The legal basis of this data processing is that it is necessary to manage contracts that you request or to which you are a party, or to apply precontractual measures if you request them, as established in art. 6.1.b) of the General Data Protection Regulation (GDPR).

Therefore, this processing is necessary for you to establish and maintain Contractual Relations with us. If you object to it, we will end these relations, or we cannot establish them if they have not yet started.

The types of processing required to establish contractual relations are listed below, arranged from (A) to (B). We will indicate for each of them: a description of the purpose (Purpose), whether or not the processing is carried out jointly with other CaixaBank Group companies (Data Controller/Joint Data Controllers) and data categories processed (Data categories)

Purpose

The purpose of this data processing is to formalise and maintain the Contractual Relations that we establish.

This includes the processing of your applications or mandates and the procedures prior to requesting a service (pre-contractual relations) and processing your requests to take part in draws, promotions or events.

This data processing involves collecting the information necessary to establish or to manage the application, to evaluate the suitability of the product and to process the information needed to properly maintain and execute the contracts.

The processing operations involved in signing, maintaining and performing the Contractual Relations are:

• Collection and registration of the data and documents needed to apply for the products requested
• Formalising the signing of the contracts for the products and services
• Managing the products and services you have taken out with us, including the handling of any associated incidents and the annotation and verification of accounting entries for receiving and making product payments
• Adjusting measures to resolve any potential default payments, including claims for non-payment
• Carrying out the communications derived from managing the Contractual Relations
• Monitoring and responding to your complaints and/or claims
• Processing your applications to take part in prize draws, promotions or events, including managing said applications

Data categories

The categories of data we will process for this purpose, the content of which is detailed under heading 5 of our Privacy Policy, (www.caixabank.com/privacypolicy), are:

• Data provided by you
• Data observed as part of maintaining our products and services, with the exception of sensitive data

Data controller

The data controller is CaixaBank. There is no co-processing with joint controllers.

Furthermore, if the product or service you apply for is marketed by CaixaBank but issued by another company, said other company will be responsible for processing your data in relation to that contract.

This means that if you open a pension with or take out insurance from VidaCaixa or SegurCaixa, or a card issued by CaixaBank Payments & Consumer, through CaixaBank, these companies will be the controllers of your data as the issuers of the products.

We will inform you about this in detail in the contractual documentation for each product or service.

Purpose

The purpose of this data processing is to assess your suitability for applying for investment products and services, as established by the regulations applicable to said products and services.

This data processing involves collecting the information needed to assess your suitability to take out certain investment products and services and to monitor, as applicable, the appropriateness of the product.

Data categories

The categories of data we will process for this purpose, the content of which is detailed under heading 5 of our Privacy Policy, (www.caixabank.com/privacypolicy), are:

• Data provided by you
• Data observed as part of maintaining our products and services, with the exception of sensitive data

Data controller

The data controller is CaixaBank. There is no co-processing with joint controllers.

Purpose

The purpose of this data processing is to assess whether applicants for products or services that involve the repayment of loans or credits, or deferred instalments, have the solvency and repayment capacity needed to make the payments required as part of the operations in question.

Detailed information on the solvency and repayment capacity analysis process that will be carried out when you request operations involving the repayment of loans or credits, or the deferred payment of instalments, will be provided in the transaction request you will be required to sign when you apply for these products.

This information will detail the data processing operations needed to handle your request, as well as the consequences of not accepting them. Without prejudice to the above, you will find basic information on this processing below.

The processing operations involved when analysing the solvency and ability to repay of applicants who request lending transactions are:

• Collection and registration of the data and documents needed to evaluate the applicants' solvency and ability to repay
• The application of scoring models to their data, consisting of statistical analyses of sociodemographic and economic variables. Specifically, a profile of the applicant will be drawn up, to include:
  • The type of operation requested (payment, term, purpose)
  • Socio-economic information on the applicant (residence, age and commercial segment to which the applicant belongs)
  • The applicant's overall financial status (balances, income, expenses)
  • Information obtained from external databases documenting failures to comply with monetary obligations, as well as risk assessments provided by other financial institutions to the Risk Information Centre of the Bank of Spain

This profile assigns a specific value to each of these aspects involving the applicant and their request, the sum of which provides a score indicative of the probability of a non-performing loan or non-fulfilment of a financial obligation, should the requested transaction be approved. The importance of each variable and its influence on the final result is calculated beforehand using risk assessment, management and control models overseen by the Bank of Spain and that are included in the bank's internal risk policies.

Data categories

The categories of data we will process for this purpose, the content of which is detailed under heading 5 of our Privacy Policy, (www.caixabank.com/privacypolicy), are:

• Data provided by you
• Data observed as part of maintaining our products and services, with the exception of sensitive data
• Data inferred or deduced by CaixaBank
• Data that you have not provided us directly

Joint data controllers

Sector regulations on the prudential and solvency requirements that apply to the financial sector require that a credit operation be granted to customers jointly by all the companies that comprise the same consolidated group of credit institutions.

As a result, the following CaixaBank Group companies are all co-controllers in the process of analysing the solvency and repayment capacity of customers who apply for lending transactions.

These companies will be able to share the data and use it for the same purpose:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Nuevo Micro Bank, S.A.U.
• Telefónica Consumer Finance, E.F.C., S.A.
• CaixaBank Equipment Finance, S.A.U
• Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
• Corporación Hipotecaria Mutual, S.A.U., Establecimiento Financiero de Crédito
• Hipotecaixa 2, S.L.U,
• Banco BPI, S.A.

You will find the list of companies that process your data, as well as the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.