These processing activities are carried out to achieve the legitimate interests of CaixaBank or a third party. We will do so whenever our interests do not prevail over your interests or your fundamental rights and freedoms, as established in Article 6.1.f) of the General Data Protection Regulation (GDPR).
Before carrying out the processing activities, we will performing the weighting of your rights and our legitimate interest. We will only process the data of data subjects in the cases in which our interest prevails over the data subject's rights and liberties. You can consult the analysis of the legitimate interest of data processing by sending your inquiry to delegado.proteccion.datos@caixabank.com.
Please bear in mind that you may object to the processing of your personal data on the basis of legitimate interest. If you believe that CaixaBank must consider your personal situation or stop processing your personal data, you may object to this at no cost via the channels mentioned in section 4.
We detail these processing procedures below, organised from (A) to (N). We will point out for each of them: the legitimate interest of CaixaBank, the description of the purpose, the types of processed data, where applicable, information on the use of profiles, other necessary information about the processing and whether they are procedures conducted under the system of co-responsibility with other companies of the CaixaBank Group.
(Other relevant information) whether they are procedures conducted under the system of co-responsibility with other companies of the CaixaBank Group (Co-controllers/Data Controller),
A. Classification of customers
CaixaBank's legitimate interest: Organise the company's human resources and materials for correct and efficient customer service.
Purpose: Classify customers according to the following basic information:
- The income or money they have deposited in CaixaBank.
- Their salary or other income that is paid directly into their account.
- Age.
- Address.
- The use of the products arranged.
With this classification, we can organise our human and material resources to serve you properly.
We will process your data for:
- Grouping customers into different categories according to the way CaixaBank's commercial activity is organised. That is, we will classify customers so that we can better manage and meet their needs.
- Assigning each customer a customer service centre and/or an employee of CaixaBank. This will be the person responsible for assisting you when you need help.
Data processed:
- Personal and contact details
- Data on your professional or employment activity and socio-economic information
- Contracting data
- Basic financial data
- Third-party data observed on demand and payment account statements and receipts
- FEGA/SEGA data
- Demographic and socioeconomic data: Statistical data associated with geographical areas, age sectors or professional activity sectors, not with particular individuals.
Other relevant information:
- Right to objection to processing: If you believe that CaixaBank must consider your personal situation or stop processing your personal data, you may object to this at no cost via the channels mentioned in section 4.
Party responsible for the data processing: The data controller responsible for this data processing is CaixaBank.
B. Management of the performance of employees, agents and suppliers
Legitimate interest of CaixaBank: Managing relationships with employees and agents based on their professional performance. We will also manage the relationship with suppliers to ensure that they are doing their job properly.
Purpose: Monitor the professional performance, challenges and objectives of employees and agents. To this end, the transactions and contracts that they maintain with customers are analysed. We also monitor the activity of our suppliers.
Types of processed data:
- Personal and contact details
- Contracting data
- Basic financial data
Other relevant information:
- Right to objection to processing: If you believe that CaixaBank should stop using your data for any personal reason, you can request this free of charge and easily through the channels mentioned in section 4.
- Ancillary use of customer data: This data processing deals with customer information, but only in a manner that supports the intended purpose. This does not affect or have any consequences for the customer.
Data controller: The data controller responsible for this data processing is CaixaBank.
C. Fraud prevention
Legitimate interest: Prevent fraud involving financial or reputational losses to CaixaBank or its customers.
Purpose: TAdopt the necessary steps to avoid malicious transactions or behaviour before they are committed. It also aims to reverse any effects that may arise by identifying transactions or conduct suspected of fraud against CaixaBank or its customers.
We will process your data to:
- Verify the identity of customers to prevent fraudulent access to information or transactions.
- Review and analyse the contracting and transactions that are carried out in our systems to protect our customers from fraud on any channel and prevent cyberattacks.
- Verify your identity and the validity of the identification documents you provide us with. We will confirm that the document you provided is yours. We will do so by comparing it with national and international databases from law enforcement agencies. Also with similar organisations, such as INTERPOL (International Criminal Police Organization). We do this to protect you from identity theft, for example, where someone might impersonate you.
- Consult the information included in the PAYGUARD Fraud Prevention Service to detect fraudulent accounts, and, if applicable, report your fraudulent transactions.
Types of processed data:
- Personal and contact details
- Data on your professional or employment activity and socio-economic information
- Contracting data
- Basic financial data
- Third-party data observed on demand and payment account statements and receipts
- Data on any communication with you
- Browsing data
- Geographical data
- Data obtained from other processing operations provided for in this policy:
- Risk assessment or scoring data (processing defined under heading 6.2.C).
- Data obtained from running statistical models
Use of profiling: We will create a profile based on your usual transactions and activities. We will use this profile to spot unusual situations that may point to attempted fraud
- Purpose of the profile: the profile used aims to identify activities that are unusual or outside your behavioural profile. These may be attempts at fraud or fraudulent access to information.
- Consequences: profiles help us to identify fraudulent transactions. Its use involves applying measures ranging from detailed review of the transaction to blocking or denying it.
Other relevant information:Below, you will find other relevant information on this processing:
- Automated decisions: to prevent fraud, we will carry out automated decision-making processes. This allows us to detect potential fraudulent transactions. For transactions that cannot be reversed once made, such as immediate payments or transfers, the automated decision may prevent you from carrying out the transaction if it detects that it may be fraudulent. Therefore, you will not be able to carry out that transaction. You can request the transaction again at any of our branches, where the analysis does not involve automated decisions.
- Right to objection to processing: if you believe that CaixaBank should stop using your data for any personal reason, you can request this free of charge and easily through the channels mentioned in section 4.
- PAYGUARD Fraud Prevention Service: CaixaBank is a member of the PAYGUARD Fraud Prevention Service, which includes the country's leading financial institutions and is managed by Sociedad Española de Sistemas de Pago, S.A. (Iberpay).
The service aims to minimise the levels of fraud related to movements between accounts by detecting, investigating, monitoring and reporting, where applicable, suspicious and fraudulent transactions involving customers' current or savings accounts. The legal basis for the processing is the legitimate interest in preventing fraud that could affect these transactions.
CaixaBank may include data related to the IBAN number and identifying details of the holder of the account where the suspicious or fraudulent transaction has been detected in the PAYGUARD Fraud Prevention Service. You may view the updated list of the participating companies at the following link https://www.iberpay.es/es/servicios/servicios/prevenci%C3%B3n-del-fraude/
The data will be kept for a maximum of thirty days for suspicious transactions and one year for confirmed fraudulent transactions.
The institutions participating in the PAYGUARD Fraud Prevention Service are jointly responsible for your data. You may request the main aspects of the joint liability agreement by sending an email to www.caixabank.com/delegadoprotecciondedatos and also exercise your rights regarding the processing of your data over any of the channels indicated in section 4. Exercising rights and filing complaints through the Spanish Data Protection Agency (AEPD).
- FrauDfense Fraud Prevention Service: CaixaBank is a member of the FRAUDFENSE Fraud Prevention Service, which includes some of the country's leading financial institutions and is managed by FrauDfense, S.A.
This service aims to minimise the levels of fraud related to customers' transactions, by detecting, investigating, monitoring and reporting, where applicable, suspicious and fraudulent transactions involving customers' current or savings accounts in their digital banking transactions. The legal basis for the processing is CaixaBank's legitimate interest in preventing fraud in their transactions.
CaixaBank may include data related to the IBAN number, data related to the fraudulent transaction identified, details of the device from which the fraudulent transaction was made and identification data of the holder or the account where the suspicious or fraudulent transaction has been detected in the FrauDfense Fraud Prevention Service. You may view the updated list of participating FRAUDFENSE institutions at: https://916087356-1.servicio-online.net/sobre-nosotros1/nuestros-partners.
The details will be kept in the FrauDfense Fraud Prevention Service for a maximum of 12 months in the case of confirmed fraudulent transactions and may then be kept blocked until the applicable statute of limitation period elapses.
The institutions participating in the FrauDfense Fraud Prevention Service are jointly responsible for processing your data. You may request the main aspects of the joint liability agreement by sending an email to www.caixabank.com/delegadoprotecciondedatos or protecciondedatos@frauDfense.com.
You may also exercise your rights regarding the processing of your data via any of the channels indicated in section 4 Exercising Your Rights and Lodging Claims with the Spanish Data Protection Agency (AEPD), and by emailing protecciondedatos@frauDfense.com.
Joint data controllers: The following companies shall process and be jointly liable for your data:
- CaixaBank, S.A.
- CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
- Nuevo Micro Bank, S.A.U.
- Global Payments Moneytopay, EDE, S.L.
- CaixaBank Equipment Finance, S.A.U.
You can find the main aspects of the joint data controller agreements in the following section: www.caixabank.es/empresasgrupo.
D. Enquiry and communication with credit reporting systems within the framework of the request and subsequent management of products involving financing
CaixaBank's legitimate interest: Avoid non-payments and defaults by applicants or holders of products involving financing.
Purpose:
- Determine whether applicants or holders of products or services involving deferred payment of instalments are able to pay the agreed instalments.
- Determine whether the holders of products or services that involve repaying money we have advanced can do so.
- Monitor and manage current transactions.
- Prevent and manage non-payments.
We will process your data to:
- Consult your information: Before granting you a transaction involving financing, and subsequently to monitor and manage risk, we will consult the following credit information systems (financial solvency and credit files): Asnef File and Badexcug File.
- Share your personal data: If you stop paying some money obligations that you have with us, will be able to communicate details of the non-payment to the same credit information systems. We will always do so in compliance with current regulations.
Types of processed data:
- Personal and contact details
- Contracting data
- Basic financial data
- Data on credit information systems
Other relevant information:
- Right to objection to processing: if you believe that CaixaBank should stop using your data for any personal reason, you can request this free of charge and easily through the channels mentioned in section 4
Data controller: CaixaBank is the controller for the part of the processing relating to querying credit information systems. CaixaBank and the solvency files Asnef and Badexcug are the joint controllers of the part of the processing relating to communication to credit information systems. We will provide you with the necessary information on how to contact these databases:
- Asnef file: Asnef Equifax Servicios de Información sobre Solvencia y Crédito. Apartado de Correos 10546, 28080 Madrid (sac@equifax.es)
- Badexcug file: Apartado de Correos 1188, 28108 Alcobendas (badexcug@experian.com)
E. Acquiring additional contact data for managing non-payment situations
CaixaBank's legitimate interest: Debt recovery in situations of non-payment. To do so, it is necessary to have up-to-date customer contact details.
Purpose: Collect additional contact information from customers in order to contact them in the event of a breach of their contractual obligations.
Additional contact details are obtained from public lists such as white pages, yellow pages and Lleida.net. They are also obtained from private lists such as Equifax, detectives or debt collection agencies. We will always do this in compliance with applicable regulations.
Types of processed data:
- Personal and contact details
- Information obtained from sources accessible to the public, and public registers
Other relevant information:
- Right to objection to processing: if you believe that CaixaBank should stop using your data for any personal reason, you can request this free of charge and easily through the channels mentioned in section 4
Data controller: The data controller responsible for this data processing is CaixaBank.
F. Preparation of mathematical models
Legitimate interest: Organise and improve our business activity as efficiently as possible. To achieve this, we need to create mathematical algorithms that help us analyse information in an advanced way.
Purpose: Create and maintain statistical and mathematical algorithms and models. These can be used to perform complex calculations and analyses that enable us to apply the processing described in this policy.
Types of data: The data that has already been identified in each process is used. Whenever possible, we apply techniques so that the data cannot be associated with a person (anonymisation or pseudonymisation). This ensures that the rights of data subjects are not affected and that the result is mathematical formulas or algorithms.
Other relevant information:
- Right to objection to processing: if you believe that CaixaBank should stop using your data for any personal reason, you can request this free of charge and easily through the channels indicated in section 4.
- Ancillary data processing: the objective is not to process customer data individually. It is a necessary but secondary process for creating mathematical formulas. For this reason, anonymisation techniques are used and the information is minimised. These data processing activities have no individual consequences for customers.
Data controller: When mathematical models are based on processing carried out by CaixaBank under this policy, the data controller will be CaixaBank. If carried out under joint responsibility, the same regime as the original processing will apply. You can consult the details of the jointly responsible companies and the agreements at www.caixabank.es/empresasgrupo.
G. Preparation of management reports
Legitimate Interest: Organise and improve our business activity as efficiently as possible. To do this, we need reports on the company's management and on the market.
Purpose: Prepare reports on the company's activity, its relationship with the market, the composition and evolution of its customer base, and the effectiveness of its products and services. These reports assist us in our internal analysis, planning, and decision-making processes. They are not used to make commercial offers to our customers.
Types of processed data: The data that has already been identified in each process is used. Whenever possible, we apply techniques so that the data cannot be associated with a person (anonymisation or pseudonymisation). These reports contain statistical or aggregated information, except when it is necessary to maintain traceability for proper internal management.
Other important information:
- Right to objection to processing: if you believe that CaixaBank should stop using your data for any personal reason, you can request this free of charge and easily through the channels mentioned in section 4.
- Ancillary data processing: the objective is not to process customer data individually. It is a necessary but secondary process for creating aggregate reports. For this reason, anonymisation techniques are used and the information is minimised. These data processing activities have no individual consequences for customers.
Data controller:When the reports are based on processing carried out by CaixaBank, the data controller will be CaixaBank. If carried out under joint responsibility, the same regime as the original processing will apply. You can consult the details of the jointly responsible companies and the agreements at www.caixabank.es/empresasgrupo.
H. Commercial communications based on a basic commercial profile
We will only process your data if:
- You have not informed us of your preferences regarding the commercial processing described in sections 6.1 A, 6.1 B and 6.1.C.
- You have not objected to the processing.
CaixaBank's legitimate interest: Promote the marketing of the products and services in our portfolio and build customer loyalty.
Purpose: Provide you with commercial communications about products and services similar to those you have contracted with us. We will do this based on a basic commercial profile that we will create using your data.
Types of data processed:
- Personal and contact details: full name, gender, postal contact information, telephone number and e-mail address, place of residence, nationality and date of birth, language for communications, identification document.
- Socioeconomic data and information about your professional or work activity: professional or work activity, income or remuneration, family unit, education level, assets, and fiscal and tax data.
- Contracting data: contracted or requested products and services, status of the holder, authorised parties or representative for the contracted product and service, categorisation according to the regulation on stock markets and financial instruments (MiFID category), information on investments made and their evolution, and information and movements of finance transactions
- Basic financial data: current and historic balances of products and services and payment history regarding contracted services and products.
- Details of your shareholder status, or not, of CaixaBank: if you hold CaixaBank shares, or not.
- Details of the communications we have held with you: data obtained from chats, walls, video conferences, telephone calls or any other equivalent means of communication.
- Own browsing data: if you have accepted the use of cookies and similar technologies on your browsing devices, the data obtained from your browsing on our websites or mobile applications and your browsing on them: browsing history (websites visited and clicks on content), device ID, advertising ID, IP address and installed version of the application.
- Geographical data: the geolocation data of your mobile device provided through the installation and/or use of our mobile applications, when so authorised in the set-up of the application itself.
- Data obtained from other processing operations provided for in this policy:
- Risk assessment or scoring data:in operations involving financing or payments in instalments, we will infer your payment or non-payment capacity or the risk limits by applying statistical-mathematical models that are calculated using your data (processing defined in section 6.2.C).
- Customer classification data. (processing defined in section 6.4.A).
- Data obtained from the execution of statistical models: we use the results of applying mathematical modelling to customer data to deduce consumer habits, preferences or propensity to contract or classify customers.
- Demographic and socioeconomic data: statistical data not associated with specific persons but with geographical areas, age sectors or professional activity sectors, which we will use in relation to the customers' information.
Use of profiling: We will generate a basic commercial profile using only the data mentioned above:
- Purpose of the profile: we will deduce the products and services that we believe may interest you. We will offer you these products instead of generic commercial offers.
- Consequences: we will provide you with customized offers on the products and services marketed by CaixaBank.
We will only create the profile with the details provided in this section. We will never use this profile to refuse any product or service, or to set credit limits.
Objecting to this data processing does not prevent, limit or condition your access to our complete catalogue of products and services, which is always available to you.
If you apply for any product or service, your application will be assessed in accordance with our procedures. Objecting to this data processing will not affect this assessment.
Objecting this data processing will not prevent us from contacting you to manage your products and services.
- Logic: this basic commercial profile is calculated based on the data specified in the "Types of Data Processed" section. We will only use data from the last thirteen months.
These data are applied to mathematical formulas obtained from past behaviours observed in customers of similar characteristics. This allows us to deduce the customer's propensity to consume. These mathematical formulas allow us to determine the importance of all the data processed in the final result of the customer's profile. This final result is the probability that the customer will be interested in a product or service.
Other relevant information:
- Right to objection to processing: you can object to this processing easily and free of charge by clicking on the following link www.caixabank.es/ile or by calling 93 102 82 89.
You may also object through the channels indicated in section 4.
Please note that if you object to the processing of your data, we will cease to do so without you having to give us a reason.
- Prior verification of your repayment capacity: when the products or services we want to offer you involve financing or the payment of instalments, we will first verify your repayment capacity. We will do so in accordance with Point 6.2.C
The aim is to offer you a credit limit and payment terms that reflect our knowledge of your financial situation. This preliminary check will be carried out in accordance with the principles of accountability in the offering of financing products demanded by the Bank of Spain, and by the regulation on prudential supervision and solvency of credit institutions and of responsible lending.
- Validity of the processing: we will stop carrying out this processing, with no other additional requirement, in any of these two circumstances:
- When we contact you to request your consent to the commercial processing by the CaixaBank Group companies described in sections 6.1, regardless of whether you authorise them or not.
- If you object to the processing.
Data controller: The data controller responsible for this data processing is CaixaBank.
I. International financial sanctions and countermeasure policies of OFSI and OFAC
Legitimate interest: TCaixaBank and the jointly responsible companies mentioned in this section need to process your data in order to comply with international regulations on sanctions and financial measures in the United States and the United Kingdom. This is necessary in order to operate and do business in those countries.
Purpose: Comply with the sanctions and financial controls required by the authorities in the United Kingdom and the United States.
To comply with these regulations, jointly responsible companies will check whether your name appears on lists of persons or entities subject to restrictions in the United States and the United Kingdom.
Types of processed data:
- Personal and contact details
- Data related to international sanctions
Other relevant information:
- Right to objection to processing: if you believe that CaixaBank must consider your personal situation or stop processing your personal data, you may object to this at no cost via the channels mentioned in section 4.
Joint data controllers: The following CaixaBank Group companies shall process and be jointly liable for your data:
- CaixaBank, S.A.
- CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
- VidaCaixa, S.A. de Seguros y Reaseguros
- Nuevo Micro Bank, S.A.U.
- CaixaBank Asset Management SGIIC, S.A.U.
- CaixaBank Equipment Finance, S.A.U.
- Buildingcenter, S.A.U.
- Livingcenter Activos Inmobiliarios, S.A.U.
- Puerto Triana, S.A.
- Bankia Habitat, S.L.U.
- Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
- Banco BPI, S.A.
- BPI Gestão de Ativos, SGOIC, S.A.
- CaixaBank Wealth Management Luxembourg, S.A.
- CaixaBank Asset Management Luxembourg, S.A
- OpenWealth, S.A.U.
You can find the main aspects of the joint data controller agreements in the following section: www.caixabank.es/empresasgrupo.
J. Improved efficiency of internal processes
CaixaBank's Legitimate Interest:Managing processes efficiently in order to optimise them to the maximum. This enables us to achieve a higher level of service quality and improve business continuity.
Purpose: Reviewing internal processes. Volumes, process times and customer interactions with our systems are analysed and identified. This provides aggregate information that helps to improve these internal processes and the customer experience.
Types of data processed:
- Identification and contact
- Contracting data
- Basic financial data
- Third-party data observed on demand and payment account statements and receipts
- Data on any communication with you
- Browsing data
- Data obtained from other processing operations
- Data obtained from running statistical models
- Data obtained from sources accessible to the public or external sources
- Third-party browsing data
Other relevant information:
- Right to objection to processing: if you believe that CaixaBank should stop using your data for any personal reason, you can request this free of charge and easily through the channels mentioned in section 4.
Data controller: The controller responsible for this data processing is CaixaBank.
K. Customer surveys
Legitimate interest of CaixaBank: Assessing the level of customer satisfaction. This enables you to improve the services and products you offer your customers, guaranteeing them an appropriate experience that meets their expectations.
Purpose: Conduct customer surveys to gauge their satisfaction with our services and improve internal processes where necessary.
Types of data processed
- Identification and contact details.
- Contracting data
- Browsing data
- Data obtained from other processing operations provided for in this policy:
- Customer classification data (processing defined in heading 6.4.A).
Other relevant information
- Right to objection to processing: you may object through the channels indicated in section 4. Please note that if you object to the processing of your data, we will cease to do so without you having to give us a reason.
- Validity of the processing: we will stop carrying out this processing, with no other additional requirement, if you exercise your right to object.
Data controller: The data controller responsible for this data processing is CaixaBank. This processing is not carried out as a joint controller.
L. Determination of social measures on foreclosed assets
Legitimate interest: Detecting and reducing the risk that our activity may have on our reputation in relation to the properties we acquire. We do so in accordance with the EBA Guidelines on Risk Management and Internal Governance and the Bank of Spain Guidelines. In addition, we will ensure that we correctly apply the Code of Good Practice.
Purpose: The purpose of this processing is to determine whether there are exceptional circumstances of residential vulnerability. And, if they exist, see if they justify applying the appropriate and available social measures for the proper management of risks and social action, and for the proper management of the property.
Types of processed data: The types of data that we process for this purpose, whose content is detailed in section 5, are:
- Personal and contact details
- Data on your professional or employment activity and socio-economic information
- Sensitive data regarding situations of vulnerability
- Data on legal capacity and on particular communication needs
- Contracting data
- Basic financial data
- Details of communications with the data subject
- Health details
Other relevant information
- Right to objection to processing: if you believe that CaixaBank must consider your personal situation or stop processing your personal data, you may object to this at no cost via the channels mentioned in section 4.
Joint data controllers: For this processing, CaixaBank will manage your data jointly with the CaixaBank Group company listed below that owns the property:
- BuildingCenter, S.A.U.
- Living Center Activos Inmobiliarios, S.A.U.
- Bankia Habitat, S.L.U.
You will find the key aspects of the joint processing agreements (joint responsibility) at: www.caixabank.es/empresasgrupo.
M. Defence of the rights and interests of CaixaBank by judicial or administrative means
CaixaBank's legitimate interest: Defence of the rights and interests of CaixaBank by judicial or administrative means. CaixaBank invokes its right to effective judicial protection.
Purpose: Manage administrative or legal proceedings in which CaixaBank is the claimant or defendant.
Types of processed data: The types of data that we will process for this purpose are as follows:
- Personal and contact details
- Data on your professional or employment activity and socio-economic information
- Sensitive data regarding situations of vulnerability
- Data on legal capacity and on particular communication needs
- Contracting data
- Basic financial data
- Details of communications with the data subject
- Data obtained from sources accessible to the public and public registers:
Other relevant information:
- Right to objection to processing: if there is a particular situation or other reasons that justify us ceasing to process your data, you can request this easily and free of charge through the channels indicated in section 4.
Data controller:The data controller responsible for this data processing is CaixaBank.
N. Compilation of statistical information
Legitimate Interest: Create a set of statistical information about their business processes. This is considered a legitimate interest because it helps them improve and analyse their activity.
Purpose: The objective is to combine certain personal data to generate fully anonymised and aggregated information. This provides an overview of business processes without identifying any individuals.
Types of data processed
- Personal and contact details
- Data on your professional or employment activity and socio-economic information
- Contracting data
- Basic financial data
- Third-party data observed on demand and payment account statements and receipts
- Data of your status as a shareholder or non-shareholder of CaixaBank
- Browsing data
- Geographical data
- Data obtained from other processing operations
Other relevant information:
- Right to objection to processing: if there is a particular situation or other reasons that justify us ceasing to process your data, you can request this easily and free of charge through the channels indicated in section 4.
- Ancillary data processing: the processing of personal data is limited to the operations necessary for the creation of statistical information and is carried out using aggregation techniques until the data is fully anonymised.
Joint data controllers: The following companies shall process and be jointly liable for your data
- CaixaBank, S.A.
- CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
- Global Payments Moneytopay, EDE, S.L.
- Comercia Global Payments Entidad de Pago, S.L.
You will find the key aspects of the joint data processing liability agreements at: www.caixabank.es/empresasgrupo.
