Become a customer

Additional information on personal data protection

1. Who is responsible for processing your data?

The entity responsible for processing your personal data is ABANCA Corporación Bancaria, S.A. (hereinafter, "ABANCA"), with Tax ID A-70302039 and registered office in Betanzos (A Coruña - Spain), C/ Cantón Claudino Pita, nº 2, 15300.

At ABANCA, we have a Data Protection Officer (hereinafter also "DPO"), whom you can contact, if needed, to obtain more information about any of the points included in our Privacy Policy and to send your questions, inquiries, or complaints related to the processing of your personal data, via the email address privacidad@abanca.com.

Below, we provide you with detailed information about the processing of your personal data carried out by ABANCA as the data controller.

2. What is the origin of your personal data and what data do we process?

We must distinguish between the sources from which your personal data originate and the categories of personal data we process:

2.1. Sources from which your personal data originate

Your personal data processed by ABANCA may come from yourself (when you provide or supply them within the scope of your relationship with us), be generated by ABANCA (in the course of managing those relationships), or originate from external sources (i.e., from third parties who are not part of the relationships you maintain with us and from whom we obtain data about you under the consent you may have given us for this purpose, or under another legally provided legal basis that allows it).

Below, we provide detailed information regarding the aforementioned internal and external sources from which your personal data may originate:

  • Data provided by you in the applications you submit to us or within the scope of the formalization and development of your contractual or pre-contractual relationships with ABANCA (e.g., the data necessary to request and contract a current account, a loan, a card, a deposit, or an investment fund).

  • Data generated about you derived from the management, development, and maintenance of the contractual or pre-contractual relationships you have with ABANCA (e.g., data relating to the management, development, and maintenance of current account, loan, card, deposit, or investment fund contracts you have formalized); or browsing data (including multimedia content playback data) on ABANCA's websites or applications, provided you have expressly accepted the use of cookies and similar technologies on your browsing devices).

  • Companies of the ABANCA Economic Group, whose business sectors include finance, social, insurance, real estate, securities investment, training, marketing, and consulting and advisory services.

    You can access the complete list of companies that are part of the ABANCA Economic Group at any given time by clicking here.

  • Credit institutions in Spain or with a branch in Spain.

  • Publicly accessible sources (e.g., promotional census, electronic communications service directories, public lists of people associated with professional associations, official journals and bulletins, social media, and open social networks).

  • Public Administration bodies (e.g., the General Treasury of Social Security or the State Tax Administration Agency).

  • Asset and credit solvency information files (e.g., BADEXCUG and/or ASNEF).

  • Common identity protection and fraud prevention files (e.g., the "CONFIRMA" File and the "IBERPAY" File).

  • Payment Service Providers.

  • Central Credit Register of the Bank of Spain (CIRBE).

  • Appraisal and management entities responsible for carrying out appraisals of real estate and other procedures related to transactions you carry out with us that affect such assets (e.g., procedures for granting the public deed of mortgage constitution, for settling the relevant taxes, and for making the corresponding entries in the Property Registry).

  • Public registers (e.g., the Property Registry, the Commercial Registry, and the Land Registry).

2.2. Categories of personal data

At ABANCA, we process different types of personal data to manage the contractual or pre-contractual relationships you have with us at any given time, as well as for the other purposes indicated in section 3. "For what purposes and on what legal basis do we process your personal data?" of this Privacy Policy.

To provide you with clear and detailed information in this regard, we have grouped the personal data we process into the following categories:

  • Identification and contact data: name, surname, identity document (DNI, passport, or NIE), Social Security number, postal and email address, and landline or mobile phone number.

  • Data relating to your voice and image (e.g., recordings of telephone calls you have with us or videos recorded during online contracting procedures for new products and/or services).

  • Signature data (handwritten and digitized) and data relating to identification codes or keys for access and operation in remote channels you use in your relationships with ABANCA.

  • Personal, family, and social circumstances data: marital status, age, family situation, date and place of birth, nationality, sex, licenses for leisure activities (e.g., hunting and fishing), housing/accommodation characteristics, membership in clubs/associations.

  • Sociodemographic data: types of people by age and education level living in the client's geographic area; types of families living in that area by number and characteristics of their members; categories of professional activities existing in the area where the client resides; economic capacity, according to annual incomes in that area; or the characteristics of that area according to the age of buildings, the level of grouping—single-family or multi-family—or the presence of commercial areas.

  • Academic and professional data: education/qualifications, and membership in professional associations or organizations.

  • Employment data: type of contract, job position, seniority, professional experience, non-economic payroll data.

  • Commercial activity data: licenses for the activity, economic sector in which it is carried out, National Classification of Economic Activities (CNAE) in which the activity is classified.

  • Economic and asset solvency data: tax data and tax deductions (IRPF, VAT, etc.); economic payroll data; income and expenses; investments and assets; movable and immovable property owned by the client or over which they have possession, use, and enjoyment; subsidies and benefits; and credit capacity, including data on default on a debt contracted with a private company or public bodies obtained from asset and credit solvency information files (e.g., ASNEF and BADEXCUG files).

  • Financial data: bank account number both at ABANCA and at other Spanish credit institutions or those with a branch in Spain, of which you are the holder or authorized person; investment funds; credits, loans, and guarantees; mortgages; pension plans; credit cards; credit history; data obtained from CIRBE (information on the existence of loans, credits, guarantees, and guarantees whose accumulated risk exceeds 1,000 euros).

  • Transactional data: compensation and subsidies you may receive; data related to account entries and movements, such as data on direct debits, transfers, and debits (including the type of operation, issuer, concept, third party related to the transaction, amount, location, date and time, and other related information, e.g., in a car insurance debit, the insured vehicle's license plate); data on products and services requested or contracted (payment history, associated limits, and types of products and services); information on payments made with ABANCA cards or other payment methods or using our POS or payment gateways; or information on payments made against credit lines or loans granted by ABANCA.

  • Insurance data that you have domiciled in an ABANCA account or insurance data marketed by ABANCA that you have contracted (data including the insurer, insurance branch, premium, expiration date, policyholder and beneficiary/insured, insured amounts, and vehicle license plate in the case of car insurance).

  • Data inferred or deduced from the analysis and processing of other categories of personal data: This category includes, on the one hand, the grouping of clients into categories and segments based on objective criteria such as age, income level, real estate properties, operations, product and service consumption, preferences or propensities to contract products and services, or categorization according to applicable regulations on Financial Instruments Markets ("MiFID"); and, on the other hand, "scoring" scores, which assign probabilities of default, maximum financing limits, and commercial and credit risk profiles for commercial purposes.

    In no case will we infer any data that reveals your ethnic or racial origin, political opinions, religious or philosophical beliefs, or trade union membership, nor genetic data, data relating to your health or your sex life or sexual orientation, nor biometric data aimed at uniquely identifying you ("Special categories of data").

  • Special categories of data: we refer to those data that, by their nature, are particularly sensitive in relation to fundamental rights and freedoms and therefore deserve special protection, as their processing could involve a greater risk for the individual; that is, we refer to data that reveal your ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data relating to your health (e.g., information on diseases, disabilities, or physiological or biomedical status) or your sex life or sexual orientation, data of vulnerable groups—in case you are included in any—as well as biometric data aimed at uniquely identifying you.

    At ABANCA, as a general rule, we do not collect or use this type of personal data, but we may collect and process them in the following cases:

    (i) On an ancillary basis, when necessary for the study of a contract application or a contractual modification (e.g., the application for a debt moratorium on a loan you have contracted, for which the request of data relating to your health may be necessary to verify the requirements established by the applicable regulations to access this type of moratorium). In these cases of collecting special categories of data on an ancillary basis, we request your specific consent for their processing at the time of collection.

    (ii) If you request the online contracting of a product and/or service that has this remote contracting modality, we will proceed to identify you by video call, always with your prior consent and having been informed of all aspects of the processing of the biometric data associated with your image that will be carried out in this process.

    (iii) If you use the digital signature system (signature on tablet or signature via surface) to give your consent in the context of applications you submit to ABANCA or contracts you have formalized or formalize with it, we will process the data associated with that signature. The data associated with the digitized signature are categories of data that include the calligraphic features of the signature, such as the pressure and speed with which it is made, as well as the inclination of the stroke; therefore, they may be used exclusively for the formulation, exercise, or defense of claims or in a judicial or administrative process in case of repudiation of the operation signed by means of the digitized signature system, in order to verify, through the corresponding comparison, that the signature is yours and to be able to prove, thus, the consent given and the reality and validity of the operation reflected in the electronic document to which the signature is attached. In this regard, the aforementioned data associated with the signature will be duly encrypted through a third-party trusted service provider, who will be the custodian of the private key to access them; thus, ABANCA will not have access to such data except in the exclusive case that it requests the third-party provider to decrypt them by formal request and before a notary public, and only in the cases and for the purposes of verification and accreditation mentioned above.

  • Geographical location data: geolocation data of your mobile device, when you have authorized it so that we can provide you with a service, such as, for example, indicating the ABANCA branches closest to your location; or, based on ABANCA's legitimate interest in preventing fraud in the contracting and use of our products and services, the location data of that mobile device, if you have installed our Mobile Banking application on it.

  • Browsing and online/app behavior data: IP address and behavioral habits on our websites and in the ABANCA applications you use (e.g., which pages you visit or how you navigate through the different sections of the website) if you have accepted the use of cookies and other similar technologies; data about the ISP (domain of the provider that gives access to the network), and the date-time linked to access; as well as the codes or keys used to access/operate in the digital channel or Mobile Banking and the physical identification of the device or mobile device (e.g., IMEI, device model, and operating system).

  • Data of persons subject to international financial sanctions and countermeasures: data of persons as indicated in laws, regulations, guidelines, resolutions, programs, or restrictive measures on international economic-financial sanctions imposed by the United Nations, the European Union, the Kingdom of Spain, the United Kingdom, and/or the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC).

We inform you that not all the categories of data mentioned above are used for all the processing provided for in this Privacy Policy. In the following section 3 ("For what purposes and on what legal basis do we process your data?"), which describes the different data processing carried out by ABANCA, indicating their purposes and respective legal bases, it is detailed which specific categories of data are used for each of these processing operations.

Furthermore, we inform you that when in the following section 3 a category of personal data is associated with a specific processing, it does not mean that all and each of the data included in that category will always be used whenever that processing is carried out. Indeed, and by application of the legal principle of data minimization, such personal data will only be used to the extent that, depending on the circumstances of each specific case, they are adequate and relevant to fulfill the purpose assigned in this Privacy Policy to the corresponding processing.

We inform you below about the different processing of your personal data for which ABANCA is responsible, specifying the purposes and legal bases for each of them. Additionally, and as indicated in the previous sub-section 2.2. ("Categories of personal data"), the specific categories of data used in each processing are detailed.

3.1. Processing necessary for the execution of your contractual or pre-contractual relationships with ABANCA

In this sub-section, we refer to the processing we carry out of your personal data for the execution of the contractual or pre-contractual relationships you establish with ABANCA and, therefore, to be able to provide you with the services and products that are the subject of those relationships.

The legal basis for these processing operations lies, therefore, in the fact that they are necessary to execute or fulfill those contractual or pre-contractual relationships with ABANCA of which you are a party.

The processing referred to is detailed below, indicating their respective purposes, as well as the categories of personal data used in each of them:

3.1.1. Formalization, maintenance, and fulfillment of relationships with ABANCA

The purpose of this processing is the correct formalization, maintenance, and fulfillment of the contractual or pre-contractual relationships you establish with us.

The following are the data processing operations we may carry out within the framework of the referred processing, which include obtaining the data necessary to manage the requests you make to us, evaluating the suitability of contracting the corresponding products and services, and the correct formalization, maintenance, and fulfillment of the resulting contracts:

  • Receive the information or contracting requests you have made regarding our products and services, analyze and evaluate them, respond to you, and clarify any doubts that may arise.

  • Contact you, by electronic or non-electronic means, in the event of any incident that may have prevented the completion of the contracting of a product or service and allow you to resume its contracting.

  • Proceed, if applicable, to register the requested operation by signing the corresponding contract.

  • If you request the online contracting of a product and/or service that has this remote contracting modality, proceed to identify you by video call, always with your prior consent and having been informed of all aspects of the data processing that will be carried out in this process.

  • Maintain, develop, and control your relationships with ABANCA. In relation to this, we may process your personal data to organize the Entity's client portfolios, assign each one to a specific manager, and include you in the corresponding portfolio according to the relationships you maintain with us.

  • Send you non-commercial communications strictly related to the products and services you have contracted with ABANCA.

  • Allow access to the different remote banking channels we make available to you (Electronic Banking, Mobile Banking, and Telephone Banking).

  • With prior information (either in the contractual or pre-contractual documentation or at the beginning of the call itself), record the telephone conversations you have with us, to, if necessary, comply with legal obligations (for example, those arising from regulations relating to investment products and services), carry out quality controls, and use them as evidence in the context of a judicial or extrajudicial claim.

  • If applicable, analyze and manage situations of non-payment that may occur in the context of the products and services you have contracted with ABANCA, which may involve the communication of your data to debt recovery service providers, who act on behalf and for the account of ABANCA, to carry out collection actions. In these cases, we may also obtain additional contact data as described in section 3.1.3.

  • Manage and respond to any claims you may submit.

  • Manage the application of bonuses, discounts, or any other promotional conditions, as well as the delivery of prizes and/or promotional gifts that may be associated with or applicable to the contractual relationship you have established with ABANCA.

  • Allow the verification of the ownership of your account at the request of any third party (Applicant) with whom you have initiated a contractual relationship that involves any payment by direct debit or account charge (such as, for example, a provider whose services you have contracted—for example, telephone services—and which involves a payment by you by direct debit or account charge).

    In this regard, the processing of identification data (name, surname, and DNI) and account data (IBAN) for the purpose of ABANCA verifying the ownership of the account in which an immediate or future collection or payment is to be formalized is based on the contractual relationship you maintain—as the data subject—with both the Applicant (natural or legal person) and ABANCA, and its purpose is the correct fulfillment of the contracts signed between the parties (that is, on the one hand, the contract you have signed with the Applicant; and, on the other, the account contract you have signed with ABANCA). Thus, when ABANCA receives the Applicant's request (which will include the aforementioned data) to verify the account you have provided to the Applicant for the formalization of the contract with them, ABANCA will carry out a prior, even automatic, check of the actual ownership of the account, so that the contract can be properly executed and the harm that could be caused to you by an error in the account for payment by direct debit is avoided.

For the formalization, maintenance, and fulfillment of the contractual or pre-contractual relationships you establish with ABANCA and, therefore, to provide you with the services and products that are the subject of those relationships, we may process personal data corresponding to the following categories detailed in sub-section 2.2. ("Categories of personal data") of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same sub-section 2.2): Identification and contact data; Data relating to your voice and image; Personal, family, and social circumstances data; Sociodemographic data; Employment data; Economic and asset solvency data; Financial data; Transactional data; Signature data (handwritten and digitized) and data relating to identification codes or keys; Geographical location data; Browsing and online/app behavior data; where applicable, Special categories of data (in cases of collection of special categories of data as indicated in sub-section 2.2, we request your specific consent for the processing of such data); Data inferred or deduced from the analysis and processing of other categories of personal data (especially, categorization according to MiFID regulations); and, where applicable, Data associated with the digital signature.

3.1.2. Solvency analysis and repayment capacity for financing

The purpose of this processing is to assess whether, when you request or maintain with us a product that involves financing or deferred payment of installments, that is, a credit risk operation, you have sufficient solvency and repayment capacity to be able to make the payments provided for in the corresponding contract in a timely manner.

The following are the data processing operations we may carry out within the framework of the referred processing:

  • Collect and record the data and documentation necessary to carry out the analysis of your solvency and repayment capacity for financing.

  • At the time you request the financing product, analyze your solvency by applying "scoring" techniques and expert analysis rules, thus obtaining your credit risk profile, as explained below, with the aim of assessing whether your solvency and repayment capacity are adequate and sufficient to meet the expected payments. The aforementioned techniques and rules are explained below:

    "Scoring" is a computerized evaluation system consisting of applying a statistical model that allows us to assign a rating or "score" to credit risk applications (i.e., financing products, such as, for example, mortgage loans, consumer loans, or credit cards) based on the estimated probability of default, which, in turn, translates into a recommendation to approve or reject the risk application.

    Scoring is therefore based on the application of statistical techniques, in particular the adjustment of a logistic regression statistical model based on ABANCA's historical data, which allows us to predict as the target variable the probability of future non-compliance with the expected payments. Thus, we apply this statistical model to your personal data to estimate the probability that you will default and obtain the corresponding rating or "score" that measures the credit risk present in the requested operation.

    We also estimate your financial solvency understood as the ability to pay the debt, which allows us to assign you a maximum financing limit appropriate to that capacity.

    Each variable and its influence on the final result is calculated in advance, through models for assessment, management, and control created to comply with Spanish and European regulations that require financial institutions to comply with a series of rules and guidelines for the control of solvency, financial risk, calculation of capital, and provisions required for each operation.

    Expert analysis rules refer to criteria established based on logic and expert knowledge of the banking business, without relying on statistical analysis as in the case of "scoring" and are used to calculate a debt ratio taking into account, for example, the installment of the requested operation and your income and expense data. In this sense, expert analysis rules can complement the statistical model that estimates the probability of default.

Regarding the way the aforementioned techniques are applied and their impact, you should bear in mind that, depending on the requested financing operation, automatic decisions may be made to approve or deny it; or decisions to approve or deny such operation that are not completely automatic, since there is a subsequent review of the "scoring" result by a specific approval committee for the operation (so the result of the "scoring" techniques is, in that case, merely indicative). In the event that the decision on the product application is completely automatic, you can obtain, if you wish, additional information to that explained here about the logic applied and the personal data that have been considered in the analysis, by contacting ABANCA's Data Protection Officer at the following email address: privacidad@abanca.com. Likewise, in relation to this type of operation, you have the right to challenge the decision, express your point of view, and request human intervention through the means specified in section 7 "What are your rights?".

  • In the case of contracting the financing product, carry out the assessment and monitoring of the credit risk of the corresponding contract, as long as it is in force, by applying the aforementioned "scoring" techniques and expert analysis rules.

  • Consult the data relating to the risks that, where applicable, are in your name in the Central Credit Register of the Bank of Spain (CIRBE), as well as the data relating to your non-compliance with monetary obligations that, where applicable, appear in asset and credit solvency information files (such as, for example, ASNEF and BADEXCUG), under the conditions and requirements provided for in the regulations (that is, upon your request for a financing product, deferred payment of installments, or periodic billing; or for the maintenance and control of the contractual relationship derived from said product in the event that you finally contract it with ABANCA).

For the analysis of your solvency and ability to meet the payments of the financing products you request and/or contract with us, we may process personal data corresponding to the following categories detailed in sub-section 2.2. ("Categories of personal data") of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same sub-section 2.2): Identification and contact data; Personal, family, and social circumstances data; Sociodemographic data; Academic and professional data; Employment data; Economic and asset solvency data; Financial data; Transactional data; and Data inferred or deduced from the analysis and processing of other categories of personal data (especially, "scoring" scores and maximum financing limits).

3.1.3. Obtaining contact data to manage non-payment situations

In the context of the execution of the contractual relationships you maintain with ABANCA, so that we can claim the amount(s) owed in the event of non-payment, it is necessary to have up-to-date contact data that allow the development of extrajudicial collection actions.

The purpose of this processing is to update your contact information if we are unable to contact you through the information you provided when formalizing the contractual relationships with ABANCA. This update of your contact data will be carried out only and exclusively in the event of non-payment.

Thus, we inform you that the new contact data may be obtained from the following sources:

  • Companies of the ABANCA Economic Group;

  • Publicly accessible sources (e.g., official journals and bulletins, public lists of people associated with professional associations, or open social networks);

  • Debt recovery agencies;

  • Third parties who are accidentally contacted because they are the current holders of the contact address that previously belonged to you.

The information is always obtained with the guarantee that the data collected comply with the principle of quality and accuracy, in addition to having been obtained lawfully.

For obtaining additional contact data to manage non-payment situations, we may process personal data corresponding to the following categories detailed in sub-section 2.2. ("Categories of personal data") of this Privacy Policy (without prejudice to the application of the principle of minimization of personal data as indicated in that same sub-section 2.2.): Identification and contact data.

[…]

Due to the extreme length of the original text, this is a partial translation. Please specify if you need the full translation or a specific section.