Legal Notice

• Please read the following general conditions carefully. By visiting this address and any of its pages (hereinafter referred to as "the Website") you will be considered to be a user and will be deemed to have accepted these General Conditions. Access to some of the pages of this website may be limited by the laws and provisions of the various jurisdictions of the countries.
• The information contained in this website, including that relating to certain products and services, is essentially intended for use by individuals, companies, firms, trusts, natural or legal persons or any other organisation (hereinafter "Persons") resident in Spain or accessing it from Spain. The Santander Group therefore disclaims all liability for access by Persons in jurisdictions where such distribution or use could be contrary to the rules or regulations. Certain products and services may not be available or authorised in all jurisdictions or for all Persons.

• RESTRICTIONS IN THE UNITED KINGDOM: Persons outside the United Kingdom who make their investments through a Santander Group company that is not resident in the United Kingdom are not covered by the laws and regulations for the protection of investors in the United Kingdom. These include rights to certain remedies, rights of cancellation, access to complaints and arbitration bodies, among others.
  The publications and reports contained on this Website that, where appropriate, have been issued in the United Kingdom, must have the prior approval of the Banco Santander, SA branch in London, an organisation that is regulated and under the supervision of the "Financial Services Authority".
• RESTRICTIONS FOR UNITED STATES CITIZENS (including any citizen or resident of the United States or any legal entity established in or under the laws of the United States, or any political subdivision of that country): If you are a United States citizen or if you are accessing the Website from the United States of America (including its territories, possessions and the District of Columbia), we hereby inform you that the Santander Group, by means of this page, offers the possibility of trading and providing information on securities that are not registered under the 1933 U.S. Securities Act and its corresponding reforms. In accordance with the above-mentioned standard, such securities must not be bought, transferred, delivered or sold (directly or indirectly) in the United States of America, except when the securities laws and regulations of that country allow it, either through their registration or exemption.
  Under no circumstances shall the Santander Group be liable for any loss, damage, penalty or any other claim that may arise, directly or indirectly, from the use of this website or its content by United States investors.
• THIRD PARTY REUTERS INFORMATION: The Santander Group may include third party reports on the Website, or have relationships with issuing companies, trade in securities or other investments, hold positions in such companies, act as a market maker, or support the business of the companies mentioned in a publication or analysis report. The Santander Group accepts no responsibility for any loss, direct or consequential, resulting from the use of such publications or analysis reports. Similarly, this information may not be reproduced, distributed, or published by any recipient, whatever the purpose.
  Reuters information is the intellectual property of Reuters. Any form of copying, publishing or distributing of the Reuters content, without the prior consent of Reuters, including caching techniques, framing or similar means is expressly prohibited. Reuters is exempt from all liability in connection with any errors or delays in the information or with any action taken based on such errors or delays. Reuters and the Reuters’ Logo are registered trademarks of the worldwide Reuters group of companies. For more information, visit the Reuters website (http://www.reuters.com).

• Processing carried out for the contract. They are necessary for signing the contract or for the provision of the service that you request from us.
  
  We will process your data to inform you about the Bank's products and services, for the purpose of acquiring them, as well as to maintain and fulfil the contract, evaluating for this purpose, when necessary, your solvency and credit risk.
  
  If you have used a digitalised handwritten signature in your interaction with the bank to request services and/or formalise transactions, we hereby inform you that we will store your biometric data obtained through the digitalisation of your handwritten signature (such as the stroke, intensity, speed, pressure and acceleration of the graph) and it will be processed exclusively as proof in the event of any repudiation in order to verify by comparison that the signature is yours and therefore perform customer authentication. Under no circumstance will we process your biometric data as a means of identification.
  
  In order to fulfil the contract, we may resort to external sources of information, such as official journals and newsletters, public records, government rulings, telephone directories, lists of persons belonging to professional associations, official lists for the prevention of fraud, social networks and the Internet.

• Processing carried out with your consent. Provided that you have given your consent by ticking the box on the form that we make available to you.

• Processing carried out for legitimate reasons

• Treatments carried out to comply with a legal obligation

• The information that you provide to us when you subscribe to and maintain products and/or services with us, both directly and indirectly. Some examples are: through inquiries, transactions, operations or contract requests.
• External information sources, such as official journals and gazettes, public registers, government rulings, telephone directories, lists of persons belonging to professional associations, official lists for the prevention of fraud, social networks and the Internet, as well as third party companies to which you have given your consent for the transfer of your data to credit, financial and insurance institutions.
  In particular, the data that we will process includes the following categories: data of an identifying nature, data referring to personal characteristics and social circumstances, academic and professional data, marketing information.
• Companies that provide information on solvency, arrears and, in general, financial or credit risk indicators.
  More precisely, the data that we will process includes the following categories: Identification data, economic, financial and solvency data; and data regarding transactions for goods and services.

• Continue to consent to commercial activities: we will process your data for the commercial activities to which you have consented. We will assume that you have chosen this option if you do not expressly revoke your consent.
• Revoke your consent to carry out commercial activities: we will cancel your data by blocking them.
  As a result of this blocking, the Bank will not have access to your data and will only process it to make it available to the competent Public Authorities, Judges and Courts or the Public Prosecutor's Office, for the purpose of dealing with any possible liabilities related to the processing of the data, in particular for the exercise and defence of claims before the Spanish Data Protection Agency. We will keep your data blocked for the periods provided for in the applicable regulations or, where appropriate, in the contractual relationship with the Bank, and will physically delete your data after these periods have elapsed.

Who will receive your data?

We transmit your personal data to:

1. Santander Group companies and third parties partially owned by Santander Group (for example, insurance companies and financial asset management companies). In accordance with the purpose of the processing stipulated in this document, we will only disclose your data to the aforementioned third parties: i) when doing so is necessary in order to undertake processes to simulate the acquisition of products and/or services from said entities, the actual acquisition of said products and/or services, and/or the maintenance and/or management of the contract in place with the aforementioned entities; ii) when you provide us with consent; iii) when the transfer is based on the legitimate interest of the bank and/or of the third party to which we disclose your data; and, finally, iv) when the transfer is required for compliance with a legal obligation.

You can view the full list of group companies and third parties partially owned by Santander Group to which we disclose your data by requesting it from your branch or via the following link: http://bsan.es/sociedades_banco_santander.

2. Government agencies and private entities, when there is a legal obligation to disclose it to them (non-exhaustive list):

2.1) CIRBE (Servicio Central de Información de Riesgos de Banco de España — Bank of Spain Risk Information Centre): The bank, in accordance with Ley 44/2002 on the reform of the financial system, will disclose your identifying data (whether as a holder or guarantor) and data regarding the risk of the banking transactions you have contracted with us and, if applicable, your status as self-employed.

2.2) Financial ownership files of the Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias (Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences): The bank, in accordance with regulations on the prevention of money laundering and terrorist financing, must disclose the following to the Spanish State Secretariat for the Economy and Business Affairs: (i) identifying data of all holders, representatives and authorised persons and any other persons with dispositive powers in relation to current accounts, securities accounts and term deposits, independently of their business name, as well as amendments that may be made with regard to said accounts (ii) the start date, termination date and other mandatory data with respect to the aforementioned contracts.

2.3) The Spanish Tax Agency, in accordance with tax legislation.

2.4) Official bodies and authorities of other countries, both within and outside of the European Union, as part of the fight against terrorist financing, serious forms of organised crime and money laundering, in the case of funds transfer orders, and to comply with national and international legal and tax-related obligations if you have indicated multiple countries of nationality and/or for tax residence other than Spain.

2.5) Accounts auditors, when the bank must be audited to satisfy a legal obligation.

2.6) Deposit Guarantee Fund. The bank, for purposes of calculating contributions to the Spanish Deposit Guarantee Fund for Credit Institutions, will disclose, to said Fund, individualised information regarding balances corresponding to the deposits made by customers.

3. Courts and state law enforcement and security forces, when doing so is required due to a legal obligation or when it is necessary for the formulation, execution or defence of claims, on the basis of the legitimate interest of the bank to guarantee its right to effective legal protection.

4. Lawyers and legal representatives, when acting as procedural representatives before a court, on the basis of the legitimate interest of the bank to guarantee its right to effective legal protection and legal assistance.

5. Shared credit information systems: the bank may disclose your identifying data and data regarding non-payment to credit information systems with which the bank is linked, including Experian, Asnef and RAI. The procedures and guarantees in effect at any given time, as established and recognised by the legislation in force, will be complied with at all times.

6. Third parties for the prevention of fraud, such as Confirma Sistemas de Información S.L. (Confirma) and mobile phone operators. In the case of any request for the opening or acquisition of a payment product or service and/or a financing or deferred payment operation, the bank will disclose your data to the “Fichero Confirma” (a filing system managed by Confirma) for the prevention of fraud. The controllers of the Fichero Confirma are the participating institutions in the Fichero Confirma. The processor is Confirma Sistemas de Información S.L., with registered address at Avda. de la Industria, 18, Tres Cantos, 28760 Madrid. You can view the list of participating institutions at any time at www.confirmasistemas.es, as well as exercise your data protection rights with respect to CONFIRMA by writing to the address indicated or emailing the Data Protection Officer at dpo@confirmasistemas.es. Your data will be stored in the CONFIRMA filing system for a period of two years. Moreover, with regard to any application for an acquisition of a product or service or when you amend your telephone number, your telephone number may be checked with mobile phone operators in order to detect potential identity theft and to prevent fraud.

7. Sociedad Española de Sistemas de Pago, S.A. (Iberpay): For any request for the opening or acquisition of a payment product or service with the bank via remote means (by telephone, electronically or online), and in order to comply with anti-money laundering legislation, when you opt for us to verify your identity via a third party that is subject to such legislation, we will transmit your data to the “Iberpay platform” for the sole purpose of verifying that you are the holder of the account that you have specified. The controllers as regards the “Iberpay platform” are the institutions participating in the SNCE (Sistema Nacional de Compensación Electrónica — Spanish National Electronic Clearing System), and the processor is Iberpay S.L. Moreover, for any application for an asset product through remote channels wherein you have authorised the bank to value the risk of the transaction by means of the aggregation service, we will transmit your data to the Iberpay platform to verify that you are the holder of the aggregated account.

Furthermore, for purposes of detecting and preventing fraud, the bank may add your data to a shared filing system for the prevention of fraud in banking transactions, which is managed by Iberpay and for which responsibility is shared by the participating institutions, including the bank, for the detection, investigation, monitoring and potential reporting of suspicious and fraudulent transactions involving your current or savings account. You may view the up-to-date list of the participating institutions as regards this filing system via the following link: [https://www.iberpay.es/Secciones/04MasServicios/Paginas/PrevencionFraude.aspx] and request additional information and enquire about the core elements of the co-responsibility agreement between said institutions by emailing privacidad@gruposantander.es

The only data that we will transmit to the filing system will be that relating to the IBAN and the holder of the account involved in the unauthorised or suspected fraudulent transaction. This data may be viewed by the other participating institutions. The legitimate basis for the processing is the legitimate interest of the bank to detect and prevent fraud in banking transactions involving your account, which is also in the interest of account holders potentially affected by fraud committed by a third party.

The data will be stored in the filing system for a maximum period of thirty days in the case of suspicious transactions, and of one year in the case of unauthorised transactions (when the fraud has been confirmed by the victim). The bank will automatically erase data included in the common filing system when they are no longer accurate or do not accurately reflect the situation of the victim.

8. Other credit institutions, state-owned corporate entities, brokers, venture capital firms and guarantee institutions, trusted third-party service providers, payment service providers, third-party aggregators, payment systems and technology service providers, Notaries, Registrars, valuing companies, digital certificate issuers and administrators, in cases where it is necessary for the execution of a contract or provision of a service that you request from us. For example, when you order a transfer to another institution within or outside the European Union, we will disclose, as necessary, your data for the execution of the order, or when risk operations that we grant you are guaranteed and/or subsidised by third-party institutions with which the bank has entered into a cooperation agreement (for example, the European Investment Fund or the ICO [Instituto de Crédito Oficial — Spanish official credit institution]), when you make a request to us for a transaction via a third party (broker) with which the bank works, or when the contract that you entered into with the bank must be notarised by a Notary Public or recorded in a Mercantile Registry, a Registry of Movable Goods or Property Registry, or when, with regard to an application to acquire a service, to obtain the documentation and information needed to consider said application, we are required to do so via a digital certificate issuer. Moreover, when processing a mortgage transaction, we will disclose your data to the administrator to calculate and prepare the provision of funds.

9. Banco Santander service providers: The bank also works in partnership with some third-party service providers who have access to your personal data and who process this data, as the data processor, on behalf of the Bank as part of their services.

To ensure compliance with its data protection obligations, the Bank follows strict criteria when selecting its service providers and it signs data processing agreements with them binding them to the following obligations: applying appropriate technical and organisational measures; processing personal data for the purposes agreed and only in accordance with documented instructions from the bank; and deleting or returning the data to the bank once the services have been provided.

Specifically, the Bank will arrange to have third parties provide services in sectors including but not limited to the following: logistics services, legal advice, administration, provider approval, multidisciplinary professional services companies, technological service provider companies, software service provider companies, physical security companies, instant messaging service providers and call centre service companies.

Will your personal data be transmitted to thirdcountries?

The data processors engaged by the bank may include providers outside of the European Economic Area, with your data being transmitted internationally. As such, the bank has appropriate safeguards of compliance with data protection regulations, including the signing of standard contractual clauses and binding corporate rules. The data subject may request further information regarding the aforementioned appropriate safeguards by using the contact information in the section “What are your rights when you provide us with your data?”.

Furthermore, when you request a transaction in which the destination bank account is in a country outside of the European Economic Area, your personal data will be transferred to the institution with which said account is held. In such circumstances, the legitimate basis for the aforementioned transfer is that it is necessary for the execution of the contract between you and the bank.