CaixaBank and the companies that we indicate below (within each of the processing operations) are joint controllers of your data (hereinafter, 'Joint Controllers') to comply with the following regulations applicable to CaixaBank Group companies: (i) anti-money laundering and terrorist financing regulations; (ii) tax regulations; (iii) obligations arising from sanctions policies and international financial countermeasures.

In accordance with the applicable regulations, the Joint Controllers have signed a joint controller agreement for certain processing activities. The essential elements of this agreement are as follows:

(i) For certain processing activities identified in the Privacy Policy, the Joint Controllers will act in a coordinated or joint manner.

(ii) All suitable technical and organisational measures have been determined to ensure a level of security that corresponds with the risk inherent to processing the personal data subject to joint processing.

(iii) A one-stop shop mechanism is in place for the exercise of data subjects’ rights. This means that requests relating to rights that are received are handled centrally, from a single point of entry. The Controllers agree to collaborate and assist each other.

(iv) The Controllers comply with the duty of secrecy and the requirement to keep the personal data they process confidential.

(v) Regardless of the terms of the joint controller agreement, the data subjects can exercise their data protection rights by contacting any of the Joint Controllers.

This processing is required to comply with a legal obligation, as established in Article 6.1.c) of the General Data Protection Regulation (GDPR).

We need to process your data so that you can enter into and maintain your contracts with us. If you do not want us to carry out this processing, we will have to end this relationship, or you will not be able to enter into the relationship if it is not already in place.

The types of processing required to satisfy the regulatory requirements are listed below, arranged from (A) to (C). For each item, we will indicate:

  • A description of the purpose.
  • Type of data processed.
  • Information on the use of profiling.
  • Other relevant information about the processing.
  • The joint controllers

A. Processing to comply with anti-money laundering and terrorist financing regulations

Purpose: To adopt the measures imposed on our activity by the regulations on the prevention of money laundering and terrorist financing.

We will process your data for:

  • Collecting information and documentation that allows us to comply with due diligence and know-your-customer measures.
  • Verifying the information that you provide us with.
  • Verifying whether you hold or have held positions of public responsibility.
  • Assigning you a risk level. Depending on this level, different due diligence measures will be applied to you, as indicated by the regulations on the prevention of money laundering and terrorist financing.
  • Analysing the operations executed through CaixaBank.
  • Verifying your relationship with companies and, if necessary, your controlling position within the ownership structure of such companies.
  • Proceeding to report and update the Financial Ownership File on a monthly basis. This file is the responsibility of the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offenses (SEPBLAC).

Types of processed data:

  • Personal and contact details
  • Data on your professional or employment activity and socio-economic information
  • Contracting data
  • Basic financial data
  • Third-party data observed on demand and payment account statements and receipts
  • Data on any communication with you
  • Data obtained from other processing operations provided for in this policy:
  • Risk assessment or scoring data (processing defined in section 6.2.C)
  • Data obtained from running statistical models
  • Data on directors, functional officers and corporate relationships:
  • Data held by the General Social Security Treasury
  • Information obtained from sources accessible to the public, and public registers

Use of profiling: We will create a profile exclusively for applying the measures imposed on our activity by the regulations on the prevention of money laundering and terrorist financing.

  • Purpose of the profile</strong: prevent the contracting of transactions that could be subject to money laundering or terrorist financing.
  • Consequences: profiles are tools that help us determine whether our customers' activities are susceptible to money laundering or terrorist financing. This allows us to decide whether or not to accept the transaction.

Joint data controllers: The following CaixaBank Group companies are joint data controllers of this data processing.

  • CaixaBank, S.A.
  • CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
  • VidaCaixa, S.A. de Seguros y Reaseguros
  • BPI Vida e Pensões – Companhia de Seguros, S.A.
  • Nuevo Micro Bank, S.A.U.
  • CaixaBank Asset Management SGIIC, S.A.U
  • Buildingcenter, S.A.U.
  • Livingcenter Activos Inmobiliarios, S.A.U.
  • Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
  • CaixaBank Wealth Management Luxembourg, S.A.
  • CaixaBank Asset Management Luxembourg, S.A.
  • BPI Gestão de Ativos, SGOIC, S.A.
  • Banco BPI, S.A.
  • Bankia Habitat, S.L.U.
  • Puerto Triana, S.A.U.

B. Processing to comply with the applicable tax regulations

Purpose: Adopting the measures imposed by the tax regulations applicable to our activity. We are required to identify the tax residence of the people who have ownership or control of certain financial accounts. We are also obliged to report on these accounts within the framework of mutual assistance. For this reason, CaixaBank will process your data for:

  • Collecting tax-related information and documentation as required by tax regulations.
  • Notifying the public administration of your tax-related information, when this is established by the regulations or required by the authorities.

Types of processed data:

  • Personal and contact details
  • Data on your professional or employment activity and socio-economic information
  • Contracting data
  • Basic financial data

Joint data controllers: The following CaixaBank Group companies shall process and be jointly liable for your data:

  • CaixaBank, S.A.
  • VidaCaixa, S.A. de Seguros y Reaseguros
  • Nuevo Micro Bank, S.A.U.
  • CaixaBank Asset Management SGIIC, S.A.U

C. Processing to comply with the obligations under international financial sanctions and countermeasures policies

Purpose: To adopt the measures imposed on our activity in programmes of international financial sanctions and countermeasures adopted by the European Union and the Kingdom of Spain.

To comply with these measures, CaixaBank will check if you are listed on any list of individuals or entities included in these sanction programs. There is no match for this segment.

Types of processed data:

  • Personal and contact details
  • Data related to international sanctions

Other relevant information: The international financial sanctions programmes that we will consult at CaixaBank are those adopted by:

  • The Office of Financial Sanctions Implementation (OFSI) of His Majesty's Treasury (HMT) of the UK.
  • The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) based on our legitimate interest, as detailed in section 6.4.H.

Joint data controllers: The following CaixaBank Group companies shall process and be jointly liable for your data:

  • CaixaBank, S.A.
  • CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
  • VidaCaixa, S.A. de Seguros y Reaseguros
  • Nuevo Micro Bank, S.A.U.
  • CaixaBank Asset Management SGIIC, S.A.U.
  • CaixaBank Equipment Finance, S.A.U.
  • Buildingcenter, S.A.U.
  • Livingcenter Activos Inmobiliarios, S.A.U.
  • Puerto Triana, S.A.
  • Bankia Habitat, S.L.U.
  • Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
  • Banco BPI, S.A.
  • BPI Gestão de Ativos, SGOIC, S.A.
  • CaixaBank Wealth Management Luxembourg, S.A.
  • CaixaBank Asset Management Luxembourg, S.A.
  • OpenWealth, S.A.U.