Data Protection Policy

Fundación Banco Santander (hereinafter, "the Foundation") fully complies with the regulations on the protection of personal data and, in particular, with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals regarding the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter, "GDPR"), such that the processing of personal data obtained through the website https://www.fundacionbancosantander.com/ (hereinafter, the "Website"), will be carried out in compliance with the applicable legal guarantees and obligations.

In compliance with current regulations, the Foundation has implemented appropriate technical and organizational measures to ensure an adequate level of security and to prevent the loss, misuse, alteration, unauthorized access and theft of data provided by users. Likewise, the Foundation guarantees that it complies with the duty of secrecy and confidentiality regarding the personal data provided by users (interested parties) through the Website.

Who is responsible for the processing of your data?
- Identity of the Data Controller: Fundación Banco Santander
- NIF: G-80576200
- Contact details of the Data Controller:
  - Postal address: Calle Serrano 57, 28006 Madrid.
  - E-mail address: privacidadfundacionbs@gruposantander.com
Why do we process your data?
2.1 Description of the purposes of the processing
Through the website we may collect your data for different purposes, namely:
1. When you decide to subscribe to the newsletter service. In this case we use your personal data to register you for the service and send you e-mails with information about publications and events of the Foundation on the subjects or areas in which you have specified your interest.
2. When you wish to participate in one of the calls for projects that we offer from the Foundation through our website. In this case you will have to register, this registration will allow you to apply for participation in the relevant call and in any other using the same registered user name and password. Therefore, we will use your data to register you.
3. When you wish to participate in activities for employees, their families or friends, we use the data for the correct and better organization of the Event including, in some cases, the management of access, parking (in the events held in the Financial City) and accessibility for disabled people or people with special needs.
If, in order to participate in the call, personal data other than those requested for registration are necessary, you will be specifically asked for them and you will be informed of the purpose of the processing in the corresponding applicable privacy policy.
2.2 Data retention periods or terms
The personal data provided will be kept as long as the relationship with the user remains active. This means, both for those users registered in the newsletter and for those who have decided to register in any of our calls, as long as they do not unsubscribe or request to unsubscribe.
Personal data provided for participation and attendance to the activities for employees, family or friends of employees, will be retained only for the period necessary for the organization of the event.
Once the above period has elapsed, the data will remain blocked for a period of five years in order to address possible claims arising from its processing, and then proceed to its complete deletion.
2.3 Automated decisions, profiling, and applied logic
No automated decisions will be made, and users will not be profiled.
Where does your data come from?
3.1 Detailed information on the origin of the data
The data we process have been communicated to us directly by the users through the corresponding forms on the Web site, both for subscription to the newsletter and for registration in one of our calls or registration forms in the activities for employees, family, or friends of employees through the Bank's Intranet.
3.2 Categories of processed data
The data processed for the subscription to the newsletter service are:
- First Name
- Last Name
- E-mail address
- The user can also indicate to which type of newsletters they want to subscribe: Art, Environment and Social Action
Additionally, the data processed for the management of calls or projects are:
- First Name
- Surname
- National ID number
- Date of birth
- Place of birth
- Place of residence
- Phone number
- E-mail address
Likewise, the data processed for the registration and execution of the activities for employees, relatives or friends of employees are:
- Name and surname of all attendees *(employee, accompanying persons and children) ID of all adults*/ Age of minors
- Car registration number
- Mobile phone (employee's)
- Need of special assistance for the attendance and accessibility to the event (YES/NO)
Legal basis for processing
The data processing carried out regarding the subscription to newsletters, will be carried out by virtue of your consent. Such consent may be withdrawn at any time, without affecting any previously processed information.
In turn, the legitimate basis of the processing of your personal data for the registration in any of the calls for projects, through the Website, is the execution of the contractual relationship between the parties, free of charge and in accordance with the terms of the subscription requested and those of the legal notice and the terms and conditions of the Website, which will be displayed on the Website.
Regarding the registration for activities for employees, family or friends, the legitimate basis for processing your personal data, related to the registration and your attendance to the event, will be the execution of the contractual relationship. However, if you request special assistance for the attendance and accessibility to the event, a circumstance that could imply the existence of a disability or limitation of any kind, related to health, the treatment will be carried out in a more discreet and confidential manner, in order to comply with our purpose and legal obligation to facilitate universal accessibility to the activities.
Who do we share your information with?
We do not share your data with third parties and no international data exchanges are carried out.
Although the Foundation does not disclose personal data to third parties, it does collaborate with some third party service providers who may have access to personal data and who process such data in the name and on behalf of the Foundation as a result of their provision of services. To select these suppliers, the Foundation has strict criteria and the relevant data processing agreements are established with all of them in accordance with the provisions of Article 28 of the GDPR.
What rights do you have over your data?
6.1 Exercising your rights
As the owner of the personal data processed, at any time you have the right to request access, rectification, deletion and portability of your data, and the limitation or opposition to its processing. The Foundation will stop processing the data, except for legitimate reasons or for exercising or defending possible claims.
6.2 How to exercise the rights of access, rectification, deletion and portability of your data, and the limitation or opposition to its processing
Interested parties may request to exercise their rights by letter to C/ Serrano, 57, 28006 Madrid and/or by e-mail to: privacidadfundacionbs@gruposantander.com, duly accrediting their identity. If it is not possible to identify you correctly, the Foundation may request additional information.
6.3 Right to complain to the Control Authority
Data owners have the right to contact the Spanish Data Protection Agency at Calle Jorge Juan 6, 28001, Madrid or at www.aepd.es, in the event that they consider that their personal data are not being treated correctly or that their rights have not been properly addressed.