Privacy Policy of ABANCA Seguros Salud

Additional information on personal data protection

1. Who is the data controller?

The data controller is ABANCA GENERALES DE SEGUROS Y REASEGUROS, S.A., with registered office at Avenida Linares Rivas 30 3ª, CP: 15005, A Coruña and NIF A-14715270 (hereinafter, “ABANCA Seguros Generales”).

At ABANCA Seguros Generales, we have a Data Protection Officer (hereinafter also “DPO”), whom you can contact, if necessary, to obtain more information about any of the points included in our Privacy Policy and to send your questions, inquiries, or complaints related to the processing of your personal data, via the email address dpo.abancagenerales@abancaseguros.com.

Below, we provide you with detailed information about the processing of your personal data carried out by ABANCA Seguros Generales as the data controller.

2. What is the origin of your personal data and what data do we process?

We must distinguish between the sources from which your personal data originate and the categories of personal data we process:

2.1 Sources from which your personal data originate

Your personal data processed by ABANCA Seguros Generales may come from yourself (when you provide or supply them in the context of your relationship with us), be generated by ABANCA Seguros Generales (as a result of managing those relationships), or originate from external sources (that is, from third parties who are not part of the relationships you maintain with us and from whom we obtain data about you under the consent you may have given us for this purpose, or under another legally provided legal basis that allows it). Below, we provide detailed information regarding the aforementioned internal and external sources from which your personal data may originate:

Data provided by you in the applications you submit to us or in the context of the formalization and development of your contractual or pre-contractual relationships with ABANCA Seguros Generales (e.g., the data necessary to request and contract an insurance policy—which includes, in the case of health insurance, data relating to your health—as well as other data provided for the processing of claims arising from the insurance contract, complaints, or other incidents). If you provide us with data of third parties (e.g., insured persons or beneficiaries in insurance contracts), you guarantee that you have the express and explicit consent of these third parties for ABANCA Seguros Generales to process their data, including health data if you provide such information. You also guarantee that the third parties whose data you provide have been duly informed of the processing that ABANCA Seguros Generales will carry out with said data and that are included here in this Privacy Policy.
Data generated about you derived from the management, development, and maintenance of the contractual or pre-contractual relationships you have with ABANCA Seguros Generales (e.g., data about you generated as a result of the management and development of the products or services you have subscribed to with us).
Data obtained from external sources, under your prior consent or another legitimizing basis provided for in the regulations (e.g., because they are necessary for the proper provision of the insurance contract and its contingencies or for the assessment of the policy and management of claims in the case of ABANCA Seguros Generales' legitimate interest, see section 3.3). Below are identified the “external sources” from which your personal data may originate:
- Entities responsible for managing the contingencies included in the insurance contract you have with ABANCA Seguros Generales;
- Companies of the ABANCA Economic Group, whose business sectors include finance, social, insurance, real estate, securities investment, training, marketing, and consulting and advisory services. You can access the complete list of companies that are part of the ABANCA Economic Group at any time via the hyperlink (https://www.abanca.com/es/legal/empresas-grupo-abanca/);
- Common files of the insurance sector under the assumptions, conditions, and guarantees that allow their creation and consultation;
- Publicly accessible sources: these include, for example, promotional census, electronic communications service directories, public lists of people associated with professional associations, official journals and bulletins, social media, and open social networks;
- Files containing information on asset and credit solvency (e.g., ASNEF).

2.2 Categories of personal data

At ABANCA Seguros Generales, we process different types of personal data to manage the contractual or pre-contractual relationships you have with us at any given time, as well as for the other purposes indicated in section 3. “For what purpose and on what legal basis do we process your personal data?” of this Privacy Policy.

To provide you with clear and detailed information in this regard, we have grouped the personal data we process into the following categories:

Identification and contact data: name, surname, identity document (DNI, passport, or NIE), postal and email address, and landline or mobile phone number.
Data relating to your voice (e.g., recordings of telephone calls you have with us).
Signature data (handwritten and digitized) and data relating to codes or identification keys for access and operations in remote channels you use in your relationship with ABANCA Seguros Generales.
Data on insurance policies contracted with ABANCA Seguros Generales: seniority, type of insurance, claims history, etc.
Data on claims occurred.
Health data of the insured when necessary for:
- The assessment, formalization, and management of health insurance.
- The processing and management of claims and, where appropriate, payment to healthcare providers or reimbursement to the insured or their beneficiaries for healthcare expenses incurred under the insurance contract.
Personal, family, and social circumstances data: marital status, age, family situation, date and place of birth, nationality, sex; as well as personal data of third parties covered by the policy (e.g., family members). -Sociodemographic data: types of people by age and education level living in the client's geographic area; types of families living in that area according to the number and characteristics of their members; categories of professional activities existing in the geographic area where the client resides; economic capacity, according to the annual income existing in that area; or the characteristics of that area according to the age of the buildings, the level of grouping—single-family or multi-family—or the presence of commercial areas.
Academic and professional data: education/qualifications, and membership in professional associations or organizations.
Employment data: type of contract, job position, seniority, professional experience, non-economic payroll data.
Commercial activity data: licenses for the activity, economic sector in which it is carried out, National Classification of Economic Activities (CNAE) in which the activity is classified.
Economic and asset solvency data: tax data and data on the non-fulfillment of a debt contracted with a private company or public bodies obtained from asset and credit solvency files (e.g., ASNEF and BADEXCUG files).
Financial data: ABANCA bank account number.
Transactional data: information related to the products and services requested or contracted (characteristics of the insurance, its coverage, and payment methods, for example).
Inferred or deduced data from the analysis and processing of the rest of the categories of personal data: This category includes, on the one hand, the grouping of clients into categories and segments based on objective criteria such as age, preferences, or propensity to contract products and services. In no case will we infer any data that reveals your ethnic or racial origin, political opinions, religious or philosophical beliefs, or trade union membership, nor genetic data, data relating to your health or your sex life or sexual orientation, nor biometric data aimed at uniquely identifying you (“Special categories of data”).
Biometric data (not belonging to special categories of data): if you use the digitized signature system to give your consent in the context of applications you submit to ABANCA Seguros Generales or contracts you have formalized or formalize with it, we will process the biometric data associated with that signature. The biometric data associated with the digitized signature are data categories that include the calligraphic features of the signature, such as the pressure and speed with which it is made, as well as the inclination of the stroke. The processing of such biometric data by ABANCA Seguros Generales is necessary, as appropriate, for the formulation, exercise, or defense of claims that may arise from the relationships you maintain with us. Therefore, they will be processed exclusively in the event of repudiation of the operation signed through the digitized signature system, in order to verify, through the corresponding comparison, that the signature is yours. Consequently, such biometric data associated with the signature will not be processed in any case as a means to uniquely identify you, and therefore will not be considered special categories of data.
Geographical location data: geolocation data of your mobile device, when you have authorized it so that we can provide you with a service, such as, for example, indicating the nearest medical center; or, based on the legitimate interest of ABANCA Seguros Generales in preventing fraud in the contracting and use of our products and services, the location data of said mobile device, in the event that you have installed our application on it.
Data of persons subject to international sanctions and financial countermeasures: data of persons as indicated in laws, regulations, guidelines, resolutions, programs, or restrictive measures on international economic-financial sanctions imposed by the United Nations, the European Union, the Kingdom of Spain, the United Kingdom, and/or the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC).

3. For what purposes do we process personal data and under what legal basis?

Below, we inform you about the different processing of your personal data for which ABANCA Seguros Generales is responsible, specifying the respective legal bases that legitimize them and the purposes of each. Additionally, and as indicated in the previous subsection 2.2. (“Categories of data”), the specific categories of data used in each processing are detailed.

3.1. Processing necessary for the execution of your contractual or pre-contractual relationships with ABANCA Seguros Generales.

This subsection refers to the processing we carry out of your personal data for the execution of the contractual or pre-contractual relationships you establish with ABANCA Seguros Generales and, therefore, to be able to provide you with the services and products that are the subject of those relationships.

The legal basis for this processing is, consequently, the necessity to execute or fulfill those contractual or pre-contractual relationships with ABANCA Seguros Generales of which you are a party.

Below, the referred processing is detailed, indicating their respective purposes, as well as the categories of personal data used in each:

3.1.1. Formalization, maintenance, and fulfillment of relationships with ABANCA Seguros Generales

The purpose of this processing is the correct formalization, maintenance, and fulfillment of the contractual or pre-contractual relationships you establish with us.

The following are the data processing operations we may carry out within the framework of the referred processing, which include obtaining the data necessary to manage the requests you make to us, evaluating the feasibility of contracting the corresponding products and services, and the correct formalization, maintenance, and fulfillment of the resulting contracts:

Receive the information or contracting requests you have made regarding our products and services, analyze and evaluate them, respond to you, and clarify any doubts that may arise.
Where appropriate, register the requested operation by signing the corresponding contract.
Maintain, develop, and control your business relationships with ABANCA Seguros Generales.
Send you strictly non-commercial communications related to the products and services you have contracted with ABANCA Seguros Generales.
With prior information (either in the contractual or pre-contractual documentation or at the beginning of the call itself), record the telephone conversations you have with us, in order to, where appropriate, comply with legal obligations, carry out quality controls, and use them as evidence in the context of a judicial or extrajudicial claim.
Where appropriate, analyze and manage situations of non-payment that may occur in the context of the products and services you have contracted with ABANCA Seguros Generales.
Manage and respond to any claims you may submit.
Manage the application of bonuses, discounts, or any other promotional conditions, as well as the delivery of prizes and/or promotional gifts that may be associated with or applicable to the contractual relationship you have established with ABANCA Seguros Generales.
For reasons arising from the inclusion of a product or service in a reinsurance or coinsurance or due to the management of the policy itself, it will be necessary to communicate to third-party insurance entities information about the contracting of any product or service, regardless of its commercial name, as well as the identification data of the contracting parties and the product or service (name and surname or company name; type and number of identification document; date of birth or date of incorporation, depending on whether it is an individual or legal entity; country of nationality, if the country of issue of the identification document is not available; country of issue of the identification document, if the country of nationality is not available; declared country of residence; type of numbering of the contracted product or service; start and end date of the relationship between the account or deposit and the intervening person and the other holders, beneficial owners, and, where appropriate, representatives or authorized persons).
Determine the healthcare assistance to be provided to the insured and/or beneficiaries under the coverage included in the contract, as well as proceed with payment to healthcare providers or reimbursement to the insured or beneficiary for healthcare expenses.

For the formalization, maintenance, and fulfillment of the contractual or pre-contractual relationships you establish with ABANCA Seguros Generales and, therefore, to provide you with the services and products that are the subject of those relationships, we may process the personal data corresponding to the following categories detailed in subsection 2.2. (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection 2.2.): Identification and contact data; Data relating to your voice; Personal, family, and social circumstances data; Sociodemographic data; Employment data; Economic and asset solvency data; Financial data; Transactional data; Signature data (handwritten and digitized) and data relating to codes or identification keys; where appropriate, Health data for the operations indicated in the last point and under the provisions of the insurance sector regulations; Inferred or deduced data from the analysis and processing of the rest of the categories of personal data; and, where appropriate, Biometric data (not belonging to special categories of data) associated with the digitized signature.

3.1.2. Analysis and assessment of the insured risk in the formalization, maintenance, and fulfillment of relationships with ABANCA Seguros Generales

The purpose of this processing is to analyze the risk associated with the insurance and, through the application of actuarial and statistical techniques, calculate premium rates.

Below are the data processing operations we may carry out within the framework of the referred analysis:

ABANCA Seguros Generales collects and records the data and documentation necessary to carry out the corresponding analysis of your financial situation and/or solvency.
When you request an insurance product from us, as well as in the case of contracting and even during its validity, we will carry out an analysis and assessment using actuarial and statistical techniques, thus obtaining a premium rate that is consistent with the characteristics of the insured and beneficiaries, the environment, and the historical data of ABANCA Seguros Generales. Likewise, data relating to your non-fulfillment of monetary, financial, or credit obligations that appear in common credit information systems such as the ASNEF file may be consulted.
Regarding the way these techniques are applied and their impact, you should bear in mind that, depending on the product requested or actually contracted, automatic decisions may be made regarding approval, denial, or reassessment of the product; or decisions of approval, denial, or reassessment of the product that are not completely automatic, as there is a subsequent review of the result by a specific approval committee (so the result of the actuarial techniques is, in such case, merely indicative). In the event that the decision of approval, denial, or reassessment is completely automatic, we inform you that you will have certain rights, in particular, the right to obtain human intervention by ABANCA Seguros Generales in the analysis of the decision, to express your point of view, and to challenge the decision made.

For the analysis and assessment of the insured risk in the formalization, maintenance, and fulfillment of relationships with ABANCA Seguros Generales, we may process personal data corresponding to the following categories detailed in subsection 2.2. (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection 2.2): i) Identification and contact data; ii) Signature data (handwritten and, where appropriate, digitized); iii) Data on insurance policies contracted; iv) Health data included in the pre-contracting questionnaire; v) Data on claims occurred; vi) Personal data of third parties covered by the policy (e.g., family members or employees); vii) Personal, family, and social circumstances data; vii) Sociodemographic data; ix) Academic and professional data; x) Employment data; xi) Commercial activity data; xii) Economic and asset solvency data; xiii) Financial data; xiv) Transactional data; xv) Inferred or deduced data from the analysis and processing of the rest of the categories of personal data.

3.2. Processing carried out to comply with legal obligations

The insurance sector, of which ABANCA Seguros Generales is a part, is highly regulated, and this means that we must process your data to comply with the legal obligations applicable to us in each case.

The legal basis for this processing is, consequently, the necessity to comply with the legal obligations to which ABANCA Seguros Generales is subject in the course of its activity.

Below are the data processing operations we may carry out in the context of the referred processing and depending on the legal framework applicable to ABANCA Seguros Generales in each case:

3.2.1. Responding to possible requests for information made by administrations, public bodies, and courts and tribunals.

In compliance with the applicable regulations in force and on the occasion of proceedings in which administrations and public bodies, as well as courts and tribunals, are competent, we are obliged to communicate to these entities the data generated at ABANCA Seguros Generales as a result of the relationship(s) it has established with you.

To comply with the obligation to respond to possible requests for information made by the aforementioned competent administrations, public bodies, and courts and tribunals, we may process data corresponding to the following categories detailed in subsection 2.2. (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection): i) Identification and contact data; ii) Data relating to your voice; iii) Signature data (handwritten and, where appropriate, digitized) and data relating to codes or identification keys; iv) Data on insurance policies contracted; v) Special categories of data (e.g., health data necessary for the formalization and management of life insurance, as well as for the processing and management of claims occurred); vi) Data on claims occurred; vii) Personal data of third parties covered by the policy (e.g., family members or employees); viii) Personal, family, and social circumstances data; ix) Sociodemographic data; x) Academic and professional data; xi) Employment data; xii) Commercial activity data; xiii) Economic and asset solvency data; xiv) Financial data; xv) Transactional data; xvi) Inferred or deduced data from the analysis and processing of the rest of the categories of personal data; xvii) Biometric data (not belonging to special categories of data).

3.2.2. Other legal obligations

Consult lists of persons and entities subject to international sanctions and financial countermeasures (e.g.: list of specially designated nationals and blocked persons at the United States Department of the Treasury “SDN List” -http://sdnsearch.ofac.treas.gov-), either directly or through consultation tools and databases provided by third parties;

3.3. Processing based on the legitimate interest of ABANCA Seguros Generales.

This section refers to the processing of your personal data that is based on the satisfaction of legitimate interests pursued by ABANCA Seguros Generales, provided that your own interests or fundamental rights and freedoms do not prevail over those legitimate interests. In no case will health data or other special categories of data be processed on the basis of legitimate interest.

For this reason, prior to carrying out the processing described in this subsection 3.3., we have carried out a balancing test between your rights and the legitimate interest of ABANCA Seguros Generales, concluding that the latter prevails. You can consult the balancing analysis we have carried out by contacting our DPO at the following email address: dpo.abancagenerales@abancaseguros.com.

3.3.1. Fraud prevention

It is also a legitimate interest of ABANCA Seguros Generales to prevent situations of fraud in the contracting and use of our products or services (e.g., identity theft or password theft) that could result in harm to you, third parties, and/or ABANCA Seguros Generales. Therefore, and for the purpose of fraud prevention in (i) our product and service contracting processes, as well as (ii) during the provision of said products and/or the execution of the contracted services, we may carry out the following data processing operations on your personal data:

Verify the accuracy and truthfulness of the documents you provide us, for example, through the CSV code (secure verification code) or the CEA code (Electronic Authenticity Code) in the case of digital copies of tax returns and employment history.

To prevent fraud in our product and service contracting processes, as well as in the provision of said products and/or the use of the contracted services, we may process personal data corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection 2.2.): i) Identification and contact data; ii) Sociodemographic data; iii) Employment data; iv) Economic data (taxes); and v) Financial data.

3.3.2. Creation of commercial profiles, to offer you advertising information tailored to those profiles, about products and services similar to those contracted

At ABANCA Seguros Generales, we use your personal data obtained from our internal sources (that is, data we have because you have provided them or generated at ABANCA Seguros Generales as a result of managing the products and services you have contracted with us) to create your commercial profile, and use that profile to offer you advertising information tailored to it about products and services similar to those you have contracted with us. For this purpose, we will only use data obtained from external sources in the exclusive case that you have given us your consent for this purpose, as provided in subsection 3.4.4. of this Privacy Policy, or if we have another legally provided legal basis that allows its processing.

Below, we explain how we create and use your commercial profile for the indicated purpose:

The processing of your personal data to create your commercial profile aims to understand your needs, interests, and preferences and to personalize the product and service offers we make so that you only receive offers that match those needs, interests, and preferences.

The interest pursued by ABANCA Seguros Generales is to be more efficient and effective in targeting advertising to our client base, or in other words, to maximize the performance of our commercial campaigns.

This processing consists of using your personal data to analyze and predict your personal preferences, economic situation, interests, and behavior using techniques consisting of basic profiling rules (that is, simple segmentations such as, for example, clients with a certain age range or residence in a specific region), and advanced techniques consisting of supervised and unsupervised Machine Learning mathematical algorithms, which allow the construction of propensity models and the realization of advanced segmentations.

To create this commercial profile, we will process personal data corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection 2.2): Identification and contact data; Personal, family, and social circumstances data; Employment data; Economic and asset solvency data; Financial data; and Transactional data. As indicated above, such data will not include those obtained from external sources, except in the exclusive case that we have your consent for this purpose, as provided in subsection 3.4.4. of this Privacy Policy, or if we have another legally provided legal basis that allows its processing.

The data used may correspond to the two years immediately prior to the creation and/or review of the commercial profile.

At any time, you may object to the processing of your data for the creation of your commercial profile by emailing: dpo.abancagenerales@abancaseguros.com.

The final consequence of creating your commercial profile is that, as a client, you will only receive advertising information about our products and services that is appropriate to your needs, interests, and preferences. That is, this profile is used exclusively for the indicated purpose and, therefore, cannot be used as grounds for denying any product and/or service.

3.3.3. Providing you with advertising information about products and services similar to those contracted

By virtue of ABANCA Seguros Generales' legitimate interest in promoting its products and services, we may process your personal data for the purpose of sending you advertising information regarding products and services similar to those you have contracted with ABANCA Seguros Generales.

Prior to processing your data for such direct marketing purposes, in addition to consulting our internal records to ensure that you have not objected to such processing, we will consult the Robinson List, in order to ensure that you are not included in any advertising exclusion database.

This advertising information may be generic or personalized, that is, tailored to your commercial profile as described in subsection 3.3.2 above (profiling with internal sources) or, if you give your consent for this purpose, as described in subsection 3.4.4 below (profiling with external sources).

You may object to the sending of such advertising information at any time by contacting us at: dpo.abancagenerales@abancaseguros.com.

Unless you indicate otherwise, this information may be sent to you through the following channels:

Postal mail;
Email and social networks;
Any type of message to your mobile phone;
The apps that ABANCA Seguros Generales may offer and of which you are a user;
Telephone calls.

To send you advertising information regarding products and services similar to those you have contracted with ABANCA Seguros Generales, we may process personal data corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in the same subsection 2.2): Identification and contact data.

3.3.4. Conducting satisfaction surveys on our contracted products and services

By virtue of ABANCA Seguros Generales' legitimate interest in assessing the level of satisfaction and quality of the contracted product or service, we may process your personal data for the purpose of conducting satisfaction surveys regarding products and services you have contracted with ABANCA Seguros Generales.

You may object to the sending of satisfaction surveys at any time by contacting us at: dpo.abancagenerales@abancaseguros.com.

Unless you indicate otherwise, these surveys may be sent through the following channels:

Postal mail;
Email and social networks;
Any type of message to your mobile phone;
The apps that ABANCA Seguros Generales may offer and of which you are a user;
Telephone calls.

To assess the level of satisfaction and quality of the product or service contracted with ABANCA Seguros Generales, we may process personal data corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in the same subsection 2.2): Identification and contact data; and Data on contracted insurance and products.

3.3.5 Conducting statistical and historical studies

ABANCA Seguros Generales has a legitimate interest in knowing the characteristics of its clients and the services and products they have contracted (e.g., knowing the average customer tenure, the acceptance of a particular product in an age segment, etc.). These analyses allow us to detect the strengths and weaknesses of our products or our commercial strategy and, ultimately, to improve as a company. Likewise, the impact that this activity may have on our clients is very limited, since, even though all Categories of data identified in subsection 2.2 may be processed—except for special categories of data (health data)—only the minimum relevant data for the study will be processed and, whenever possible, pseudonymization techniques will be used.

You may object to the conducting of studies for statistical and historical purposes at any time by contacting us at: dpo.abancagenerales@abancaseguros.com

3.4. Processing based on your consent

In this subsection, we refer to those processing activities of your personal data that we will carry out exclusively if we have requested and obtained your prior consent for this purpose.

The legal basis for the different processing activities described below therefore lies in the consent that you may have given us for each of them.

We remind you that such consent is revocable, meaning you may withdraw it at any time and, in that case, ABANCA Seguros Generales will cease the corresponding processing. However, withdrawal of consent will not have retroactive effects and will not affect the lawfulness of processing previously carried out. To revoke or withdraw the consent you may have given us, you may contact us at: dpo.abancagenerales@abancaseguros.com

The processing of your personal data that we may carry out if we have requested and obtained your prior consent are detailed below:

3.4.1. Providing you with advertising information tailored to your profile about products and services of ABANCA Economic Group companies and partners

We will process your personal data to provide you, through any means (postal mail, telephone, any type of message to your mobile phone—such as SMS or push messages—, email, social networks, or our apps), with information tailored to your commercial profile (i.e., adapted to your interests, needs, and preferences, as explained in subsection 3.3.2 of this Privacy Policy) about products and services of ABANCA Economic Group companies, as well as third-party partners of ABANCA Seguros Generales.

The business sectors of the ABANCA Economic Group companies include finance, social, insurance, real estate, investment, education, marketing, and consulting and advisory services. You can access the complete list of companies that are part of the ABANCA Economic Group at any time at https://www.abanca.com/es/legal/empresas-grupo-abanca/.

The third-party partners of ABANCA Seguros Generales are companies with which ABANCA Seguros Generales maintains commercial collaboration agreements and that offer financial, insurance, leisure, food, appliances, furniture, vehicles, footwear, textile, optical, or personal consumption products and services.

To provide you with advertising information about products and services of ABANCA Economic Group companies and third-party partners as indicated in this section, we may process personal data corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection 2.2): Identification and contact data; Data inferred or deduced from the analysis and processing of the rest of the categories of personal data (mainly, the commercial profile created with the basic and advanced profiling techniques described in subsection 3.3.2 of this Privacy Policy).

3.4.2. Sharing your data with ABANCA Economic Group companies to facilitate their contracting processes with you

We will share your personal data with ABANCA Economic Group companies referred to in the previous subsection 3.4.1 in order to facilitate and expedite the analysis (including the risk to be insured in the case of insurance operations or credit risk in the case of financing operations) and the possible formalization of a contract or pre-contract that you have requested from the corresponding ABANCA Economic Group company recipient of the data; or to facilitate and expedite the management and execution of a contract or pre-contract that you already have with the corresponding ABANCA Economic Group company recipient of the data.

The personal data that ABANCA Seguros Generales may share with other ABANCA Economic Group companies as provided in this subsection 3.4.2 are those corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection 2.2): Identification and contact data; Data on contracted insurance; Economic and asset solvency data; Financial data; Transactional data; Data inferred or deduced from the analysis and processing of the rest of the categories of personal data (mainly, the commercial profile created with the basic and advanced profiling techniques described in subsection 3.3.2 of this Privacy Policy).

3.4.3. Sharing your data with ABANCA Economic Group companies so that they can provide you with advertising information tailored to your profile about their products and services

We will share your personal data with ABANCA Economic Group companies referred to in the previous subsection 3.4.1 so that these companies can create or update your commercial profile and your risk profile in insurance matters or, where appropriate, your credit risk profile, and, using these profiles, prepare and provide you with information tailored to them (i.e., adapted to your interests, needs, preferences, savings capacity, and credit capacity) about the products and services they market at any given time; information that, consequently, these companies will send you directly and through any means (including email, SMS messages, and other equivalent electronic communication means).

For the creation or updating of your commercial profile, ABANCA Economic Group companies may use basic and advanced profiling techniques as described in subsection 3.3.2 of this Privacy Policy. Additionally, and also for the purpose of creating or updating your commercial profile, such companies may consult legitimate files from the sector or sectors in which they operate (e.g., common files for risk selection and pricing in the insurance sector). The personal data that ABANCA Seguros Generales may share with ABANCA Economic Group companies as provided in this subsection 3.4.3 are those corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection 2.2): Identification and contact data; Data on contracted insurance; Economic and asset solvency data; Financial data; Transactional data; Data inferred or deduced from the analysis and processing of the rest of the categories of personal data (mainly, the commercial profile created with the basic and advanced profiling techniques described in subsection 3.3.2 of this Privacy Policy).

3.4.4. Creation of your commercial profile using external sources

We will enrich the information about you that we already have through our internal sources (i.e., the information you have provided or generated at ABANCA Seguros Generales in connection with the management of the products and services you have contracted with us), with other data about you provided by various external sources, such as public records (e.g., the Land Registry, the Commercial Registry, the National Statistics Institute, and the Cadastre); publicly accessible sources (e.g., public lists of people associated with professional associations, official journals and bulletins, social media, and open social networks); ABANCA Economic Group companies that you have authorized to transfer your personal data to us for the creation by us of your commercial profile and your risk profile in insurance matters; geomarketing tools and databases; browsing data on third-party websites and applications, if you have accepted the use of cookies and similar technologies on the relevant browsing devices; as well as common files in the insurance sector (e.g., files for risk selection and pricing and files for the preparation of technical and statistical-actuarial studies). All this with the purpose of creating a more complete and in-depth commercial profile about you than the one created with the internal sources mentioned in subsection 3.3.2 of this Privacy Policy, which will allow us to more accurately personalize the offers we send you regarding our products and services.

Indeed, with the information about you enriched with external sources, and by applying the profiling techniques described in subsection 3.3.2 of this Privacy Policy to such information, we will be able to adapt or select with greater precision the offers of products and services from ABANCA Seguros Generales that best suit your characteristics and, therefore, your interests, insurance needs, preferences, savings capacity, and credit capacity; as well as, if we have obtained your consent referred to in subsection 3.4.1, select the offers of products and services from ABANCA Economic Group companies and/or partners that best suit your characteristics and, therefore, your financial or insurance needs, preferences, savings capacity, and credit capacity.

For the creation of your commercial profile using information about you enriched with external sources, we may process personal data corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same subsection 2.2): Identification and contact data; Personal, family, and social circumstances data; Sociodemographic data; Employment data; Economic and asset solvency data; Financial data; Transactional data; and Online/app browsing and behavior data.

The data used may correspond to the last two years.

3.4.5. Retaining the processing of your personal data once our relationship has ended for the management of a new request

We will retain your personal data once our relationship with you has ended, and for a maximum period of 5 years, to manage new requests for products or services that you may submit to us.

For this purpose, we may process personal data corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same section): Identification and contact data; Data on contracted insurance; Personal, family, and social circumstances data; Sociodemographic data; Academic and professional data; Employment data; Economic and asset solvency data; and Financial data.

3.4.6. Retaining the processing of your personal data once our relationship has ended to continue sending you advertising information tailored to your profile about products and services of ABANCA Seguros Generales

We will retain your personal data once our relationship with you has ended, and for a maximum period of 5 years, to continue sending you, through any means (postal mail, telephone, any type of message to your mobile phone—such as SMS or push messages—, email, social networks, or our apps), advertising information tailored to your commercial profile (i.e., adapted to your interests, needs, and preferences, as explained in subsection 3.3.2 of this Privacy Policy) about products and services of ABANCA Seguros Generales.

For these purposes, we may process personal data corresponding to the following categories detailed in subsection 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same section): Identification and contact data; Data inferred or deduced from the analysis and processing of the rest of the categories of personal data.

3.4.7. Retaining the processing of your personal data once our relationship has ended to continue sending you advertising information tailored to your profile about products and services of ABANCA Economic Group companies and partners

We will retain your personal data once our relationship with you has ended, and for a maximum period of 5 years, to continue sending you, through any means (postal mail, telephone, any type of message to your mobile phone (such as SMS or push messages), email, social networks, or our apps), information tailored to your commercial profile (i.e., adapted to your interests, needs, and preferences, as explained in subsection 3.3.2 of this Privacy Policy) about products and services of ABANCA Economic Group companies and third-party partners of ABANCA Seguros Generales referred to in the previous subsection 3.4.1 of this Privacy Policy.

For these purposes, we may process personal data corresponding to the following categories detailed in section 2.2 (“Categories of data”) of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same section): Identification and contact data; Data inferred or deduced from the analysis and processing of the rest of the categories of personal data.

4. Who do we share your data with?

We will only share your personal data with third parties when you have given us your consent to do so or there is another legal basis supporting such data communication. Thus, the data processing carried out by ABANCA Seguros Generales described in this Privacy Policy may involve your data being communicated to the following recipients:

To the common files of the insurance sector that may be applicable and public records (e.g., files for risk selection and pricing and files for the preparation of technical and statistical-actuarial studies).
To Public Bodies, such as the Institute of Accounting and Auditing or the Insurance Compensation Consortium, in cases where current regulations, or an agreement signed by ABANCA Seguros Generales with the corresponding body, so determine.
To private reinsurance or coinsurance entities, responsible for managing the coverages included in the coinsurance and reinsurance policy regarding the risks assumed by them.
To entities responsible for managing the contingencies and services included in the insurance contract you have with ABANCA Seguros Generales.
To insurance intermediaries.
To national and European Union supervisory authorities.
To ABANCA Economic Group companies and partner companies, with your prior consent and for the purposes of expediting your contracting processes and carrying out advertising actions tailored to your profile. You can access the complete list of companies that are part of the ABANCA Economic Group at any time at: www.abanca.com/es/legal/empresas-grupo-abanca/
Service providers. The purpose of these communications will be the management by these third parties, called data processors, of the provision of certain services on behalf of ABANCA Seguros Generales. They will process your personal data on our behalf and always following our instructions. Under no circumstances may they process your personal data for their own purposes. At ABANCA Seguros Generales, we follow strict criteria for selecting service providers and sign with each of them the corresponding data processing agreement, which sets out the conditions of confidentiality, security, and data processing in accordance with the regulations in force at any given time. These third parties may include different sectors of activity such as, for example: Marketing and advertising services; Training services; Trusted third-party services; Survey services; Call center services; Insurance back-office services; Administrative support services; Postal, distribution, and courier services; Printing and envelope stuffing services; Archiving, custody, storage, and digitization services; Document removal and destruction services; Audit and consulting services; Legal services; Physical security services; Logical security services; IT services; Telecommunications services; and Communication and activity support services.
To entities that manage credit information systems or also known as files on non-compliance with monetary obligations (e.g., BADEXCUG or ASNEF). The purpose of these communications is to report debts that meet the requirements established by law, after prior notification indicating your rights.
To the State Tax Administration Agency (AEAT) and other competent tax administrations, in compliance with applicable tax regulations.
To State Security Forces and Corps in the context of investigation procedures—judicial and/or administrative—in which they are competent or in compliance with applicable regulations.
To Judges and Courts, in the context of judicial proceedings in which they are respectively competent or in compliance with applicable regulations.
To the Customer Ombudsman: D.A. Defensor, S.L., in order to address and resolve, in the second instance, complaints and claims that have previously been resolved by the ABANCA Seguros Generales Customer Service in the first instance arising from insurance contracts in accordance with the ABANCA Seguros Generales Customer Defense Regulations.

5. Is any international transfer foreseen?

Certain companies that provide services to ABANCA Seguros Generales are located outside the European Union, which implies the carrying out of International Data Transfers. In this regard, ABANCA Seguros Generales guarantees the application of technical, organizational, and legal security measures that are appropriate to the level of risk of the processing, regardless of the territory where it takes place.

Any communication of data to third parties located in countries outside the European Economic Area (EEA) will be subject to an adequate level of protection that guarantees the security and legitimacy of the processing of your personal data, in accordance with the applicable regulations.

For more information on international data transfers and the guarantee mechanisms applied, you can contact the Data Protection Officer of ABANCA Seguros Generales at the following email address: dpo.abancagenerales@abancaseguros.com.

6. How long do we keep your data?

Your personal data will be kept for the duration of the contractual or pre-contractual relationship with ABANCA Seguros Generales and, if you have given your consent for this purpose, will be kept after the contractual or pre-contractual relationship for a maximum period of 5 years.

Once the contractual or pre-contractual relationship has ended (or, where appropriate, after the 5-year period), the data will be blocked in accordance with the applicable regulations, which means the identification and reservation of the data, adopting technical and organizational measures to prevent their processing, except for the formulation, exercise, or defense of claims or for making them available to Judges and Courts, the Public Prosecutor's Office, or the competent Public Administrations, for the purpose of attending to or demanding possible liabilities arising from the processing and only during the legal limitation periods for such liabilities.

After these periods, your personal data will be deleted.

7. What are your rights?

Data protection regulations grant you a series of rights in relation to the processing of your personal data:

Right of access. You can find out what type of data we are processing and the characteristics of the processing we are carrying out.
Right of rectification. You can request the modification of your data when they are inaccurate or incomplete.
Right to portability. You can obtain a copy in an interoperable format of the data being processed.
Right to restriction of processing. You can request the restriction of the processing of your personal data when any of the conditions set out in the law are met:
- When you challenge the accuracy of your personal data, during the period in which ABANCA Seguros Generales verifies their accuracy;
- When the processing is unlawful but you oppose the erasure of your data;
- When ABANCA Seguros Generales does not need to process your data but you need them for the exercise or defense of claims; and
- When you have objected to the processing of your data carried out for the fulfillment of a mission in the public interest or for the satisfaction of a legitimate interest while it is verified whether the legitimate grounds for the processing prevail over yours.
Right to erasure. You can request the deletion of your data when the processing is no longer necessary.
Right to object. You can request that we do not process your personal data (e.g., to stop sending commercial communications about the entity's products) and not to be subject to decisions based solely on automated processing. You can also request the cessation of processing based on the legitimate interest of ABANCA Seguros Generales, in which case we will stop processing your data, unless we demonstrate compelling legitimate grounds for the processing that may override your rights, or for the formulation, exercise, or defense of claims.
Right to withdraw the consent given at any time.
Right to lodge a complaint with the supervisory authority (in Spain, the Spanish Data Protection Agency: https://www.aepd.es/).

To exercise any of these rights, you must contact our Customer Service at the following email address: dpo.abancagenerales@abancaseguros.com.

We will process your request as soon as possible and, in any case, within the legal period of one month from receipt of your request. This period may be extended by another two months if necessary, taking into account the complexity and number of requests. In this case, you will be informed of the extension within the first month from receipt of the request, indicating the reasons for the delay.