Who is the controller of your personal data?

BanSabadell Pensiones EGFP, S.A.

Registered office at c/ Isabel Colbrand 22, 28050 Madrid, Spain.

Tax ID No. A-58581331.

Registered in the Madrid Companies Register, Volume 36622, Book 0, Folio 140, Section 8, Page M657072, Entry 2, and in the Special Register of Pension Fund Managers under number G-0085.

Data Protection Officer: DPO_BSPensiones@BSPensiones.com

How do we obtain your personal data?

BanSabadell Pensiones EGFP, S.A. markets its products through its commercial distributor, Banco de Sabadell, S.A., holder of Tax ID No. A-08000143 and with registered office at Avda. Óscar Esplá, 37, 03007 Alicante, Spain.

At the time of taking out pension plans, our distributor collects personal data directly from data subjects in the capacity of data controller through the Banco de Sabadell, S.A. distribution network.

In order to issue a pension plan and keep it in force, we need to process your identification data, contact details, bank account details and certain personal, family, financial and property circumstances that will enable us to advise you properly and ensure the suitability of the product you wish to acquire.

Please note that we are subject to certain disclosure obligations under the Financial Markets and Instruments Directive (MiFID) that are designed to enhance the protection of individual customers when buying and selling financial instruments. 

For the personnel selection processes, we need to process your identification and contact data, as well as your academic and professional information, among others, according to the needs of the candidacy to which you apply.

The personal data you provide at the time of taking out your pension plan and during its term will be processed for the following purposes:

1. To prepare, issue and manage your pension plan, including the sending of periodic communications relating to your plan, consultancy services, resolving queries and the processing of contributions, as well as designating beneficiaries, transfers or redemptions;

2. To register, process and respond to complaints and claims that you send us, if and when you have any;

3. To carry out the verification needed to detect and prevent money laundering and terrorist financing;

4. To make direct non-commercial communications by electronic means relating to your assessment of the company. Such communication may include satisfaction surveys to help us improve our services.

5. To carry out, directly or through our intermediary, commercial and/or advertising actions or communications relating to products similar to those taken out by any means, including electronic means. These actions may be aimed at informing you of services included in your plan, news, current promotions or various events;

6. To carry out, directly or through our intermediary, commercial and/or advertising actions or communications by any means, including electronic ones, in relation to products of other insurance companies or pension plan managers of the Banco de Sabadell Group. These actions may be aimed at offering you insurance products or pension plans that are not offered directly by us, but by another of the Group’s companies, as well as informing you of news, current promotions or other events;

7. To include you as a participant in competitions, prize draws or other promotional activities, at your request and in compliance with any applicable regulations or rules that are announced.

8. To include you in the personnel selection process of the candidacy or candidacies in which you have decided to apply, as well as to carry out the management and resolution of it.

Yes, we create marketing profiles in order to predict what other products, terms or benefits you may be interested in and/or that we can offer you, and to determine the best time to offer them to you; e.g. when you reach a certain age or when we detect any signs of displeasure or dissatisfaction with our service that we may be able to correct or make up for. These profiles are prepared using (i) information that you provide directly to us, (ii) the number of products you have taken out with us and their performance, and if applicable (iii) the risk profile indicators assigned by the insurance companies in which Banco de Sabadell, S.A.* has a controlling interest and with which it has taken out insurance product/s. We only use data that are useful, relevant and necessary with regards to the aforementioned commercial purposes. Furthermore, such data will always be subject to prior pseudonymisation and encryption techniques in order to guarantee data subjects’ privacy.

When you take out your pension plan, we will store your personal data for the duration of your contractual relationship with us, and for a period of ten (10) years following termination of the same.

When you initiate or receive communication via telephone or other means (instant messaging), this communication will generally be recorded for the purpose of monitoring the quality of service and the recordings will be retained for a period of two (2) years.

When you respond to our evaluation surveys about your level of satisfaction with our services, we will store information about your responses for seven (7) years.

When you submit an application and we receive your CV, we will keep your data for the time strictly necessary for its management. Only if you are selected in the process, this data will be kept for a maximum period of two (2) years.

Throughout the storage period, we will implement appropriate security measures to prevent any risk of accidental destruction, loss, accidental modification or unauthorised access to your personal data. In compliance with article 32 of the Personal Data Protection Act 3/2018, near the end of the pre-determined storage period your personal data will be blocked and can only be used to answer to any potential liability in relation to the processing thereof.

The lawful bases for the aforementioned processing operations are as follows:

1. To prepare, issue and manage your pension plan, the applicable lawful basis is the execution of the insurance contract to which you are a party or the application of the pre-contractual measures requested for this purpose, under the terms and within the limits specified by Royal Legislative Decree 1/2002, which enacted the revised text of the Pension Plans and Funds Regulation Act [article 6.1.b) of the General Data Protection Regulation (EU)];

2. In order to register, process and respond to the complaints and claims that you send us, the applicable lawful basis is compliance with our legal obligation pursuant to article 7 of Royal Legislative Decree 1/2002, which enacted the revised text of the Pension Plans and Funds Regulation Act [article 6.1.c) of the General Data Protection Regulation (EU)];

3. In order to carry out the verification needed to detect and prevent money laundering and terrorist financing, the applicable lawful basis is compliance with legal obligations applicable to us, derived from the Prevention of Money Laundering and Terrorist Financing Act 10/2010 [article 6.1.c) of the General Data Protection Regulation (EU)];

4. In order to conduct customer satisfaction surveys and a customer evaluation of the company, the lawful basis is our legitimate interest in building customer loyalty and improving our services [article 6.1.f) of the General Data Protection Regulation (EU)];

5. In order to carry out commercial and/or advertising actions or communications, including profiling for this purpose, the applicable lawful basis is our legitimate interest in building customer loyalty, ensuring that customers are satisfied with our services, and possibly offering them other products similar to those taken out that may be of interest to them [article 6.1.f) of the General Data Protection Regulation (EU)];

6. To carry out commercial and/or advertising actions or communications relating to products of other insurance companies or pension plan managers of the Banco de Sabadell Group, including the preparation of profiles for this purpose, the applicable lawful basis is the express, free, informed, unequivocal and specific consent that you give at the time you decide to participate in the data cycle [article 6.1.a) of the General Data Protection Regulation (EU)];

7. To include you as a participant in competitions, prize draws or other promotional activities, the applicable lawful basis is the consent you give at the time of applying for participation [article 6.1.a) of the General Data Protection Regulation (EU)].

8. To manage your candidacy for the Company's selection processes, the applicable legal basis is the execution of the pre-contractual measures necessary to achieve a labor contract [article 6.1.b) of the General Data Protection Regulation (EU) ].

In relation to profiling for marketing purposes, the applicable lawful basis is our legitimate interest in keeping our customers loyal, ensuring that customers are satisfied with our services, and possibly offering them other products similar to those they have purchased and that may be of interest to them [article 6.1.f) of the General Data Protection Regulation (EU)]. We will only enrich these profiles with external sources, from the insurance companies of other branches and/or pension plan managers in which Banco de Sabadell, S.A.* has a controlling interest and with which you have taken out insurance product/s when (a) you have given us your express, free, informed, unequivocal and specific consent to do so, which you may revoke at any time [article 6.1.a) of the General Data Protection Regulation (EU)], or when (b) you have expressly requested a service from us that makes it necessary [article 6.1.b) of the General Data Protection Regulation (EU)].

Will we disclose your personal data to third parties?

The aforementioned processing operations require the disclosure of your personal data to:

· Competent public authorities and bodies, in compliance with the legal supervisory obligations provided for in Royal Legislative Decree 1/2002, which enacted the revised text of the Pension Plans and Funds Regulation Act and other legal obligations relating to the duty to cooperate with the justice system and the State Administration, including the Directorate-General of Insurance and Pension Funds, SEPBLAC, the Spanish Tax Agency (Agencia Tributaria), the State Security Forces and Agencies as well as Courts and Tribunals.

· Other group or affiliated companies, in various circumstances:

o We may share information on your pension plan’s balance with the insurance companies in which Banco de Sabadell, S.A.* has a controlling interest and with which you have taken out an insurance product, if applicable, so that they may assess the possibility of offering you additional conditions or benefits that increase your level of satisfaction, provided that you have given us valid consent to do so or requested a service from us that makes it necessary.

Your personal data will also be accessible to our DATA CONTROLLERS (commercial distributors and service providers). In application of our corporate governance policies, we only work with data controllers who have previously provided sufficient guarantees of compliance with current data protection laws. This ensures that your personal data will never be processed from a country that does not offer a level of protection equivalent to European levels, either through contractual measures with the data controller, through the existence and verification of binding corporate rules or by means of other equivalent safeguards. We do not currently carry out international transfers of personal data outside the European Union.

Do we carry out international transfers?

We use the services of Medallia Inc., whose servers are located in the United States, to conduct satisfaction surveys and company evaluations.

As a result, the data necessary to conduct the surveys may be sent, stored and accessed from outside the European Economic Area (“EEA”). These transfers are carried out on the basis of the standard data protection clauses adopted by the European Data Protection Commission, the content of which ensures the confidentiality of the data transferred and legal compliance with data protection provisions [art. 46.2 d) of the European Data Protection Regulation (EU)].

What are your rights?

Data subjects may exercise the following rights at any time:

· Right of access. If you wish to ask us to confirm whether or not we are processing your personal data, and if so to obtain a copy of the data and full information about its processing.

· Right of rectification. If you wish to request the correction of errors, the modification of inaccurate or incomplete data, and to guarantee the accuracy of the information that is subject to processing.

· Right of erasure. If you wish to request the cancellation or deletion of your data because their processing is unlawful or because the purpose for which they were processed or collected has ceased to exist.

· The right to object. If you wish to object to the processing of your personal data for marketing purposes, including profiling for such purposes. In the case of processing operations based on a legitimate interest, data subjects also have the right to object to processing on grounds relating to a particular situation, provided that there are no compelling legitimate grounds for the processing or that the data are not necessary for the establishment, exercise or defence of claims.

· The right to restrict processing. If you wish to request the suspension of processing if it is unlawful or if the accuracy of the data is contested.

· The right to portability. If you wish to request a copy of your data in a structured, commonly used and machine-readable format for direct transmission to another pension plan manager.

· The right to safeguards in automated individual decision-making. This right includes requiring human intervention, expressing your point of view and/or challenging decisions based solely on automated processing of your personal data, including profiling.

To exercise any of these rights, please contact our Data Protection Unit by emailing ProteccionDatos_BSPensiones@BSPensiones.com. In order to process your petition without delay, it is recommended that you clearly state your identity (first name, surname/s and national identity card number) and the right/s you wish to exercise. The exercise of these rights is free of charge, except in the case of manifestly unfounded or excessive petitions for access, in which case we are legally entitled to charge a reasonable fee to cover the cost of processing your petition.

In addition, and in relation to the right of opposition, we inform you that any citizen may use the existing advertising exclusion systems to express their refusal or opposition to receiving commercial communications from any entity to which they have not given their express consent. For more information, please visit www.listarobinson.es.

Should you have any doubts or concerns relating to respect for your rights, please contact us at any time and request the mediation of our Data Protection Officer, who has been approved by the Spanish Data Protection Agency for this duty, by emailing DPO_BSPensiones@BSPensiones.com. In particular, you can ask our Data Protection Officer for more information about the weighting of the legitimate interest on which we have based a specific processing operation and/or the impact assessment we have previously carried out, where such processing gives rise to reasonable doubts in this respect.

We inform you that you may ultimately petition the Spanish Data Protection Agency to protect your rights or submit a claim on its website www.agpd.es, or at its head office located at c/ Jorge Juan, 6 – 28001 Madrid (Spain).