CaixaBank and the CaixaBank Group companies listed below are joint controllers (hereinafter, the “Joint Controller Entities”) of your data for the purpose of carrying out the following commercial activities: (i) personalisation of products and services offered based on the analysis of your data; (ii) communication of the commercial offer of products and services through channels, and (iii) disclosure of your data to other companies:

  • CaixaBank, S.A.
  • CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
  • Nuevo Micro Bank, S.A.U.
  • Facilitea Selectplace, S.A., Sociedad Unipersonal
  • ImaginersGen, S.A.
  • VidaCaixa, S.A.U. de Seguros y Reaseguros

In accordance with the applicable regulations, the Joint Controller Entities have entered into a joint controllership agreement for certain processing activities. The essential elements of this agreement are as follows:

(i) That, for certain processing activities identified in the Privacy Policy, the Joint Controller Entities will act in a coordinated or joint manner.

(ii) That they have determined the appropriate technical and organisational security measures to ensure a level of security commensurate with the risk inherent in the processing of personal data subject to joint controllership.

(iii) That they have a one-stop-shop mechanism for the exercise of data subjects’ rights. This means that requests relating to rights that are received are handled centrally, from a single point of entry. The Entities undertake to cooperate with and assist one another.

(iv) That the Entities comply with the duty of secrecy and maintain the confidentiality of the personal data that are processed.

(v) Regardless of the terms of the joint controllership agreement, data subjects may exercise their data protection rights against each of the controllers.

These processing activities are based on your consent.

We may have requested that consent through different channels; during the interview in which you registered as a customer in person, through our digital channels or through one of the CaixaBank Group companies that is a joint controller of the specific processing activity.

If we have not requested your consent, these processing activities will not apply to you.

You can consult the authorisations you have granted or refused and modify your decision at any time and free of charge at our branches, on the CaixaBank website (www.caixabank.es) or mobile applications, and on those of each of the CaixaBank Group companies that are joint controllers of the processing.

The processing activities based on your consent are set out below, ordered from (A) to (C). For each of them we will indicate:

  • The description of the purpose.
  • Details of the types of data processed.
  • Information on the use of profiling, where applicable.
  • Other relevant information about the processing.

A. Customisation of products and services based on an analysis of your data

Purpose: If you give us consent, and based on our data, we will create a commercial profile to identify your preferences and offer you, through your manager (in person or remotely), the products and services that we think may interest you the most.

This does not mean that you can only choose the products we have identified based on your profile.

Whether you accept or reject this processing, you will always be able to request any of our products or services.

By processing your data, we may provide you with personalised offers that we believe will be more relevant to you than generic offers.

If you also consent to receive commercial offers through other channels (refer to Point 6.1.B. of the Privacy Policy), you will receive such offers through the channels you choose.

Data processed: For this processing, we will not use any data that contains information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliations, genetic data, biometric data intended to identify you individually, health-related data or data related to your sexual life or orientation.

The data that we will process for this purpose are:

  • Personal and contact details: full name, gender, postal contact information, telephone number and e-mail address, place of residence, nationality and date of birth, language for communications, identification document.
  • Socioeconomic data and information about your professional or work activity: professional or work activity, income or remuneration, family unit, education level, assets, and fiscal and tax data.
  • Contracting data: ontracted or requested products and services (own or of third parties), holder's condition, authorised or representative of the contracted product and/or service, categorisation according to regulations with regard to stock markets and financial instruments (MiFID category), information on investments made and their evolution and information and movements of financing operations.
  • Basic financial data:current and historic balances of products and services and payment history regarding contracted services and products (own or of third parties).
  • Third-party data from statements and receipts of current accounts and payment accounts: information on entries and transactions made on your accounts by third-party issuers, including the transaction type, issuer, amount and item appearing on receipts and statements of debit, credit and prepaid card transactions.
  • Data on your status as a shareholder or non-shareholder of CaixaBank: if you own shares in CaixaBank or not.
  • Data on any communication with you: data obtained from chats, walls, video conferences, telephone calls or any other equivalent means of communication.
  • Personal browsing data: whether you have accepted the use of cookies and similar technologies on your browsing devices, the data obtained from your browsing through our websites or mobile applications and the browsing you carry out on such sites or applications: browsing history (websites visited and clicks on content), device ID, advertising ID, IP address and installed version of the application.
  • Geographical data: data on the location of the merchants of your card transactions and geolocation data of your mobile device provided by the installation and/or use of our mobile applications when you have authorised this in the application settings.
  • Data obtained from other processing operations provided for in this policy:
    • Risk assessment or scoring data: in operations involving financing or payments in instalments, we will infer your payment or non-payment capacity or the risk limits by applying statistical-mathematical models that are calculated using your data (processing defined in section 6.2.C).
    • Customer classification data. (processing defined in section 6.4.A).
  • Data obtained from the execution of statistical models: we use the results of applying mathematical modelling to customer data to deduce consumer habits, preferences or propensity to contract or classify customers.
  • Demographic and socioeconomic data: statistical data not associated with specific persons but with geographical areas, age sectors or professional activity sectors, which we will use in relation to the customers' information.
  • Data on properties and vehicles associated with you: data obtained from the land registry and basic data on vehicles obtained from the Spanish Traffic Directorate, which we will use to add to the information on your properties and vehicles.
  • Data on directors, functional officers and corporate relationships : data extracted from INFORMA databases that we will use to supplement the information on your activity.
  • Data on agricultural subsidies and insurance: data published by the Spanish Agricultural Guarantee Fund (FEGA) and the State Agency for Agricultural Insurance (ENESA).
  • Data from third-party companies where you have given your consent to share them with us: your personal data processed by other companies with which you have agreements and which you have authorised to share your information with us.
  • Browsing data: if you have accepted the use of cookies and similar technologies on your browsing devices, the data obtained from your browsing on third-party websites or mobile applications and your browsing on them: browsing history (websites visited and clicks on content), device ID, advertising ID, IP address.
  • Social media or internet data: social media or internet data that you have authorised us to consult.

Use of profiles: We will create a commercial profile that we will use exclusively to customise the products and services we offer you:

  • Purpose of the profile: purpose of the profile: the purpose of the profile is to identify the products and services we think may interest you, based on the information we have, in order to offer you these specific contracting options instead of sending you generic commercial offers.
  • Consequences: if you authorise the processing of your data, we will use commercial profiles to decide which products or services to offer you. If you do not give your authorisation, we will not use your information to customise our commercial offer.
    We will never use this profile to refuse any product or service, or to set credit limits. Refusal to accept this processing will not prevent, limit or condition your access to our full catalogue of products and services, which will always be available to you.
    If you apply for any product or service, your application will be assessed in accordance with our procedures. Acceptance or not of the analysis of your data to customise the products and services will not have an impact on the assessment.
    The non-acceptance of this data processing activity will not prevent us from contacting you to manage your products and services.
  • Logic: The profile of a customer is calculated based on the data indicated in the section "Processed data".
    These data are subject to the application of mathematical formulas obtained from past behaviours observed in customers of similar characteristics, with a view to deducing the customer's future behaviour. These mathematical formulas allow us to determine the importance of all the data processed in the final result of the applicant's profile.
    This final result is the probability that the customer will be interested in a product or service.

Other relevant information: Below, you will find other relevant information on this processing:

  • Preliminary check of your ability to pay: When the products or services we want to offer you involve financing or the payment of instalments, we will first verify your repayment capacity. We will do so in accordance with Point 6.2.C.
    The aim is to offer you a credit limit and payment terms that reflect our knowledge of your financial situation. This preliminary check will be carried out in accordance with the principles of accountability in the offering of financing products demanded by the Bank of Spain, and by the regulation on prudential supervision and solvency of credit institutions and of responsible lending.
    Refusal to accept this processing will not prevent, limit or condition your access to our catalogue of financing products and services. Your application will be assessed in accordance with our procedures if required.
  • Validity of the processing: We will only process your data if you have given us your consent to do so. Your consent will remain valid until you revoke it. If you cancel all your products or services with us but forget to revoke your consent, we will do so automatically.
  • Preparation of management reports and mathematical models: The data processed and resulting from this process will also be used to prepare management reports and mathematical models under the terms described in Point 6.4.F.

B. Communication of the product and service offering through channels

Purpose: You can choose other service channels for us to send you both our customised and non-customised offer for products and services, according to your response in Section A above.

If you give consent, we will send you information about our products and services through the channels you choose:

  • Website, app and email.
  • Letter.
  • Telephone.

We will process and use your data according to the following:

  • We will only use your identifying and contact details to send generic offers if you do not wish to receive customised offers (see Section 6.1.A).
  • We will use the information in your commercial profile to send customised offers if you allow us to customise the information about the products and services we send to you (see Section 6.1.A).

Data processed: For this processing, we will not use any data that contains information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliations, genetic data, biometric data intended to identify you individually, health-related data or data related to your sexual life or orientation.

The data that we will process for this purpose are:

  • Personal and contact details: full name, gender, postal contact information, telephone number and e-mail address, place of residence, language for communications.
  • Data obtained from other processing operations provided for in this policy:
    • Data related to the customisation of products and services based on the analysis of your data: we will also use the information in your commercial profile to send customised offers if you allow us to customise the information about the products and services we send to you (refer to the information on processing in Point 6.1.A of the policy).

Other relevant information: Below, you will find other relevant information on this processing:

  • Validity of the processing: We will only process your data if you have given us your consent to do so. Your consent will remain valid until you revoke it. If you cancel all your products or services with us but forget to revoke your consent, we will do so automatically.

C. Disclose your details to other companies

Purpose: If you give consent, we will share your data with other companies so that they can send you commercial offers of their products and services. The data will vary according to the following:

  • If you do not wish to receive customised offers and do not give consent (see Section 6.1.A), we will only share your identifying and contact details with these companies.
  • If you wish to receive customised offers and give your consent (see Section 6.1.A), we will also share your commercial profile information with these companies, as well as information about your probability of default or repayment, or about the risk limits.

If you do not give consent, we will not share your information with other companies.

These third-party companies to which we might transfer your data are dedicated to the following activities:

  • banking
  • investment services
  • insurance and reinsurance
  • venture capital
  • real-estate
  • transportation
  • sale and distribution of goods and services,
  • consultancy services
  • leisure
  • charity

Data processed: For this processing, we will not use any data that contains information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliations, genetic data, biometric data intended to identify you individually, health-related data or data related to your sexual life or orientation.

The data that we will process for this purpose are:

  • Personal and contact details: full name, gender, postal contact information, telephone number and e-mail address, place of residence, nationality and date of birth, language for communications, identification document.
  • Data obtained from other processing activities provided for in the Privacy Policy:
    • Details regarding the customisation of products and services based on the analysis of your data: We will also use the information in your commercial profile to send customised offers (refer to Section 6.1.A) if you allow us to customise the information about the products and services we send to you.

Other relevant information: Below, you will find other relevant information on this processing:

  • Information on the transfer: If we reach an agreement with a third-party company to transfer your data, the recipient company will inform you of this fact. In addition, this company will inform you of the data received and the details of the intended processing activities.
  • Validity of the processing: We will only process your data if you have given us your consent to do so. Your consent will remain valid until you revoke it. If you cancel all your products or services with us but forget to revoke your consent, we will do so automatically.