Zero interest and charges

To manage your relationship with us, at Wivai Select Place, S.A.U. (hereinafter “Wivai”) we will process your personal data for various reasons, always in accordance with the provisions of current legislation, respecting your rights and with complete transparency.

The processing of your data may vary depending on the degree of identification established in the contractual relationships that you have with us, and therefore:

If you have registered in Wivai using means of identification provided by CaixaBank, S.A. (“CaixaBank”), if you finance the purchase of a Wivai product through a credit transaction with CaixaBank or contract a renting product, we will consider you a fully identified customer (“Identified Wivai Customer”) and we will apply certain types of processing, explained in this Privacy Policy.

In section 6 (What types of processing we carry out using your data) we will explain the types of processing that apply to an Identified Wivai Customer.
If you register in Wivai without using the aforementioned means, as occurs in the user registration and the purchase of products and services on the Wivai website, we will consider you an unidentified user (“Wivai User Customer”), and we will apply certain types of processing, explained in this Privacy Policy.

In section 6 (What types of processing we carry out using your data) we will explain the types of processing that apply to an Identified Wivai Customer.

In this Privacy Policy, which you can access at any time at www.wivai.com/politicaprivacidad, you can see complete details on how we will use your data in the relationships we establish with you.

The main regulations governing the processing of your personal data are as follows:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the (en adelante el RGPD)
Organic Law 3/2018 of 5th December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter the LOPD)

2. Who processes your data

Data controller: The data controller for your personal data for contractual and business relations with us ("Contractual Relations") is Wivai (Wivai Select Place, S.A.U.), with tax ID number (NIF) A-58481730 and registered office at Gran Via de les Corts Catalanes, 159-163, Barcelona.

Joint data controllers: Furthermore, for certain types of processing that we will explain in detail in this policy, Wivai will jointly process your data with other companies, deciding jointly on the objectives (“why your data is used”) and the methods used (“how your data is used”), thereby acting as joint data controllers.

The purposes for which Wivai will jointly process your data with other companies is described in detail in section 6 “What types of processing we carry out using your data”.

You will also find the list of the companies that process your data, as well as the essential aspects of the joint data controller agreements at: www.caixabank.es/empresasgrupo.

3. Data Protection Officer

Wivai and CaixaBank Group companies have appointed a Data Protection Officer, who will deal with any matters related to the processing of your personal data and the exercising of your rights.

You can contact the Data Protection Officer to send your suggestions, queries or claims by going to: www.caixabank.com/delegadoprotecciondedatos.

4. Exercising rights and submitting complaints to the Spanish Data Protection Agency (AEPD)

You can exercise your rights of access, rectification, objection to processing, erasure, restriction, the portability of your personal data, to withdraw your consent and not be subject to automated decision-making, in accordance with the law

You can exercise these rights through the following channels:

at our CaixaBank branches open to the public
by using the options provided in the customer area at www.wivai.com;
by email to: www.wivai.com/ejerciciodederechos; and
by post to: Apartado de Correos n.º 209 de Valencia, 46080.

Additionally, if you have any complaints related to the processing of your data, you can send them to the Spanish Data Protection Agency(www.agpd.es).

5. Data processed

The list of the data used by the various types of processing in this Privacy Policy is specifically explained in each of the types of processing included in section 6.

6. What types of processing we carry out using your data

The types of processing that we will carry out using your data are varied, and are for various purposes and legal reasons.

Processing based on your consent.
Processing required for the performance of contractual relationships
Processing required to comply with regulatory obligations
Processing based on the legitimate interest of Wivai

Regarding the above types of processing, we will carry some out solely with regard to Identified Wivai Customers and others solely with regard to Wivai User Customers. We will carry out the other types of processing with regard to all Wivai customers (Identified Wivai Customers and Wivai User Customers).

In the information included about each type of processing shown in this clause, we will specifically indicate whether the processing we carry out is with regard to Identified Wivai Customers, with regard to Wivai User Customers or with regard to all Wivai customers.

In addition to the listed types of processing, we may carry out specific types of processing not included in this policy, arising from your requests for products or services. The information about these types of processing will be provided to you when fulfilling the specific request.

TYPES OF PROCESSING THAT WE WILL CARRY OUT WITH REGARD TO IDENTIFIED WIVAI CUSTOMERS

6.1 PROCESSING BASED ON YOUR CONSENT

We will only carry out this processing with regard to Identified Wivai Customers and the legal basis for this processing is your consent, as laid out in Article 6.1.a) of the General Data Protection Regulation (GDPR).

We may have requested this consent through various channels, through digital channels or mobile applications, at Caixabank or at any of the CaixaBank Group companies that are joint data controllers for a specific processing, or through any Bankia S.A. channel before its merger with CaixaBank.

If you have given your consent for the processing of your data to Bankia for commercial purposes prior to its merger with CaixaBank, the processing types A, B and C listed below will be carried out in accordance with the preferences that you indicated to Bankia at the time.

Specifically, the processing described in sections A and B below will only be carried out by CaixaBank Group companies as joint data controllers if you have consented to the disclosure of data between Bankia Group companies (now CaixaBank).

If, for any reason, we have never asked you for your consent, this processing will not apply to you..

You can view the consent you have given or denied and change your decision at any time free of charge on the Wivai website (www.wivai.com) in your private area, at CaixaBank branches and at the offices of any of the other companies that are the joint data controllers for the specific processing.

The types of processing based on your consent are listed below from (A) to (C). For each item, we will indicate: a description of the purpose (Purpose), the details of the processed data (Type of data or processed data), if applicable, information on the use of profiling (Use of profiling), other relevant processing information (Other relevant information) and whether or not the processing is carried out jointly with other CaixaBank Group companies (Joint data controllers/Data controller).

A. Customisation of the product and service offering based on the analysis of your data

Purpose: If we have your consent, we will use the data indicated below to create a commercial profile for you, which will allow us to define your preferences or needs and offer you products and services marketed by companies acting as joint data controllers that we believe may interest you according to those preferences and needs.

By processing your data, we can make customised offers that we believe may be of more interest to you than generic offers.

Furthermore, should you authorise us to send you messages about our range of products and services by channels (Section 6.1.B), we will offer you the products and services marketed by the jointly-responsible companies we set up that might be of interest to you on the basis of the preferences and needs deducted using any other channel you might authorise.

Data processed: We will not process data that contains information that reveals your ethnicity or race, your political opinions, religious or philosophical convictions, union membership, the processing of genetic data, biometric data intended to uniquely identify you, health data or data relating to your sex life or orientation.

The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, nationality and date of birth, language choice and identification document.
- Details of your professional or work activity and socio-economic data: details related to your job, income or remuneration, household, level of education, assets and tax and fiscal data.
- Contract details: contracted or requested products and services (own or third-party), status as contract holder, authorised party or representative for a contracted product or service, categorisation according to regulations regarding securities markets and financial instruments (MiFID category), information on investments made and their performance and information and transactions related to your financing transactions.
- Basic financial data: current and historical balances for products and services and payment history of contracted products and services (own or third-party).
- Third-party data from statements and receipts from current accounts and payment accounts: information on entries and transactions that third-party issuers make to your accounts, including transaction type, issuer, amount and the description as it appears on receipts and statements for debit, credit and prepaid card transactions.
- Details of whether or not you are a CaixaBank shareholder: if you have CaixaBank shares or not.
- Data on communications maintained with you: data obtained in chats, communication walls, video conferences, telephone calls or any other equivalent means of communication.
- Your browsing data: if you have accepted the use of cookies and similar technologies on your browsing devices, data obtained from your browsing of our websites or applications and your browsing history on these websites: browsing history (pages visited and clicks on content), device ID, advertising ID, IP address.
- Geographical details: when authorised by you in the settings of the apps, details of the location of the businesses where you make card transactions and the geolocation data of your mobile device provided by the installation and/or use of our mobile applications.
- Data obtained in the performance of other processing as provided for in this policy:
- Risk assessment or score data: in transactions based on loans or payment in instalments, we will estimate your ability to pay or otherwise, or risk limits, by applying statistical mathematical models to your data (processing described in section 6.3.B
- Data obtained from the use of statistical models: we use the results of the application of mathematical models to clients' data to determine their consumer habits and purchase aspirations and/or propensities.
- Demographic and socio-economic data: statistical data not related to specific people but geographical areas, age sectors or professional activity sectors, which we will use to put them into context with customer information.
- Data about properties and vehicles associated: these are data obtained from the land registry and basic data on vehicles obtained from the Spanish Traffic Directorate, which we will use to complement the information about your properties and vehicles.
- Details of directors, functional officers and corporate relationships: these are data taken from the INFORMA databases that we will use to complement the information about your activities.
- Details of agricultural subsidies and insurance: these are data published by the Spanish Agricultural Guarantee Fund (FEGA) and the State Agricultural Insurance Institution (ENESA)
- Data from third-party companies to which you have given your consent to share data with us: your data processed by other companies with which we have agreements, and which you have authorised to share your information with us.
- Your browsing data: if you have accepted the use of cookies and similar technologies on your browsing devices, data obtained from your browsing of third-party websites or applications and your browsing history on these websites: browsing history (pages visited and clicks on content), device ID, advertising ID, IP address.
- Social media or internet details: social media or internet data that you authorise us to view.
Use of profiling: For this processing, we will create a business profile that we will use exclusively to customise the products and services we offer you:
- Purpose of the profile: The purpose of the profile is to identify the products and services we think may interest you, based on the information we have about you, to offer you specific rather than generic commercial offers.
- Consequences: If you authorise the processing, we will use commercial profiles to decide which products or services to offer you. If you do not give your authorisation, we will not use your information to customise our commercial offer.
  
  We do not use this profiling, under any circumstances, to refuse any product or service, or to set credit limits. Refusal to accept this processing will not prevent, limit or condition your access to our full catalogue of products and services, which is always available to you.
  
  If you apply for any product or service, your application will be assessed in accordance with our regular procedures, the acceptance or non-acceptance of the analysis of your data for the purpose of customising the product and service offering will not affect this assessment.
  
  If you do not agree to this processing it will not prevent us contacting you for operational management of the products and services you have contracted.
- Logic: The profile of a customer is calculated based on the data indicated in the Processed Data section.
  
  Mathematical formulas obtained from past behaviour observed in clients of similar characteristics are applied to these data to infer the customer's future behaviour. These mathematical formulae allow us to determine the importance of all the data processed in the final result of the applicant's profile.
  
  This final result is the probability that the customer will be interested in a product or service.
Other relevant information: The following section includes other relevant data processing information:
- Pre-check of your payment capacity: When the offers we wish to propose to you consist of products or services that involve payment in instalments or financing, we will first check your payment capacity.
  
  We will carry out this check by means of the processing outlined in section 6.3.B, with the aim of offering you a credit limit and repayment term suited to our knowledge of your financial situation, in accordance with the principle of responsibility regarding the offer of financing products required by the Bank of Spain, under regulations on the oversight and solvency of credit institutions and responsible lending.
  
  Not accepting this processing does not prevent, limit or condition your access to our catalogue of financing products and services. If you request them, we will evaluate them with you in accordance with our standard procedures.
- Duration of data processing: We will only process your data if you have given us your consent, which will remain in force until you withdraw it. If you cancel all your products or services but forget to revoke your consent, we will do so automatically.
- Preparation of management reports and mathematical models: The processed data and data resulting from this processing will also be used for the preparation of management reports and mathematical models, under the terms established in the processing as defined in heading 6.5.B of this policy.
Joint data controllers: The following CaixaBank Group companies will process your data jointly.
- CaixaBank, S.A.
- CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
- Nuevo Micro Bank, S.A.U.
- Wivai Select Place, S.A.U,
- ImaginersGen, S.A.
- VidaCaixa, S.A.U. de Seguros y Reaseguros
You will find the essential elements of the joint data controller agreements at: www.caixabank.es/empresasgrupo.

B. Communication of the product and service offering through channels

Purpose: If we have your consent, we will place at your disposal our range of products and services through the channels you authorise: mobile apps, digital environments and electronic channels, letter or telephone.

The data we will use for communication through the channels you authorise will vary depending on whether or not the customisation of the product and service offering based on the analysis of your data:
- If we do not have your consent to personalise our commercial range (processing A above), we will use only your identifying and contact data to send you generic offers.
- If you have given us your consent to personalise our commercial range (processing A above), we will also use the information in your commercial profile as set forth in processing 6.1.A, to send you personalised offers.
Data processed: We will not process data that contains information that reveals your ethnicity or race, your political opinions, religious or philosophical convictions, union membership, the processing of genetic data, biometric data intended to uniquely identify you, health data or data relating to your sex life or orientation.

The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, language choice.
- Data obtained from other data processing provided for in this policy:
  - Data from the customisation of the product and service offering based on the analysis of your data: If you have given us your consent to customise our commercial offering (processing A above), we will also use the information from your commercial profile as detailed in section 6.1. A of the Privacy Policy, to send you customised offers.
Other relevant information: The following section includes other relevant data processing information:
- Duration of data processing: We will only process your data if you have given us your consent, which will remain in force until you withdraw it. If you cancel all your products or services but forget to revoke your consent, we will do so automatically.
Joint data controllers: The following CaixaBank Group companies will process your data jointly.
- CaixaBank, S.A.
- CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
- Nuevo Micro Bank, S.A.U.
- Wivai Select Place, S.A.U,
- ImaginersGen, S.A.
- VidaCaixa, S.A.U. de Seguros y Reaseguros
You will find the essential elements of the joint data controller agreements at: www.caixabank.es/empresasgrupo

C. Transfer of data to other companies in order to send commercial offers

Purpose: If we have your consent, we will transfer the data indicated below to companies with which we have agreements so they can offer you their products and services.

If you do not consent to this data processing, we will not disclose your data. However, if you do give your consent, the data transferred to other companies will vary depending on whether you have authorised us to customise our product offerings by analysing your data:
- If we do not have your consent to customise our commercial offer (processing A above), we will only provide these companies with your identification and contact details.
- If you have given us your consent to personalise our commercial offer (processing A above), we will also inform these companies of your commercial profile, including information on your preferences and needs, as well as inferred information about your probability of payment or non-payment, or risk limits.
These third-party companies to which we may transfer your data undertake the following activities:
- banking
- investment services
- insurance and reinsurance
- venture capital
- real estate
- highways
- sale and distribution of goods and services
- consultancy services
- leisure and
- charity-social actions
Data processed: We will not process data that contains information that reveals your ethnicity or race, your political opinions, religious or philosophical convictions, union membership, the processing of genetic data, biometric data intended to uniquely identify you, health data or data relating to your sex life or orientation.

The data we will process for this purpose are:
- Identification and contact details: full name, gender, postal, telephone and email contact information, address of residence, nationality, date of birth, communication language, identification document.
- Data obtained from other data processing provided for in this policy:
  - Data from the customisation of the product and service offering based on the analysis of your data: If you have given us your consent to customise our commercial offering (section A above), we will also use the information from your commercial profile as detailed in section 6.1. A of the Privacy Policy, so you can be sent customised offers.
Other relevant information: The following section includes other relevant data processing information:
- Data transfer information: If we reach an agreement with a third-party company to transfer your data to it, the recipient company will inform you of this situation and the details of the processing they intend to carry out.
- Duration of data processing: We will only process your data if you have given us your consent, which will remain in force until you withdraw it. If you cancel all your products or services but forget to revoke your consent, we will do so automatically.
Joint data controllers: The following CaixaBank Group companies will process your data jointly.
- CaixaBank, S.A.
- CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
- Nuevo Micro Bank, S.A.U.
- Wivai Select Place, S.A.U,
- ImaginersGen, S.A.
- VidaCaixa, S.A.U. de Seguros y Reaseguros
You will find the essential elements of the joint data controller agreements at: www.caixabank.es/empresasgrupo.

TYPES OF PROCESSING THAT WE WILL CARRY OUT WITH REGARD TO WIVAI USER CUSTOMERS

6.2 PROCESSING BASED ON THE LEGITIMATE INTEREST OF WIVAI

We will only carry out this processing with regard to Wivai User Customers and the legal basis for this processing is the satisfaction of legitimate interests pursued by Wivai or by a third party, provided that these interests do not take precedence over your interests or your fundamental rights and freedoms, in accordance with art. 6.1.f) of the General Data Protection Regulation (GDPR).

This processing will imply that we have considered your rights and our legitimate interest and we have concluded that the latter prevails. Otherwise, we would not process the data. You can ask about the analysis that is done to consider the legitimate interest of a processing operation at any time by emailing your enquiry to delegado.proteccion.datos@caixabank.com

We also remind you that you have the right to object to processing based on a legitimate interest. If you understand that Wivai and, where appropriate, any jointly-responsible companies must take into account any individual circumstances or other reasons for us to cease processing of your data, you may request this simply and free of charge through the channels we specify in section 4.

A. Offer of products and services.
Legitimate interest of Wivai: The legitimate interest of Wivai is to communicate the offer of products and services that it markets to users that have shown an interest in them or have purchased similar products in the past.

Purpose: The purpose of the processing is to select a target market for the offer of products and services through electronic channels.

Data processed: The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, language choice, identification document.
- Contract details: contracted or requested products and services.
- Basic financial information: payment history of contracted products and services.
- Your browsing data: data obtained from your browsing of our websites or, if applicable, applications and your browsing history on these websites: browsing history (pages visited and clicks on content), device ID, advertising ID, IP address, if you have accepted the use of cookies and similar technologies on your browsing devices.
- Your browsing data: data obtained from your browsing of third-party websites or, if applicable, applications and your browsing history on these websites: browsing history (pages visited and clicks on content), device ID, advertising ID, IP address, if you have accepted the use of cookies and similar technologies on your browsing devices.
Other relevant information:
- Right of opposition to processing: You have the right to object to processing based on a legitimate interest. You can do this simply and free of charge through the channels indicated in heading 4.
Should you decide to exercise your right of objection, you are informed that we will cease the processing without requiring that you give us any reason why we should stop processing your data.

If you do not agree to this processing it will not prevent us contacting you for operational management of the products and services you have contracted.

Data controller: The data controller of this processing is Wivai. This processing is not carried out jointly.

TYPES OF PROCESSING THAT WE WILL CARRY OUT WITH REGARD TO ALL WIVAI CUSTOMERS

6.3 PROCESSING REQUIRED FOR THE PERFORMANCE OF CONTRACTUAL RELATIONSHIPS

We will carry out this processing with regard to all Wivai customers (Identified Wivai Customers and Wivai User Customers) and the legal basis is that it is necessary in order to manage the contracts of the products and services that you request or in which you are a party, or to apply pre-contractual measures if you request them, as established in art. 6.1 .b) of the General Data Protection Regulation (GDPR).

Therefore, this processing is necessary for you to establish and maintain Contractual Relations with us. If you object to it, we will end these relations, or we will not be able to establish them if they have not yet started.

The types of processing required to establish contractual relations are listed below, arranged from (A) to (B). For each item, we will indicate: a description of the purpose (Purpose), the details of the processed data (Processed data), if applicable, information on the use of profiling (Use of profiling), other relevant processing information (Other relevant information) and whether or not the processing is carried out jointly with other CaixaBank Group companies (Joint data controllers/Data controller).

A. Signing, maintenance and performance of Contractual Relations
Purpose: The purpose of this data processing is to formalise and maintain the Contractual Relationships established between you and us, including the processing of your requests or orders, the steps prior to entering into a contract (pre-contractual relationships) or the purchase of a product or service.

This data processing involves collecting the information necessary to establish the relationship or manage the request, and processing the information required to properly maintain and perform the contracts and/or purchases made by you.

The processing activities involved in signing, maintaining and performing the Contractual Relations are:
- Collection and registration of the data and documents required for the purchase of the requested products or services
- Managing the products and services you have contracted with us, including responding to operational queries, ¡and the management of any incidents arising from the delivery of products, also all the formalities that are necessary in order to comply with the accepted commitments for the contracting of specific products or services.
Data processed: The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
- Contract details: contracted or requested products and services.
- Basic financial information: payment history of contracted products and services.
- Data obtained in the performance of other processing as provided for in this policy:
  - Risk assessment or score data (processing described in section 6.3.B).
Data controller: The data controller of this processing is Wivai. This processing is not carried out jointly.

B. Analysis of solvency or ability to repay in the case of products involving the grant of payment in instalments and monitoring of credit risk.
Purpose: The purpose of this data processing is to assess whether applicants and/or contract holders of products or services that involve the deferred repayment by instalments have the required solvency and repayment capacity to make the scheduled payments in the transactions that are analysed and/or have been granted.

Detailed information on the solvency and repayment capacity analysis process that will be carried out when you apply for or have already been granted transactions involving deferred repayment by instalments, will be provided in the transaction request you will be required to sign when you apply for these transactions, or, in the case of transactions already granted, in the relevant contract.

Processing operations that are carried out in the analysis of the solvency and ability to repay of applicants and/or contract holders of products that involve deferred repayment by instalments are:
- Analysis of the repayment capacity of applicants at the time of granting new transactions that involve deferred repayment by instalments.
- Analysis of the solvency of the contract holders of products involving deferred repayment by instalments throughout the life of the aforementioned transactions, for internal risk management and to prevent repayment defaults.
Data processed: The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
- Details of your professional or work activity and socio-economic data: details related to your job, income or remuneration, household, level of education, assets, tax and fiscal data.
- Contract details: contracted or requested products and services (own or third-party), status as contract holder, authorised party or representative for a contracted product or service, categorisation according to regulations regarding securities markets and financial instruments (MiFID category), information on investments made and their performance and information and transactions related to your financing transactions.
- Basic financial data: current and historical balances for products and services and payment history of contracted products and services.
- Third-party data from statements and receipts from current accounts and payment accounts: information on entries and transactions that third-party issuers make to your accounts, including transaction type, issuer, amount, and the description as it appears on receipts and statements for debit, credit and prepaid card transactions.
- Data obtained from the execution of statistical models: we use the results of applying mathematical modelling to client data, which helps us combat fraud, detect your consumer habits, preferences or product tendencies for regulatory compliance and to manage your products and services.
- Data on credit information systems: obtained by consulting the Asnef and Badexcug credit reporting databases, which provide information on debts, financial solvency and credit (debtor, creditor and debt).
- Details of Equifax Risk Score: For financing or payment by instalments transactions, we will use the result provided by this forecast system for the probability of default at 12 months, which is calculated by applying statistical and mathematical models to your national ID, postcode of residence and data in credit information systems.
- CIRBE details: we will check if you have risks (financing) with other institutions. We will obtain this information from the Bank of Spain Credit Reporting Agency (CIRBE).
- Demographic and socio-economic data: statistical data not related to specific people but to geographical areas, age sectors or professional activity sectors, which we will use to correlate them with customer information.
- Details of properties and vehicles associated with you: these are data obtained from the land registry and basic data on vehicles obtained from the Spanish Traffic Directorate, which we will use to complement the information about your properties and vehicles.
- Information obtained from public access sources and public records: data provided by public access sources and public records to compare the information you provide to enter into, maintain and fulfil Contractual Relationships, information from the Equifax Bankruptcy database and additional contact data obtained from telephone directories (White Pages, Yellow Pages, Lleida.net) and the INFORMA database, to contact our customers in the event of a breach of contractual obligations.
Use of profiling: For this processing, we prepare a risk profile that we will use exclusively for the analysis of the solvency and ability to repay of applicants and/or contract holders of products that involve deferred repayment by instalments.
- Purpose: The purpose of using a profile is to determine the probability of default when granting transactions, assess the need to adjust the risk of current transactions and calculate the provisions and capital requirements applicable to the CaixaBank consolidated group.
- Consequences: risk profiles are tools used to support decisions on whether to grant transactions that involve deferred repayment, or on the termination of granted transactions.
  Transactions requested through electronic channels may involve automated decisions on whether to grant the transaction, as detailed in the section "Other relevant information” below.
- Logic: The applicant's profile will use the information indicated in the "Data processed" section above.
  Based on this information, a specific value is assigned to each piece of the applicant’s data, the sum of which produces a score indicating the probability of a default or breach of monetary obligations.
  
  The importance of each variable and its influence on the final result is calculated in advance using mathematical models and is included in the institution's internal risk policies.6
Other relevant information: The following section includes other relevant data processing information:
- Automated decisions: We will use automated processes to analyse solvency and repayment capacity for applications submitted through electronic channels to check whether the deferred payment option is suitable for you, payment in instalments is appropriate or otherwise.
  If the requested deferred repayment option is not deemed to be suitable for your repayment capacity based on the profile calculations employed, you will not be able to contract the product, and your application will be rejected automatically in this channel.
  
  You may resubmit an application, requesting that the analysis does not include automated decisions, challenge the automated decision or exercise your right not to be subject to a decision based solely on automated processing by contacting Wivai directly through the channels set out in section 4 of this policy.
- Regulatory obligations: In addition to these processing operations being required to perform the contractual relationship between you and us, this processing is carried out in accordance with the provisions of the 10/2014 Act of 26th June, on the regulation, supervision and solvency of credit institutions.
- Credit information system enquiries: We will carry out the credit information systems enquiries required for solvency analysis based on our legitimate interest, as detailed in section 6.5.C.
- Consultation and communication with CIRBE: The consultation of the CIRBE (the Bank of Spain risk information service) necessary to assess solvency is effected on the basis of the stipulations of the Measures to Reform the Financial System Act, Law 44/2002 of 22nd November 2002. Moreover, the data necessary to identify the people with whom credit risks are undertaken will be passed on in accordance with the same act.
- Preparation of management reports and mathematical models: The processed data and data resulting from this processing will also be used for the preparation of management reports and mathematical models, under the terms established in the processing as defined in heading 6.5.B of this policy.
Joint data controllers: Sectoral regulations on the prudential and solvency requirements that apply to the financial sector require that a credit transaction be granted to customers and monitored jointly by all the companies that comprise the same consolidated group of credit institutions.

Pursuant to the above, the following CaixaBank Group companies will process your data jointly.
- CaixaBank, S.A.
- CaixaBank Payments & Consumer, E.F.C., E.P., S.A.U.
- Nuevo Micro Bank, S.A.U.
- Telefónica Consumer Finance, E.F.C., S.A.
- CaixaBank Equipment Finance, S.A.U.
- Unión de Crédito para la Financiación Mobiliaria e Inmobiliaria, CREDIFIMO, E.F.C., S.A.U.
- Corporación Hipotecaria Mutual, S.A.U., Establecimiento Financiero de Crédito
- Hipotecaixa 2, S.L.U,
- Banco BPI, S.A.
- Wivai SelectPalce, S.A.U.
You will find the essential elements of the joint data controller agreements at: www.caixabank.es/empresasgrupo

6.4 PROCESSING REQUIRED TO COMPLY WITH REGULATORY OBLIGATIONS

We will carry out this processing with regard to all Wivai customers (Identified Wivai Customers and Wivai User Customers) and the legal basis is that it is necessary in order to comply with a legal obligation that is required of us, as laid out in art. 6.1.c) of the General Data Protection Regulation (GDPR).

A. Processing to comply with tax regulations
Purpose: The purpose of this processing is to adopt the measures imposed on our activity by the 58/2003 Act of 17th December, the General Tax Act, and Royal Decree 1021/2015 of 13th November.

The processing operations carried out to comply with tax regulations are:
- Collection of information and documentation regarding your tax situation as required by tax laws, and
- Reporting details relating to your tax situation to government agencies when required by law or by a competent authority.
Data processed: The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
- Contract details: contracted or requested products and services.
Data controller: The data controller of this processing is Wivai. This processing is not carried out jointly.

B. Processing for handling complaints and claims.
Purpose: The purpose of this processing is to handle queries, complaints and claims submitted to Wivai.

Furthermore, the 3/2018 Act of 5th December on the Protection of Personal Data and the Guarantee of Digital Rights requires the data controller, in this case Wivai, to handle any complaints submitted to its Data Protection Officer and respond to any data protection rights exercised by data subjects.

The following types of processing are carried out to comply with regulations on handling complaints and claims:
- Receiving complaints and claims through the Wivai Customer Service Department
- Responding to the submitted complaint or claim within the established time frame, and
- Managing data protection rights and queries submitted to the CaixaBank Group’s Data Protection Officer and the actions required to cooperate with the Supervisory Authority (the Spanish Data Protection Agency).
Data processed: The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
- Contract details: contracted or requested products and services.
- Basic financial information: payment history of contracted products and services.
Data controller: The data controller of this processing is Wivai. This processing is not carried out jointly.

6.5 PROCESSING BASED ON THE LEGITIMATE INTEREST OF WIVAI

We will carry out this processing with regard to all Wivai Customers (Identified Wivai Customers and Wivai User Customers) and the legal basis for this processing is the satisfaction of legitimate interests, pursued by Wivai or by a third party, provided that these interests do not take precedence over your interests or your fundamental rights and freedoms,, in accordance with art. 6.1.f) of the General Data Protection Regulation (GDPR).

We also remind you that you have the right to object to processing based on a legitimate interest. If you understand that Wivai and, where appropriate, any jointly-responsible companies must take into account any individual circumstances or other reasons for us to cease processing of your data, you may request this simply and free of charge through the channels we specify in section 4.

The types of processing are listed below, arranged from (A) to (C). For each item, we will indicate: the legitimate interest of Wivai (Legitimate interest of Wivai), a description of the purpose (Purpose), the details of the processed data (Processed data), if applicable, information on the use of profiling (Use of profiling), other relevant processing information (Other relevant information) and whether or not the processing is carried out jointly with other CaixaBank Group companies (Joint data controllers/Data controller).

A. Fraud prevention
Legitimate interest of Wivai: The legitimate interest of Wivai for carrying out this processing is to prevent fraud that could lead to financial or reputational damage to the institution or its customers.

Purpose: The purpose of this processing is to adopt the necessary measures to prevent malicious transactions or conduct before they occur or to mitigate their impact if they do occur by identifying suspicious transactions or conduct that could involve an attempt to defraud the institution or its customers.

The processing operations carried out to prevent fraud are:
- Verifying the identity of customers that interact with the bank to prevent fraudulent access to information or transactions.
- Reviewing and analysing the contracts and transactions carried out in our systems to protect our customers from fraud through any channel and prevent cyber-attacks.
Data processed: The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
- Contract details: contracted or requested products and services.
- Basic financial information: payment history of contracted products and services.
- Your browsing data: data obtained from your browsing of our websites or applications and your browsing history on these websites: browsing history (pages visited and clicks on content), device ID, advertising ID, IP address, if you have accepted the use of cookies and similar technologies on your browsing devices.
- Your browsing data: data obtained from your browsing of third-party websites or applications and your browsing history on these websites: browsing history (pages visited and clicks on content), device ID, advertising ID, IP address, if you have accepted the use of cookies and similar technologies on your browsing devices.
Use of profiling: This processing involves creating a profile of your usual transactions and activities, which we use exclusively to detect unusual situations that could indicate an attempt to commit fraud.
- Purpose: The purpose of the profile is to identify transactions or interactions that are unusual or do not match your behaviour profile that could be an attempt to commit fraud or gain fraudulent access to information.
- Consequences: Profiles are tools that help to identify fraudulent transactions, and their use requires the implementation of measures, including reviewing transactions in detail, blocking transactions and disabling their automatic execution.
Other relevant information: The following section includes other relevant data processing information:
- Automated decisions: For the purpose of fraud prevention, we will use automated processing to try to detect fraudulent transactions.
  In the case of transactions that cannot be cancelled once executed, such as immediate payments or transfers, if automated processing detects suspect transactions that might not be legitimate they will be blocked, preventing their execution.
  
  You may resubmit an application, requesting that the analysis does not include automated decisions, challenge the automated decision or exercise your right not to be subject to a decision based solely on automated processing by contacting Wivai directly through the channels set out in section 4 of this policy.
- Right of opposition to processing: If you understand that Wivai must take into account any individual circumstances or other reasons for us to cease processing of your data, you may request this simply and free of charge through the channels we specify in section 4.
Data controller: The data controller of this processing is Wivai. This processing is not carried out jointly.

B. Preparation of management reports and mathematical models
Legitimate interest of Wivai: Wivai’s legitimate interest in carrying out this processing is to design, organise and optimise its business and commercial activity as efficiently as possible, which requires having reports on the management and activity of the company and the market, as well as mathematical algorithms for the advanced analysis of information.

Purpose: The purpose of this processing is to prepare reports on the company's activity and its relationship with the market, on the composition and development of its customer base and on the suitability and effectiveness of its products and services. These reports are used to efficiently manage said products/services and to create and maintain statistical and mathematical models that make it possible to carry out the processing detailed in this policy, which requires advanced calculations and analysis of information.

Data processed: The data we will process for this purpose are data that have been identified previously for each processing type. We will apply, whenever possible, anonymisation or pseudonymisation techniques to ensure that this processing does not have an impact on the rights of the data subjects, and that the result of the processing is reports containing statistical or aggregated data, or mathematical or algorithmic formulas.

Other relevant information: The following section includes other relevant data processing information:
- Right of opposition to processing: If you understand that Wivai must take into account any individual circumstances or other reasons for us to cease processing of your data, you may request this simply and free of charge through the channels we specify in section 4.
- Ancillary data processing: The purpose of processing data for the creation of statistical reports and mathematical models is not to process individual customer data.
  This data processing is necessary, but secondary, to the main purpose of preparing management reports or algorithmic or mathematical formulas, and is therefore carried out using, whenever possible, anonymisation techniques or, failing that, pseudonymisation techniques, and minimising the data processed.
  
  This processing has no effects or consequences on the individual data subject.
Data controller: When management reports or mathematical models are prepared that result from other processing in this policy whose data controller is Wivai, the data controller of such processing will also be Wivai.

If management reports or mathematical models are prepared that result from other processing in this policy performed as a joint data controller, such processing shall be performed under the same joint data controller system as the original processing. In these cases, you will find the list of the joint controller companies and the essential aspects of the processing agreements at: www.caixabank.es/empresasgrupo.

C. Consulting credit information systems as part of the application for and subsequent management of products that involve deferred payment by instalments.
Legitimate interest of Wivai: The legitimate interest of Wivai to carry out this processing is to avoid non-payment and defaults by applicants or contract holders of those products that involve financing.

Purpose: The purpose of this processing is to assess the solvency and repayment capacity to (i) ensure adequate compliance by the interested parties with their payment obligations resulting from transactions of deferred payment by instalments, (ii) to monitor and manage the transactions granted, and (iii) to prevent and manage defaults and non-performing loans.

The processing operations carried out when consulting solvency databases are:
- Checking your information: Prior to approving the transactions involving deferred payment by instalments or in order to monitor and manage the risk of the granted loan, the databases of the following asset solvency and credit agencies will be consulted: (i) Asnef database, (ii) Badexcug database, and
Data processed: The data we will process for this purpose are:
- Identification and contact details: full name, gender, telephone and email contact information, address of residence, nationality and date of birth, language choice, identification document.
- Contract details: contracted or requested products and services.
- Basic financial information: payment history of contracted products and services.
- Data on credit information systems: obtained by consulting the Asnef and Badexcug credit reporting databases, which provide information on debts, financial solvency and credit (debtor, creditor and debt).
Other relevant information: The following section includes other relevant data processing information:
- Right of opposition to processing: If you understand that Wivai must take into account any individual circumstances or other reasons for us to cease processing of your data, you may request this simply and free of charge through the channels we specify in section 4.
Data controller: Wivai is responsible for the part of the processing related to the consulting of Wivai credit information systems. You are informed of the contact details for the solvency files:
- Asnef database: Asnef Equifax Servicios de Información sobre Solvencia y Crédito. Apartado de correos10546, 28080 Madrid (sac@equifax.es)
- Badexcug database: Apartado de correos 1188, 28108 Alcobendas (badexcug@experian.com)

7. Recipients of the data

Data controller and joint data controllers

The data we process in your capacity as a Wivai customer is processed by Wivai. If joint data controllers process data, it will be processed by CaixaBank Group companies in accordance with the provisions of the above sections on processing.

Authorities and official bodies

Wivai could be legally required to provide information on the transactions we carry out to authorities or official bodies in other countries located both within and outside the European Union.

Disclosure of data to outsourced service providers

We sometimes use service providers with potential access to personal data.

We ensure these providers grant adequate and sufficient safeguards related to the processing of your data, because we carefully screen service providers by including specific requirements if their services involve the processing of personal data.

The type of services we can assign to service providers is:

Back-office financial services
Administrative support services
Auditing and consulting services
Legal services and asset and non-payment recovery services
Payment services
Marketing and advertising services
Survey services
Call centre services
Logistics services
Physical security services
IT services (system and information security, cyber security, information systems, architecture, hosting, data processing)
Telecommunications services (voice and data)
Printing, enveloping, postal and courier services
Data retention and destruction services (digital and physical)

8. Data retention periods

Retention to maintain Contractual Relations

We will process your data as long as the Contractual Relations we have established remain in force.

Retention of authorisations for processing based on consent

We will process the data based on your consent until you revoke said consent.

If you cancel all your product and service contracts with CaixaBank Group companies but do not revoke the consent you have given us, we will automatically void said consent from when you cease to be a customer.

Retention to comply with legal obligations and to make, enforce and defend claims

Once authorisations for use have been revoked through the withdrawal of your consent, or the contractual or business relations established with us have ended, we will only keep your data to comply with legal obligations and to allow you to make, enforce or defend claims during the limitation period for actions arising from these contractual relations.

We will process these data by applying the technical and organisational measures required to guarantee that they are only used for these purposes.

Data destruction

We will destroy your data when the retention periods imposed by the regulations governing Wivai's activity have passed and the limitation periods for administrative or judicial actions arising from the relations established between you and us have elapsed.

9. Data transfers outside the European Economic Area

At Wivai we process your data within the European Economic Area and, in general, we have service providers located within the European Economic Area or in countries deemed to have an adequate level of data protection.

If we need to use service providers that carry out processing outside the European Economic Area or in countries not deemed to have an adequate level of data protection, we will ensure that your data are processed securely and in accordance with the law.

To do this, we require these service providers to apply suitable safeguards in accordance with the GDPR, so that they have, for example, binding corporate standards that guarantee data protection in a similar way to European standards or we require that they subscribe to European Union standards. You can request a copy of the appropriate guarantees required by Wivai from these suppliers by contacting the Data Protection Delegate at www.caixabank.com/delegadoprotecciondedatos.

10. Automated decisions

Section 6 of this Policy contains information on the type of processing that incorporates automated decision-making.

Additionally, if during the Contractual Relationships you maintain with us we use mechanisms that could take decisions based solely and exclusively on automated processing (i.e. without the participation of a person) that could have legal effects for you or that could significantly affect you (not allow you to contract a certain product, for example), we will inform you of this, as well as of the reasoning behind the decision, in the contractual documentation of the product or service you have requested.

At that time, we will also adopt measures to safeguard your rights and interests by giving you the right to request human intervention, to express your views and to challenge the decision.

11. Revision

We will revise this Privacy Policy whenever it is necessary to keep you duly informed, such as when publishing new standards or criteria or when we engage in new processing activities.

Whenever there are substantial or significant changes to this Privacy Policy, we will notify you through the usual communication channels.

Zero interest and charges

Finance by Caixabank

Free delivery and returns

0% TAE - Free delivery and returns

WIVAI SELECT PLACE, S.A.U. PRIVACY POLICY

CONTENTS

1. How we process your personal data