CaixaBank and the CaixaBank Group companies listed below are joint controllers (hereinafter, the “Joint Controllers”) of your data for the purpose of gathering statistical data:

• CaixaBank, S.A.
• CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
• Global Payments Moneytopay, EDE, S.L.

In accordance with the applicable regulations, the Joint Controllers have signed a joint controller agreement for certain processing activities. The essential elements of this agreement are as follows:

(i) For certain processing activities identified in the Privacy Policy, the Joint Controllers will act in a coordinated or joint manner.

(ii) All suitable technical and organisational measures have been determined to ensure a level of security that corresponds with the risk inherent to processing the personal data subject to joint processing.

(iii) A one-stop shop mechanism is in place for the exercise of data subjects’ rights. This means that requests relating to rights that are received are handled centrally, from a single point of entry. The Controllers agree to collaborate and assist each other.

(iv) The Controllers comply with the duty of secrecy and the requirement to keep the personal data they process confidential.

(v) Regardless of the terms of the joint controller agreement, the data subjects can exercise their data protection rights by contacting any of the joint controllers.

This processing is carried out for the legitimate interests of CaixaBank or a third party. We do so provided that these interests do not take precedence over your interests, or your fundamental rights and freedoms, as per Art. 6.1.f of the GDPR.

Before carrying out this processing, we will consider your rights against our legitimate interest. We will only carry out the processing in cases where our interest prevails over your rights and freedoms. You can ask about the analysis that is done to consider the legitimate interest of a processing operation at any time by emailing your enquiry to delegado.proteccion.datos@caixabank.com

We remind you that you have the right to object to this processing carried out for legitimate interest. If you believe that CaixaBank should consider any personal situation or reason to stop processing your data, you can request this easily and free of charge through the channels mentioned in section 4.

Below you will find details on the Legitimate Interest, a description of its purpose, the types of data processed, as the case may be, information on the use of profiling, and other relevant information about the processing.

Legitimate Interest: Create a set of statistical information about their business processes. This is considered a legitimate interest because it helps them improve and analyse their activity.

Purpose: The objective is to combine certain personal data to generate fully anonymised and aggregated information. This provides an overview of business processes without identifying any individuals.

Types of data processed

• Personal and contact details
• Data on your professional or employment activity and socio-economic information
• Contracting data
• Basic financial data
• Third-party data observed on demand and payment account statements and receipts
• Data of your status as a shareholder or non-shareholder of CaixaBank
• Browsing data
• Geographical data
• Data obtained from other processing operations

Other relevant information:

• Right to objection to processing: if there is a particular situation or other reasons that justify us ceasing to process your data, you can request this easily and free of charge through the channels indicated in section 4.
• Ancillary data processing: the processing of personal data is limited to the operations necessary for the creation of statistical information and is carried out using aggregation techniques until the data is fully anonymised.