process for this purpose (the content of which is detailed in heading 5) are:
Other relevant information: The following section includes other relevant data processing information:
Joint data controllers: The following CaixaBank Group companies will process your data jointly:
You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.
Data controller and joint data controllers
The data we process in your capacity as a customer of CaixaBank Payments & Consumer is processed by CaixaBank Payments & Consumer. If data is processed by joint data controllers, it will be processed by CaixaBank Group companies in accordance with the previous processing sections.
Authorities or official bodies
Credit institutions such as CaixaBank Payments & Consumer and other payment service providers may be legally required to provide information on transactions we carry out to authorities or official bodies in other countries located both within and outside the European Union. This obligation is within the scope of the fight against financing terrorism, serious forms of organised crime, and money laundering, as well as the prudential supervision of credit institutions by the Bank of Spain and the European Central Bank.
This obligation may also apply to payment services and technology service providers with which we maintain relations and to which we send data to carry out transactions.
Credit reporting databases
If you stop making payments in relation to any of the monetary obligations you have undertaken with us pursuant to our Contractual Relations, we will be able to disclose payment default details to the following credit information systems in the conditions and requirements outlined in regulations:
> Asnef database: Asnef Equifax Servicios de Información sobre Solvencia y Crédito. Apartado de correos10546, 28080 Madrid (sac@equifax.es)
> Badexcug database: Apartado de correos 1188, 28108 Alcobendas (badexcug@experian.com)
We inform you that you can exercise your rights to access, rectify, object to processing, delete, restrict processing, transfer your personal data and not be subject to automated decision-making in accordance with the law with these records regarding fulfilment or non-fulfilment at the indicated addresses.
Disclosure of data to outsourced service providers
Sometimes we use service providers with potential access to personal data.
Such providers grant an adequate, sufficient safeguarding service when it comes to processing your data, since we carefully screen service providers by including specific demands in the event that their services involve the need to process personal data.
The type of services we can assign to service providers is:
> Financial back-office services
> Administrative support services
> Audit and consulting services
> Legal services and asset and non-payment recovery services
> Payment services
> Marketing and advertising services
> Survey services
> Call centre services
> Logistics services
> Physical security services
> Computer services (system and information security, cybersecurity, information systems, architecture, hosting, data processing)
> Telecommunications services (voice and data)
> Printing, enveloping, postal and courier services
> Data storage and destruction services (digital and physical)
> Maintenance services for buildings, installations and equipment
Storage for maintaining Contractual Relations
We will process your data as long as the Contractual Relations we have established remain in force
Storage of authorisations for consent-based processing
We will process the data based on your consent until you revoke it.
If you cancel all your product and service contracts with the CaixaBank Group companies but do not withdraw the consent you have given us, we will automatically void said consent until you stop being our customer.
Storage to comply with legal obligations and to formulate, exercise and defend against claims
Once authorisations for use have been revoked as you have withdrawn your consent, or the contractual or business relations established with us have ended, we will only keep your data to comply with legal obligations and to allow you to formulate, exercise or defend claims during the limitation period for actions derived from these contractual relations.
We will process this data by applying the technical and organisational measures required to guarantee that it is only used for these purposes.
Data destruction
We will destroy your data when the retention periods imposed by the regulations governing CaixaBank Payments and Consumer's activity have passed and the limitation periods for administrative or judicial actions arising from the relations established between you and us have elapsed.
At CaixaBank Payments & Consumer, we process your data within the European Economic Area and generally, our service providers are located within the European Economic Area or in countries that are deemed to have an adequate level of data protection.
If we need to use brokers that carry out processing outside the European Economic Area or in countries not determined to have an adequate level of data protection, we will ensure that your data is processed in a secure and legitimate manner.
For this purpose, we require these brokers and service providers to apply suitable guarantees in accordance with the GDPR (such as binding corporate standards guaranteeing information protection in a similar way to European standards) or to subscribe to the standard clauses of the European Union. You may request a copy of the proper guarantees required by CaixaBank Payments & Consumer from these vendors by contacting the data protection officer at www.caixabank.com/delegadoprotecciondedatos.
Section 6 of this Policy contains information on the type of processing that incorporates automated decision-making.
If during the Contractual Relationships you maintain with us, we adopt decisions that could establish legal effects for you or could significantly affect you (for example, to not allow you to take out a certain product) based solely and exclusively on automated processing (i.e., without the participation of a person), we will inform you of this, as well as of the logic through which we adopted it, in the contractual documentation of the product or service you have requested.
Moreover, at that time, we will also adopt measures to safeguard your rights and interests by giving you the right to human involvement, to express your views and to challenge the decision.
We will revise this Privacy Policy whenever necessary to keep you duly informed, for example, when publishing new standards or criteria or when we engage in new processing activities.
We will notify you through the usual communication channels whenever there are substantial or important changes to this privacy policy.
Last review date
18 October 2023
