Basic information on personal data protection

BASIC INFORMATION ON PERSONAL DATA PROTECTION

1. Who is responsible for processing your data?

ABANCA VIDA Y PENSIONES DE SEGUROS Y REASEGUROS, S.A.U., with NIF A-15140387 (hereinafter, "ABANCA Vida y Pensiones").

2. What is the origin of your personal data and what data do we process?

2.1. Sources of your data: Your personal data processed by ABANCA Vida y Pensiones may come from yourself, be generated by ABANCA Vida y Pensiones, or originate from external sources: i) Data provided by you; ii) Data generated about you derived from the management, development, and maintenance of the contractual or pre-contractual relationships you have with ABANCA Vida y Pensiones; iii) Entities responsible for managing the coverages and contingencies included in the insurance contract you have with ABANCA Vida y Pensiones; iv) Entities responsible for managing the services you request or use under the insurance contract you have with ABANCA Vida y Pensiones (e.g., the second medical opinion service); v) Companies of the Economic Group of ABANCA Corporación Bancaria, S.A. (to which ABANCA Vida y Pensiones belongs); vi) Common files of the insurance sector (e.g., risk selection and rating files and files for the preparation of technical and statistical-actuarial studies); vii) Publicly accessible sources (e.g., promotional census, official journals and bulletins, or open social networks); viii) Public Administration bodies (e.g., the General Treasury of Social Security, the National Institute of Statistics -INE-, the State Tax Administration Agency -AEAT-, or the National Death Index -INDEF-); and ix) Files with information on asset solvency and credit (e.g., ASNEF).

If you provide data of third parties, you guarantee that you have the express consent of said third parties to communicate their data to ABANCA Vida y Pensiones. Likewise, you guarantee that the third parties whose data you provide have been duly informed of the processing that ABANCA Vida y Pensiones will carry out with said data, processing which is included here in this Basic Information on Personal Data Protection.

2.2. Categories of personal data: The data we process correspond to the following categories: i) Identification and contact data; ii) Data related to your voice; iii) Signature data (handwritten and digitized) and data related to identification codes or keys; iv) Data on contracted insurance; v) Special categories of data (e.g., health data necessary for the formalization and management of life insurance, as well as for the processing and management of claims; or data associated with digital signature—signature on tablet or via surface); vi) Data on claims; vii) Personal data of third parties covered by the policy (e.g., family members or employees); viii) Data on personal, family, and social circumstances; ix) Sociodemographic data; x) Geographical location data; xi) Academic and professional data; xii) Employment data; xiii) Commercial activity data; xiv) Economic and asset solvency data; xv) Financial data; xvi) Transactional data; xvii) Data inferred or deduced from the analysis and processing of the rest of the categories of personal data; and xviii) Data of persons subject to international sanctions and financial countermeasures.

3. For what purposes do we process personal data and under what legal basis?

Below, we inform you about the different processing of your personal data for which ABANCA Vida y Pensiones is responsible, specifying the respective legal bases that legitimize them and the purposes of each:

3.1. Processing necessary for the execution of your contractual or pre-contractual relationships with ABANCA Vida y Pensiones. In order to execute the contractual or pre-contractual relationships you establish with ABANCA Vida y Pensiones and, therefore, to provide you with the services and products that are the subject of those relationships, we will carry out the following processing: i) we will process your data for the formalization, maintenance, and fulfillment of your contractual or pre-contractual relationships with ABANCA Vida y Pensiones (which includes receiving information or contracting requests you have made regarding our products or services or processing the corresponding renewals; contacting you in the event of any incident that may have prevented the completion of the contracting process and allowing you to resume it; proceeding, if applicable, to activate the requested operation by signing the corresponding contract; maintaining, developing, and controlling your insurance relationships with ABANCA Vida y Pensiones; sending you non-commercial communications strictly related to the products and services you have contracted; after informing you, recording telephone conversations you have with us; analyzing and managing situations of non-payment that may occur; managing and responding to any claims you may submit; and managing the application of bonuses, discounts, or any other promotional conditions, as well as the delivery of prizes and/or promotional gifts that may be associated with or applicable to the contractual relationship established with ABANCA Vida y Pensiones); ii) additionally, the necessary processing of your health data prior to the establishment of the contractual relationship and during its development and execution (including the determination of the compensation that may be due in the event of the contingencies included in the contract, in compliance with the Law on the regulation, supervision, and solvency of insurance and reinsurance entities) is based on the express consent you provide by signing and accepting this document and the health questionnaire used for this purpose by ABANCA Vida y Pensiones (likewise, the information collected in the health questionnaire, in addition to the specific insurance you are requesting or have contracted, may be taken into account by the insurance company as a measure to combat fraud, in the event that you initiate the contracting of a new insurance); iii) if you request or maintain an insurance product with us, we will process your data for the analysis and assessment of the insured risk, which includes: collecting and recording the data and documentation necessary to carry out said analysis and assessment; performing the indicated analysis and assessment using actuarial and statistical techniques, both at the time you request the insurance product and, if contracted, during its validity; and, in order to achieve the necessary consistency between your financial situation and the insured capital or interest, analyzing your financial situation (including your solvency), which includes collecting and recording the data and documentation necessary to carry out said analysis, which will depend on the type of insurable risk—free or linked to a financing product, such as a loan—(e.g., in the case of free risk: professional and employment data, economic and asset solvency data, or data from previous insurance; and in the case of linked risk: proof of the granting of the financing product to which the insurance is linked), performing the indicated analysis using actuarial techniques (e.g., "Profit testing"), as well as consulting data relating to your non-compliance with monetary, financial, or credit obligations that appear in common credit information systems, such as the ASNEF file; iv) consulting information in the National Death Index - INDEF; and v) if necessary, obtaining your updated contact details to manage non-payment situations when it is impossible to contact you through the information you provided when formalizing the contractual relationships.

3.2. Processing carried out to comply with legal obligations. To comply with the legal obligations applicable to us in each case, we may process your data to: i) respond, if appropriate, to information requests made by public administrations and bodies and competent judges and courts; ii) Prevention of Money Laundering and Terrorist Financing; iii) communicate your data to the Register of Insurance Contracts Covering Death; to the Institute of Accounting and Auditing of Accounts; to common files of the insurance sector for the preparation of technical and statistical-actuarial studies; to the Insurance Compensation Consortium; and to private entities for reasons of reinsurance, coinsurance, or policy management; iv) communicate information about your monetary and in-kind receipts, as well as your tax residence and/or any other information about your personal and family situation requested by the competent Tax Administrations (e.g., the AEAT) for the effective application of the state and customs tax system; and v) communicate information to external auditors, for the purpose of carrying out the audit required of ABANCA Vida y Pensiones under auditing regulations, due to its status as an insurance entity.

3.3. Processing carried out based on the legitimate interest of ABANCA Vida y Pensiones. We process your personal data based on the satisfaction of the legitimate interests pursued by ABANCA Vida y Pensiones, and to the extent that your own interests or fundamental rights and freedoms do not prevail over those legitimate interests, for the following purposes: i) detecting and preventing fraud in contracting and during the provision or execution of our products and services that could result in harm to you, to third parties, and/or to ABANCA Vida y Pensiones; ii) preparing, using exclusively data from our internal sources, commercial profiles (which allows us to analyze and predict your personal preferences, economic situation, interests, geographic location, and behavior) and risk profiles in insurance for commercial purposes (which allows us to assess, based on your particular situation, the potential insurable risks you may incur), in order to offer you advertising information tailored to these profiles about our products and services similar to those you have contracted; iii) offering you advertising information, including through electronic means, about products and services similar to those contracted; iv) sending surveys to assess your level of satisfaction and the quality of the product or service you have contracted; and v) analyzing data to improve our internal processes and/or improve our products and services.

At any time, you may exercise your right to object to the sending of commercial communications and surveys, as well as to the processing of your data for the preparation of the profiles mentioned in the previous section ii), by contacting the Customer Service of ABANCA Vida y Pensiones through the channels referred to in the additional and detailed information on Data Protection found in the privacy policy accessible on our website (https://www.abanca.com), within the "Legal and security aspects" section, located at the bottom of said website.

3.4. Processing carried out with your consent. Only if we have requested and obtained your prior consent for this purpose, may we carry out the following processing of your personal data:

3.4.1. Offer you advertising information tailored to your profile about products and services of other companies in the Economic Group of ABANCA Corporación Bancaria, S.A. and partners. We will process your personal data to offer you, through any means (postal mail, telephone, any type of message to your mobile phone—SMS or push messages—, email, social networks, or our apps), information tailored to your commercial and, where appropriate, insurance risk profiles (i.e., adapted to your interests, needs, preferences, and characteristics) about products and services of other companies in the Economic Group of ABANCA Corporación Bancaria, S.A. (hereinafter, "ABANCA Group Companies"), as well as third-party partners of ABANCA Vida y Pensiones (commercial entities and non-profit entities with which ABANCA Vida y Pensiones maintains collaboration agreements).

3.4.2. Transfer your data to other companies in the Economic Group of ABANCA to facilitate their contracting processes with you. We will share your personal data with other companies in the Economic Group of ABANCA in order to facilitate and expedite the analysis (including the risk to be insured in the case of insurance operations or the credit risk in the case of financing operations) and the possible formalization of a contract or pre-contract you have requested from the corresponding company of the Economic Group of ABANCA recipient of the data; or to facilitate and expedite the management and execution of a contract or pre-contract you already have with the corresponding company of the Economic Group of ABANCA recipient of the data.

3.4.3. Transfer your data to partners of ABANCA Vida y Pensiones to facilitate their contracting processes with you. We will share your personal data with partners of ABANCA Vida y Pensiones (commercial entities and non-profit entities with which ABANCA Vida y Pensiones maintains collaboration agreements) in order to facilitate and expedite the analysis (including the risk to be insured in the case of insurance operations or the credit risk in the case of financing operations) and the possible formalization of a contract or pre-contract you have requested from the corresponding partner of ABANCA Vida y Pensiones recipient of the data; or to facilitate and expedite the management and execution of a contract or pre-contract you already have with the corresponding partner of ABANCA Vida y Pensiones recipient of the data.

3.4.4. Transfer your data to other companies in the Economic Group of ABANCA so that they can offer you advertising information tailored to your profile about their products and services. We will share your personal data with other companies in the Economic Group of ABANCA so that these companies can create or update your commercial profile and your insurance risk profile or, where appropriate, your credit risk profile and, using these profiles, prepare, to offer you, advertising information tailored to them (i.e., adapted to your interests, needs, preferences, savings capacity, and credit capacity) about the products and services they offer or market at any given time; information that, consequently, these companies will send you directly and through any means (including email, SMS messages, and other equivalent electronic communication means).

3.4.5. Transfer your data to partners of ABANCA Vida y Pensiones so that they can offer you advertising information tailored to your profile about their products and services. We will share your personal data with partners of ABANCA Vida y Pensiones (commercial entities and non-profit entities with which ABANCA Vida y Pensiones maintains collaboration agreements) so that they can create or update your commercial profile and your insurance risk profile or, where appropriate, your credit risk profile and, using these profiles, prepare, to offer you, information tailored to them (i.e., adapted to your interests, needs, preferences, savings capacity, and credit capacity) about the products and services they offer or market at any given time; information that, consequently, these partners will send you directly and through any means (including email, SMS messages, and other equivalent electronic communication means).

3.4.6. Improvements in the insurance premium calculation process and preparation of your commercial profile using external sources. We will enrich the information about you that we already have through our internal sources (i.e., the information you have provided or generated at ABANCA Vida y Pensiones in connection with the management of the products and services you have contracted with ABANCA Vida y Pensiones), with other data about you provided by different external sources, such as public records (e.g., the Property Registry, the Commercial Registry, the INE, and the Cadastre); publicly accessible sources (e.g., public lists of people associated with professional associations, official journals and bulletins, social media, and open social networks); companies of the Economic Group of ABANCA that you have authorized to transfer your personal data to us (e.g., banking scoring) for the preparation by us of your commercial profile and your insurance risk profile; geomarketing tools and databases; browsing data on third-party websites or applications, if you have accepted the use of cookies and other similar technologies on the relevant browsing devices; as well as common files of the insurance sector (e.g., risk selection and rating files and files for the preparation of technical and statistical-actuarial studies). All this with the purpose of having relevant information to calculate the premium amount and prepare a more complete and in-depth commercial and insurance risk profile for you than those prepared with internal sources, which will allow us to more accurately personalize the proposals we send you regarding our products and services, including the preparation of a personalized rate or price based on your profile.

3.4.7. Maintain the processing of your personal data once our relationship has ended to manage a new request. We will retain your personal data once our relationship with you has ended, and for a maximum period of 5 years, to manage new requests for products or services that you may submit to us.

3.4.8. Maintain the processing of your personal data once our relationship has ended to continue sending you advertising information tailored to your profile about products and services of ABANCA Vida y Pensiones. We will retain your personal data once our relationship with you has ended, and for a maximum period of 5 years, to continue sending you, through any means (postal mail, telephone, any type of message to your mobile phone—such as SMS or push messages—, email, social networks, or our app), advertising information tailored to your commercial and insurance risk profiles (i.e., adapted to your interests, needs, and preferences) about products and services of ABANCA Vida y Pensiones.

3.4.9. Maintain the processing of your personal data once our relationship has ended to continue sending you advertising information tailored to your profile about products and services of other companies in the Economic Group of ABANCA and partners. We will retain your personal data once our relationship with you has ended, and for a maximum period of 5 years, to continue sending you, through any means (postal mail, telephone, any type of message to your mobile phone—such as SMS or push messages—, email, social networks, or our app), information tailored to your commercial and insurance risk profiles (i.e., adapted to your interests, needs, and preferences) about products and services of other companies in the Economic Group of ABANCA and third-party partners of ABANCA Vida y Pensiones (commercial entities and non-profit entities with which ABANCA Vida y Pensiones maintains collaboration agreements).

4. With whom do we share your data?

The processing, to fulfill the purposes detailed above according to the specified legal basis for each purpose, may involve your personal data being communicated to third parties, such as: i) Financial Entities to carry out the appropriate collections and payments; ii) Common files of the insurance sector for the preparation of technical and statistical-actuarial studies; iii) The National Death Index - INDEF; iv) The Institute of Accounting and Auditing of Accounts; v) External auditors; vi) The Insurance Compensation Consortium; vii) Private entities for reasons of reinsurance, coinsurance, or policy management; viii) Entities responsible for managing the coverages and contingencies included in the insurance contract you have with ABANCA Vida y Pensiones; ix) Entities responsible for managing the services you request or use under the insurance contract you have with ABANCA Vida y Pensiones (e.g., the second medical opinion service); x) The Register of Insurance with death coverage; xi) The ABANCA Economic Group Companies and partner entities; xii) Service providers; xiii) National and European Union supervisory authorities (such as, for example, the Directorate General of Insurance and Pension Funds); xiv) The Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offenses ("SEPBLAC") and other competent authorities in the field of money laundering and terrorist financing prevention; xv) The Spanish Union of Insurance and Reinsurance Companies—UNESPA; xvi) Common solvency files relating to the fulfillment and non-fulfillment of monetary obligations (e.g., ASNEF); xvii) The State Tax Administration Agency and other competent tax administrations; xviii) Judges and Courts; xix) State Security Forces and Corps; and xx) The Insurance Ombudsman.

We also inform you that certain companies providing services to ABANCA Vida y Pensiones are located outside the European Union, which implies the carrying out of International Data Transfers. In this regard, ABANCA Vida y Pensiones guarantees the application of technical, organizational, and legal security measures that are appropriate to the level of risk of the processing, regardless of the territory where it takes place.

5. What are your rights?

You may exercise your rights of access, rectification, erasure, restriction, objection, and portability of your personal data, as well as revoke your previously granted consents, by contacting the Customer Service of ABANCA Vida y Pensiones through the channels referred to in the additional and detailed information on Data Protection found in the Privacy Policy of ABANCA Vida y Pensiones accessible on the website https://www.abanca.com, within the "Legal and security aspects" section, located at the bottom of said website, or by clicking here.

6. Where can you consult detailed information on Data Protection?

You can consult additional and detailed information on Data Protection in the Privacy Policy of ABANCA Vida y Pensiones accessible on the website https://www.abanca.com, within the "Legal and security aspects" section, located at the bottom of said website (https://www.abanca.com/es/legal/politica-privacidad-abanca-vida-pensiones/informacion-adicional/), or by clicking here. The Privacy Policy also details, for each processing carried out by ABANCA Vida y Pensiones, the specific categories of data used in each of these processing activities, and includes an explanation of the logic applied to the profiling that may be carried out on your personal data depending on the corresponding legal basis.