WEB PRIVACY POLICY

Faced with the interest the users have in safeguarding their privacy and protecting their data, Unicaja Banco, S.A. (hereinafter "Unicaja Banco"), has implemented the highest security standards in its activity to guarantee the confidentiality and privacy of the users.

In that sense, we inform you of our Privacy Policy to inform you of how the data you provide is processed, of the fundamental personal data protection this entity applies, as well as the rights to which you are entitled. We recommend you read it carefully.

Controller of personal data processing

The data controller of your data is Unicaja Banco, S.A. (hereinafter "Unicaja Banco"), whose registered office is at Avenida de Andalucía, 10-12, Malaga. If you have any queries concerning the protection of your data, you may contact the Data Protection Officer through Grupo Unicaja Banco's Data Protection Office at Avenida de Andalucía, 10-12, Malaga (Post Code: 29007) or at the e-mail address oficina.proteccion.datos@unicaja.es.

For what purpose and with what legitimation does Unicaja Banco process personal data?

In fulfilment of the terms established by the current regulations, Unicaja Banco informs the user, or their legal representative that may provide them to the user, that their data shall be processed by Unicaja Banco for the following purposes:

1. Compliance with applicable legal obligations. Your data shall be processed to comply with the legal obligations required of Unicaja Banco in its relations with shareholders and users. Authority: legal obligation.
2. Management of the petition or query. Unicaja Banco shall perform the data processing that is necessary to attend to the requests or queries made by the user. Thus, we shall process data such as your name, surname, national identity card number, e-mail, telephone, province, post code, as well as information on whether the user is a client of Unicaja Banco or not, and the information on third parties related to the user, the processing of which is necessary for these purposes.
   The necessary data processing shall be performed by filling out the forms made available or by consulting them through the channels provided on the web page. Authority: consent provided by the user on making the query and providing the necessary data to attend this.
3. Whistleblowing Channel. Any processing of the data used to notify Unicaja Banco of any behaviour that might possibly infringe legislation or the institution's internal procedures shall be governed in accordance with your information on personal data processing hosted in this space. Legitimate grounds: obligación legal establecida en la Ley 2/2023.
   
4. Computer control of the web page. Unicaja Banco shall perform the surveillance and control actions of use of the web page in order to prevent and detect any fraudulent use thereof. This processing is necessary and is authorised on the basis both of legitimate interest as well as a legal obligation, pursuant to the Information Society Services and Electronic Commerce Act, in order to avoid, prevent and/or detect any unauthorised access, alteration or loss of data on third persons other than the user that may be cause Unicaja Banco civil, criminal and/or administrative liabilities.
5. Performance of the contractual relation. With regard to provision of the services under the existing contractual relation, as requested by the user, as well as should it be necessary to apply pre-contractual measures aimed at formalising the contractual relation. Authority: contractual relation and application of pre-contractual measures at the request of the user.
6. Data processing of cookies. Information on the Cookie Policy can be found at the following link: Cookie Policy.

Important questions and answers:

How long do we store your data?

The personal data to which we have access shall be processed during the time necessary to address the request, sent to Unicaja Banco. Additionally, Unicaja Banco shall retain the user’s personal data, duly blocked, over the time limit for any legal action that might derive from the relationship maintained with the data subject or to address any requirements from public authorities.

To whom shall we notify your data?

Unicaja Banco shall only communicate the user’s data to:

• Public bodies and institutions for the fulfillment of a legal obligation.
• Unicaja Banco has third-party service providers that may access personal data of the customers of Unicaja Banco for purposes of providing their services, such as lawyers, solicitors, consulting service providers, advisors, IT development and maintenance providers, administrative service providers and document destruction providers. Unicaja Banco preselects said service providers based on criteria of compliance with data protection matters, it has subscribed contracts with all providers in this regard and it controls and ensures that they comply with their obligations in relation thereto.
•  

What are the rights of users in relation to data protection?

If they wish, users may exercise their rights of data access, correction and suppression, as well as request limitation on processing of their personal data, oppose such and request data portability. With regard to that data:

1. To access their personal data, right to obtain confirmation from Unicaja Banco of whether or not their personal data is being processed and, in that case, to obtain a copy of their personal data, as well as certain information on processing their data, pursuant to the regulations in force.
2. To correct inexact or incomplete personal data without delay.
3. To obtain suppression of personal data without delay through limiting access to such when, among others, its obtention and processing is based on consent by the data subject that is now withdrawn, or when the personal data is no longer necessary with regard to the purposes for which it was gathered.
4. To obtain limitation of data processing by Unicaja Banco when any of the conditions recorded in the data protection regulations is fulfilled.
5. To receive the relevant personal data provided to Unicaja Banco and transmit it to another data processor when the processing has been based on consent, or in a contract, and for this to be performed by automated means (data portability).
6. To oppose personal data processing for other purposes than relations with the user.
   You may exercise these rights through the following channels:

• If you are a non-shareholder user: atencion.al.cliente@unicaja.es or Avenida de Andalucía, 10-12, Málaga (CP: 29007).
• If you are a Unicaja Banco shareholder user: buzonaccionistas@unicaja.es.

Before whom may you file your claims?

Any user who considers that their data protection rights have been violated or who might have any other claims concerning their personal information may write to the Unicaja Banco's Personal Data Protection Office at the postal address Avenida de Andalucía 10-12, 29007, Malaga or send an e-mail to oficina.proteccion.datos@unicaja.es. In any event, data subjects may also contact the Spanish Data Protection Agency (Agencia Española de Protección de Datos), the Spanish supervisory authority, at http://www.aepd.es.