Who is the controller of your personal data?

BanSabadell Vida, S.A. de Seguros y Reaseguros

Registered office at c/ Isabel Colbrand 22, 28050 Madrid, Spain.

Tax ID No. A-08371908.

Registered in the Madrid Companies Register, Volume 36993, Book 0, Folio 149, Section 8, Page M-661014, Entry 2 and registered with the Directorate-General of Insurance as an insurer under number C-557.

Data Protection Officer: DPO_BSVida@BSVida.com.

How do we obtain your personal data?

BanSabadell Vida S.A. de Seguros y Reaseguros markets its products through its insurance intermediaries: BanSabadell Mediación, S.L., Banking/Insurance Operator affiliated with Banco Sabadell and Sabadell Consumer Finance, S.A.U., exclusive banking/insurance operator.

At the time of taking out insurance policies, our intermediaries collect personal data directly from data subjects in the capacity of data controllers, through the Banco de Sabadell, S.A. distribution network. 

In the event of applying for a position to be part of the selection process for a vacancy, personal data will be obtained directly from the interested party or, depending on the position, from the collaborators who support BanSabadell Vida through whom the interested party applies for available vacancies.

What categories of personal data do we process?

In order to issue an insurance policy and keep it in force, we need to process your identification data, contact details, bank account details and all the information relating to the insured risk that is needed to correctly assess risk and determine pricing, which may depend on a wide range of personal, family, financial and property circumstances, in accordance with the risk in question.

In the case of life insurance, risk assessment requires the processing of data relating to the health of the insured as collected by means of a health questionnaire. Completion of the questionnaire is legally required of the insured, pursuant to article 10 of the Insurance Contract Act 50/1980, of 8 October. The processing of such specially protected data is covered by article 9 of the General Data Protection Regulation (EU), by express indication of article 9 of the Personal Data Protection and Guarantee of Digital Rights Act 3/2018, as it is necessary for the execution of an insurance contract to which the data subject is a party.

For the personnel selection processes, we need to process your identification and contact data, as well as your academic and professional information, among others, according to the needs of the candidacy to which you apply.

What do we process your personal data for?

The personal data that you provide upon taking out your insurance policy and that is stored during the policy’s term will be processed for the following purposes:

1. To prepare, issue and manage your insurance contract, including assessing and pricing the insured risk at the time of execution and at each annual renewal, loss appraisal, benefit payments and the sending of necessary communications relating to your contract;

2. When applicable, to automate the collection of unpaid bills that have not been paid within the legally established period;

3. To register, process and respond to complaints and claims that you send us, if and when you have any;

4. To carry out the verification needed to detect and prevent money laundering and terrorist financing;

5. To carry out the verification needed to detect and prevent all types of insurance sector fraud; this may occasionally involve obtaining additional expert opinions, conducting private investigations or checking public registers, credit information systems or similar resources;

6. To make direct non-commercial communications by electronic means relating to your assessment of the company. Such communication may include satisfaction surveys to help us improve our services.

7. To carry out an analysis of the quality provided in non-commercial communications, specifically those that occur by telephone, in order to improve the service and treatment of our clients.

8. To carry out, directly or through our insurance intermediaries, commercial and/or advertising actions or communications, via electronic or any other means, in relation to products similar to those taken out. These actions may be for the purpose of informing you of services included in your policy, news, current promotions or other events;

9. To carry out, directly or through our insurance intermediaries, commercial and/or advertising actions or communications via electronic or any other means in relation to products of other insurance companies or pension plan managers within the Banco de Sabadell Group. These actions may be aimed at offering you insurance products or pension plans that are not offered directly by us, but by another of the Group’s companies, as well as informing you of news, current promotions or other events;

10. To include you as a participant in competitions, prize draws or other specific activities for promotional purposes, when you have so requested and always in compliance with the regulations or terms and conditions made public in this regard.

11. To include you in the personnel selection process of the candidacy or candidacies in which you have decided to apply, as well as to carry out the management and resolution of it.

Will we process your personal data for profiling purposes?

Yes. Like all insurers, we need to create statistical-actuarial profiles in order to assess and price the insured risk when the policy is taken out and at each annual renewal, i.e. to determine your insurance premium and update it each year. These profiles are prepared using

(i) information that you provide directly to us,

(ii) the mortality and survival tables prepared by the Directorate-General for Insurance and Pension Funds,

(iii) the risk profile indicators assigned by Banco de Sabadell, S.A. and

(iv) the risk profile indicators assigned by the insurance companies of other branches and/or pension plan managers in which Banco de Sabadell, S.A.* has a controlling interest and with which it has taken out insurance product/s or pension plan/s, if applicable.

We only use data that are useful, relevant and necessary with regards to the aforementioned statistical/actuarial purposes. Furthermore, such data will always be subject to prior pseudonymisation and encryption techniques in order to guarantee data subjects’ privacy.

We also create marketing profiles in order to predict what other products, terms or benefits you may be interested in and/or that we may offer you, and to determine the best time to offer them to you, e.g. when you reach a certain age or when we detect any signs of displeasure or dissatisfaction with our service that we may be able to correct or make up for. These profiles are prepared using

(i) information that you provide directly to us,

(ii) the number of products you have taken out with us and their performance and

(iii) the risk profile indicators assigned by the insurance companies of other branches and/or pension plan managers in which Banco de Sabadell, S.A.* has a controlling interest and with which it has taken out an insurance product or pension plan.

We only use data that are useful, relevant and necessary with regards to the aforementioned commercial purposes. Furthermore, such data will always be subject to prior pseudonymisation techniques in order to guarantee data subjects’ privacy.

At BanSabadell Vida we have robust compliance and transparency policies that guarantee that in no case will practices prohibited by applicable regulations be carried out at all times. The use of Artificial Intelligence tools is subject to strict review and approval processes that incorporate compliance and human intervention as the central axis of any activity.

In order to establish an efficient process for improving the quality of non-commercial communications, Artificial Intelligence tools have been incorporated to speed up the process by transcribing the recordings for later analysis. This analysis is carried out based on specific and limited objective quality criteria and the result is always subsequently analysed by a team of experts from the insurer. Therefore, no automated decisions are made.

Your contractual conditions established with the insurer, such as coverage or premium, will never be affected by this analysis process, which is limited exclusively to the quality of the service.

How long will we store your personal data?

When you request an insurance policy simulation or quote, we will store your personal data for a maximum period of three (3) months to facilitate and speed up the process of formalising the insurance when you so decide, without prejudice to the price being updated at the time the product is actually taken out. In the case of insurance combined with a bank loan, we will extend this period until the bank grants you the loan. If you ultimately decide not to take out the insurance, we will delete your personal data within ten (10) days.

When you take out insurance or modify the contractual conditions by any means, we will store your personal data for the duration of your contractual relationship with us, and for a period of ten (10) years following termination of the same.

When you initiate or receive communication via telephone or other means (instant messaging), this communication will generally be recorded for the purpose of monitoring the quality of service and the recordings will be retained for a period of two (2) years.

When you respond to our evaluation surveys about your level of satisfaction with our services, we will store information about your responses for seven (7) years.

When you submit an application and we receive your CV, we will keep your data for the time strictly necessary for its management. Only if you are selected in the process, this data will be kept for a maximum period of two (2) years.

In the event that transcription analysis is carried out to improve the quality of the service, the transcription with the corresponding analysis will be kept for one (1) year.

Throughout the storage period, we will implement appropriate security measures to prevent any risk of accidental destruction, loss, accidental modification or unauthorised access to your personal data. In compliance with article 32 of the Personal Data Protection Act 3/2018, near the end of the pre-determined storage period your personal data will be blocked and can only be used to answer to any potential liability in relation to the processing thereof.

What is the lawful basis for carrying out the processing?

The lawful bases for the aforementioned processing are as follows:

1. In order to prepare, issue and manage your insurance contract, the applicable lawful bases are the execution of the insurance contract to which you are a party or the application of the pre-contractual measures requested for this purpose, under the terms and within the limits set forth by the Insurance Contracts Act 50/1980 and the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 [article 6.1.b) of the General Data Protection Regulation (EU)];

2. To automate the collection of unpaid bills, the applicable legal basis is the express, free, informed, unequivocal and specific consent that you give on the easy payment platform established for this purpose [art. 6.1 a) of the General Data Protection Regulation (EU).

3. In order to register, process and respond to the complaints and claims that you send us, the applicable lawful basis is compliance with the legal obligation applicable to us, as stated in article 97 of the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 [article 6.1.c) of the General Data Protection Regulation (EU)];

4. In order to carry out the verification needed to detect and prevent money laundering and terrorist financing, the applicable lawful basis is compliance with legal obligations applicable to us, derived from the Prevention of Money Laundering and Terrorist Financing Act 10/2010 [article 6.1.c) of the General Data Protection Regulation (EU)];

5. In order to carry out the verification needed to detect and prevent insurance sector fraud, the applicable lawful basis is our legitimate interest in complying with the provisions of the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015, and to consequently enact measures to prevent, impede, identify, detect, report and remedy fraudulent conduct, which consists of the use of deception or concealment of information from the insurer in order to obtain an insurance policy that would not otherwise be issued or the payment of a claim that does not comply with [article 6.1.f) of the General Data Protection Regulation (EU)];

6. In order to conduct customer satisfaction surveys and a customer evaluation of the company, the lawful basis is our legitimate interest in building customer loyalty and improving our services [article 6.1.f) of the General Data Protection Regulation (EU)];

7. In order to carry out the analysis of the quality provided in non-commercial telephone communications, through the use of Artificial Intelligence tools, the basis of lawfulness will be the informed and express consent that you give in the same conversation [article 6.1 a) of the General Data Protection Regulation (EU)].

8. To carry out commercial and/or advertising actions or communications relating to products similar to those taken out, including profiling for this purpose. The applicable lawful basis for these activities is our legitimate interest in building customer loyalty, ensuring that customers are satisfied with our services, and possibly offering them other products similar to those taken out that may be of interest to them [article 6.1.f) of the General Data Protection Regulation (EU)];

9. To carry out commercial and/or advertising actions or communications relating to products of other insurance companies or pension plan managers of the Banco de Sabadell Group, including the preparation of profiles for this purpose, the applicable lawful basis is the express, free, informed, unequivocal and specific consent that you give at the time you decide to participate in the data cycle [article 6.1.a) of the General Data Protection Regulation (EU)];

10. To include you as a participant in contests, sweepstakes or other specific activities for promotional purposes, the applicable lawful basis is the express, free, informed, unambiguous and specific consent that you give when you decide to participate [article 6.1.a) of the General Data Protection Regulation (EU)].

11. To manage your candidacy for the Company's selection processes, the applicable legal basis is the execution of the pre-contractual measures necessary to achieve a labor contract [article 6.1.b) of the General Data Protection Regulation (EU) ].

In relation to profiling for statistical/actuarial purposes, the applicable lawful basis is the execution of the insurance contract to which you are a party or the application of the pre-contractual measures requested for these purposes, under the terms and within the limits stated in the Insurance Contracts Act 50/1980 and the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 [article 6.1.b) of the General Data Protection Regulation (EU)]. As an insurer, we have a duty to ensure that the premium rates we charge are sufficient, based on reasonable actuarial assumptions, to guarantee the solvency of our entity, and in particular to draw up adequate technical provisions, pursuant to article 94 of the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015.

In relation to profiling for marketing purposes, the applicable lawful basis is our legitimate interest in keeping our customers loyal, ensuring that customers are satisfied with our services, and possibly offering them other products similar to those they have purchased and that may be of interest to them [article 6.1.f) of the General Data Protection Regulation (EU)]. We will only enrich these profiles with external sources, from the insurance companies in which Banco de Sabadell, S.A.* has a controlling interest and with which you have taken out insurance product/s, when (a) you have given us your express, free, informed, unequivocal and specific consent to do so, which you may revoke at any time [article 6.1.a) of the General Data Protection Regulation (EU)], or when (b) you have expressly requested a service from us that makes it necessary [article 6.1.b) of the General Data Protection Regulation (EU)].

Will we disclose your personal data to third parties?

The aforementioned processing operations require the disclosure of your personal data to:

· Competent public authorities and bodies, in compliance with the legal supervisory obligations provided for in the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 and other legal obligations relating to the duty to cooperate with the justice system and the State Administration, including the Directorate-General of Insurance and Pension Funds, SEPBLAC, the Spanish Tax Agency (Agencia Tributaria), the State Security Forces and Agencies as well as Courts and Tribunals.

· Other group or affiliated companies, in various circumstances:

o We may need to share information about your insurance policy and claims experience with other entities in our corporate group in order to comply with the legal supervisory obligations set out in the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015.

o We will share your risk profile indicator with the insurance companies of other branches and/or pension plan managers in which Banco de Sabadell, S.A.* has a controlling interest and with which you have also taken out an insurance product or pension plan, if applicable. They will use the profile to determine your insurance premium and update it each year with a greater degree of precision and better guarantees, based on their own legitimate interests and those of the other insurance companies of other branches and pension plan managers of Banco de Sabadell, S.A.* This entails complying with article 94 of the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 and ensuring that the premium rates we charge are sufficient, according to reasonable actuarial assumptions, to guarantee the solvency of our entity, and in particular to draw up suitable technical provisions.

o We may also share your risk profile indicator with the entities mentioned in the previous paragraph in order to consider the possibility of offering you additional conditions or benefits at the appropriate time to increase your level of satisfaction, provided that you have given us valid consent to do so or requested a service from us that makes it necessary.

· Entities in the insurance and reinsurance sector for the formalisation of their insurance contract (reinsurance and coinsurance entities), when so required by the policy taken out, in the terms and under the legal authorisation set out in the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015.

Our DATA CONTROLLERS (agents, intermediaries and service providers) will also have access to your personal data. In the implementation of our corporate governance policies, we only work with data controllers with a proven record of compliance with prevailing data protection laws. This ensures that your personal data will never be processed from a country that does not offer a level of protection equivalent to European levels, either through contractual measures with the data controller, through the existence and verification of binding corporate rules or by means of other equivalent safeguards. We do not currently carry out international transfers of personal data outside the European Union.

Do we carry out international transfers?

We use the services of Medallia Inc., whose servers are located in the United States, to conduct satisfaction surveys and company evaluations.

As a result, the data necessary to conduct the surveys may be sent, stored and accessed from outside the European Economic Area (“EEA”). These transfers are carried out on the basis of the standard data protection clauses adopted by the European Data Protection Commission, the content of which ensures the confidentiality of the data transferred and legal compliance with data protection provisions [art. 46.2 d) of the European Data Protection Regulation (EU)].

What are your rights?

Data subjects may exercise the following rights at any time:

· Right of access. If you wish to ask us to confirm whether or not we are processing your personal data, and if so to obtain a copy of the data and full information about its processing.

· Right of rectification. If you wish to request the correction of errors, the modification of inaccurate or incomplete data, and to guarantee the accuracy of the information that is subject to processing.

· Right of erasure. If you wish to request the cancellation or deletion of your data because their processing is unlawful or because the purpose for which they were processed or collected has ceased to exist.

· The right to object. If you wish to object to the processing of your personal data for marketing purposes, including profiling for such purposes. In the case of processing operations based on a legitimate interest, data subjects also have the right to object to processing on grounds relating to a particular situation, provided that there are no compelling legitimate grounds for the processing or that the data are not necessary for the establishment, exercise or defence of claims.

· The right to restrict processing. If you wish to request the suspension of processing if it is unlawful or if the accuracy of the data is contested.

· The right to portability. If you wish to request a copy of your data in a structured, commonly used and machine-readable format for direct transmission to another insurer. This right is exclusive to the policyholder.

· The right to safeguards in automated individual decision-making. This right includes requiring human intervention, expressing your point of view and/or challenging decisions based solely on automated processing of your personal data, including profiling.

To exercise any of these rights, please contact our Data Protection Unit by emailing ProteccionDatos_BSVida@BSVida.com. In order to process your petition without delay, it is recommended that you clearly state your identity (first name, surname/s and national identity card number) and the right/s you wish to exercise. The exercise of these rights is free of charge, except in the case of manifestly unfounded or excessive petitions for access, in which case we are legally entitled to charge a reasonable fee to cover the cost of processing your petition.

In addition, and in relation to the right of opposition, we inform you that any citizen may use the existing advertising exclusion systems to express their refusal or opposition to receiving commercial communications from any entity to which they have not given their express consent. For more information, please visit www.listarobinson.es.

Should you have any doubts or concerns relating to respect for your rights, please contact us at any time and request the mediation of our Data Protection Officer, who has been approved by the Spanish Data Protection Agency for this duty, by emailing DPO_BSVida@BSVida.com. In particular, you can ask our Data Protection Officer for more information about the weighting of the legitimate interest on which we have based a specific processing operation and/or the impact assessment we have previously carried out, where such processing gives rise to reasonable doubts in this respect.

We inform you that you may ultimately petition the Spanish Data Protection Agency to protect your rights or submit a claim on its website www.agpd.es, or at its head office located at c/ Jorge Juan, 6 – 28001 Madrid (Spain).