8. PROCESSING AND PROVISION OF PERSONAL DATA FOR COMMERCIAL PURPOSES BY CAIXABANK AND CAIXABANK GROUP COMPANIES ON THE BASIS OF CONSENT

Under the heading of data processing on page one, this document sets out the authorisations which you give us or which you revoke in relation to:

• (i) The analysis and appraisal data processing procedures carried out by CaixaBank and CaixaBank Group companies for commercial purposes

• (ii) The processing of data in order for CaixaBank and Caixabank Group companies to offer you products and services

• (iii) The provision of data to third parties

With the aim of offering you a complete range of products and services, your authorisation for us (i) to process your personal data for analysis and appraisal purposes, and (ii) to offer you products and services, if you give such authorisation, will apply to CaixaBank and the companies of the CaixaBank Group listed at www.caixabank.es/empresasgrupo (the CaixaBank Group companiesî) which may share them and use them for the purposes indicated.

The authorisations you provide will remain valid until they are revoked, or until 6 months after you cancel all your products or services with the Company.

The details of how your data will be used, in accordance with the authorisations you have provided, are as follows:

(i) Details of data processing procedures for analysis, appraisal and follow-up purposes in order to offer and design products and services tailored to the client's profile.

By giving your consent to the purposes indicated here in, you authorise us to:

• a) Proactively perform risk analyses and apply statistical and client segmentation techniques to your data, for three purposes: 1) To assess what products or services might suit your profile and your particular commercial or credit situation, all in order to offer you products and services that are tailored to your needs and preferences, 2) To monitor and follow up on the products and services you take out, 3) To adapt corrective measures for any instances of non-payment and other incidents derived from the products and services you have taken out.

• b) To associate your details with those of companies you have some kind of connection with, whether in an ownership or an administrative capacity, in order to analyse possible economic interdependencies when studying offers of services, credit applications and products you wish to take out.

• c) To perform studies and automated checks in relation to possible cases of fraud, non-payments and incidents derived from the products and services you have taken out.The data processing procedures indicated in sections (i), (ii) and (iii) may be automated and entail the elaboration of profiles, for the purposes already indicated. For this purpose, we hereby inform you of your right to obtain human intervention in the processing of your data, to express your point of view, to receive an explanation regarding decisions taken on the basis of automated processing procedures, and to contest such decisions.

• d) To conduct satisfaction surveys by telephone or electronic channels so that you can rate the services received.

• e) To design new products or services, or to improve the design and usability of existing ones, as well as to define or improve users' experience in their relationships with CaixaBank and CaixaBank Group companies.

The data which will be processed for the purposes of (i) analysing and studying data, and (ii) offering products and services will include:

• a) All data provided in establishing or maintaining commercial or business relations.

• b) All data generated in the process of contracting or operating with products and services with CaixaBank, with CaixaBank Group companies or with third parties, such as account or card movements, details of direct debits, direct deposits of salaries, insurance policy claims, complaints, etc.

• c) All data which CaixaBank or CaixaBank Group companies obtain through providing services to third parties when the recipient of that service is the Signer, such as managing bank transfers or bill payments.

• d) Data on whether or not you are a shareholder of CaixaBank according to the company's records, or of any other company that is required by the stock market regulations to maintain records of securities represented by accounting entries.

• e) Data obtained from any social networks which the Signer authorises CaixaBank to view

• f) Data obtained from third-party companies as a result of data aggregation requests raised by the signer

• g) Data obtained from the Signer browsing through CaixaBank's and the CaixaBank Group companies' digital banking services, other websites and mobile applications in which they are duly identified. This data may include geolocation information.

• h) The data relating to the Signer may be supplemented and enriched by data obtained from suppliers of commercial data, by data obtained from public sources, as well as by statistical and socioeconomic data (hereinafter, "Additional Information"), always verifying that such data complies with the requirements established in the current data protection regulations.

(iii) Provision of data to third parties

By giving your consent to the data uses set out herein, you authorise us to provide your personal data to companies with which CaixaBank and/or CaixaBank Group companies have agreements and which operate in the fields of banking, investment and insurance, stockholding, venture capital, real estate, transport infrastructure, the sale and distribution of goods and services, consultancy services, leisure and charity, in order for these companies to offer you their products and services.

In any case, in the event of your personal data being provided to a third party in virtue of your authorisation, the recipient company would inform the Signer of the processing of their data as well as of the source of that data.