Privacy policy of CaixaBank Payments & Consumer, S.A.

• Identifying and contact details: full name, sex, postal, marital status, telephone and email contact information, address of residence, nationality, date of birth, language choice, identification document, image and voice.
• Details of your professional or work activity and socio-economic information: details related to your job, income or remuneration, household, level of education, assets, tax and fiscal data.
• Data on legal capacity: details of a person’s power to act, established in a court judgment.
• Details on special communication needs: data provided by disabled persons to allow accessibility to dialogue and operational management.
• Sensitive data related to situations of vulnerability: data related to personal situations of vulnerability that may be required to implement special measures to manage contracts requested by their holders or adopt the measures set out in Royal Decree-Law 6/2012 on urgent measures to protect mortgage borrowers without means.

• Contract data: contracted or requested products and services, account holder status, authorised or representative of the product and service contracted, categorisation according to regulations regarding securities markets and financial instruments (MiFID category), information on investments made and their evolution and information and transactions related to your financing operations.
• Basic financial data: current and historical balances of products and services and payment history of contracted products and services, IBAN (International Bank Account Number).
• Third-party data from statements and receipts of instant accounts and payment accounts: information on entries and transactions that third-party issuers make to your accounts, including transaction type, issuer, amount, and the concept as it appears on your receipts and statements for debit, credit and prepaid card transactions.
• Details of whether or not you are a CaixaBank shareholder: if you own CaixaBank shares or not.
• Details of our communications with you: data obtained in chats, walls, video conferences, telephone calls or any other equivalent means of communication.
• Own browsing data: if you accepted the use of cookies and similar technologies in the devices you use to browse, the data obtained from your browsing of our websites or mobile apps and what information you view on them: browsing history (pages visited and clicks on content), device ID, advertising ID, IP address and installed version of the app.
• Geographic data: details of the location of the businesses where you make card transactions and geolocation data from your mobile device provided by the installation and/or use of our mobile applications, when authorised by you in the settings for the apps themselves.

• Data obtained from other processing activities provided for in the policy: data obtained from the processing activities provided for in this policy, which will be detailed in the corresponding information on the applicable processing operations.
• Data obtained from the execution of statistical models: we use the results of applying mathematical modelling to customer data which helps us to combat fraud, identify your consumer habits, preferences/likelihood of taking out a product or service or classifying customers, for regulatory compliance and to manage your products and/or services.

• Data on credit information systems: obtained by consulting the Asnef and Badexcug credit rating services, which provide information on debts, financial solvency and credit (debtor, creditor and debt).
• Details of the Equifax RISK SCORE: in financing or instalment transactions, we will use the result provided by this system to forecast the probability of default at 12 months, which is calculated by Equifax by applying statistical and mathematical models to your information (ID, postcode of residence and data in credit information systems).
• CIRBE data: we will check if you have risk (financing) with other banks. We will obtain this information from the Bank of Spain Credit Reporting Agency (CIRBE).
• Confirma data: the Confirma File is a database of financing application records shared by participating institutions, created with the purpose of fraud prevention. We will report the data included in financing applications to this file and consult it to detect any irregular information.
• Data on international sanctions: data on people or entities included in laws, regulations, guidelines, resolutions, programmes or restrictive measures regarding international economic and financial sanctions, imposed by the United Nations, European Union, the Kingdom of Spain, the Office of Financial Sanctions Implementation (OFSI) of His Majesty’s Treasury (HMT) of the United Kingdom and/or the US Department of the Treasury’s Office of Foreign Assets Control (OFAC).
• Demographic and socio-economic data: these are data not relating to specific people but geographical areas, age sectors or professional activity sectors, which we will use to put into context with customer information.
• Details of properties and vehicles associated with you: data obtained from the Land Registry and Property Registry as well as basic vehicle information obtained from the Directorate General of Traffic, which we will use to supplement information about your properties and vehicles.
• Details of directors, functional officers and corporate relationships: data taken from the INFORMA databases that we will use to add to the information on your activities.
• Details of agricultural subsidies and insurance: these are data published by the Spanish Agricultural Guarantee Fund (FEGA) and the State Agricultural Insurance Institution (ENESA).
• Data from third-party companies to which you have given your consent to share them with us: data of yours processed by other companies with which we have agreements and which you have authorised to share your information with us.
• Information obtained from public access sources and public records: data provided by publicly accessible sources and public registers to verify the information you provide to us at onboarding, and for the maintenance and fulfilment of the Contractual Relationships. Additionally, information from the Equifax Insolvency Proceedings Enquiries file and the Public Insolvency Register, additional contact details obtained from telephone directories (White Pages, Yellow Pages, Lleida.net) and from the INFORMA database in order to contact our customers in the event of non-compliance with contractual obligations. These databases have been authorised in advance to contain this information.
• Browsing data: if you have accepted the use of cookies and similar technologies on your browsing devices, the data obtained from your browsing on third-party websites or mobile applications and your browsing activity thereon: browsing history (pages visited and clicks on content), device ID, advertising ID and IP address.
• Social media or internet data: social media or internet data that you authorise us to view.

The legal basis for this processing is your consent, as laid out in Article 6.1.a of the General Data Protection Regulation (GDPR).

We may have asked for this consent through different channels; during your customer registration interview, through your adviser (remotely or in person), through digital channels or mobile applications, through any company with which we maintain a collaboration agreement (“recommenders”), or any CaixaBank Group company that is a joint data controller of the specific processing operation.

If we have not asked you for your consent, this processing will not apply to you. You can view the consent you have given or denied and change your decision at any time and free of charge at CaixaBank branches, on the CaixaBank Payments & Consumer website (www.caixabank.es) and on the websites of each of the joint controllers for the specific processing, or through your online account or the CaixaBank Payments & Consumer mobile apps.

Processing based on your consent is indicated below from (A) to (C). For each item, we will provide:

• A description of the purpose
• Details of the types of data or the data processed
• Information on the use of profiling where applicable
• Other relevant information about the processing
• Information on whether the processing is carried out under a joint controller arrangement with other CaixaBank Group companies

A. Customise the products and services offered based on an analysis of your data

Purpose: if you give us permission, we will use your data to create a commercial profile to define your preferences and offer you through your adviser (in person or remotely) the products or services we think may interest you most.

This does not mean you can only take out the products we have concluded may be of interest to you.

Whether you accept or decline this processing, you can always apply for any of our products or services.

By processing your data, we can make customised offers which we believe may be of more interest to you than generic offers.

If you also authorise us to send you information about our commercial offer through other channels (see section 6.1.B of the Privacy Policy), you will additionally receive our offers through the channels you specify.

Data processed: for this processing, we will not use data about your ethnicity or race, your political opinions, religious or philosophical beliefs, trade union membership, genetic data, your biometric data that identifies you, your health data or data about your sex life or orientation.

For this purpose, we will process the following data:

• Identifying and contact details: full name, sex, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
• Details of your professional or work activity and socio-economic information: details related to your job, income or remuneration, household, level of education, assets, tax and fiscal data.
• Contract data: contracted or requested products and services (own or third-party), account holder status, authorised or representative of the product and service contracted, categorisation according to regulations regarding securities markets and financial instruments (MiFID category), information on investments made and their performance and information and transactions related to your financing operations.
• Basic financial data: current and historical balances of products and services and payment history of contracted products and services (own or third party).
• Third-party data from statements and receipts of instant accounts and payment accounts: information on entries and transactions that third-party issuers make to your accounts, including transaction type, issuer, amount, and the concept as it appears on your receipts and statements for debit, credit and prepaid card transactions.
• Details of whether or not you are a CaixaBank shareholder: if you own CaixaBank shares or not.
• Details of our communications with you: data obtained in chats, walls, video conferences, telephone calls or any other equivalent means of communication.
• Own browsing data: if you accepted the use of cookies and similar technologies in the devices you use to browse, the data obtained from your browsing of our websites or mobile apps and what information you view on them: browsing history (pages visited and clicks on content), device ID, advertising ID, IP address and installed version of the app.
• Geographic data: details of the location of the businesses where you make card transactions and geolocation data from your mobile device provided by the installation and/or use of our mobile applications, when authorised by you in the settings for the apps themselves.
• Data obtained from other processing activities provided for in this policy:
  • Risk assessment data or scoring: in financing or instalment payment transactions, we will assess your ability to pay or risk of default, or risk limits, by applying statistical models calculated using your data (processing defined in section 6.2.B).
  • Customer classification data. (processing defined in section 6.4.A of CaixaBank’s privacy policy at https://www.caixabank.es/particular/general/politica-privacidad.html
• Data obtained from the execution of statistical models: we use the results of applying mathematical modelling to customer data to deduce your consumption habits, product preferences or tendencies or to classify customers.
• Demographic and socio-economic data: these are data not relating to specific people but geographical areas, age sectors or professional activity sectors, which we will use to put into context with customer information.
• Details of properties and vehicles associated with you: data obtained from the land registry and basic data on vehicles obtained from the Spanish Traffic Directorate, which we will use to add to the information on your properties and vehicle.
• Details of directors, functional officers and corporate relationships: data taken from the INFORMA databases that we will use to add to the information on your activities.
• Details of agricultural subsidies and insurance: these are data published by the Spanish Agricultural Guarantee Fund (FEGA) and the State Agricultural Insurance Institution (ENESA).
• Data from third-party companies to which you have given your consent to share them with us: data of yours processed by other companies with which we have agreements, and which you have authorised to share your information with us.
• Browsing data: if you have accepted the use of cookies and similar technologies on your browsing devices, the data obtained from your browsing on third-party websites or mobile applications and your browsing activity thereon: browsing history (pages visited and clicks on content), device ID, advertising ID and IP address.
• Data from social media or the internet: social media or internet data that you authorise us to view.

Use of profiling: for this processing, we will create a business profile that we will use exclusively to customise the products and services we offer you:

• Purpose of the profile: the profile we will create with the information we have about you will help us to identify the products and services we think may interest you and send you customised rather than generic offers.
• Consequences: If you authorise us to process your data for this purpose, we will use commercial profiles to decide which products or services to offer you. If you do not give your authorisation, we will not use your information to customise our commercial offer.

We will never use this profile to refuse to provide any product or service or to set credit limits. Not accepting this data processing will not prevent, limit or condition your access to our full catalogue of products and services that is always available to you.

If you ask us for any product or service, we will assess your application in accordance with our procedures. Acceptance or non-acceptance of the analysis of your data for the purpose of customising the product and service offering will not affect this assessment.

Not accepting this data processing will also not prevent us from contacting you to manage your products and services.

• Logic: the profile of a customer is calculated based on the data indicated in the “data processed” section.

These data are applied to mathematical formulas obtained from past behaviours observed in customers of similar characteristics to infer the customer’s future behaviour. These mathematical formulae allow us to determine the importance of all the data processed in the final result of the applicant’s profile.

This final result is the probability that the customer will be interested in a product or service.

Other relevant information: the following section includes other relevant data processing information:

• Pre-check of your ability to pay: When we offer you products or services that involve payment in instalments or financing, we will first check your ability to pay. We will do this as explained in section 6.2.B.

The purpose is to offer you a credit limit and a repayment term that is appropriate based on our knowledge of your financial situation. We will do all of this in accordance with the principle of responsibility for offering financing products that is required by the Bank of Spain, under regulations on the oversight and solvency of credit institutions and responsible lending.

Not accepting this processing will not prevent, limit or condition your access to our catalogue of finance products and services. If you make an application, we will assess it according to our procedures.

• Duration of data processing: We will only process your data in this way if you have given us your express consent to do so. Your consent will remain valid until you revoke it. If you cancel all your products or services with us but forget to revoke your consent, we will do so automatically.
• Preparation of mathematical models: The data processed and resulting from this processing will be used to prepare mathematical models as described in section 6.4.E.

Joint data controllers: the following CaixaBank Group companies are joint controllers for this data processing.

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Nuevo Micro Bank, S.A.U.
• Facilitea SelectPlace, S.A. Single Shareholder Company
• ImaginersGen, S.A.
• VidaCaixa, S.A.U. de Seguros y Reaseguros

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.

B. Notification of the offer of products and services through channels

Purpose: you can choose other channels you would like us to use to tell you about our products or services, whether customised or not, depending on what you have stated in section A above.

If you give us permission, we will offer you our products and services through the channels you specify:

• website, app and email
• letter
• phone

The data we will use will vary as follows:

• If you do not allow us to customise our commercial offer (see section 6.1.A), we will only use your identification and contact details to send you generic offers.
• If you allow us to customise our commercial offer (see section 6.1.A), we will also use information from your commercial profile to provide you with customised offers.

Data processed: for this processing, we will not use data about your ethnicity or race, your political opinions, religious or philosophical beliefs, trade union membership, genetic data, your biometric data that identifies you, your health data or data about your sex life or orientation.

For this purpose, we will process the following data:

• Identifying and contact details: full name, sex, telephone and email contact information, address of residence, language choice.
• Data obtained from other processing activities provided for in this policy:
  • Data from the customisation of our product and service offer based on an analysis of your data: if you authorise us to customise our commercial offer (see processing in 6.1.A of the policy), we will also use the information from your commercial profile to provide you with customised offers.

Other relevant information: the following section includes other relevant data processing information:

• Duration of data processing: We will only process your data in this way if you have given us your express consent to do so. Your consent will remain valid until you revoke it. If you cancel all your products or services with us but forget to revoke your consent, we will do so automatically.

Joint data controllers: the following CaixaBank Group companies are joint controllers for this data processing:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Nuevo Micro Bank, S.A.U.
• Facilitea SelectPlace, S.A. Single Shareholder Company
• ImaginersGen, S.A.
• VidaCaixa, S.A.U. de Seguros y Reaseguros

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo

C. Disclosure of data to other companies

Purpose: if you give us permission, we will disclose your data to other companies so they can send you commercial offers for their products and services. These data will vary as follows:

• If you do not allow us to customise our commercial offer (see section 6.1.A), we will only disclose your identification and contact details to these companies.
• If you allow us to customise our commercial offer (see section 6.1.A), we will also disclose information from your commercial profile to these companies along with information on your probability of payment or risk of default, or risk limits.

If you do not give us permission, we will not disclose your data to other companies.

These companies to which we may disclose your data are engaged in the following activities:

• banking
• investment services
• insurance and reinsurance
• venture capital
• property
• highways
• sale and distribution of goods and services,
• consultancy services
• leisure and
• charity-social action

Data processed: for this processing, we will not use data about your ethnicity or race, your political opinions, religious or philosophical beliefs, trade union membership, genetic data, your biometric data that identifies you, your health data or data about your sex life or orientation.

For this purpose, we will process the following data:

• Identifying and contact details: full name, sex, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
• Data obtained from other processing activities provided for in the policy:
  • Data from the customisation of our product and service offer based on an analysis of your data: if you authorise us to customise our commercial offer (see section 6.1.A), we will also use the information from your commercial profile to provide you with customised offers.

Other relevant information: the following section includes other relevant data processing information:

• Data disclosure information: If we reach an agreement with a company to share your data, the company receiving the data will tell you about it. They will also notify you of the data received and the details of the processing they intend to carry out.
• Duration of data processing: We will only process your data in this way if you have given us your express consent to do so. Your consent will remain valid until you revoke it. If you cancel all your products or services with us but forget to revoke your consent, we will do so automatically.

Joint data controllers: the following CaixaBank Group companies are joint controllers for this data processing:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Nuevo Micro Bank, S.A.U.
• Facilitea SelectPlace, S.A. Single Shareholder Company
• ImaginersGen, S.A.
• VidaCaixa, S.A.U. de Seguros y Reaseguros

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.

This processing is necessary to manage the contracts you request from us or to which you are a party. It is also necessary to apply, if you request it, pre-contractual measures. We will do so based on Art. 6.1.b of the General Data Protection Regulation (GDPR).

This processing is necessary so that you can enter into and maintain your contracts with us. If you do not want us to carry out this processing, we will have to end this relationship, or you will not be able to enter into the relationship if it is not already in place.

The types of processing required to manage your contracts are listed below, arranged from (A) to (C). For each item, we will provide: the purpose, the type of data processed, information on profiling, other relevant information about the processing and whether the processing is carried out jointly with other companies in the CaixaBank Group.

A. Signing, maintenance and performance of Contractual Relationships

Purpose:

The purpose of this data processing is to establish and maintain the contractual relationship between you and CaixaBank Payments & Consumer. This means that CaixaBank Payments & Consumer will process your data to:

• Manage your requests and mandates
• Complete the necessary steps prior to entering into a contract (known as “pre-contractual arrangements”), which can be handled directly with us or through one of our intermediaries (such as our agent CaixaBank, S.A. or any of our recommenders who operate retail outlets where you may be a customer).
• Put in place measures to ensure compliance with the contracts you have with us.

This data processing means that CaixaBank Payments & Consumer will only gather the information it needs to:

• Establish the relationship with you or process your application
• Check whether the product or service you wish to sign up for is suitable for you
• Maintain and perform your contracts appropriately

The processing activities involved in signing, maintaining and performing the Contractual Relationships are:

• Collection and registration of the data and documents needed to apply for the products requested.
• Formalising the signing of the contracts for the products and services.
• Managing the day-to-day operation of the products and services you have taken out with us. This includes responding to your operational enquiries, handling incidents, recording and verifying accounting entries for receiving and making product payments and sending operational communications. It also involves all the steps needed to meet the commitments made when you signed up for specific products or services, such as loyalty schemes, fee and commission or interest bonuses and special deals.

Type of data processed: the types of data we will process for this purpose (the content of which is detailed in section 5) are:

• Identification and contact details
• Details of your professional or work activity and socio-economic information
• Sensitive data related to situations of vulnerability
• Legal capacity data
• Details on special communication needs
• Contract details
• Basic financial data
• Third-party data from statements and receipts of instant accounts and payment accounts
• Details of the communications with you
• Data obtained from the execution of statistical models
• Data obtained from other processing activities provided for in this policy
• Risk assessment or scoring data (processing defined in section 6.2.B)
• Data obtained from the execution of statistical models
• Data on credit information systems
• Details of Equifax Risk Score
• CIRBE data
• Data relating to international sanctions
• Information obtained from public access sources and public records

Use of profiling: to recover any outstanding payments, we create a profile of your likelihood of payment. Based on this, we classify you as having a high, medium or low probability of recovery.

Purpose: this profile calculates the likelihood of recovering the debt within the next 90 days.

• Consequences: payment probability profiles help determine the best strategy for recovering the money.
• Logic: the process begins when the contract reaches 90 days of non-payment. The applicant’s profile will use the information indicated in the “Type of data processed” section above.

This basic information is used to assign a specific value to each piece of data about the applicant, and the sum yields a score indicating the probability of contract recovery within 90 days.

The importance of each variable and its influence on the final result is calculated in advance using mathematical models.

Other relevant information:

• Automated decision-making: when you apply for a product or service, we will assess whether the product is suitable for your needs, interests and goals. We will do this by taking into account the data listed in the “type of data processed” section of this privacy notice, such as your employment status, your investor profile or your place of residence.

Based on this data, if we consider that the product is not suitable for you, you will not be able to take it out.

You can ask for this decision to be reviewed by a human being by emailing CaixaBank Payments & Consumer at [email protected].

• Application or monitoring of commitments, discounts or preferential conditions: if you take out a product or service which requires you to meet certain requirements, we will process your data as necessary to check that you continue to meet these requirements. Furthermore, if there are other joint account holders in your accounts, please note they may indirectly become aware of information concerning your compliance with these requirements.

For example, if you take out a product or service which makes you eligible for discounts because you belong to a professional group such as healthcare or law enforcement personnel, we will check throughout the term of the contract that you are still a member of this group. You should be aware that if you share accounts with other people, they may learn that you meet the requirements when they see the discounts applied to your account, or that you no longer meet them if you stop receiving the discounts.

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

If you sign up for the product or service through CaixaBank Payments & Consumer but it is provided by another company, that company will be the controller for your data in relation to that contract.

For example:

• If you take out an insurance plan from VidaCaixa or SegurCaixa through CaixaBank Payments & Consumer as the banking and insurance operator, these companies will be the controllers of your data.

We will specify who the controller is in the documentation for each product or service you take out.

B. Analysis of creditworthiness and repayment capacity for the granting and monitoring of credit risk

Purpose: the purpose of this data processing is to determine whether applicants or holders of products or services involving deferred payment of instalments are able to pay the agreed instalments.

Another purpose of this processing is to find out whether holders of products or services involving the repayment of money we have advanced are able to repay it.

We will give you details of this processing when you apply for one of the products or services mentioned, or in the relevant contract for that product or service.

The processing operations we perform for internal risk management and to prevent non-payment are as follows:

• Analysis of applicants’ ability to pay at the time the products and services mentioned are granted.
• Analysis of the ability to pay of holders of the products and services mentioned while they are valid.

Types of data processed:

• Identification and contact details
• Details of your professional or work activity and socio-economic information
• Contract details
• Basic financial data
• Third-party data from statements and receipts of instant accounts and payment accounts
• Data obtained from the execution of statistical models
• Data on credit information systems
• Details of Equifax Risk Score
• CIRBE data
• Demographic and socio-economic data
• Details of properties and vehicles associated with you
• Information obtained from public access sources and public records

Use of profiling: we will draw up a risk profile, which we will use solely to assess whether you are able to repay the agreed instalments or the money we have given you in advance.

• Purpose of the profile: This profile is used to:
  • Determine the probability of default when granting you a product.
  • Increase or reduce the amount granted for your current transactions.
  • Calculate the provisions and capital requirements applicable to CaixaBank Payments & Consumer.
• Consequences: risk profiles help us decide whether to approve the transaction you have applied for. They also help us assess whether to increase or reduce the amount granted for your existing transactions.

When you apply for one of these products or services via electronic channels, this profile involves automated decision-making about whether to give you the product you are applying for.

You can find full details under “Other relevant information”.

• Logic: the information set out in the previous section, “Type of data processed”, will be used.

This information is used to assign a specific value to each piece of data. The sum of these values will yield a score reflecting the likelihood of default.

The importance of each variable and its influence on the final result is calculated in advance using mathematical models and is included in our internal risk policies.

Other relevant information:

• Automated decision-making: to assess your ability to repay when you apply via electronic channels or through recommenders, we will use automated processes to determine whether we can grant you the financing you are applying for.

If the above calculation means we cannot grant you the financing, you will not be able to sign up for the requested product via this channel. However, you can ask for this decision to be reviewed by a human being by emailing CaixaBank Payments & Consumer at [email protected].

You can resubmit your application so that the assessment does not involve automated decision-making.

• Regulatory obligations: this processing is necessary for the purposes of managing our contractual relationship. It is also needed to comply with regulations, namely Law 44/2002 on Financial System Reform Measures, Law 10/2014 of 26 June on the regulation, supervision and solvency of credit institutions, and other obligations and standards set out in regulations on responsible lending which apply to us as a credit institution.
• Credit information system enquiries: we will check credit information systems as needed to assess your ability to pay. We will carry out these enquiries based on our legitimate interest as set out in section 6.4.C.
• CIRBE enquiry and communication: The CIRBE enquiries required to assess your ability to pay are carried out in accordance with Law 44/2002 of 22 November on Financial System Reform Measures. Furthermore, the data necessary to identify the persons with whom credit risks are maintained will be communicated, based on the same standard.
• Preparation of mathematical models: we will use the data from this processing to create mathematical models in accordance with section 6.4.E of this Policy.

Joint data controllers: applicable regulations require us to assess your ability to pay in conjunction with the companies that form part of our consolidated group of credit institutions.

The following CaixaBank Group companies are joint controllers for this data processing.

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Nuevo Micro Bank, S.A.U.
• CaixaBank Equipment Finance, S.A.U.
• Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
• Banco BPI, S.A.
• Facilitea Selectplace S.A., Single Shareholder Company
• CaixaBank Wealth Management Luxembourg

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo

C. Management of non-payment and arrears

Purpose: establishing measures to resolve any non-payment that occurs, or may occur, in connection with instalment payment transactions or refunds of advance payments.

These measures may include:

• Initial debt management.
• Disclosure of your data to external agencies for debt recovery.
• Disclosure of your data to credit information systems (credit databases).
• Filing and tracking legal claims and monitoring their progress.
• Identifying and monitoring insolvency proceedings.
• Reviewing and assessing debt refinancing measures, voluntary repossession or cases covered by the Code of Good Practices.
• Selling credit portfolios
• In-person visits

Type of data processed:

• Identification and contact details
• Details of your professional or work activity and socio-economic information
• Sensitive data related to situations of vulnerability
• Legal capacity data
• Details on special communication needs
• Contract details
• Basic financial data
• Third-party data from statements and receipts of instant accounts and payment accounts
• Details of the communications with you
• Data obtained from the execution of statistical models
• Data on credit information systems
• Details of Equifax Risk Score
• CIRBE data
• Data from the General Treasury of the National Social Security Institute
• Information obtained from public access sources and public records

Use of profiling: we will create a financial or creditworthiness profile which we will only use to set specific and appropriate measures for debt recovery.

• Purpose of the profile: identifying the most appropriate measures for debt recovery procedures carried out by CaixaBank Payments & Consumer. It also helps to determine the expected debt recovery rate for each customer.
• Consequences: profiles are tools designed to assist in decision-making regarding debt recovery actions. They help us determine the most appropriate measures for each customer.
• Logic: the profile will use the data indicated in the previous section. Using this basic information, a value is assigned to each piece of your data; the sum will give a score relating to the probability of debt recovery and the most appropriate debt recovery actions.

Other relevant information: the following section includes other relevant data processing information:

• Disclosure to credit information systems: this processing may involve disclosing debt or default information to credit information systems. We would do this based on our legitimate interest as detailed in section 6.4.C.
• Obtaining contact information: external debt recovery agencies may need to gather additional contact information about you in order to recover the debt. This will be done based on our legitimate interest as detailed in section 6.4.D.
• Preparation of mathematical models: the data processed and resulting from this processing will also be used to create mathematical models. This will be done as detailed in section 6.4.E.

Joint data controllers: under applicable regulations, we are required to manage credit and liquidity risk across all the companies within our consolidated group.

The following CaixaBank Group companies are joint controllers for this data processing:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Nuevo Micro Bank, S.A.U.
• CaixaBank Equipment Finance, S.A.U.
• Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
• Banco BPI, SA
• Facilitea Select Place, S.A.U.
• CaixaBank Wealth Management Luxembourg

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.

This processing of personal data is necessary to comply with a legal obligation to which we are subject as set out in Article 6(1)(c) of the General Data Protection Regulation (GDPR).

We need to process your data so that you can enter into and maintain your contracts with us. If you do not want us to carry out this processing, we will have to end this relationship, or you will not be able to enter into the relationship if it is not already in place.

The types of processing required to satisfy the regulatory requirements are listed below, arranged from (A) to (G). For each item, we will provide: a description of the purpose, the type of data processed, information on profiling, other relevant information about the processing and whether the processing is carried out jointly with other companies in the CaixaBank Group.

A. Processing to comply with anti-money laundering and terrorist financing regulations

Purpose: adopting the measures imposed on our activity by anti-money laundering and terrorist financing regulations.

We will process your data to:

• Gather information and documentation that enables us to comply with due diligence and know-your-customer measures.
• Check the information that you give us.
• Check whether you are or have been a politically exposed person.
• Assign you a risk level. Based on this level, the due diligence measures specified by anti-money laundering and terrorist financing regulations will be applied to you.
• Analyse transactions performed through CaixaBank Payments & Consumer.
• Check your relationship with companies and, if necessary, your controlling position within their ownership structure.
• Report and update your information in the Financial Ownership File on a monthly basis. This file is managed by the Executive Service of the Commission to Prevent Money Laundering and Financial Crimes (SEPBLAC).

Types of data processed:

• Identification and contact details
• Details of your professional or work activity and socio-economic information
• Contract details
• Basic financial data
• Third-party data from statements and receipts of instant accounts and payment accounts
• Details of the communications with you
• Data obtained from other processing activities provided for in this policy:
  • Risk assessment or scoring data (processing defined in section 6.2.B).
• Data obtained from the execution of statistical models
• Details of directors, functional officers and corporate relationships
• Information obtained from public access sources and public records

Use of profiling: we will create a profile that we use exclusively for adopting the measures imposed on our activity by anti-money laundering and terrorist financing regulations.

• Purpose: preventing the contracting of operations susceptible to money laundering or the financing of terrorism.
• Consequences: profiles are tools that help determine whether our customers’ transactions are susceptible or not to being used for money laundering or terrorist financing. This enables us to decide whether to accept the transaction.

Joint data controllers: the following CaixaBank Group companies are joint controllers for this data processing.

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• VidaCaixa SA de Seguros y Reaseguros
• BPI Vida e Pensões – Companhia de Seguros, S.A.
• Nuevo Micro Bank, S.A.U.
• CaixaBank Asset Management SGIIC, S.A.U
• Buildingcenter, S.A.U.
• Livingcenter Activos Inmobiliarios, S.A.U.
• Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
• CaixaBank Wealth Management Luxembourg, S.A.
• CaixaBank Asset Management Luxembourg, S.A.
• BPI Gestão de Ativos, SGOIC, S.A.
• Banco BPI, S.A.
• Bankia Habitat, S.L.U.
• Puerto Triana, S.A.U.

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo

B. Processing to comply with obligations arising from sanctions policies and international financial countermeasures

Purpose: adopting the measures imposed on our activity by the financial sanctions and countermeasures programmes of the European Union and the Kingdom of Spain.

To comply with these measures, CaixaBank Payments & Consumer will check whether you appear on any list of individuals or entities subject to these sanctions programmes.

Types of data processed: the types of data we will process for this purpose, whose content is detailed in section 5, are:

• Identification and contact details
• Data relating to international sanctions

Other relevant information: the international financial sanctions programmes that we will consult at CaixaBank Payments & Consumer are those adopted by:

• The Office of Financial Sanctions Implementation (OFSI) of His Majesty’s Treasury (HMT) of the United Kingdom
• The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) based on our legitimate interest, which is detailed in Section 6.4.A.

Joint data controllers: the following CaixaBank Group companies are joint controllers for this data processing:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• VidaCaixa SA de Seguros y Reaseguros
• Nuevo Micro Bank, S.A.U.
• CaixaBank Asset Management SGIIC, S.A.U
• Buildingcenter, S.A.U.
• Livingcenter Activos Inmobiliarios, S.A.U.
• Puerto Triana, S.A.
• Bankia Habitat, S.L.U.
• Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
• Corporación Hipotecaria Mutual, S.A.U., Establecimiento Financiero de Crédito
• Banco BPI, S.A.
• BPI Gestão de Ativos, SGOIC, S.A.
• CaixaBank Wealth Management Luxembourg, S.A.
• CaixaBank Asset Management Luxembourg, S.A.
• OpenWealth, S.A.U.

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo

C. Processing for handling complaints and claims

Purpose: handling queries and complaints submitted to CaixaBank Payments & Consumer in accordance with the regulations applicable to us as a financial institution. This means Law 44/2002 of 22 November and Order ECO/73/2004, requiring us to have a customer service department for our customers and users.

Data protection regulations also require us to handle any complaints you may make to our Data Protection Officer and manage any requests to exercise your data protection rights.

CaixaBank Payments & Consumer will process your data to:

• Receive your complaints through CaixaBank Payments & Consumer’s Customer Service Department;
• Respond to you within the specified timeframe;
• Handle requests to exercise your personal data rights and any enquiries you make to CaixaBank Payments & Consumer’s Data Protection Officer.
• Cooperate with supervisory authorities such as the Spanish Data Protection Authority.

Types of data processed:

• Identification and contact details
• Legal capacity data
• Details on special communication needs
• Sensitive data related to situations of vulnerability
• Contract details
• Basic financial data
• Third-party data from statements and receipts of instant accounts and payment accounts
• Details of the communications with you
• Own browsing data
• Data on credit information systems
• CIRBE data

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

D. Internal oversight and control

Purpose: internally overseeing our activities. This oversight is performed to verify compliance with corporate governance and risk management regulations.

We will carry out regular checks to ensure that internal rules and procedures are being followed. We will do this to mitigate the risks associated with marketing and taking out products and services. and also to mitigate risks in our regular transactions.

Types of data processed:

• Identification and contact details
• Details of your professional or work activity and socio-economic information
• Legal capacity data
• Details on special communication needs
• Sensitive data related to situations of vulnerability
• Contract details
• Basic financial data
• Third-party data from statements and receipts of instant accounts and payment accounts
• Details of the communications with you
• Own browsing data
• Geographical details
• Data obtained from other processing activities provided for in this policy
• Data obtained from the execution of statistical models
• Data obtained from public-access sources or external sources
• Third-party browsing data

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

E. Management of official requests, information requirements, and/or garnishments

Purpose: responding to requests for information or garnishments relating to one of our customers. These requests are sent to CaixaBank Payments & Consumer by the relevant government departments, authorities, law enforcement agencies or courts.

Types of data processed:

• Identification and contact details
• Details of your professional or work activity and socio-economic information
• Sensitive data related to situations of vulnerability
• Details on legal capacity and special communication needs
• Contract details
• Basic financial data
• Details of the communications with you
• Information retrieved from publicly accessible sources and records

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

F. Financial regulatory reporting

Purpose: preparing reports on the activities of CaixaBank Payments & Consumer as a financial institution. These reports are submitted to the relevant bodies and authorities that supervise CaixaBank Payments & Consumer’s activities.

To do this, it is necessary to process personal data and send the information to various regulatory and supervisory bodies in accordance with the specific rules established by each of them. These bodies include the Bank of Spain, the European Banking Authority (EBA) and the European Central Bank in accordance with the requirements of Law 10/2014 of 26 June on the organisation, supervision and solvency of credit institutions.

Types of data processed:

• Identification and contact details
• Details of your professional or work activity and socio-economic information

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

G. Accounting management

Purpose: managing CaixaBank Payments & Consumer’s accounting.

To comply with this obligation, it is necessary to process some personal data and send information to regulatory and supervisory bodies, such as the Bank of Spain, in accordance with the requirements of Law 10/2014 on credit institutions.

Types of data processed:

• Identifying details
• Professional or employment-related activity data
• Contract details

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

This processing is carried out for the legitimate interests of CaixaBank or a third party. We do so provided that these interests do not take precedence over your interests or your fundamental rights and freedoms, as per Article 6.1.f of the GDPR.

Before carrying out this processing, we will consider your rights against our legitimate interest. We will only carry out the processing in cases where our interest prevails over your rights and freedoms. You can ask about the analysis that is done to consider the legitimate interest of a processing operation at any time by emailing [email protected].

We remind you that you have the right to object to this processing based on the legitimate interest. If you believe that CaixaBank Payments & Consumer and, where applicable, the joint controllers should consider any personal situation or reason to stop processing your data, you can request this easily and free of charge through the channels mentioned in section 4.

This processing is detailed below, arranged from (A) to (H). For each item, we will provide: CaixaBank’s legitimate interest, a description of the purpose, the type of processed data if applicable, information on the use of profiles, other relevant processing information and on whether the processing is carried out under a joint controller arrangement with other CaixaBank Group companies.

A. OFSI and OFAC international financial sanctions policies and countermeasures

Legitimate interest: CaixaBank Payments & Consumer and the joint controllers mentioned in this section need to process your data to comply with international regulations on sanctions and financial measures of the United States and the United Kingdom. This is necessary to be able to operate and conduct business in those countries.

Purpose: complying with the financial sanctions and control regulations required by the UK and US authorities.

To comply with these regulations, the joint controllers involved will check whether your name appears on US and UK lists of restricted persons or entities.

Types of data processed:

• Identifying and contact data.
• Data relating to international sanctions.

Other relevant information:

• Right of objection: if you believe that CaixaBank Payments & Consumer should consider any personal situation or reason to stop processing your data, you can request this easily and free of charge through the channels shown in section 4.

Joint data controllers: the following CaixaBank Group companies are joint controllers for this data processing:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• VidaCaixa, SA de Seguros y Reaseguros.
• Nuevo Micro Bank, S.A.U.
• CaixaBank Asset Management SGIIC, S.A.U.
• CaixaBank Equipment Finance, S.A.U.
• Buildingcenter, S.A.U.
• Livingcenter Activos Inmobiliarios, S.A.U.
• Puerto Triana, S.A.
• Bankia Habitat, S.L.U.
• Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
• Banco BPI, S.A.
• BPI Gestão de Ativos, SGOIC, S.A.
• CaixaBank Wealth Management Luxembourg, S.A.
• CaixaBank Asset Management Luxembourg, S.A.
• OpenWealth, S.A.U.

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.

B. Fraud prevention

Legitimate interest of CaixaBank Payments & Consumer: preventing fraud involving financial or reputational losses to CaixaBank Payments & Consumer or its customers.

Purpose: taking the necessary measures to prevent malicious transactions or conduct before they happen. It also aims to reverse their effects should they occur by reporting transactions or conduct suspected of fraud to CaixaBank Payments & Consumer or its customers.

We will process your data to:

• Verify the identity of customers to prevent fraudulent access to information or operations.
• Review and analyse contracts and transactions carried out in our systems to protect our customers from fraud through any channel and prevent cyberattacks.
• Verify your identity and the validity of the identification documents you give us. We will confirm that the document you have provided is yours. We will do this by checking it against national and international law enforcement databases. We will also check with similar organisations such as INTERPOL (International Criminal Police Organisation). We do this to protect you from identity fraud; for example, someone else pretending to be you.
• Consult the information included in the PAYGUARD Fraud Prevention Service to detect fraudulent accounts and report, where applicable, fraudulent transactions.

Types of data processed:

• Identification and contact details
• Details of your professional or work activity and socio-economic information
• Contract details
• Basic financial data
• Third-party data from statements and receipts of instant accounts and payment accounts
• Details of the communications with you
• Own browsing data
• Geographical details
• Data obtained from other processing activities provided for in this policy:
  • Risk assessment or scoring data (processing defined in section 6.2.B).
• Data obtained from the execution of statistical models
• Confirma data

Use of profiling: we will create a profile with data from your transaction history and regular banking activities. We will use this profile solely to identify unusual situations that may be indicative of attempted fraud.

• Purpose of the profile: The purpose of the profile is to identify operations or interactions that are unusual or not in line with your behaviour profile that could be an attempt to commit fraud or gain fraudulent access to information.
• Consequences: profiles help us identify fraudulent transactions. Their use involves applying measures ranging from a detailed review of the transaction to its blocking or denial.

Other relevant information:

• Automated decision-making: to prevent fraud, we will use automated decision-making processes. This enables us to detect potential fraudulent transactions. In the case of transactions that cannot be reversed once completed, such as payments or instant transfers, the automated decision-making process may prevent you from carrying out the transaction if it suspects that it might be fraudulent. Consequently, you will not be able to perform that transaction. You may resubmit an application for the transaction by contacting CaixaBank Payments & Consumer directly via the channels listed in section 4 of this policy, where the analysis does not involve automated decision-making.
• Right to object to processing: If you believe that CaixaBank Payments & Consumer and, where applicable, the joint controllers, should stop using your data for any personal reason, you can request this easily and free of charge through the channels shown in section 4.
• Confirma File: CaixaBank Payments & Consumer is part of the Confirma File to help prevent fraud in financing applications. This file is managed by Confirma Sistemas de Información, S.L., located at Avenida de la Industria 18, TRES CANTOS (28760) MADRID.

The purpose of the Confirma File is to check for signs of fraud in contracts. We share your personal data from your application to compare it with other records and detect potential issues.

The legal basis is the legitimate interest of the entities adhering to the Confirma File in preventing fraud, financial loss and breaches of the law.

We check the Confirma File because it is an appropriate tool for preventing fraud, and we do this in a balanced way: the benefit to the participating entities outweighs the impact on your privacy. This is within what you might reasonably expect as it is standard practice when applying for finance or during our business relationship. We also use technical and security measures to protect your data effectively and prevent any issues for you.

The personal data you provide to CaixaBank Payments & Consumer when applying for financing will be shared with the Confirma File. We do this to compare your application with others already registered by the participating entities and to detect potential fraud in the contacting process. Other entities adhering to the File may also view these data, but only for the same purpose.

Your personal data will be retained for at most five years.

The entities adhering to the Confirma File regulations are joint controllers of your data. You can view the list of entities adhering to the Confirma File regulations at www.confirmasistemas.es, and also ask for additional information along with the main aspects of the joint data controller agreement by contacting www.caixabank.com/delegadoprotecciondedatos.com.

Under data protection law, you can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability. To do this, please contact Confirma Sistemas de Información, S.L., at the address provided above.

You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). Confirma Sistemas de Información, S.L. has a Data Protection Officer who you can email at [email protected] for any queries about the privacy of the Confirma File.

• PAYGUARD Fraud Prevention Service: CaixaBank is a member of the PAYGUARD Fraud Prevention Service, which covers the country’s leading financial institutions and is managed by Sociedad Española de Sistemas de Pago, S.A. (Spanish Payment Systems Company) (Iberpay).

This service aims to minimise the levels of fraud related to movements between accounts by detecting, investigating, monitoring and reporting, where applicable, suspicious and fraudulent transactions involving customers’ current or savings accounts. The legal basis for the processing is the legitimate interest in preventing the type of fraudulent activity that could affect these transactions.

CaixaBank may include in the PAYGUARD Fraud Prevention Service data related to the IBAN number and identifying details of the holder of the account where the suspicious or fraudulent transaction has been detected. You can view the updated list of participating institutions at: https://www.iberpay.es/es/servicios/servicios/prevenci%C3%B3n-del-fraude/

The data will be stored for a maximum of thirty days for suspicious transactions, and one year for confirmed fraudulent transactions.

The institutions participating in the PAYGUARD Fraud Prevention Service are the joint controllers of your data. You can ask for the main aspects of the joint data controller agreement by emailing www.caixabank.com/delegadoprotecciondedatos and also exercise your rights regarding the processing of your data through any of the channels indicated in section 4. Exercising rights and filing complaints with the Spanish Data Protection Agency (AEPD).

• FRAUDFENSE Fraud Prevention Service: CaixaBank is a member of the FRAUDFENSE Fraud Prevention Service, which covers the country’s leading financial institutions and is managed by FrauDFense, S.A.

This service aims to minimise the levels of fraud related to customer transactions by detecting, investigating, monitoring and reporting, where applicable, suspicious or fraudulent activities in customer current or savings accounts and digital banking transactions. The legal basis for processing data is CaixaBank’s legitimate interest in combating and preventing fraud in its operations.

CaixaBank may include in the FRAUDFENSE Fraud Prevention Service data related to the IBAN number, details of the identified fraudulent transaction, information about the device from which the fraudulent transaction was made, and identifying details of the holder of the account where the suspicious or fraudulent transaction has been detected. You can view the updated list of participating institutions in FRAUDFENSE at: https://916087356-1.servicio-online.net/sobre-nosotros1/nuestros-partners.

The data will be retained in the FRAUDFENSE Fraud Prevention Service for a maximum of 12 months in the case of confirmed fraudulent transactions. After this period, the data may be kept blocked until the applicable limitation periods expire.

The institutions participating in the FRAUDFENSE Fraud Prevention Service are the joint controllers of your data. You can ask for the main aspects of the joint controller agreement by emailing www.caixabank.com/delegadoprotecciondedatos or [email protected].

Additionally, you can exercise your rights regarding the processing of your data through any of the channels listed in section 4 “Exercising rights and filing complaints with the Spanish Data Protection Agency (AEPD)” or by emailing [email protected].

Joint data controllers: the following CaixaBank Group companies are joint controllers for this data processing:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Nuevo Micro Bank, S.A.U.
• Global Payments Moneytopay, EDE, S.L.
• CaixaBank Equipment Finance, S.A.U.

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo

C. Consultation and communication with credit reporting systems as part of the application for and subsequent management of products that involve financing

Legitimate interest of CaixaBank Payments & Consumer: to prevent non-payment and late payments by applicants or holders of products or services involving deferred payment of instalments.

Purpose:

• Determining whether applicants or holders of products or services involving deferred payment of instalments are able to pay the agreed instalments.
• Finding out whether holders of products or services involving the repayment of money we have advanced are able to repay it.
• Monitoring and managing current transactions.
• Preventing and managing non-payments.

We will process your data to:

• Check your information: before granting you a transaction involving financing, and subsequently to monitor and manage risk, we will consult the following credit information systems (financial solvency and credit files): Asnef and Badexcug databases.
• Disclose your personal details: if you fail to pay any of the monetary obligations you have with us, we may disclose your payment default details to the same credit information systems. We will always do this in compliance with applicable regulations.

Types of data processed:

• Identification and contact details
• Contract details
• Basic financial data
• Data on credit information systems

Other relevant information:

• Right to object to processing: if you believe that CaixaBank Payments & Consumer and, where applicable, the joint controllers, should stop using your data for any personal reason, you can request this easily and free of charge through the channels shown in section 4.

Data controller: CaixaBank Payments & Consumer is the controller for processing related to consulting credit information systems. CaixaBank Payments & Consumer and financial solvency databases (Asnef and Badexcug) are joint controllers for disclosure to credit information systems. You can contact these databases as follows:

• Asnef database: Asnef Equifax Servicios de Información sobre Solvencia y Crédito. Apartado de correos 10546, 28080 Madrid ([email protected])
• Badexcug database: Apartado de correos 1188, 28108 Alcobendas ([email protected])

D. Collection of additional contact details for default management

Legitimate interest of CaixaBank Payments & Consumer: CaixaBank Payments & Consumer’s legitimate interest is to collect the debt in non-payment situations, which requires having up-to-date contact details on its customers.

Purpose: obtaining additional customer contact details to contact them in the event of breach of your contractual obligations.

Additional contact details are obtained from public listings such as White Pages, Yellow Pages and Lleida.net, and also from private lists such as Equifax, Detectives or debt collection agencies. We will always do this in compliance with prevailing regulations.

Types of data processed: the types of data we will process for this purpose are:

• Identification and contact details
• Information obtained from public access sources and public records

Other relevant information:

• Right to object to processing: if you believe that CaixaBank Payments & Consumer should stop using your data for any personal reason, you can request this easily and free of charge through the channels shown in section 4.

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

E. Preparation of mathematical models

Legitimate interest: designing, organising and improving our business operations as efficiently as possible. To achieve this, we need to create mathematical algorithms which help us analyse information using advanced methods.

Purpose: creating and maintaining statistical and mathematical models. These enable us to perform complex calculations and analyses which allow us to apply the processing operations described in this policy.

Types of data processed: the data that have already been identified in each processing operation are used. Wherever possible, we apply techniques to make sure that the data cannot be linked to an individual (anonymisation or pseudonymisation). This enables us to ensure that the rights of data subjects are not affected and that the result is mathematical formulas or algorithms.

Other relevant information:

• Right to object to processing: if you believe that CaixaBank Payments & Consumer and should stop using your data for any personal reason, you can request this easily and free of charge through the channels shown in section 4.
• Ancillary data processing: the aim is not to process customer data individually. Instead, it is necessary but secondary processing to create mathematical formulas. We thus use anonymisation techniques and minimise the amount of information. This processing has no individual consequences for customers.

Data controller: where mathematical models are based on data processing carried out by CaixaBank under this policy, CaixaBank will be the data controller. If they are carried out under a joint controller arrangement, the same rules will apply as for the original processing. You can find the details of the joint data controllers and the agreements at https://www.CaixaBank.es/empresasgrupo.

F. Sending commercial communications based on a basic commercial profile

Who does this processing apply to? We will only process your data in this way if:

• You have not indicated your preferences for the commercial processing described in sections 6.1.A., 6.1.B. and 6.1.C.
• We have sent you a personalised communication informing you of this; and
• You have not objected to the processing.

Legitimate interest of CaixaBank Payments & Consumer: promoting sales of the products and services in its portfolio and building customer loyalty.

Purpose: providing you with commercial communications about products and services similar to those you have taken out with us. We will do this based on a basic commercial profile which we will create using your data.

Types of data processed:

• Identifying and contact details: full name, sex, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
• Details of your professional or work activity and socio-economic information: professional or employment activity, income or salary.
• Contract data: contracted or requested products and services, account holder status, authorised or representative of the product and service contracted and information and transactions related to your financing operations.
• Basic financial data: current and historical balances of products and services and payment history of contracted products and services.
• Data obtained from the execution of statistical models: we use the results of applying mathematical models to customer data to combat fraud, identify your spending habits, preferences or likelihood of taking out a contract, comply with our regulatory obligations, and manage the operations relating to your products and/or services.
• Data obtained from other processing activities provided for in this policy:
  • Risk assessment data or scoring: in financing or instalment payment transactions, we will assess your ability to pay or risk of default, or risk limits, by applying statistical mathematical models calculated using your data (processing defined in section 6.2.B).
• Demographic and socio-economic data: these are data not relating to specific people but geographical areas, age sectors or professional activity sectors, which we will use to put into context with customer information.

Use of profiling: we will prepare a basic commercial profile using the data specified previously:

• Purpose of the profile: we will identify the products and services that we think may interest you. We will offer you these products instead of generic commercial offers.
• Consequences: we will provide you with customised offers concerning products and services marketed by CaixaBank Payments & Consumer.

We will only create the profile using the data detailed in this section. We will never use this profile to refuse to provide any product or service or to set credit limits.

Objecting to this data processing will not prevent, limit or condition your access to our full catalogue of products and services that is always available to you.

If you ask us for any product or service, we will assess your application in accordance with our procedures. Objecting to this processing will not affect this assessment.

Objecting to this data processing will also not prevent us from contacting you to manage your products and services.

• Logic: this basic commercial profile is calculated based on the data shown in the “Type of data processed” section. We will only use data from the last thirteen months.

We apply mathematical formulas derived from past behaviour of customers with similar characteristics to the data. This enables us to estimate the customer’s propensity to spend.

These mathematical formulas allow us to determine the importance of all the data processed in the final result of the customer’s profile. This final result is the probability that the customer will be interested in a product or service.

Other relevant information: the following section includes other relevant data processing information:

• Right to object to processing:

You can object to this processing simply and free of charge at https://www.caixabank.es/apl/particulares/gdpr/index_es.html?empresa=6&derecho=oposicioncomunicaciones

You can also object through the channels indicated in section 4.

Please note that if you object to our processing of your data, we will stop processing it without you having to give a reason.

• Pre-check of your payment capacity: When we offer you products or services that involve payment in instalments or financing, we will first check your ability to pay. We will do this as explained in section 6.2.B.

The purpose is to offer you a credit limit and a repayment term that is appropriate based on our knowledge of your financial situation. We will do all of this in accordance with the principle of responsibility for offering financing products that is required by the Bank of Spain, under regulations on the oversight and solvency of credit institutions and responsible lending.

• Duration of data processing: This processing will come into effect on 10 October 2022. In any case, you will receive a personalised informative message beforehand. We will stop processing this data, with no other additional requirements, in either of these two circumstances:
  • When we contact you to ask for your consent to the commercial processing carried out by the CaixaBank Group companies described in section 6.1. (A, B and C), whether you authorise or reject it.
  • If you object to the processing.

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

G. Defence of the rights and interests of CaixaBank Payments & Consumer through legal or administrative channels

Legitimate interest of CaixaBank Payments & Consumer: defence of the rights and interests of CaixaBank Payments & Consumer through both legal and administrative channels. CaixaBank Payments & Consumer in its right to an effective remedy.

Purpose: handling administrative or legal proceedings in which CaixaBank Payments & Consumer is either the plaintiff or the defendant.

Types of data processed:

• Identification and contact details
• Details of your professional or work activity and socio-economic information
• Sensitive data related to situations of vulnerability
• Details on legal capacity and special communication needs
• Contract details
• Basic financial data
• Details of the communications with the data subject
• Information retrieved from publicly accessible sources and records

Other relevant information:

• Right to object to processing: if there is a personal situation or other justifiable grounds for us to stop processing your data, you may submit a request to this effect simply and free of charge through the channels indicated in section 4.

Data controller: the data controller is CaixaBank Payments & Consumer. This processing is not done with another controller.

H. Preparation of statistical information

Legitimate interest of the joint controllers: compiling statistical information on how their business processes operate. This is considered a legitimate interest because it helps them to improve and analyse their operations.

Purpose: combining certain personal data to generate fully anonymised and aggregated information. This provides an overview of business processes while ensuring that no individual can be identified.

Types of data processed:

• Identification and contact details
• Details of professional or work activity and socio-economic information
• Contract details
• Basic financial data
• Third-party data from statements and receipts of instant accounts and payment accounts
• Details of whether or not you are a CaixaBank shareholder
• Own browsing data
• Geographical details
• Data obtained from other processing activities provided for in the policy

Other relevant information:

• Right to object to processing: if there is a personal situation or other justifiable grounds for us to stop processing your data, you may submit a request to this effect simply and free of charge through the channels indicated in section 4.
• Ancillary data processing: our processing of personal data is restricted to the processing operations needed to prepare statistical information and is performed using aggregation techniques until the data are fully anonymised.

Joint data controllers: the following companies will process your data under a joint controller arrangement:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Global Payments Moneytopay, EDE, S.L.
• Comercia Global Payments Entidad de Pago, S.L.

You will find the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.