Unicaja Digital Channel Privacy Policy

 

Data controller

The data controller of your data is Unicaja Banco, S.A. (hereinafter "Unicaja"), whose registered office is at Avenida de Andalucía, 10-12, Malaga. If you have any queries concerning the protection of your data, you may contact the Data Protection Officer send an e-mail to oficina.proteccion.datos@unicaja.es.

 

Purpose and grounds for personal data processing

Pursuant to the personal data protection legislation that is in force, Unicaja hereby informs the user or their legal representative that their personal data may be processed on Unicaja's website, mobile app and other digital channels for the purposes set forth herein. 

Certain functionalities may only be available in said channels' public or private areas. Hence, the associated processing shall only be performed where the user uses or accesses the functionalities in question.

1. To manage requests made by the customer. Unicaja shall perform the data processing needed to deal with queries, requests for information, procedures or processes carried out by the user or their representative on the website, the mobile app or any other digital channel enabled for such purposes. To this end, Unicaja may process identification and contact data, as well as any other information that the user provides related to their request or which may be necessary to attend them properly.
   
   Where the nature of the request requires it, Unicaja may disclose the user's data to other entities belonging to Grupo Unicaja or to collaborating third parties that take part in handling said request like, for instance, where it refers to products or services marketed or provided by such entities.
   
   This processing shall be performed in order to respond to the request made by the user and shall be based on the performance of a contract or the implementation of pre-contractual measures requested by the user. In any cases where these legal grounds do not apply, processing shall be performed on the grounds of Unicaja's legitimate interest or the user's consent where it is required by the legislation in force.
   
   
2. To receive and analyse surveys submitted by users. Unicaja may make survey forms available to users on the website, mobile app or other digital channels in order to obtain their opinion about said channels' quality, functionality and user experience. The completion of such surveys is voluntary.
   
   Unicaja shall process the personal data provided by the user, along with the information and assessments included in the survey in order to analyse the results obtained, assess the quality of its digital channels and implement any improvements, measures or actions it deems appropriate.
   This processing shall be performed on the grounds of the user's consent, which is expressed by completing and voluntarily sending the relevant survey. Unicaja shall only process the personal data, if any, that is requested in the survey itself.
   
   
3. Unicaja may send commercial communications. Unicaja may send commercial communications by post, e-mail, SMS, push notifications, or other media regarding products and services provided by Unicaja, Grupo Unicaja companies or third-party collaborators. These include, but are not limited to, banking, investment, real estate, and insurance products, as well as products related to cultural, sports, academic, or training activities and events.
   
   This processing shall be performed on the grounds of the consent previously granted by the user, which shall be requested through boxes specifically enabled for such purpose in the relevant forms. If the data subject does not grant such consent, Unicaja shall not send any commercial communications for this purpose.
   
   This processing shall solely apply to data subjects who are not Unicaja customers. Data processing related to sending the institution's customers commercial communications shall be governed by the personal data protection information provided within the framework of their contractual relationship with Unicaja.
   
   
4. Newsletter: Unicaja shall process the personal data provided by the user in order to periodically send them the institution's newsletter, which may include information on products, services, initiatives, activities, news and other content of interest having to do with Unicaja.
   
   This processing shall be performed on the grounds of the consent previously granted by the user. Consent may be withdrawn from time to time through the link enabled for this purpose in each of the communications sent or through the channels that Unicaja makes available to manage your communication preferences.
   
   
5. Use and operation of digital channels. Unicaja shall perform the data processing needed to handle the signing up and registration of users, allow access to and use of the website and mobile app's private area and ensure proper operation of the digital services and functionalities made available to users.
   
   For such purpose, Unicaja may process both the user's identification and access data as well as certain kinds of technical data generated when digital channels are used, such as the IP address, technical identifiers, type of device used, operating system, the browser used, application version, activity logs and information on errors or technical incidents.
   
   This kind of processing shall be performed in order to identify and authenticate users, manage credentials and accesses, keep the session active, deal with incidents, prevent unauthorised access, ensure the security of digital channels, detect and correct errors, optimise the services' performance and, in general, allow any services requested by the user to be properly provided.
   
   This processing is necessary to fulfil the contractual relationship with the user or to implement pre-contractual measures requested by the user and is additionally grounded by Unicaja's legitimate interest in ensuring its digital channels' security, availability and proper operation.
   
   
6. Security, fraud prevention and control over the use of digital channels. Unicaja shall perform surveillance and control actions on the website or mobile app's use in order to prevent and detect any kind of fraudulent use. This processing is necessary to fulfil the legal obligations set forth by legislation on electronic communications and network and information system security to avoid, prevent and/or detect any unauthorised access, alteration or loss of any information on third parties other than the user which may lead to civil, criminal and/or administrative liabilities for Unicaja.
   
   
7. Profile image in digital channels' private area. The user may voluntarily add a personal image to their profile in the website or mobile app's private area. The sole purpose of adding such an image is to facilitate the user profile's customisation and visual identification within Unicaja's digital channels.
   
   Adding an image is completely voluntary and does not constitute a requirement for access to or use of the services Unicaja offers. This processing is based on the user's consent, which is expressed by the voluntary decision of adding their image to the profile. The user may delete or replace the image from time to time by using the functionalities enabled for such purpose, which shall no longer be displayed on their profile from that moment on.
   
   
8. Service notifications and alerts. Unicaja may send the user notifications, alerts and communications related to the use of the digital services the user has signed up for or uses, including operational, security, technical incident, system maintenance, relevant update, and transaction confirmation notifications or any other kind of communication needed to provide the services properly. These communications may be sent to the contact details provided by the user, as well as through the mobile app's own functionalities, including push notifications where they are enabled. This processing is necessary to fulfil the contractual relationship with the user and to ensure the services Unicaja offers are properly provided and secure.
   
   
9. Use of geolocation data. Information about your location is solely processed to help you find nearby ATMs or branches only if you have granted permission to your device for such purpose. Your device (i.e. your mobile phone or computer) can determine your location in different ways, such as through GPS, nearby Wi-Fi networks or your IP address. This processing is performed in real time and solely for the aforementioned purpose. When you grant permission to the device, the location allows a map provided by the Google Maps service to be displayed to you on our website or app. Unicaja does not store, record or reuse this information about your location in our systems.
   
   
10.  Cookies and similar technologies. Unicaja uses cookies and other similar technologies on the website and mobile app to enable their proper operation, improve the browsing and user experience, analyse the use of digital channels and, where appropriate, carry out customisation or advertising actions in accordance with the preferences expressed by the user. Detailed information on the technologies used, their purposes, retention periods and how to manage or withdraw consent is available in the relevant Cookie Policy, which can be accessed via this link.
    
    
11. Data processing as a client: When the user logs in to the private Digital Banking area or uses any digital services linked to their status as a customer, Unicaja shall process their personal data in accordance with the provisions set forth in the personal data protection information (basic and detailed) provided to the institution's customers, which describes the processing associated with the subscription and management of financial products and services. The user may consult this information at any Unicaja branch, via this link or, in the case of Digital Banking customers, by accessing the Personal data processing section available in My Area.
    
    

Related questions and answers

For how long will we retain your personal data?

The personal data to which access is gained shall be processed for the time needed to respond to the user's request, manage the use and operation of digital channels, analyse the surveys received, send the requested newsletter, manage service notifications and alerts or fulfil the other purposes set out in this policy. As regards any kind of processing based on the user's consent, the data shall be processed for so long as the user does not withdraw said consent.

In the case of registered users or customers who log in to the private Digital Banking area, personal data shall be kept during the term of their contractual relationship with Unicaja and, once it has ended, during the legally required retention and statute of limitations periods.

In this regard, Unicaja shall keep the user's personal data —subject to any restrictions on access which apply according to the legislation which is in force— for the duration of the statute of limitations for any legal actions which may arise from the relationship with the user, as well as for the time needed to fulfil any requirements made by competent authorities or to prove fulfilment of any legal obligations that may apply.

 

With whom will we share your personal data?

Unicaja only shares users information with:

• General Administration of the State public organisations and institutions as well as those of Autonomous and Local Administration, including the judicial bodies to whom it is legally required to provide this information.
• Entities belonging to Grupo Unicaja or collaborating third parties, where necessary to deal with a request, query or procedure made by the user related to products or services marketed or provided by said entities.
• Service providers acting on behalf of Unicaja within the framework of the provision of services related to the operation of the website, the mobile app and other digital channels, as well as to the institution's activity. The data may be accessed by, among others, providers of technology services, IT development and maintenance, platform hosting and support, consulting services, legal advice, administrative services, customer service and other ancillary activities required for the provision of services.

Unicaja chooses its providers based on data protection compliance criteria and enters into the corresponding contracts with them to ensure that data is processed in accordance with the legislation which applies.

Furthermore, some of these providers may be located outside the European Economic Area, which might involve international data transfers. In such cases, transfers shall only be carried out where there is an adequacy decision by the European Commission or where the appropriate safeguards provided for in the legislation which applies have been implemented, such as the inclusion of standard contractual clauses or other legally recognised mechanisms. Unicaja shall, in any event, take the necessary measures to ensure an adequate level of personal data protection is achieved.

 

Which companies are part of Grupo Unicaja?

You can query the companies which form part of Grupo Unicaja on the Unicaja corporate website through this link.

 

To what sectors of activity do Unicaja's third-party collaborators belong?

Unicaja's third-party collaborators belong, among others, to the sectors of agriculture, industry, construction and renovations, banking, insurance, investment services, energy and supplies, telecommunications, private security, professional services, travel and tourism agencies, interior design and decoration, and the retail trade. The list of the aforementioned sectors is solely for information purposes and may be extended or amended depending on the collaboration agreements Unicaja may reach from time to time.

 

How have we obtained your personal data?

The personal data regarding the user that Unicaja processes through the website, the mobile app and other digital channels are the data which the user provides when submitting a request for information, filling in forms, subscribing to the newsletter, answering surveys, using the available functionalities or communicating with Unicaja through said channels.

For registered users or customers accessing the private Digital Banking area, Unicaja will also process the personal data linked to the contractual relationship required to provide the services available across these digital channels.

Unicaja may likewise process certain kinds of technical data generated during the use of such digital channels where it is necessary to ensure their proper operation, security and maintenance.

 

How does Unicaja obtain user consent?

Where the legislation which applies requires the user's consent to the processing of their personal data, Unicaja shall obtain such consent through the mechanisms specifically enabled for that purpose on the website, the mobile app or the other digital channels made available to the user. Such consent may be obtained, among other means, by checking the appropriate boxes, configuring preferences, voluntarily enabling certain functionalities or performing actions that unequivocally demonstrate the user's intent.

 

How can the user withdraw their consent?The user may from time to time withdraw the consent they have granted for any data processing based on such grounds without it affecting the lawfulness of the processing carried out prior to the withdrawal of consent. The user may likewise change their privacy and consent management preferences from time to time where the digital channels enabled by Unicaja allow for such a functionality.

Consent may be withdrawn through the mechanisms made available to the user for each specific kind of processing, such as via the unsubscribe link included in electronic communications sent by Unicaja, by sending an e-mail to

 bajaspublicidad@unicaja.es or through any other channel provided by the institution for such purpose.

 

What are the users' personal data protection rights?

If they so wish, the user may exercise the rights of access, to rectification and to the elimination of data, as well as to request restriction of the processing of their personal data, to object to processing and to request their data's portability by writing a letter to our Customer Service Department at Avenida de Andalucía 10 and 12, Malaga (Post Code: 29007) or by sending an e-mail to atención.al.cliente@unicaja.es.

 

Before whom may the user file complaints?

Any user who deems that their data protection rights have been infringed or has any claims concerning their personal information may send a letter by post to Unicaja's Personal Data Protection Office for it to resolve their claim at the address Avenida de Andalucía 10 and 12, Malaga (Post Code: 29007) or send an e-mail to oficina.proteccion.datos@unicaja.es. In any event, users may also contact the Spanish Data Protection Agency (Agencia Española de Protección de Datos), the Spanish supervisory authority, at http://www.aepd.es.