PERSONAL DATA PROTECTION

POLICY

1. Personal Data Protection Policy

Take your time and read this document carefully. Do not hesitate to ask us for clarification on anything you do not understand.

In this section, we explain what BBVA will use your details for and what rights you have in relation to their use.
BASIC INFORMATION ON DATA PROTECTION
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

Banco Bilbao Vizcaya Argentaria, S.A. (“BBVA”), with registered office at Plaza San Nicolás 4,
48005, Bilbao, Spain. Email address: [email protected]
Data Controller

Further details in the Additional Information section

If you are a BBVA customer:

1. Manage the contractual relationship for the products and services you request or
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

have taken out with BBVA.

2. Comply with legal obligations and regulations applicable to BBVA.

3. Inform and consult credit information systems.

4. Prevent fraud.

5. Analyze risks, profiles and commercial purposes:

(i) Preparation of basic profiles.

(ii) Preparation of advanced commercial and risk profiles.

Purposes (iii) Offer products and services from BBVA, the BBVA Group, or its subsidiaries or
partners, as well as products and services marketed by any of the former.

6. Data analysis.

7. Provide your details to the following subsidiaries and partners of the BBVA Group
https://www.bbva.es/content/dam/public-web/bbvaes/ documents/gdpr/datos-
personales/sociedades-grupo.pdf so that they can offer you their own customized
products and services.

Further details in the Additional Information section

If you are a representative, guarantor, authorized user, payee, or spouse providing consent or non-
debtor mortgagor, we will process your personal data at BBVA in order to manage the contract
you intervene in pursuant to your legal relationship with a BBVA customer.

Further details in the Additional Information section

Your data is yours and you control it. Therefore, you can access it, correct it, delete it and request
Rights
other rights at any time, as explained in the Additional Information section.

You can view additional and detailed information on BBVA Personal Data Protection in the
Additional information
Additional information section.

If you are a BBVA customer, based on our legitimate interest, at BBVA we analyze your preferences to offer you the BBVA products

1/17
 and services, and others marketed by BBVA, that we think might be of interest to you in keeping with these preferences. Furthermore,
if you so authorize us in the boxes below, we will be able to conduct a more detailed analysis, as well as send you offers for other
products and services that we think might be of interest to you.

[ ] I want BBVA to check and process my details and preferences more closely in order to offer me solutions that help me
better manage my finances.
more info in Additional Information, in the section on Preparation of advanced commercial and risk profiles.
[ ] I want BBVA to communicate with me to offer me products and services from the companies of the BBVA Group and its
subsidiaries and partners.
more info in Additional Information, in the section on Products and services from the BBVA Group companies and/or its
subsidiaries and partners.
[ ] I want my details to be provided only to companies of the BBVA Group, its subsidiaries and partners, so they can personalize
the products and services they offer me.
more info in Additional Information, in the section on Communicating your data to companies of the BBVA Group, its
subsidiaries, and companies with whom we have partnership agreements, so that they can offer you their products and
services.

You can change your selection and configure your settings at any time from the app, online banking, or through your adviser or your
branch.

We remind you that you are not required to accept that your data be processed for these purposes. In this sense, if you do not mark
the boxes, you do not consent to the processing, yet this will not affect the development any product or service contracts you hold
with the Bank nor your compliance with them.
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

If you are a representative, guarantor, authorized user, beneficiary, or spouse providing consent or non-debtor mortgagor, you only
have to sign on the last page of the document, since the processing of your data is necessary for the management of the contractual
relationship in which you partake.

When you enter the password we ask you for during the signing process, you will be expressing your agreement with this Personal
Data Protection Policy.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

Finally, we remind you that this Personal Data Protection Policy may be updated and is subject to change. Therefore, we recommend
that you review it every so often, without prejudice to any informative messages that BBVA may send out. You can access the latest
version of this document at any time at the following link:

https://www.bbva.es/content/dam/public-web/bbvaes/documents/gdpr/datos-personales/politica-tratamiento-datos-
personales_eng.pdf

Additional information Keep reading to find out exactly how we process your personal data at BBVA.
Who is the data controller of your personal data?

Banco Bilbao Vizcaya Argentaria, S.A. (“BBVA”), tax ID A-48265169, with its registered office at Plaza de San Nicolás 4, 48005,
Bilbao, Spain. Email address: [email protected]

How can you contact the BBVA Data Protection Officer?

You can contact the BBVA Data Protection Officer at the following email address: [email protected]

What data do we process?How do we obtain your data?

▪ If you are a customer

At BBVA we process the data shown below and the data that comes from information you have provided directly,
information that we have collected or generated about you, and information that we have obtained from other sources.
At BBVA, we process this data in relation to the products and services you have taken out with us and the products and
services that BBVA markets.

▪ Identity and contact data, such as: first and last names, photograph, national ID (DNI), passport or NIE, nationality,
country of birth, date of birth, postal addresses, email addresses, phone number, mobile phone number, and data
related to voice and image.

2/17
 ▪ Signature information: handwritten, digitized, and online banking passwords.

▪ ID codes or passwords you use in your relationship with BBVA to log in and do your banking through the remote
banking channels.

▪ Economic and creditworthiness information, such as: monthly net income, average balance in accounts, asset
balance, direct debit bills, direct deposit of salary, income and expenses, assets and assets, as well as, where
applicable, those related to your financial rating, financial situation and investment goals.

Similarly, when provided, BBVA will process data such as working life or your Personal Income Tax return which, if
you consent to it, will be verified with the General Treasury of the Social Security or the Tax Agency, respectively. If
you maintain a certain, overdue, and payable debt with BBVA, additional data may be obtained in order to manage its
collection.

▪ Transaction data, such as:your account transactions, card transactions, balances, income, payments, transfers,
debits, bills, and direct deposits and debits. They include the origin, destination, item, and third party concerning
the transaction, as well as the location where the transaction is carried out and the date and time. In addition, the
aforementioned data is that which is processed by BBVA in relation to the products and services that you have taken
out with BBVA, as well as the products and services of the aggregated companies in the event that you have taken out
the aggregation or payment initiation services.

▪ Sociodemographic data, such as:age, marital status, family situation, residence, education and occupation (contract
type, job type, employer, time at the job), membership in groups as well as sustainability preferences, knowledge and
experience in investments and their risks, level of studies and professional experience in the financial sector.

▪
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

Data on the products and services you have with us, such as:contract number, contract limits, types of products
and services you have taken out, contract details (features associated with the contract), direct debit account, BBVA
risk, intervening parties, as well as any documentation associated with any of these contracts.

▪ Data included in the aggregation and payment initiation services: in the event you have taken out these services,
we process data on products and services open in the other aggregated entities and data on the other categories
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

mentioned (e.g. signature information and transaction details, including, where applicable, the origin, destination,
item, location, data, time, etc.) with regard to these services.

▪ Communication data: any data originating from telephone calls or exchanges you make with the Bank through
any written or oral communication channel, such as email, instant messaging, social networks, or the conversation
interfaces available to you at any time; commercial communication data, including their results; as well as the data
you provide through satisfaction surveys.

Data collected or generated on you:

▪ Data on the use of the channels that BBVA makes available to you to manage your products and services: such as
the device ID, device manufacturer and model, device operating system, IP address, browser and version, as well as
browsing and access data.

▪ Information derived from products and services you have with us, such as: data on browsing and use of digital
channels, data on how you interact with BBVA through the various channels, geolocation data, data obtained from
your comments in messages or transactions, information included in your transaction data (e.g. receipts, transfers,
debts), or data from your interactions with chatbots.

Data obtained from other sources:

▪ Solvency information from the Risk Information Center of the Bank of Spain (CIRBE).

▪ Information to analyze the financial suitability of your applications and operations, obtained from credit information
systems (Asnef-Equifax Servicios de Información sobre Solvencia y Crédito S.L. and Experian Bureau de Crédito,
S.A.) and credit rating companies such as Equifax Ibérica, S.L.

▪ Information from fraud prevention information systems, such as Confirma and Iberpay.

3/17
 ▪ Publicly accessible sources such as official journals and gazettes, public records, Public Administration decisions,
land registries, telephone directories, lists of persons belonging to professional bodies, and official lists for fraud
prevention (Confirma and Experian).

▪ Information on the valuation of real estate, vehicles, or other movable assets from sources such as Madiva Soluciones,
S.L., vehicle appraisals obtained from EUROTAX, or appraisals of any other assets used to assess solvency.

▪ Information on profiles obtained from utility companies (energy, communications, etc.).

▪ Data concerning the delivery of goods or services for which BBVA has provided financing, obtained from the suppliers
of these goods or services.

▪ Digital behavior data obtained from media platforms and centers assigned to cookies or devices, when you consent
to our website and mobile cookie policy.

▪ If you are a representative, authorized user, or payee:

▪ Identification and contact data (including postal and/or email addresses).

▪ Signature data (including digital and electronic signatures).

▪ Identification codes and passwords you use in your relationship with BBVA to log in and manage your banking through
the remote banking channels.

▪
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

Data on the products and services you take out.

▪ Information on knowledge and experience, level of studies and professional experience in the financial sector.

▪ In addition to those mentioned above, there may be additional processing of personal data if you have agreed to it
with the Bank.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

▪ If you are a Guarantor:

▪ Identification and contact data (including postal and/or email addresses).

▪ Signature data (including digital and electronic signatures).

▪ Financial and solvency data.

▪ Sociodemographic data, such as: age, marital status, family situation, residences, studies, occupation (type of
contract, employment seniority), or group memberships.

▪ Data obtained from other sources: Solvency information from the Risk Information Center of the Bank of Spain (CIRBE);
Information obtained from credit information systems (Asnef-Equifax Servicios de Información sobre Solvencia
y Crédito S.L. and Experian Bureau de Crédito, S.A.) and credit rating companies such as Equifax Ibérica, S.L.; and
information from fraud prevention information systems, such as Confirma.

▪ Data from other products in which you participate as a guarantor.

▪ If you are a spouse that provides consent or a non-debtor mortgagor:

▪ Identification and contact data (including postal and/or email addresses).

▪ Signature data (including digital and electronic signatures).

▪ Data on the products and services you take out.

4/17
 At BBVA, we ask you to keep your data duly updated to ensure that the data we are processing is accurate, complete, exact, and
updated at all times. If you modify the data, you must communicate this fact to us without delay to keep us up-to-date of your current
situation.

For what purposes and why (legal basis) do we process your personal data?

A) IF YOU ARE A CUSTOMER

1. Manage the contractual relationship for the products or services you request from or have with BBVA

During the new customer registration process

BBVA processes your personal data to identify you and to manage your application to register as a new customer, and to help
you during said process.

For registration processes with video-call or video-identification, you can consult the information involved in this
processing here: https://www.bbva.es/content/dam/public-web/bbvaes/documents/legal/tratamiento-de-datos/
videollamada-y-videoidentificacion.pdf

When you are a customer for taking out any product or service

At BBVA, we process your personal data to:

▪ Properly manage the products and services you request from us or take out with us. This includes assessing your
solvency and the development, maintenance, and monitoring of the pre-contractual and contractual relationship
between you and BBVA.

▪
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

Respond to your queries and monitor our relationship with you and your financial progress (the products and services
you have taken out with BBVA as a customer or those that BBVA markets).

▪ Send you non-commercial notifications to manage your relationship with BBVA resulting from the products and
services you have taken out with us, as well as assess the opinion you wish to give on the services provided.

▪
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

To show you your financial information in a simple and intuitive way in the various channels that BBVA makes available
to you.

▪ Track, analyze, and process risk, non-payment, incidents, or claims as regards your status as a customer, including,
in this last case, any processing involving their investigation and/or discovery so that we can take the necessary
actions.

▪ Manage your access to the various channels made available to you by BBVA so that you can access and manage the
products and services you have taken out with BBVA.

▪ Furthermore, when BBVA grants you financing for the purchase of a good or service, BBVA will inform the provider of
the good or service of the corresponding financing operation (operation number, customer and amount) so that the
provider can track and monitor the operations paid by the Bank for the purposes of its own internal billing. BBVA may
also have to request information from the provider of the good or service concerning its delivery so that BBVA can
execute the respective financing contract.

The legal basis that allows us to process your personal data is the processing of the contract for the products and services
requested or that you have with BBVA.

Additionally, in certain cases, BBVA may, directly or through companies with which it contracts this service, obtain additional
data and process it on the basis of its legitimate interest to recover the amount of the debt.

In addition, if you have taken out products from BBVA Seguros, S.A. de Seguros y Reaseguros, BBVA may share any updated
information it may have concerning your personal data. In other words, if you update some personal information through
BBVA, it may share it with BBVA Seguros, S.A. de Seguros y Reaseguros.

The legal basis for this processing is the legitimate interest of BBVA Seguros, S.A. de Seguros y Reaseguros to keep the
contact details of its customers accurate and up-to-date at all times.

5/17
 Iberpay account ownership verification service We will also process your identification details and the account to confirm
whether you are the holder of an account with BBVA at the request of a third party (hereinafter, the Applicant), with whom
you have signed or are going to sign a contract that involves a payment on your part by direct debit or debit in that account.

The processing of your data in order for BBVA to verify the ownership of your account in which it intends to make a payment
or collection immediately or in the future, has as its legal basis the contractual relationship you maintain with both the
Applicant and BBVA and the purpose of this contract is to ensure that the parties comply correctly with the contract, so that
you avoid damages resulting from an error in the direct debit payment account.

2. Comply with legal obligations and regulations applicable to BBVA

(i) Report to and consult with CIRBE

At BBVA, we are legally required to notify the Bank of Spain’s Risk Information Center (CIRBE) of the risks involved in
your banking transactions as a customer, together with your personal data and your status as an individual entrepreneur,
if applicable. BBVA can consult any data relating to you in the CIRBE in order to manage your financing application and
verify and assess your solvency and credit risk, if you hold financing products or services with the Bank.

The legal basis is the fulfillment of a legal obligation (Law 44/2002, of 22 November, on the Reform of the Financial
System).

(ii) To prevent money laundering and terrorist financing

To prevent money laundering and terrorist financing, we are required to:

▪ Report to the Centralized Banking Account Register on a monthly basis regarding any checking accounts, savings
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

accounts, securities accounts or term deposits that have been opened, closed, or modified, as well as any safe
deposit box contracts and their duration, regardless of the business name. Therefore, your identification details
will be added to that database, which is maintained by the State Secretariat for Economy and Business Support.

▪ To gather information about you and identify you to comply with the due diligence obligations imposed by this
regulation.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

▪ Analyze the operations made in your account through BBVA and report them to Sepblac if appropriate.

▪ Provide information on transactions to the authorities of Spain and other countries, both within and outside the
European Union, on the basis of legislation of some countries and agreements signed with them.

The legal basis is the fulfillment of a legal obligation (Law 10/2010 of April 28, on the Prevention of Money Laundering and
the Financing of Terrorism, and Law 5/2015 on the promotion of corporate financing and its implementing regulations).

(iii) Creation of risk models

Spanish and European regulations (e.g. the European Central Bank, the European Banking Authority, or the Bank of Spain)
require financial institutions to comply with standards and guidelines for the control of solvency, financial risk, and the
calculation of Capital and Provisions required by each operation and customer in relation to the different phases of governing
risk management: admission (risk/price/delegation), monitoring, collection, and recoveries. This regulation requires data
processing when creating risk profiles and risk models in terms of their detail and historical depth.

The legal basis is the compliance with a legal obligation provided for in the regulations governing credit institutions,
investment companies, and solvency and financial risk monitoring entities.

The analytical models used to prepare profiles may lead us to adopt automated decisions in order to comply with the
aforementioned regulation. You can check the details of those decisions that may be made in this manner at the following link:
https://www.bbva.es/content/dam/public-web/bbvaes/documents/experiencias/agregador-financiero/tratamiento-
comportamental-normativo.pdf. You also have the right to have an operator intervene to explain the decision made, to take
your comments on the matter, and to challenge the decision.

(iv) MiFID classification, suitability and convenience analysis to take out investmenr products When required
by the regulations, we will process the personal information and data that you provide us to assess your knowledge of
and experience with a specific product and, when necessary, to define your investor profile. To do this, we will take into
account, depending on the service provided, your knowledge and experience with specific financial instruments, your
investment goals (including your tolerance level and sustainability preferences), as well as your financial situation, in

6/17
 order to determine whether the product or service is suitable for you.

The legal basis is compliance with a legal obligation (Act 6/2023 of 17 March, on the Securities Market and Investment
Services and Delegated Regulation 217/565).

In the case of portfolio advisory and discretionary management services, this processing involves the creation of an
investment risk profile that we use exclusively in order to provide you with the services indicated, as well as to monitor the
suitability of the product you have taken out, in accordance with the obligations imposed on our activity by the Securities
Markets and Investment Services Act.

You can check the details of those decisions that may be made in this manner at the following link: https://www.bbva.es/
content/dam/public-web/bbvaes/documents/legal/tratamiento-de-datos/perfil-de-riesgo-de-inversion.pdf. You also
have the right to have an operator intervene to explain the decision made, to take your comments on the matter, and to
challenge the decision.

3. Report to and consult credit reporting systems

To analyze the economic feasibility of your applications and operations, BBVA needs to consult the data held under your
name in credit information systems by the following entities: Asnef-Equifax Servicios de Información sobre Solvencia y
Crédito S.L. (ASNEF) and Experian Bureau de Crédito, S.A. (EXPERIAN).

Please be notified that we may communicate the details of your debts to credit record companies when:

▪ There is a specific, overdue, and payable debt, the existence or amount of which you would not have appealed
administratively, legally, or through arbitration.

▪
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

Less than 5 years have passed since the date on which the debt should have been settled, or on which the liability or
specific repayment installment fell due.

The legal basis for any communication with credit reporting systems, as well as for inquiries for applications involving
consumer credit, is BBVA's legitimate interest to comply with the responsible credit criteria.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

The legal basis for inquiries involving applications for real estate loans pursuant to Law 5/2019 of March 15, which regulates
real estate credit contracts, is to satisfy a legal obligation.

4. Fraud prevention We will use your personal data to prevent situations of fraud when using our products and services, as
well as to prevent situations in which you may be harmed as a result of the fraudulent activity of third parties.

For this purpose, we will also process your personal data to send you communications containing general information on
fraud operations for your knowledge.

The legal basis is BBVA's legitimate interest to prevent these situations from occurring, with the consequent harm to you and,
where applicable, to the bank itself. You can exercise your right to object by sending an email to: derechosprotecciondatos@
bbva.com, or by requesting it at any of our branches.

In addition, to fulfill this purpose, we may report to and consult the data that appears in the following information systems:

(i) Confirma system

In order to prevent and avoid possible attempts at fraud, BBVA is a member of the Confirma File. For this reason, we also
need to pass on the data you provide us as part of a financing application to the Confirma System, whose data controllers
are the companies who have signed on to the Confirma System Regulations, whose data processor is Confirma Sistemas de
Información, S.L. with registered address at Avda. de la Industria, 18, TRES CANTOS (28760) MADRID. You can consult the
list of Companies that are currently signed on to the CONFIRMA System Regulations on the website www.confirmasis-temas.
es.

Data passed on to the Confirma database may be transferred to the associated companies, who may then hold the data for
a maximum of two years.

You will be able to exercise your rights of access, rectification, erasure, limitation of processing, or opposition, by contacting
the office of the data processor, CONFIRMA SISTEMAS DE INFORMACIÓN, S.L., at the address indicated above. You can also
exercise your right to file a claim with the Supervisory Authority.

Confirma Sistemas de Información, S.L. has appointed a Data Protection Officer, whose contact email is dpo@
confirmasistemas.es

7/17
 The legal basis is BBVA's legitimate interest in preventing fraud during the application process, whereby it shares the data
relating to these operations with member entities in order to reduce identity theft and document tampering, thus protecting
customers and minimizing their financial loss, in the interest of society as a whole. Curtailing the ability to carry out fraudulent
operations means a reduction, in general terms, of subsequent crime and the implications for other crimes such as money
laundering or the financing of terrorism. This File is clearly in your interest, as it is intended to protect you from the fraudulent
practices of third parties that may affect you specifically.

If you do not agree, you can object by sending an email to: [email protected]

(ii) Iberpay system

Be informed that your personal data may be included by BBVA in a common system for preventing fraud in banking
operations, the joint controllers of which are the entities associated with this system, including BBVA. You can consult
the updated list of the companies associated with this common system at the following link: https://www.iberpay.es/
es/servicios/servicios/prevenci%C3%B3n-del-fraude/ You can request additional information, and check the essential
aspects of the joint controller agreement between the associated companies, by writing to [email protected].

This common system is managed by Sociedad Española de Sistemas de Pago S.A. (Iberpay) and its purpose is to identify,
investigate, track and potentially report payment transactions in your checking or savings account that are unauthorized or
suspected of being fraudulent.

The details included by BBVA in the aforementioned common system will be those relating to the IBAN number and the
account holder where the transaction that is unauthorized or suspected of being fraudulent was detected. The system may
be consulted by financial institutions associated with this common system for the sole purpose of identifying, preventing and
tracking fraud.

The legal basis for processing your data is the legitimate interest of this financial institution to identify and prevent fraud in
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

banking operations that in any way involve your checking or savings account. Similarly, the processing described is carried
out in the interest of the account holders themselves who may be affected by fraud committed by third parties.

The data will be stored in the system for a maximum of thirty days in the event of suspicious transactions, and for one year
in the case of unauthorized transactions (when the fraud has been confirmed by the affected party). BBVA will automatically
delete the data included in the common system when it is no longer accurate or does not accurately reflect the actual situation
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

of the affected person.

Finally, we remind you that you may exercise your rights of access, correction, deletion, objection, limitation of processing,
and portability involving your data by writing to the following email address: [email protected] or, if you
prefer, by sending a letter to Servicio Atención al Cliente Grupo BBVA, APDO: 1598-28080 Madrid, specifying which right you
wish to exercise.

If you think we have failed to process your personal data in accordance with the law, you can contact the BBVA Data Processing
Officer at the following address: [email protected]. In any case, you have the right to file a claim with the Spanish Data
Protection Agency (www.agpd.es).

5. Risk analysis and commercial purposes

(i)Preparation of basic profiles

a) Preparation of basic commercial profiles
For the creation of basic commercial profiles, we will analyze your preferences using the data from your relationship
with BBVA, such as identification and contact details, sociodemographic data, financial and solvency data, transactional
data, basic data on Aggregation and Payment Initiation Services when you opt in when singing up for the service,
communication data, data on products and services you have taken out with BBVA or those marketed by BBVA, data
on the use of the service channels made available by BBVA, including browsing information and digital behavior data
obtained from platforms and media centers assigned to cookies or devices that we collect when you consent to our
cookie policy on the website and mobile, and to geolocation on your mobile device when you consent through said device.
Likewise, we use data obtained from public sources, sources providing real estate valuations, such as Madiva Soluciones,
S.L., vehicle appraisals obtained from EUROTAX, and statistical sources.
The data we process will be that corresponding to the previous year.
b)Preparation of a basic profile for risk purposes
In order to draw up your basic risk profile, we will assess your solvency and, depending on your creditworthiness, we

8/17
 will assign you a maximum financing limit or overdraft for products such as checking accounts, cards, loans, or credits
that may be of interest to you. We would perform this assessment on the Bank's own initiative, without your having
requested it, and using information from our own sources or third-party sources that are publicly available or mandatory,
in accordance with the regulations for assessing solvency, such as credit information systems (Risk Information Center
of the Bank of Spain (CIRBE), Asnef-Equifax Servicios de Información sobre Solvencia y Crédito S.L., Experian Bureau de
Crédito, S.A., and credit assessment companies like Equifax Ibérica, S.L.); fraud prevention information systems, such
as Confirma; sources providing real estate valuations, such as Madiva Soluciones, S.L., vehicle appraisals obtained from
EUROTAX; and statistical sources.
For this purpose, we use data such as: identification and contact details, financial and solvency data, transactional
data, sociodemographic data, data on products and services, data included in the Aggregation and Payment Initiation
Services, communications data, data on the use of the channels made available by BBVA to manage your products and
services, information derived from the products and services you have taken out, data on the use of digital channels,
including browsing information and digital behavior data obtained from platforms and media centers assigned to cookies
or devices that we collect when you consent to our web and mobile cookie policy and the use of geolocation data of your
mobile device when you consent to it on the device itself.
The data we process will be that corresponding to the last five years.
In some cases, the data may be processed using mathematical algorithms (automatic processing) to ensure that the
approved financing or the product or service offered is best suited to your personal situation at the time.
You can check the types of decisions that could be made in this manner at https://www.bbva.es/content/dam/
public-web/bbvaes/documents/legal/tratamiento-de-datos/decisiones-automatizadas-ii.pdf, which contains
the relevant information. You also have the right to have an operator intervene to explain the decision made, to take
your comments on the matter, and to challenge the decision.
c) Carbon footprint calculation
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

We will analyze your CO2 emissions to calculate the carbon footprint you generate with your activity from your use of
electricity and fuel. We will do so by using details from your transactions with BBVA, specifically from those transactions
made with cards, as well as from direct debited bills you have in the BBVA accounts that are in your name, provided that
these transactions have been previously categorized as involving electricity, gas and transport. Similarly, we use the
details on the issuer of the bill in order to know the CO2 emission factor that has to be applied to generate this carbon
footprint.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

The carbon footprint is calculated using data that is generated daily or, at the most, in the three previous days.
By analyzing these profiles as described in sections a) and b), we can offer you suggestions to help you manage your finances
and recommendations on the products and services that are best suited to your profile; and with the profile described in
section c) we can show you the level of CO2 emissions that you generate, so that, by knowing your carbon footprint, you can
reduce it.
The legal basis for the processing indicated in the previous sections is the legitimate interest of BBVA in (i) better knowing
its customers and creating a wider and improved range of products and services; and (ii) adjust its products/services to the
needs of customers. We consider this processing to be beneficial to you; in its analysis, we have taken into consideration
your rights and freedoms and, in particular, respect for your fundamental right to the protection of personal data; and
(iii) collaborate with citizens to improve their ecological efficiency by raising awareness among customers regarding the
environmental impact of their daily activities.
You can exercise your right to object by sending an email to [email protected], requesting so at any of
our branches, or through the app in the "Carbon Footprint" section. You can also modify the objection exercised via the email
address indicated above.

(ii) Preparation of advanced commercial and risk profiles

a) Preparation of advanced commercial profile If you give us your consent, we will process your personal data to
prepare your commercial profile in more detail than laid out in section (i) above. We may process your personal data
from a period not to exceed the last (5 years). This processing thus yields highly detailed knowledge of your
preferences as a customer as a result of using more of your personal data.
To draw up your advanced commercial profile, we apply analytical models that allow us to gain a deeper understanding of
your preferences, your payment ability or your financial solvency. To do this, in addition to the data analyzed in the basic
commercial profile, we use data such as: transactional data (including texts by inference of the details of account and card
transactions and other transactions such as origin, destination, purpose and third party related thereto) and details from the
Aggregation and Payment Initiation Services, when you opt in when you sign up for these services. We also use data from
public sources, data involving the delivery of goods or services for which BBVA has provided financing, obtained from the
suppliers of these goods or services.
b) Preparation of advanced risk profile

9/17
 If you give us your consent, we will process your personal data to prepare a broader risk profile in more depth than laid out
in the section above. The personal data we will process may correspond to the validity period of the products you
have with us, which is why this processing entails very detailed knowledge of your preferences as a customer as
a result of using more of your personal data.
To draw up your advanced risk profile, we will analyze your saving and debt capacity and your financial history. To do
this, in addition to the data analyzed in the basic risk profile, we use data such as: transactional (including texts of bills by
inference from the details of account and card transactions, such as origin, destination, purpose and third party related
to the transaction), including data from the Aggregation and Payment Initiation Services, when you consent when you
sign up for these services, from communications, data on how you use the Bank's channels, data you provide through
satisfaction surveys, including the information we collect from your browsing and use of digital channels when you
consent to our website and mobile cookie policy, details of your location (geolocation of your mobile device) when you
consent to it through the device, and data obtained from other sources, in addition to those indicated in the basic risk
profile, such as:

▪ Publicly-accessible sources such as official journals and bulletins, public registers, lists of members of professional
associations and Chambers of Commerce.

▪ Information on profiles obtained from utility companies (energy, communications, etc.).

By applying these models, we can make suggestions for you to manage your finances, recommend offers for products and
services that best suit your profile, and/or apply better conditions to the products and services you have with us or that you
may apply for in the future. Similarly, by applying these models, we will be able to anticipate your needs and offer you, where
applicable, products and/or services adjusted to your profile before you even request them.
In addition, the Bank may, depending on your credit rating and solvency, offer you a maximum funding limit or some other
product that is of interest to you. Said product will be subject to your acceptance of the offer and other specific conditions
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

that we will inform you of as appropriate, such as consulting your financial positions in credit information systems.
In some cases, the analytical models used to prepare profiles may lead us to adopt automated decisions in order to ensure
that the product or service is offered at the right time and suited to your personal situation. You can check the types of
decisions that could be made in this manner at https://www.bbva.es/content/dam/public-web/bbvaes/documents/legal/
tratamiento-de-datos/decisiones-automatizadas-ii.pdf, which contains the relevant information. You also have the right to
have an operator intervene to explain the decision made, to take your comments on the matter, and to challenge the decision.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

The legal basis is your consent.

These profiles will not be used for any other purpose and are designed to offer you the best products and services adapted to
your personal profile at all times. Special data categories are never used to prepare these profiles. For your information, you
can decide whether or not to consent to the processing explained in this section (ii) by checking the corresponding box in the
Basic Data Protection Information “I want BBVA to check and process my data and preferences in more detail in order to
offer me solutions that can help me better manage my finances.”

(iii) Offer you products and services

a) Range of products and services from BBVA or marketed by it
Based on the basic profile described in section (i) above and, if you consent to the advanced profile described in section
(ii), we can send you commercial communications on BBVA products and services, or those marketed by BBVA, in the
financial and insurance field.
We can send you commercial communications on BBVA products and services similar to those you have taken out
directly with the Bank, or those marketed by it, or we can offer you better conditions and/or more suitable prices for the
products and services you have taken out or may take out in the future.
As regards similar products, you may receive commercial communications for BBVA financial products or services or
those marketed by BBVA on behalf of companies with whom it has agreements, such as investment funds, pension
plans, including some insurance policies distributed by BBVA Mediación Operador de Banca Seguros Vinculado. You can
view these products and services here: https://www.bbva.es/content/dam/public-web/bbvaes/documents/legal/
tratamiento-de-datos/listado-productos-y-servicios.pdf.
Likewise, if you have been a BBVA customer, you may continue receiving general commercial information on BBVA
products and services, similar to those you previously had.
The legal basis for this processing is BBVA's legitimate interest to (i) promote its own products and services and
those it markets, and (ii) offer responsible credit, minimize the risk of non-payment and, simultaneously, support
your economic needs to provide you with a loan more quickly, easily, and flexibly. We consider this processing to
be beneficial for you; in its analysis, we have taken into consideration your rights and freedoms and, in particular,
respect for your fundamental right to the protection of personal data. If we send you commercial communications

10/17
 by electronic means (such as email, SMS or instant messaging applications), the legal basis is the exception to the
consent laid out in the regulation on information society services.
You can exercise your right to object by sending an email to: [email protected], or by requesting it
at any of our branches. You can also modify the objection exercised via the email address indicated above.
b) Offer you products and services from BBVA Group companies or from subsidiaries or partners
Based on the profiles described in sections (i) and (ii) above, if you gave your consent for the second one, we can contact
you and send you information on products, services and offers from the companies of the BBVA Group, its subsidiaries
and companies we have partnership agreements with, in these sectors of activity: financial, para banking, insurance,
travel, automotive, telecommunications, utilities, security, IT, education, real estate, consumer products, leisure and free
time, professional services and social services.
The legal basis is your consent to receive advertising material on the products and services of the BBVA Group and third
parties. For your information, you can decide whether or not to consent to the processing explained in this section by
checking the corresponding box in the Basic data protection information "I want BBVA to communicate with me to
offer me products and services of the BBVA Group, its subsidiaries and partner companies".
You can view them at: https://www.bbva.es/content/dam/public-web/bbvaes/documents/gdpr/datos-personales/
sociedades-productos-terceros.pdf

6. Data analysis

At BBVA, we analyze the information about our customers that is generated when you apply for the products you have with
us, as well as from your interactions with the Bank, for the following purposes:

1. Refine our internal processes.

2. Improve and develop new products and services.

Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

3. Gather statistics, conduct surveys, perform actuarial calculations, surveys and/or market studies that may be of
interest to BBVA or third parties.

4. Conduct macro and microeconomic analyses, generate economic indicators, and obtain aggregated economic
information for our own benefit and that of third parties.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

5. Improve the tools available to combat fraud and money laundering.

6. Calculate your ability to pay for pre-approval.

7. Commercial purposes, solvency analysis, advice, scoring or propensity models, customer segmentation, estimates,
recommendations, pricing models.

8. Business monitoring and generation of reports for decision-making support.

To carry out the above purposes, at BBVA we will sometimes create and use tools such as analytical and statistical models,
which are created and supplied with the information described in the section What data do we process?

Whenever possible, BBVA replaces the identification and contact details (identified in the previous section on “data
categories of data”) with a code, always maintaining the correspondence list between each code and the customer to whom
it corresponds independently and securely. This is known as pseudonymized data, and it preserves the identity of the data
holder.

Similarly, whenever possible, personal data will be subject to anonymization, tokenization and aggregation processes
to dissociate the information of any specific individual. We use technical measures in order to protect the identity of our
customers and provide guarantees in the event of security breaches, so that identification is prevented.

The legal basis is BBVA's legitimate interest to (i) continuously improve the quality and functionality of the services we offer
and of our operations, as well as to make a wider and improved range of products and services available to you; (ii) exploit
large volumes of anonymized information while respecting the privacy of customers, in order to have aggregated economic
information to exploit both internally and externally.

We believe this processing to be beneficial to you, and when analyzing it, we have taken into account your rights and freedoms
and, in particular, respect for your fundamental right to the protection of personal data.

If you do not agree, you can object by sending an email to: [email protected], or by requesting it at any
of our branches.

7. Provide your data to BBVA Group companies, subsidiaries or companies with which we have a partnership

11/17
 agreement so they can offer you their own products and services

If you give us your consent, BBVA will provide your identifying, contact, sociodemographic, economic and transactional
information, as well as information on the products and services you have, to the companies of the BBVA Group, its
subsidiaries and companies we have partnership agreements with, in these sectors of activity: financial, para banking,
insurance, travel, automotive, telecommunications, utilities, security, IT, education, real estate, consumer products, leisure
and free time, professional services and social services, which can be viewed at https://www.bbva.es/content/dam/
public-web/bbvaes/documents/gdpr/datos-personales/sociedades-grupo.pdf, for the following purposes:

a) Offer you products and services, including by electronic means, with personalized features and prices, in anticipation
of your needs and whenever you request it.

b) Prepare personal profiles to offer you a price tailored to you for the products and services you have taken out.

c) Prepare statistics and analytical studies involving said data for actuarial, promotional, and commercial purposes.

The legal basis is your consent allowing us to provide your personal data to the companies of the BBVA Group, its subsidiaries,
and the companies with whom BBVA has partnership agreements, so that they can send you advertising material for their
products and services. For your information, you can decide whether or not to consent to the processing explained in this
section by checking the corresponding box in the Basic data protection information "I want my details to be provided only
to companies of the BBVA Group, its subsidiaries and partner companies so they can personalize the products and services
they offer me".

B) OTHER TYPES OF PARTICIPATION

Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

If you are a guarantor

1. Manage the processing of the products and services you have with us, in particular:

▪ Manage the guarantee you provided in favor of BBVA.

▪
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

Manage our relationship with you.

▪ Send you non-commercial notifications to manage your relationship with BBVA.

▪ Monitor, analyze and manage situations of risk, non-payments, incidents or claims.

▪ Manage your access to the various channels made available to you by BBVA so that you can access and manage
the products and services you have with us.

The legal basis is the contractual execution or the adoption of pre-contractual measures.

2. To comply with legal obligations and with regulations applicable to BBVA, in particular:

▪ Inform and consult CIRBE.

▪ Prevent money laundering and terrorist financing (the obligation to report to the Centralized Banking Account
Register does not apply to this type of involvement).

▪ Creation of risk models.

The legal basis for compliance with a legal obligation.

For more information, please consult the content of this processing in section "A) If you are a Customer" included in
section 2. "To comply with legal obligations and regulations applicable to BBVA".

3. Inform and consult credit reporting systems

The legal basis for any communication with credit reporting systems, as well as for inquiries for applications involving
consumer credit, is BBVA's legitimate interest to comply with the responsible credit criteria. The legal basis for inquiries
involving applications for real estate loans pursuant to Law 5/2019 of March 15, which regulates real estate credit

12/17
 contracts, is to satisfy a legal obligation.

For more information, please consult the content of this processing in section "A) If you are a Customer" included in
section 3. "Inform and Consult credit information systems".

4. Prevent fraud, report to and consult the Confirma Database.

The legal basis is a legitimate interest.

For more information, please consult the content of this processing in section "A) If you are a Customer" included in
section 4. "Prevent fraud", which will be applied in full, except for the sending of communications relating to general
information on fraud operations.

If you are a representative or proxy1. Manage the processing of the products and services you have with us, in
particular:

▪ Manage the contract of which you are a party as a representative or proxy because of your legal link to one of
BBVA's clients, under the powers, competencies or instructions you receive from said client to arrange products,
services or transactions.

▪ Send you non-commercial notifications to manage your relationship with BBVA or the relationship of the client
you represent.

▪ Manage your access to the various channels made available to you by BBVA so that you can access and manage
the products and services in your legal capacity as a customer of BBVA.
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

The legal basis is the contractual execution or the adoption of pre-contractual measures.

If you are the representative of a legal entity, the legal basis is BBVA's legitimate interest to maintain commercial and
contractual relations with the entity you represent, in accordance with the provisions of Article 19 of Organic Law 3/2018
of 5 December, on Personal Data Protection and the guarantee of digital rights.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

2. To comply with legal obligations and with regulations applicable to BBVA, in particular:

▪ Anti-money laundering and counterterrorist financing.

The basis for compliance with a legal obligation.

For more information, please consult the content of this processing in section "A) If you are a Customer" included in
section 2. "To comply with legal obligations and regulations applicable to BBVA".

3. Prevent fraud, report to and consult the Confirma Database.

The legal basis is a legitimate interest.

For more information, please consult the content of this processing in section "A) If you are a Customer" included in
section 4. "Prevent fraud", which will be applied in full, except for the sending of communications relating to general
information on fraud operations.

If you are a payee

1. Manage the processing of the products and services you have with us, in particular:

▪ Manage the contract in which you are intervening in your capacity as payee due to your legal relationship with a
BBVA customer.

▪ Send you non-commercial notifications to manage your relationship with BBVA.

▪ Manage your access to the various channels made available to you by BBVA so that you can access and manage
the products and services you have taken out with BBVA.

The legal basis is the contractual execution or the adoption of pre-contractual measures.

13/17
 2. To comply with legal obligations and with regulations applicable to BBVA, in particular:

▪ Prevent money laundering and terrorist financing (the obligation to report to the Centralized Banking Account
Register does not apply to this type of involvement).

The basis for compliance with a legal obligation.

For more information, please consult the content of this processing in section "A) If you are a Customer" included in
section 2. "To comply with legal obligations and regulations applicable to BBVA".

If you are a spouse that provides consent or a non-debtor mortgagor:

1. Manage the processing of the products and services you have with us, in particular:

▪ Manage the maintenance, compliance, development, control and execution of the provisions of the contracts you
have signed.

▪ Send you non-commercial notifications to manage your relationship with BBVA.

The legal basis is the contractual execution or the adoption of pre-contractual measures.

2. To comply with legal obligations and with regulations applicable to BBVA, in particular:

▪ Prevent money laundering and terrorist financing (the obligation to report to the Centralized Banking Account
Register does not apply to this type of involvement).
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

The basis for compliance with a legal obligation.

For more information, please consult the content of this processing in section "A) If you are a Customer" included in
section 2. "To comply with legal obligations and regulations applicable to BBVA".
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

How long will we keep your data for?

We will keep your personal data on file for the duration of the contractual relationship or for as long as necessary for the specific
purpose of each processing. Once it is deleted, we will keep blocked those data that are necessary to:
i) comply with legal obligations; specifically:
a. 10 years pursuant to the law to prevent money laundering and terrorist financing.
b. During the maximum period of time established by the regulation to which financial institutions are subject regarding
the calculation of capital and provisions (European Central Bank, European Banking Authority, and Bank of Spain).

ii) and during the legal limitation periods for the exclusive purposes of processing claims or legal actions.

Once these periods end, we will destroy your personal data.

Who will we disclose your data to?

• (i) Communications to third parties based on legitimate interest, law or to manage a contractual relationship
for purposes set forth in other sections of the Personal Data Protection Policy we communicate risk operations, in
compliance with our legal obligations, to the Risk Information Center of the Bank of Spain (CIRBE) (if you are a customer
or guarantor);

• we communicate identification details and certain contracted products to the Centralized Banking Account Register of
the State Secretariat for Economic Affairs and Business Support in compliance with the regulations for the prevention of
money laundering and financing of terrorism (if you are a customer, representative or authorized user);

• to national and European Union supervisory authorities, such as, among others, the Bank of Spain, the European Central
Bank, the European Banking Authority (EBA) and Spain's National Securities Market Commission, when we are required
to do so pursuant to a legal obligation.

14/17
 • to national and foreign authorities inside and outside the European Union, in compliance with the regulations for the
prevention of money laundering and financing of terrorism; to fraud prevention authorities;

• to BBVA Group companies to comply with their internal regulations on financial crime prevention, their legal obligations
to prevent money laundering and regulatory reporting to the supervisory authorities.

• we communicate the debts that meet the respective requirements to entities that manage the credit information systems,
based on compliance with the regulations (if you are a customer or guarantor);

• to the Confirma and Iberpay fraud prevention systems (if you are a customer or guarantor for the purposes of the
Confirma system);

• to the petitioner of an account ownership verification, through the Iberpay service, with which you have signed or are
going to sign a contract that involves a payment on your part by direct deposit or debit in your account, based on the
contractual relationship you have both with the requesting entity and BBVA.

• to Judges, Courts, Tax Ministry and/or the relevant government agencies, we provide the necessary information in the
event of possible complaints when we are required to do so in compliance with the law.

• when BBVA grants you financing for the purchase of a good or service, BBVA will inform the provider of the good or
service of the corresponding financing operation (operation number, customer and amount) so that the provider can
track and monitor the operations paid by the Bank for the purposes of its own internal billing.

• we notify BBVA Seguros, S.A. de Seguros y Reaseguros of any updates to your personal data when you are also a
customer of this company.

(ii) Communications to third parties based on consent included in purpose 7 of the Personal Data Protection Policy
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

If you consent to this, we may provide your identification, contact, socio-demographic, economic and transactional data and
the products and services contracted to the companies of the BBVA Group, and to subsidiaries and/or other companies with
which BBVA has collaboration agreements, included at this address

https://www.bbva.es/content/dam/public-web/bbvaes/documents/gdpr/datos-personales/sociedades-grupo.
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

pdf

(iii) Communications to third parties within the framework of BBVA operations

, BBVA may provide your personal data to third parties, potential purchasers or interested parties, in those cases where it
is necessary to carry out (i) sales operations of assets, debt or liabilities, as well as sales of loan portfolios, credits or other
type of financing (all with or without mortgage or other guarantees) and (ii) commercial structural modification operations
(including mergers, demergers or divisions), contributions of assets or liabilities and/or sales or contributions of branches of
activity, production units or business, as well as the sales or contributions of companies or other entities (including sales of
shares, company shares, etc.), provided that this communication is necessary for the successful completion of the operation.

In these cases, we will sign agreements with these third parties or potential purchasers or interested parties, which require
them to (i) process your data confidentially and exclusively for the aforementioned purpose and (ii) delete your data
immediately if the operation in question is not formalized.

The legal basis for communicating your data is the legitimate interest of BBVA and these third parties or potential buyers
or interested parties in the successful completion of the operation. The purpose of the communication is to allow them to
access and review the information necessary for these purposes.

(iv) Service providers

In order to offer you a proper service and manage our relationship with you as a customer, at https://www.bbva.es/content/
dam/public-web/bbvaes/documents/legal/tratamiento-de-datos/proveedores.pdf, you will find a categorized listing
of the companies that process your data on behalf of BBVA as part of the services they have been engaged to provide.

We also wish to point out that, for the same purpose as that mentioned in the previous paragraph, certain companies that
provide services to BBVA and that are located outside the European Union may access your personal data (international
data transfers). These transfers are made: (i) to countries with a level of protection equivalent to that of the European Union
(suitability decisions issued by the European Commission); (ii) through standard contractual clauses; (iii) or on the basis of

15/17
 other appropriate guarantees provided for by law.

In any case, BBVA enters into contracts with service providers that guarantee data processing in accordance with BBVA's
instructions and in full compliance with the applicable data protection regulations.

For further information, please contact the BBVA Data Protection Officer at the following email address: dpogrupobbva@
bbva.com

What are your rights when you submit data to us?

RIGHT CONTENT
Access You can view your personal data included in BBVA files.

Rectification You can amend your personal data if it is inaccurate.

Erasure You can request for your personal data to be erased.

You can request:

Objection - That your personal data not be processed, and/or
- Not to be subject to automated decisions.

▪
You can request that processing of your data be restricted under the following circumstances:
Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the

▪
While challenges as to the accuracy of your data are being checked.

▪
When the processing of your data is unlawful, but you object to it being erased.

Processing limitation If BBVA does not need to process your data, but you need it in order to file or defend

▪
claims.

If you have objected to your data being processed in order to comply with an underta-
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

king in the public interest or to fulfill a legitimate interest, while it is considered if the
legal grounds for processing the data prevail over the ones you cite.

You may receive, in electronic format, the personal data you have provided and any data that has
Portability
been obtained due to your contractual relationship with BBVA and transfer it to another entity.

Whenever BBVA carries out automated processing without human intervention, you also have the
Not to be subject to decisions based solely on automated
right to request an operator to explain the decision made, to take your comments on the matter,
processing
and to challenge the Bank on the decision.

SERVICE CHANNELS

BBVA Group Customer Services Department,

[email protected] BBVA Branches
APDO: 1598 - 28080 Madrid

If you believe that we have failed to process your data in accordance with the law, you can contact the BBVA Group Data Protection
Officer at [email protected]

You may also file a claim with the Spanish Data Protection Agency (www.agpd.es).

Exercising these rights is free.

Similarly, if you are a BBVA customer, you may withdraw any consent given, without this affecting the legality of the processing,
as well as configure your options and consents from your online banking profile or on the BBVA app, by sending a request by email
to [email protected], by postal mail to the Servicio Atención al Cliente Grupo BBVA, APDO: 1598 - 28080
Madrid, or by visiting one of our branches.

16/17
 Banco Bilbao Vizcaya Argentaria, S.A., with registered address at Plaza San Nicolás, número 4, 48005 Bilbao, listed in the
Biscay Commercial Register, volume 2083, Folio 1, sheet B1-17-A, entry 1, with Tax ID no. A-48265169

17/17