PERSONAL DATA PROCESSING: WHISTLEBLOWING CHANNEL

Data controller

The legal entity legally responsible for processing the personal data collected through this Channel is the company Unicaja Banco, S.A. (hereinafter "Unicaja Banco"), the registered office of which is at Avenida de Andalucía 10-12, Malaga (Post Code 29007).  Data Protection Officer contact oficina.proteccion.datos@unicaja.es  


Category and source of the data

The personal data of the whistleblower and person reported collected through this Whistleblowing Channel, along with that of any third parties involved in the reported facts (for example, possible witnesses), may be processed. In any event, only such data as may be strictly and objectively required to follow up the reports and, where appropriate, to verify the truth of the reported facts shall be processed. Said data shall likewise be appropriate, relevant and not unduly excessive.

Unicaja Banco may receive said personal data directly from the data subject (where they are provided when filing any possible allegations or at any other time during the investigation), as well as indirectly from any of the legal or natural persons involved in the investigation, where said persons work for Unicaja Banco or provide their services to it.

Lastly, any whistleblower who wishes to reveal their identity must notify Unicaja Banco of their current and accurate personal data so that the information contained in its systems is up to date and error-free (especially said person's contact data for any matters related to the report that has been submitted).


Purpose of and legal grounds for the processing

For legal purposes, it is hereby stated that the processing of any data collected through this Whistleblowing Channel pursues the following purposes, along with their relevant legal grounds:

a) Fulfilment of Act 2/2023 on Informant Protection. Firstly, we shall process the information collected in order to (i) manage and investigate any reports submitted through the Whistleblowing Channel; and (ii) take the protection measures that are legally set forth to prevent any possible retaliation, thereby strictly complying with the provisions set forth by Act 2/2023 of 20 February on Informant Protection.

b) Criminal risk prevention. Furthermore, any personal data collected shall likewise be processed in order to prevent, detect and uncover any possible risks and breaches that may come about and give rise to criminal liability for Unicaja Banco.

Data retention period

Any data collected may be kept (i) for the time required to decide on the suitability of initiating an investigation into the reported facts; (ii) where appropriate, for the time in which the relevant investigation is being conducted; and, lastly, (iii) for as long as any relevant legal actions are being exercised.

In any event, said data shall be eliminated once three months have elapsed as from the report's reception, save where the purpose of keeping such data is to leave evidence of the channel's operation.

Lastly and after all of the above, the data collected shall be kept (i) to fulfil any possible legal obligations that may apply; and (ii) to deal with any possible claims and liabilities, keeping such data duly blocked for the maximum legally established periods and at the disposal of the State's security forces, the courts and tribunals and any possible competent public administrations for a maximum legal period of ten years.


Recipients of the personal data

Unicaja Banco shall not transfer any data it receives through the Whistleblowing Channel to any third parties. Access to such data shall be restricted to personnel who have been duly authorised beforehand by virtue of their functions, responsibilities and duties. Said data may only be provided to third parties to whom Unicaja Banco is legally obliged to do so, such as, for instance, the courts and tribunals, the State's security forces or any other competent public body.


Rights of data subjects

The people referred to by any reports received (whistleblower, reported person and witnesses) may exercise their right of access to their personal data, as well as request the rectification of inaccurate data or, where appropriate, request such data's elimination where they are no longer necessary for the purposes for which they were collected. Data subjects may also request restriction to the processing of their data and object to it under certain circumstances and for reasons related to their specific situation.

Pursuant to the provisions set forth in Act 2/2023, should the person referred to in the facts set out in the report exercise the right to objection, it shall be assumed, save where there is evidence to the contrary, that there are compelling legitimate grounds that justify the processing of their personal data. Said rights may be exercised under the terms legally set forth, particularly with regard to a scope and content that do not allow the reported person to know the whistleblower's identity through exercising such rights.

The data subject may exercise the aforementioned rights under the terms and conditions set forth in the legislation that is in force at Avenida de Andalucía, 10-12, Malaga (Post Code 29007) or request them by sending an e-mail to: atencion.al.cliente@unicaja.es, indicating that they are exercising their right over the personal data provided through the Unicaja Banco Whistleblowing Channel and attaching thereto a copy of their National ID Card or equivalent identity document. If they fail to obtain a satisfactory response and wish to file a complaint or obtain additional information concerning any of these rights, they may contact the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at (www.aepd.es - C/ Jorge Juan, 6 de Madrid).