Data Protection Policy

For the purposes of the provisions of current legislation on the protection of personal data, through this Privacy Policy, Fundación Banco Santander (hereinafter, "the Foundation") informs the users (hereinafter, the "User" or "Users") of its website https://www.fundacionbancosantander.com/ (hereinafter, the "Web Site"), owned and operated by the Foundation, regarding its privacy policy.

The Foundation fully complies with the regulations on the protection of personal data and, in particular, with the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter "GDPR"), whereby the processing of personal data obtained through the Website complies with the applicable legal guarantees and obligations.

In compliance with current regulations, the Foundation has implemented appropriate technical and organizational measures to ensure an adequate level of security and to prevent the loss, misuse, alteration, unauthorized access and / or theft of data provided by Users. Likewise, the Foundation guarantees that it complies with the duty of secrecy and confidentiality concerning the personal data provided by the Users (interested parties) through the Website.

  1. Who is responsible for processing your data?
    • Data Controller: Fundación Banco Santander
    • Tax identification number: G-80576200
    • Contact details of the Data Controller
  2. Why do we process your data?
    2.1 Description of the purposes of data processing
    Through the Web Site we may collect your data for different purposes:
    a. When you decide to subscribe to the newsletter service. In this case, we use your personal data to register you in the service and send you information about activities of the Foundation related to the subjects you have specified your interest in.
    b. When you wish to register and participate in one of the calls for projects offered by the Foundation through our Web Site. In this case, you must register on the Website; this registration will allow you to apply for participation in the relevant call and in any other call using the same previously created user name and password. Therefore, we will use your data indicated in this policy to register you on the Website as well as to manage your participation in the corresponding call.
    In the event that, in order to participate in a call, personal data are required, other than the data initially requested for registration on the Website and the corresponding registration in the call, these data will be specifically requested from you and you will be informed of the purpose of the processing in the corresponding applicable privacy policy.
    c. When you wish to participate in activities for employees, family members or friends of employees. In this case, we use your data to improve the organization of the event, including, in some cases, the management of access and parking (in the events held in the Financial City of Santander Group) and accessibility for people with disabilities or people with special needs.
    We may also send a participant satisfaction survey by email to get your feedback on these activities, so that we can adjust or adapt them to your preferences, whenever possible.
    2.2 Data retention periods or criteria
    The personal data provided will be kept as long as the relationship with the User remains active.
    a. When you decide to subscribe to the newsletter service.
    For those Users registered in the newsletter service, as long as they do not unsubscribe or make a request to do so from the Responsible Party.
    b.When you wish to participate in any of the calls for projects.
    The personal data provided for registration on the Website, will be kept as long as you do not unsubscribe or make a request to do so from the Responsible party.
    The personal data provided for registration in the corresponding Call will be kept as long as necessary to manage your participation in the Call.
    c. When you wish to participate in activities for employees, family members or friends of employees.
    The personal data provided for the participation and attendance to the activities for employees, relatives or friends of the same will be kept for the period necessary for the organization of the event. Once the event is over, the personal data will be kept for a maximum period of one week to send the corresponding satisfaction surveys.
    Once the above period has elapsed, the data will remain blocked for a period of five years in order to be able to deal with possible claims arising from its processing and will subsequently be completely deleted.
    2.3 Automated decisions, profiling and applied logic
    No automated decisions will be made, and users will not be profiled.
  3. Where does your data come from?
    3.1 Detailed information on the origin of the data
    The data that we process have been communicated to us directly by Users through: (i) the corresponding forms on the Website, both for subscription to the newsletter service and for registration in one of our events or; (ii) the registration forms on the Santander Group's Intranet for activities for employees, family members or friends of employees.
    3.2 Categories of data processed
    a. When you decide to subscribe to the newsletter service
    The data processed for subscription to the newsletter service are:
    • Name
    • Surname
    • E-mail
    • The User can also indicate which type of bulletins or newsletters they want to subscribe to: Art, Environment and Social Action.
    b. When you wish to register on the Website and take part in one of the calls for projects
    The personal data processed for registration on the Website are:
    • E-mail
    The personal data processed for the management of calls for applications are:
    • Name
    • Surname
    • Date of birth
    • Place of birth
    • Place of residence
    • Telephone
    • E-mail
    c. When you wish to participate in activities for employees, their family or friends
    The data processed for the registration and execution of the activities for employees, family members or friends of employees are:
    • Name and surname of all attendees *(employee, accompanying adults and, if applicable, accompanying minors): ID of all adults/ Age of minors
    • Car registration number
    • Employee's mobile phone
    • Need for special assistance for the attendance and accessibility of the event (YES/NO)
    • Where appropriate, the e-mail address in order to be able to verify, in case of doubt, the consent to the processing of personal data of children under 14 years of age.
  4. Legal basis for processing
    a. When you decide to subscribe to the newsletter service
    The processing of data carried out in connection with the registration for the newsletter service will be carried out on the basis of your consent. Such consent may be withdrawn at any time, without affecting any processing previously carried out.
    b. When you wish to register on the Website and take part in one of the calls for projects
    The legitimate basis for the processing of your personal data for registration in any of the calls for projects, through the Website, is the execution of the contractual relationship between the parties, free of charge and in accordance with the terms of the subscription requested and those of the legal notice and the terms and conditions of the Website, which will be displayed on the Website.
    c. When you wish to participate in activities for employees, family members or friends of employees
    For registrations and participation in activities for employees, family or friends, the legitimate basis for processing your personal data related to the registration and your attendance at the event will be the execution of the contractual relationship. However, in the event that you request special assistance for the attendance and accessibility of the event, a circumstance that may imply the existence of a disability or health-related limitation of any kind, the treatment will be carried out in a more discreet and confidential manner, in order to comply with our purpose and legal obligation to facilitate universal accessibility to the activities.
    The e-mail address provided for the verification of the consent to the processing of the data of the child under 14 years of age, in case the accompanying person is not the holder of the parental authority or guardian of that child, is treated in compliance with our legal obligation to verify with reasonable effort that the consent was given or authorised by the holder of the parental authority or guardian of the child under 14 years of age.
    The legitimate basis for sending satisfaction surveys to participants in activities for employees, family or friends is the legitimate interest in knowing your opinion on the activities.
    The Foundation has carried out a weighting analysis to assess whether we could indeed carry out this processing on the basis of our legitimate interest. Participants can apply to us through the contact details indicated. However, the following are some of the main conclusions of this analysis: (i) sending of satisfaction surveys represents a real interest for us which is entirely lawful; (ii) it is proportionate because there are no less invasive measures that allow us to develop our interest in your opinion on the activities we organise; (iii) it does not represent a detriment to you, rather it will allow us to adapt, if necessary, our activities to your preferences, which is beneficial to you. Note that you can object to us doing so at any time, from the outset, and this is common practice in the industry.
  5. Who do we share your data with?
    We do not disclose your data to third parties nor do we carry out international data transfers.
    Although the Foundation does not disclose personal data to third parties, it collaborates with certain third-party service providers who may have access to personal data and who process such data in the name and on behalf of the Foundation as a result of providing services to the Foundation. The Foundation has strict criteria for the selection of these suppliers and signs the relevant data processing agreements with all of them in accordance with the provisions of Article 28 of the GDPR.
  6. What rights do you have over your data?
    6.1 Reference to exercising your rights
    As the owner of the personal data processed, at any time you have the right to request access, rectification, deletion and portability of your data, as well as the limitation or opposition to its processing. The Foundation will then stop processing the data, except for legitimate reasons or for the exercise or defence of possible claims.
    6.2 How to exercise your rights of access, rectification, deletion and portability of your data, and limitation or opposition to its processing.
    Interested parties may request to exercise their rights by letter to C/ Serrano, 57, 28006 Madrid and/or by email to: privacidadfundacionbs@gruposantander.com, by duly accrediting your identity. If it is not possible to identify you correctly, the Foundation may request additional information.
    6.3 Right to complain to the Supervisory Body
    Data subjects have the right to contact the Spanish Data Protection Agency at calle Jorge Juan 6, 28001, Madrid or at www.aepd.es, in the event that they consider that their personal data are not being processed correctly or that their rights have not been properly addressed.