ANNEX DETAILED INFORMATION ON THE PROTECTION OF PERSONAL DATA (2nd DATA PROTECTION INFORMATION LAYER) Editorial version – June 2026*

(*) see at the end of the document summary of changes versions

DATA CONTROLLER
Banco de Sabadell, S.A.	Registered office: Plaça de Sant Roc nº 20, 08201 Sabadell The Data Subject may contact Banco Sabadell's LOPD Rights Unit at its registered office or via the following email address: ejercicioderechosprotecdatos@bancsabadell.com	Contact details of the Data Protection Officer. Plaça de Sant Roc nº 20, 08201 Sabadell dataprotectionofficer@bancsabadell.com

1. Management and implementation of the application and the contract/transaction

1.1. Execution of an application to engage and, where appropriate, implement, control and maintain the contractual relationship with the Bank and the performance and management of the transactions or operations arising therefrom.
Legal basis: Execution of the contract/operation	Contractual document, application or agreement that governs the individual relationship with the customer and serves as a legal basis for the formalisation and maintenance of products and services with the Bank.
Compulsory data:	Without them it is not possible to enter into contract.
1.2. The Bank may process your personal data in order to contact the Data Subject by any medium, including electronic means, in the event that any application or contracting procedure has been interrupted or has not been completed, for technical reasons or on your part, in order to clarify questions, resolve incidents or assist in its completion.
Legal basis: Processing of the application	Management of an application or procedure for entering into a contract for any product with the Bank.
Compulsory data:	They are necessary to process the application.
1.3. In the event that an application or contract for a main product contract includes additional benefits, insurance coverage or advantages in addition to the primary provision, the Bank may communicate personal data to the service companies and/or insurance company for the management and monitoring of the additional provision, coverage or service, including updating the insured amount and, where appropriate, processing the claim.
Legal basis: Processing of the application, contract or transaction	To manage the provision, coverage or additional service of the contract entered into with the Bank.
Compulsory data:	Without them it is not possible to enter into contract, manage or monitor the insurance or any additional service.

2. Prevention of money laundering

2.1 The Data Subject has been informed that the legislation currently in force on the prevention of money laundering obliges banks to obtain from their customers information on their economic activity and to verify their economic activity. For this exclusive purpose of verifying the information provided, the signatory may give their express consent to the Bank so that, on their behalf, they can request the aforementioned information from the General Treasury of the Social Security. The data obtained from the General Treasury of the Social Security shall be used exclusively to manage the foregoing. In the event of non-compliance with this obligation by the Bank and/or the staff who provide services thereto, all the actions set forth in Regulation (EU) 679/2016 of the European Parliament and of the Council concerning the protection of natural persons and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, and regulations that develop, modify or replace it.
Legal basis: Compliance with legal obligations and consent of the Data Subject in the event authorisation is granted to consult the General Treasury of the Social Security	To verify the information provided by the Data Subject themselves or through the data held in the General Treasury of the Social Security in accordance with legal obligations regarding the prevention of money laundering and financing of terrorism.
Compulsory data:	Those necessary for the verification and fulfilment of the legal obligations regarding the Prevention of Money Laundering. The granting of the consent to authorise the Bank's access to the information of the General Treasury of the Social Security is not mandatory, although it is necessary to enable the Bank to enter into and maintain contractual relations with the data subject, as a result of which, if the consent is not granted, said information must be obtained through other documentation that proves the economic activity provided by the data subject.
2.2 The Bank is required to notify the Executive Service of the Commission for the Prevention of Money Laundering and Monetary infractions of: the identifying details of all account holders, representatives or authorised signatories, and any other persons with powers of disposal over current accounts, savings accounts, term deposits and any other type of payment account, as well as safe deposit box rental agreements and their rental period, regardless of their trade name, together with any changes thereto; the date of opening and closure, and any other mandatory information arising from the aforementioned deposit accounts and safe deposit boxes. These data shall be processed under the responsibility of the Secretariat of State for Economy and Business Support (Calle Alcalá, 48, 28014, Madrid) for the purpose of preventing and combating money laundering and the financing of terrorism. The Bank shall send information on this obligation to the address agreed upon in the contract or agreement to send correspondence and the data subject who receives this correspondence shall be duty bound to inform the other data subjects of the Bank’s legal obligation.
Legal basis: Fulfilment of legal obligation	Pursuant to Article 43 of Law 10/2010. The Financial Holders File is created for the purpose of preventing and deterring money laundering and the financing of terrorism set forth in Article 51 of the Regulation of the Law.
Mandatory data	They are necessary because otherwise the Bank would not be able to enter into or maintain contractual relationships with the Data Subject.
2.3. Processing of personal data collected by the Bank necessary for the fulfilment of due diligence obligations including those arising from the provision of pooling and payment initiation services in the event that holders have contracted such services.
Legal basis: Fulfilment of legal obligation	Pursuant to Law 10/2010 of 28 April on the prevention of money laundering and the financing of terrorism, in accordance with Article 32.bis of that law, and pursuant to the provisions of Article 8.1 of Organic Law 3/2018 of 5 December and Article 6.1 c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
Mandatory data	Data necessary to implement due diligence measures.
2.4 The Bank may look up information relating to the beneficial ownership of legal persons in the Central Register of Beneficial Ownership, managed by the General Council of Notaries. Such consultation shall have the sole purpose of verifying the identity of the beneficial owner and complying with the applicable legal obligations. The Bank may contact the beneficial owner in order to address any discrepancies between the information recorded in the aforementioned Register and the information provided to the Bank by the client.
Legal basis: Fulfilment of legal obligation	As provided for in Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing, in accordance with Article 4 of said Law, and pursuant to the provisions of Article 9 of Royal Decree 304/2014 of 5 May, approving the Regulation implementing Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing.
Mandatory data	Data required to verify identification.
2.5 Banco Sabadell, S.A. shall, on the basis of the legitimate interest of a third party, disclose to Bansabadell Vida S.A. de Seguros y Reaseguros and Bansabadell Pensiones, EGFP, S.A., whose products it distributes, the necessary client data to enable those companies to comply with the regulations on the prevention of money laundering and terrorist financing in relation to ongoing due diligence. The client may object at any time to this disclosure of data in the manner set out in the section “Data Subject Rights” of this Annex. In such case, the client must provide the data directly to the aforementioned companies, which are reporting parties for the purposes of anti-money laundering regulations.
Legal basis: legitimate interest of a third party	The disclosure is carried out on the basis of the legitimate interest of the recipient entities (Article 6.1.f of Regulation (EU) 2016/679), consisting of ensuring compliance with their legal obligations regarding ongoing due diligence.
Mandatory data	Data necessary for the application of due diligence measures.

3. Processing of data related to the fulfilment of monetary obligations

3.1. The CIRBE (Bank of Spain’s Risk Information Centre), in the granting of asset operations to the data subjects who are subject to the regulations, as well as in the event of non-payment of the monetary obligations set forth in the contract in favour of the Bank within the term stipulated for this purpose, the data relating to the financing and non-payment, as appropriate, may be disclosed to files related to the fulfilment or non-fulfilment of monetary obligations that are mandatory in compliance with the applicable financial regulations.
Legal basis: Fulfilment of legal obligation	As set forth in Regulation (EU) 679/2016 of the European Parliament and of the Council on the protection of natural persons and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, or any regulations that replace or amend it. In the case of the CIRBE, also application of Memorandum 1/2013 of 24 May on the Central Credit Register or regulations replacing it.
Compulsory data	The Bank may not enter into contractual relationships with the Data Subject.
3.2 The Bank is hereby informed of its right to consult the Credit Information Systems insofar as this is necessary to assess the financial solvency of the Data Subject, or has given its consent in accordance with section 9.1 of this Annex. Accordingly, the Bank may, where appropriate, process data obtained from issuing entities regarding their financial solvency or creditworthiness.
Legal basis: Legitimate interest of the Data Controller or the Data Subject’s consent prior to analysing the solvency status thereof, unless there is a legal obligation to consult them on the basis of the Entity’s activities	Weighting set forth in Regulation (EU) 679/2016 of the European Parliament and of the Council on the protection of natural persons and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, or any regulations that replace or amend it. Specifically, article 20.1.e) of said Organic Law establishes the legal basis of this processing.
Compulsory data	In order to carry out the operation requested by the Data Subject.
3.3. It is hereby informed that, in the event of non-payment of the monetary obligations set forth in the contracts in favour of the Bank, within the time limit laid down for that purpose, the data relating to the default and any additional information to which the Bank may be entitled to legitimately access, may be processed by the Bank for the purpose of recovering amounts due as a result of non-payment. Similarly, data relating to the non-payment may be disclosed to credit information systems for inclusion in the respective files (ASNEF, BADEXCUG, CIRBE, RAI) relating to compliance or non-compliance with monetary obligations. For natural persons, the requirements set forth in Regulation (EU) 679/2016 of the European Parliament and of the Council regarding the protection of natural persons and Organic Law 3/2018, of December 5, of Personal Data Protection and guarantee of digital rights or in the regulations that modify or replace it must be met for this purpose.
Legal basis: Legitimate interest of the Data Controller.	As set forth in Regulation (EU) 679/2016 of the European Parliament and of the Council on the protection of natural persons and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, or any regulations that replace or amend it. Specifically, article 20.1.a, b, c and d) of said Organic Law establishes the legal basis of this processing.
Mandatory data	In order for the data subject to contract the product or service; this processing cannot be opposed as they are prevailing legitimate interests for the achievement of the purposes of the processing.

4. Transfer of data for fraud prevention and for the Account Holding Service (AHS)

4.1.- Transfer of data for the prevention of fraud between the Bank and the companies of the group, subsidiaries and investee companies, whose relationship is published at www.bancosabadell.com/empresas_del_grupo
Legal basis: Legitimate interest	Pursuant to Regulation (EU) 679/2016 of the European Parliament and of the Council concerning the protection of natural persons and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Personal Data Protection and Guarantee of Digital Rights, or any regulation that replaces or modifies it. Specifically, Recital 47 of the aforementioned Regulation establishes the legal basis of this processing.
Compulsory data	This is necessary in order for the Bank to mitigate the resulting loss from fraud and fraud prevention.
4.2. - Reporting of fraudulent transactions and suspected fraudulent transactions to the common fraud prevention file on payment transactions. The personal data of the Data Subjects may be included by Banco de Sabadell, S.A. in a common file for the prevention of fraud in banking transactions, managed by Sociedad Española de Sistemas de Pago S.A. (Iberpay) to detect, investigate, control and possibly report suspicious and fraudulent transactions committed on their current or savings account. The data included by Banco de Sabadell, S.A. in the aforementioned common file shall be those relating to the IBAN number and the holder of the account where the suspicious or fraudulent transaction has been detected, if applicable, and may be known by the financial institutions adhered to the aforementioned common file, as assignees, for the sole purpose of detecting, preventing and controlling fraud. You can consult the updated list of the entities adhered to the common file through the following link: https://www.iberpay.es/Secciones/04MasServicios/Paginas/PrevencionFraude.aspx. The processing shall be carried out on a co-responsibility basis, and the essential aspects of this co-responsibility agreement shall be made available to the data subjects. The data shall be processed for this purpose in the file for a maximum of thirty days in the case of suspicious transactions, and for one year in the case of fraudulent transactions (when the fraud has been confirmed by the data subject). For more information on the functioning of the common fraud prevention file for banking transactions, please send an email to infoBS@bancsabadell.com.
Legal basis: Legitimate interest	As set forth in Regulation (EU) 679/2016 of the European Parliament and of the Council on the protection of natural persons and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, or any regulations that replace or amend it. Specifically, Recital 47 of the aforementioned Regulation establishes the legal basis of this processing.
Compulsory data	This is necessary in order for the Bank to mitigate the resulting loss from fraud and fraud prevention.
4.3.- Consultation of fraudulent operations and operations suspected of fraud in the common fraud prevention file on payment transactions. The personal data of the Data Subjects may be consulted by Banco de Sabadell, S.A. in a common fraud prevention file in banking transactions, managed by Sociedad Española de Sistemas de Pago S.A. (Iberpay) to detect, investigate, control and possibly report suspicious and fraudulent transactions committed on their current or savings account. All suspicious and fraudulent transactions contained in the Service shall be visible and known to all participants. The data consulted by Banco de Sabadell, S.A. in the aforementioned common file shall be those relating to the IBAN number and the holder of the account of the member of the System that has declared it and that has detected a suspicious or fraudulent transaction, where applicable, and may be consulted by the financial institutions which are members of the common file, with the sole purpose of detecting, preventing and controlling fraud. You can consult the updated list of member institutions of the joint file at the following link: https://www.iberpay.com/Secciones/04MasServicios/Paginas/PrevencionFraude.aspx The processing shall be carried out on a co-responsibility basis, and the essential aspects of this co-responsibility agreement shall be made available to the data subjects. Due to the fact that the data of the Data Subjects are consulted and the existence of the data in the common system, Banco de Sabadell, S.A. shall not apply negative consequences either to the accounts or to the holders of suspicious transactions by the mere fact of the inclusion thereof in the Service's common file. This inclusion, by itself, shall in no case justify the blocking of the transaction or negative decisions regarding the opening of accounts, the granting of credit or loans or the refusal of other types of banking services, based exclusively on the inclusion of your data in the Service's common file. Banco de Sabadell, S.A. distinguishes between the injured parties and the alleged fraudsters, as well as the type of accounts affected in order to be able to establish measures to strengthen the security of the financial products of those injured by the fraud, depending on the specific scenario that takes place, always in accordance with criteria of proportionality and taking into consideration the importance of ensuring the necessary quality and accuracy of the data processed.
Legal basis: legitimate interest	Legitimate interest in the detection and prevention of fraud in banking operations with their origin or destination in the account, as well as the interest of the account holders who may be affected by fraud committed by third parties. As set forth in Regulation (EU) 679/2016 of the European Parliament and of the Council on the protection of natural persons and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, or any regulations that replace or amend it. Specifically, Recital 47 of the aforementioned Regulation establishes the legal basis of this processing.
Compulsory data	They are necessary to enable the Bank to mitigate the loss from fraud and to prevent fraud.
4.4. Request by the Bank itself or for a customer of the Bank for confirmation of ownership of a payment account from another entity. In execution of the interbank Account Ownership Service (STC) developed by Sociedad Española de Sistemas de Pago, S.A. (Iberpay) under the contract between Iberpay, the Bank and the other participants in the service, the Bank may request on its own behalf or for a customer of the Bank who has contracted the Service through the Bank, confirmation of the ownership of a payment account of a customer of the STC's member entities.
Legal basis: The Bank's compliance with its legal obligations in the detection of money laundering and financing of terrorism and the legitimate interest of the third party in the case of verification by the Bank's customers, arising from the business relationship and execution of the STC membership contract between Iberpay and each of the participants, including the Bank, and from the business relationship between the STC verification applicant (the Bank's customer) and the data subject, in order to prevent fraud, fulfil the respective contract, and avoid errors in direct debit or other payment transactions, as well as the improvement or automation of processes.	Participating institutions may request confirmation of the ownership of a payment account through AHS in their own legitimate interest or that of their own customers by means of a swift and immediate mechanism that ensures the reduction of fraud, errors in direct debits and other payment transactions involving a payment account or the improvement of the automation of processes, among others.
Mandatory data	The data provided by the Applicant for transfer to the receiving Participant entity are necessary for verification.
4.5. Receiving a request from another bank or its customer for confirmation of ownership of a payment account held by a customer of the Bank. In execution of the interbank Account Ownership Service (STC) developed by Sociedad Española de Sistemas de Pago, S.A. (Iberpay) under the contract between Iberpay and the Bank and the other participants in the service, the Bank may receive a request to confirm the ownership of a payment account held by a customer of the Bank to another participating entity in the STC or to a customer of the latter.
Legal basis: The requesting entity's compliance with legal obligations in the detection of money laundering and financing of terrorism and the legitimate interest of the third party in the event of verification by the customers of those entities, derived from the business relationship and execution of the STC membership contract between Iberpay and each of the participants, including the Bank, and the business relationship between the STC verification applicant (the Bank's customer) and the data subject, in order to prevent fraud, fulfil the respective contract, and avoid errors in direct debits or other payment transactions, as well as the improvement or automation of processes.	Participating entities can apply for the AHS in its own legitimate interest or in that of its customers by means of an immediate mechanism to ensure the reduction of fraud, direct debit errors and other payment transactions concerning a payment account or improved process automation, among others.
Mandatory data	The data provided by the Applicant for transfer to the receiving Participant entity are necessary for verification.
4.6 Please be informed that if the client uses the Bank's application to carry out a money transfer transaction, such as a bank transfer or Bizum, the Bank may determine whether the client is simultaneously on an active call (incoming or outgoing) or has a call on hold, in order to detect potential fraud attempts. The Bank has no access to the content of the call. You may withdraw your consent at any time from your mobile or device settings.
Legal basis: legitimate interest in fraud prevention or, where requested, consent.	Its own legitimate interest in detecting and preventing fraud in banking transactions originating from or destined to your account, as well as on the interest of the account holders who may be affected by fraud committed by third parties. Provided for in Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons, and in Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights, or any legislation that replaces or amends them. Specifically, Recital 47 of the aforementioned Regulation establishes the legal basis of this processing.
Mandatory data	Data necessary to identify potential fraud attempts.

5. Processing funds transfer orders

In the case of fund transfer orders, credit institutions and other payment service providers, as well as payment systems and related technological service providers to which the data is transmitted to carry out the transaction, may be obliged to provide information about the transaction to the authorities or official bodies of other countries, located both inside and outside the European Union, within the framework of the fight against the financing of terrorism and serious forms of organised crime and the prevention of money laundering.
Legal basis: Execution of the contract/operation in the case of the processing of one's own orders and compliance with a legal obligation in the case the Bank is obliged to communicate information to authorities or official bodies.	In the case of transfers of funds under the legislation of the State where it operates, or by agreements concluded by it, the Bank is obliged to provide information about the transaction to the authorities or official bodies of other countries, located inside and outside of the European Union alike, within the framework of the fight against the financing of terrorism and serious forms of organised crime and the prevention of money laundering of the execution of the contract or in compliance with a legal obligation. In the event that such processing involves international transfers of data, we hereby inform you that such transfers are necessary to execute the orders requested by the Data Subject, in accordance with the provisions of the Data Protection regulations.
Compulsory data	They are necessary in the framework of the fight against the financing of terrorism and serious organised crime and the prevention of money laundering.

6. Carrying out assessments, monitoring and risk profiles, in credit or contracting matters, default recovery capacity, as well as others for commercial purposes

The Data Subject is hereby informed that the Bank may carry out processing related to valuations, monitoring and risk profiles, in credit or contracting matters, default recovery capacity or for commercial purposes.
Legal basis: based on submitting a credit application and/or the fulfilment of a legal obligation.	Insofar as the customer has applied for a specific product and the Bank has to carry out a risk analysis, it may decide on the conclusion of the contract. In this regard, the processing is necessary to carry out the request, on the basis of Law 16/2011 of 24 June, Law 5/2019 of 15 March, Order EHA 2899/2011 or any other regulation which, like the aforementioned, imposes on the Bank the duty to collect information for risk assessment purposes. The Bank may continuously monitor and evaluate the quality of its credit exposures and the financial situation of those clients with credit risk, to ensure that any subsequent changes in credit risk can be identified and quantified with regard to the initial recognition of credit exposures and in order to be able to contact and discuss the situation and possible solution with the data subjects. Ongoing monitoring shall be based on internal information on customers' credit operations and payment practices, as well as on the use of external sources (e.g. credit bureaus or information provided directly by the customer), where appropriate. This processing is carried out on the basis of the Guidelines on Granting and Monitoring loans of the European Banking Authority EBA/GL/2020/06 of 29/05/20 by applying the monitoring indicators and ratios foreseen therein.
Compulsory data	The Bank may not grant or maintain the respective risk or contracting operation with the Data Subject.
Legal basis for profiling: Legitimate interest	In cases in which the Bank conducts a risk analysis or profiles with a commercial interest with a view to personalising a particular product or service for the customer that is not requested using the entity's internal databases, such as movements and transactions (movements with a sufficient but not excessive history to identify the current situation). The customer can always object to this processing at any time. This processing is conducted in keeping with the weighting carried out upon the basis of the Report of the Legal Bureau of the Spanish Data Protection Agency relating to this matter (213763/2017). The Bank may carry out profiling of those clients who have not paid any of the monetary obligations provided for in the contracts in favour of the Bank in order to predict their capacity and willingness to pay or settle the debt, on the basis of behaviour, previous actions and the application of models. All of this is based on the Bank's legitimate interest in knowing the ability to recover and pay monetary debts.
Legal basis for profiling: Consent	In cases where the Bank performs a risk analysis or profiling with a commercial interest with a view to customising a specific unsolicited product or service to the customer using the Bank's external databases. The Bank will only carry out this processing if it has obtained consent from the data subject.

7. Video surveillance

It is hereby notified that the Bank's offices, branches, buildings and corporate centres are equipped with surveillance cameras. Surveillance camera systems are installed in order to monitor entry and exit to the different offices, as well as for the Bank's security purposes. The Bank shall not use surveillance cameras in a manner that is incompatible with the purpose expressly set out and undertakes to store the images collected in good faith and in accordance with the purpose described.
Legal basis: Compliance with legal obligation and public interest, depending on the type of video surveillance carried out	It is based at Bank establishments or branches where funds or securities are held in article 120 of Royal Decree 2364/1994, of 9 December, which approves the Private Security Regulation and in the rest of the spaces in Regulation (EU) 679/2016 of the European Parliament and of the Council regarding the protection of natural persons and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, and by Instruction 1/2006, of 8 November, of the Spanish Data Protection Agency, on the processing of personal data for surveillance purposes through camera or video camera systems, or by regulations that modify or replace it.
Compulsory data	To access the Bank's premises, offices or buildings, otherwise access is not possible.

8. Processing of Personal Data Biometrics

The Bank may provide devices and tablets to digitise handwriting and signatures and other biometric readers of a physical, physiological and behavioural nature, including retina scanners, voice, facial and fingerprint images and dactyloscopic data, among others, measures which, in any event, shall be announced prior to obtaining consent, as appropriate, available through its branches, mobile managers and centres, enabling the data subject to subscribe to operations, applications, instructions, contracts, orders, declarations and documents of any kind. All of the foregoing requires the processing and retention of the biometric data of the Data Subject obtained through the digitalisation of the signature and recording of said data in order to be able to accredit the identity of the signatory and the authenticity of the documentation or transaction signed.
Legal basis: Data Subject Consent
Compulsory data	In the event that the documents or operations are signed biometrically by the Data Subject, they are necessary to manage and accredit the consent granted biometrically in the context of the development or execution of the contract/operation. If the process available to formalise and execute the contract is exclusively with the processing of biometric data, without the consent of the data subject, that product or service cannot be contracted by that means, with other different channels available to the data subjects.

9. Processing for commercial purposes.

9.1. The Bank may process the following personal data: - Those that you provide directly in your relations with the Bank and during the contracting of products and services, and - Those derived from: (i) the performance of operations or implementation of the products and services contracted with or marketed by the bank; (ii) applications, proposals, preliminary deals and quotes of the above-mentioned products and services or any other kind of relationship maintained with the bank; (iii) third-party entities that have been authorised to access the bank, expressly including those resulting from the provision of information services and the aggregation of information on payment accounts or services associated with them. The personal data processed in all these cases consist of contact details, residence or addresses, financial, property and relationship data, balances, amount of the transactions, institutions issuing the direct debits or transfers and the items or types of transaction. In no case shall data listed in the special categories of art. 9 of the General Data Protection Regulation be processed (except as expressly mentioned in the previous section for biometric data). This includes details of operations, movements and transactions carried out via accounts, cards or any other product or service held with the Bank and the texts thereof. These data shall be processed for the purpose of verifying the possible product procurement needs of our customers, offering them the products or services that the Bank may induce and understand that may be compatible with and relevant to this information (such as, for example, the purpose, basis or cause of certain cash transfers, direct debit of bills and their issuers, as well as the issuer or recipients of the aforementioned transactions). All of the foregoing with the purpose, if the Data Subject has consented to it, to offer him/her products and services and/or to send him/her commercial communications, offers, proposals and promotional advantages indicated, by any means, including electronic means (telephone, e-mail or equivalent means), with regard to the products or services that meet the following conditions: They are marketed by the Bank, belong to the Bank itself or to the companies of the Banco Sabadell Group, subsidiaries and investees (the list of companies is published and kept up to date at: www.bancosabadell.com/empresas_del_grupo) and Are also of any of the following types: banking products or services, insurance, welfare, investment services, collective investment, renting and vehicles, movable assets and property, consumer products and services, sale of tickets for events and any other similar products and services in the various possible ways of marketing them, either directly, as an ancillary to or jointly with others.
- Draw up business and risk profiles based on analysing and assessing your personal data indicated to tailor commercial communications and offers that are sent to you in accordance with the profile, potential interests or possible preferences resulting from such analyses and assessments. - Make enquiries in Credit Information Systems (ASNEF; BADEXCUG; CIRBE; RAI) about possible default on your part of monetary obligations at any time, in order to adjust such offers of products or services to your commercial or risk profile (loans or pre-granted credits; insurance or any other product or service of the type indicated above) without the need for a specific, prior and express request or authorisation on your part but rather at the initiative of the Bank itself.
Legal basis: Consent of the Data Subject, except for specific cases in which there is legitimate interest	It is based on the consent of the data subject, which may be revoked at any time, notwithstanding the fact that the Bank may process personal data without the need to obtain prior consent in cases covered by a legitimate interest on the part of the Bank. This legitimate interest has been weighted and has its basis both in Recital 47 of the General Data Protection Regulation with regard to marketing and the interpretation given by the Spanish Data Protection Agency in its legal bureau's report Ref. 213763/2017.
Voluntary data	In the event that consent is not given, it does not prevent the contractual relationship from being maintained or the respective transaction from being carried out in the context of which it is requested. Without prejudice to the foregoing, there shall be specific cases where the legal basis is legitimate interest, and in the cases legally set forth in article 21.2 of Law 34/2002, of 11 July, on information society services and electronic commerce, as well as pursuant to Recital 47 of the General Data Protection Regulation.
9.2. The transfer of the personal data for these purposes, in the same expressed terms, to the companies of the Banco Sabadell Group and the investees referred to in section 9.1. above, similarly referred to in said section, for the purpose of offering products and services and sending commercial correspondence in relation to the types of products marketed by said companies. Information relating to contracts and transactions, as well as proposals and commercial offers, may be sent in grouped form, including together with information relating to the bank account linked to the respective product or service.
Legal basis: Data Subject Consent	It is based on the consent given by the Data Subject, which may be revoked at any time.
Voluntary data	Refusal to grant consent shall not prevent the continuation of the contractual relationship or the performance of the respective transaction within whose framework the formalisation is requested.
9.3 You are informed that your personal data may be processed for the purpose of verifying compliance with the conditions required to participate in promotions organised by the Bank. In the case of a promotion aimed at new customers, the Bank may verify whether the data subject has maintained or maintains a legal relationship with the Bank. Personal data may also be processed for the management, control and execution of such promotions.
Legal basis: Based on legitimate interest and the performance of the promotion terms and conditions	It is based on the Bank's legitimate interest in verifying that the conditions required to participate in or benefit from its promotions are met and in preventing fraud (Article 6.1.f of Regulation (EU) 2024/886), as well as on the performance of the promotion terms and conditions (Article 6.1.b of Regulation (EU) 2024/886).
Mandatory data	Data necessary for the Bank to mitigate losses arising from fraud and to prevent it.

10. Recording of non-customer calls

10.1 The Bank may record telephone calls on the basis of its legitimate interest in order to monitor incoming and outgoing calls to non-customers, for quality control purposes and to improve the service and information provided about its products and services, as well as for security purposes. Non-customer data subjects will be informed that the call is being recorded and may refuse consent and end the call. In any event, individuals who do not wish to use the telephone channel may be assisted in person at any Bank branch. Where the purpose of the call is to obtain information about investment services, the entity will be required, in compliance with its MiFID obligations, to record such calls.
Legal basis: Consent / Comply with a legal obligation	It is based on the data subject's consent to participate in a phone conversation and/or in compliance with the legal obligation to record the conversations relating to the information provided at the time of carrying out the instructions, requests or agreements for the contracting of products and services, as well as the information and conversations held prior to or after the procurement thereof.
Mandatory data	In the event that the documents or operations are subscribed by telephone by the Data Subject, they are necessary to manage and accredit the consent granted in the context of the development or execution of the contract/transaction.
10.2. The Bank may process personal data in order to propose surveys to non-customers by any means, with the aim of analysing their level of satisfaction and identifying potential improvements to the Bank's processes, services and products.
Legal basis: Legitimate interest	On the basis of its legitimate interest, the Bank may process such data for the above-mentioned purpose. In any event, the data subject may exercise their right to object to this processing, as set out in the section "Data Subject Rights".
10.3 The Bank will process the data obtained from completed surveys, subject to the data subject's prior consent to participate, in order to analyse their satisfaction and identify potential improvements to the Bank's processes, services and products. Where possible, the data will be anonymised in accordance with the section on the processing of anonymised and pseudonymised data. Under no circumstances will data relating to health, racial or ethnic origin, sexual orientation, political opinions, trade union membership, religious or philosophical beliefs be processed.
Legal basis: Data Subject's Consent	It is based on the data subject's consent for their data to be processed for the aforementioned purpose. The data subject may refuse to participate in the survey at any time.
Voluntary data	If consent is not granted, this will not prevent the continuation of a contractual relationship or the carrying out of any transactions with the Bank.

11. Recording of customer calls and customer satisfaction surveys

11.1. The Bank may, on the basis of its legitimate interest, record telephone calls in order to monitor the various calls that may be received from or made to customers, for the purposes of quality control, improving customer service and the information provided about products and services, as well as for security reasons. The customer will be informed that the call is being recorded and may refuse consent and terminate the call. In any event, customers who do not wish to use the telephone channel may be assisted in person at any Bank branch. Where the call is made for the purpose of obtaining information about investment services, the entity will be required, in compliance with its MiFID obligations, to record such calls.
Legal basis: Consent/ Legitimate interest/ Compliance with a legal obligation	It is based on the data subject's consent to participate in a phone conversation and/or in accordance with the legal obligation to record conversations related to the information provided at the time of making instructions, requests or agreements for contracting products and services, as well as the information or conversations held prior or following the procurement thereof. Similarly, the Data Controller may record the calls on the basis of the legitimate interest of being able to prove the existence thereof and its content for the defence of interests in dealing with and resolving claims.
Mandatory data	In the event that the documents or operations are contracted by telephone by the Data Subject, they shall be required to manage and accredit the consent given within the context of developing or executing the contract/operation.
11.2. The Bank may process personal data for the purpose of proposing surveys to its customers by any means in order to analyse their satisfaction and possible improvements in the Bank's processes, services and products.
Legal basis: Legitimate interest	The Bank may, in its legitimate interest, process such data for the aforementioned purpose, and the Data Subject may in any case exercise his/her right to object to such processing as indicated in the section on the Rights of the Data Subject.
11.3. The Bank will process the data derived from the surveys carried out, subject to the consent of the data subject, in order to analyse their satisfaction and possible improvements in the Bank's processes, services and products. As far as possible, the data shall be anonymised as regulated in the section on Processing of anonymised and pseudonymised data, and under no circumstances will data regarding your health, racial or ethnic origin, sexual orientation, or political, trade union, religious or philosophical affiliation be processed.
Legal basis: Data Subject Consent	It is based on the data subject's consent to the processing of their data for the aforementioned purpose, and they may refuse to take part in the survey at any time.
Voluntary data	Refusal to grant consent shall not prevent the continuation of a contractual relationship or any other transaction with the Bank.

12. Commercial processing of data after termination of the contractual relationship

With a view to contacting and carrying out commercial actions again with former clients, to offer them specific personalised conditions or products, and provided that the consent of the Data Subject is obtained, the Bank may contact them for the purposes set out.
Legal basis: Consent	Acceptance by the Data Subject.
Voluntary data	Failure to give consent does not prevent processing for the purposes of fulfilling other legal obligations assumed by the Data Controller.

13. Processing of anonymised and pseudonymised data

In some cases in which the Bank needs to carry out certain analyses, it will carry out full anonymisation of the data subject's personal data. It will therefore be impossible to link the information directly or indirectly to a person. In this case, they will be aggregated data, meaning that it will not be possible, under any circumstances, to re-associate the information with the data subject, in other words, it is an irreversible anonymisation process. The processing of the personal data will be carried out during the anonymisation process, as the further processing thereof will not be subject to data protection legislation, as the natural persons cannot be identified. Similarly, in order to maximise the technical security measures, the Bank will carry out pseudonymisation processes.
Legal basis: Legitimate interest	For each purpose that requires the anonymisation of data based on the legitimate interest that is the basis for the subsequent processing of this information, the corresponding Weighting Analysis shall be conducted by the Data Controller which, as shall be explained below, shall be available to the data subjects in its essential elements.
Anonymised data	In accordance with the provisions of data protection regulations.

14. Verification or extension of data

The Bank may update the data of the Data Subject, either by means of personal data provided by the Data Subject himself/herself or by means of data that are clearly in the public domain such as those derived from open social network profiles or access to a source that is covered by a legal authorisation (public registers or credit information systems). With a view to complying with the principle of data accuracy, on the basis of its own legitimate interest, it shall proceed to the constant verification or extension of the data of the Data Subject.
Legal basis: Legitimate interest	For each purpose that requires the updating of data based on the legitimate interest, the corresponding Weighting Analysis will be conducted by the Data Controller which, as will be explained below, will be available to the data subjects in its essential elements.
Mandatory data	Maintaining data quality.

15. Data processing to verify that the payee name and IBAN number match in transfers.

Purpose of processing: The Bank will process personal data (name, surname and account number) to verify that the payee's name and account number match in order to prevent errors in the execution of transfers and to avoid fraudulent or erroneous payments. This verification will be carried out: When the Bank acts as the payee of a transfer, verifying that the name provided by the payer matches the account number (IBAN) of the destination account at the Bank. When the Bank acts as the issuing entity of a transfer, checking whether the data provided by the data subjects match at the receiving institution before executing the transaction.
Legal basis: Fulfilment of legal obligation	Compliance with a legal obligation, provided for in Regulation (EU) 2024/886 of the European Parliament and of the Council on instant transfers, which imposes an obligation on payment service providers to offer a service to verify that the payee's name and IBAN match.
Mandatory data	The details of the payees (name, surname and account number) necessary to carry out the verification and ensure the correct execution of the transfer.

ORIGIN OF THE DATA
- Personal data that you provide us with at any given time, as well as data derived from the transactions you carry out through the Bank, of which you become aware in connection with applications, preliminary dealings, proposals or simulations of the aforementioned products and services or arising from any relationship with the Bank, or data from third parties in respect of which you have authorised access to the Bank, or data that may be obtained from other sources of information of a public nature or access, social networks, browsing data through cookies, or even those obtained through the use of automatic techniques based on current, historical and statistical data such as residence, wealth or income, and consumption data. Furthermore, sometimes, as a consequence of the product they wish to contract, the parties involved may communicate third-party data. The Data Subject shall be obliged to inform and, where appropriate, obtain the consent of these third parties to communicate the data to the Bank for the purposes necessary as a result of contracting the specific product.
DATA RETENTION TERMS
The Bank shall retain the Data Subject's data for the duration of the contractual relationship and following termination thereof for the period of limitation of the actions that may arise from the product/operation contracted by the Data Subject, as well as to fulfil the legal obligations incumbent upon it. Without prejudice to the foregoing, in order to be able to contact and carry out commercial actions again with former clients, to be able to offer them specific personalised conditions or products from the Bank, and provided that the consent of the Data Subject is obtained, the Bank may contact them for the purposes detailed. For illustrative purposes only, Articles 1962-1972 of the Civil Code set periods of limitation of the actions up to thirty years, depending on the action in question. Furthermore, Law 10/2010, of 28 April, on the prevention of money laundering and financing of terrorism stipulates the obligation to retain the Data Subject's documentation for a minimum period of ten years.
DATA RECIPIENTS
- Executive Service of the Commission for the Prevention of Money Laundering and Monetary Infractions. The Bank is obliged to inform this Agency of: The identification details of all holders, representatives or authorised persons and any other persons with powers of disposal in current accounts, savings accounts, securities accounts and time deposits, irrespective of their commercial name, as well as any changes thereto. The dates of opening and cancellation and other mandatory data resulting from the accounts and deposits indicated. - Entities participating in the Account Holding Service (AHS) according to the processing and transfer provided for in section 4.4. of this document. - Courts and Tribunals and State Security Forces and Corps, in the event that the Bank may be required to disclose personal data. - Authorities or official bodies of other countries, located both inside and outside the European Union, within the framework of the fight against the financing of terrorism and serious forms of organised crime and the prevention of money laundering. - Files relating to the fulfilment or non-fulfilment of monetary obligations, in order to ascertain the creditworthiness of the Data Subject. - Entities of the Banco Sabadell Group, only in cases in which the Data Subject has consented to said data transfer or it is based on legitimate interest. - For certain commercial operations that constitute structural modification operations of companies or the contribution or transfer of a business or branch of business activity, as well as securitisation operations and sale of credit portfolios, the Bank may communicate the personal data of the Data Subject (the essential minimums), provided that the processing were necessary for the successful completion of the operation and guarantee continuity in the provision of the service. In the event that the transaction is not concluded, the transferee institution shall immediately delete the data communicated by the Bank.

CONSENT
	How does Banco Sabadell obtain the Data Subject's consent? By means of the registration and updated documents held on the Bank's systems, the Data Subject may consent to each of the processing operations listed in this Informative Annex that are subject to consent. The Data Subject may choose to consent to each of them or to all of them in their entirety in any case, all the processing operations are clearly differentiated. Furthermore, there shall be occasions when the data subject's consent is given at the time of the order, engagement of services, or survey.
RIGHTS OF THE DATA SUBJECT
Exercise of rights	The Data Subject may, pursuant to the terms set forth in Regulation (EU) 679/2016 of the European Parliament and of the Council on the protection of natural persons and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights, to revoke at any time the consent granted for the processing of personal data, as well as to exercise the rights of access, rectification, opposition, cancellation, limitation, suppression and portability and to not be subject to automated decisions by writing to the "Rights PD" unit, at the following address; Plaça de Sant Roc nº 20, 08201 Sabadell, via the following e-mail address: ejercicioderechosprotecdatos@bancsabadell.com, or through the remote system established by the Bank at any given time. In particular, Data Subjects may exercise their right to object at any time to all processing operations whose legitimacy is based on the legitimate interest of the Bank as set out in this Annex. In addition to the rights expressly set forth in the aforementioned applicable regulations, Data Subjects may request, by contacting the corresponding address indicated in this Detailed Information of the Data Protection Officer, information on the essential elements of the Impact Assessments carried out by the Data Controller on the processing operations that require them, as well as the Weighting Analyses carried out in which the legal basis for the processing is the legitimate interest of the Data Controller or third parties. Spanish Data Protection Agency. Finally, in the event that the Data Subject deems it necessary, they may contact the Spanish Data Protection Agency (AEPD) with address at Calle Jorge Juan, 6, 28001, Madrid, in order to safeguard their rights.

Download PDF

VERSION CHANGE OVERVIEW.

Changes introduced by Editorial Version of 01/11/2024:

Section 1.- Management and development of the application and the contract/operation.
The processing scenarios for the management and development of recruitment and operations have been extended.
- 1.1. This includes processing for the execution of "contracting requests" made by the customer or potential customer.
- 1.2. The possibility of processing personal data is added to contact the Data Subject by any means, including electronic, if the application or contracting procedure is interrupted or not completed, due to technical reasons or on their part, and to be able to clarify issues, resolve incidents or promote its completion.
- 1.3. IF a request or contract for a main product incorporates benefits, insurance coverage or additional advantages, personal data may be communicated to service companies and/or insurance companies for the management and monitoring of the benefit.
Section 2.- Prevention of money laundering (AML).
A new section 2.3 has been added concerning personal data collected for the purpose of fulfilling AML due diligence obligations, including data arising from the provision of aggregation and payment initiation services if these services are contracted.
Section 3.- Processing of data relating to the fulfilment of monetary obligations.
The possibility for the Bank, in the event of non-payment of monetary obligations by the customer, to process any data to which the Bank may have legitimate access in order to carry out recovery actions has been added in section 3.3.
Section 4.- Transfer of data for fraud prevention and for the Account Holding Service (AHS).
A new section 4.4 has been added regarding the request, processing and transfer of data for the conformity of the ownership of payment accounts in execution of the interbank Account Holding Service (AHS) developed by Sociedad Española de Sistemas de Pago, S.A. (Iberpay)
Section 6.- Carrying out assessments, monitoring and risk profiles, in credit or contracting matters, capacity to recover from defaults, as well as others for commercial purposes.
The possibility of performing assessments, monitoring and risk profiling related to recoverability in the event of default based on (i) internal information as well as on the use of external sources (e.g. credit bureaus or given by the customer itself) and (ii) on previous debt regularisation behaviour and (iii) on the application of models is extended.
Section 9.- Processing for commercial purposes.
Clarifications have been added to further specify that the typology and concepts relating to personal data that are processed for commercial purposes include details of operations, movements and transactions (e.g. object, concept or cause, issuers, recipients) carried out through accounts, cards or any other product or service held with the bank and the texts thereof, with a view to detecting possible contracting needs and to offer services compatible and relevant with this information.
Section 11.- Recording of customer calls and customer satisfaction surveys.
Has been extended by new sections 11.2 and 11.3, depending on the type of legitimation, to include the processing of data for the purpose of conducting customer satisfaction surveys to analyse possible improvements to the bank's products and services.
Section on DATA RECIPIENTS.
Added as possible recipients of data:
- Participants of the Iberpay Account Holding Service (AHS).
- To transferee entities acquiring commercial operations carried out by the bank for the structural modification of companies or the contribution or transfer of a business or branch of business activity.

Changes introduced in the 06/10/2025 version:

Section 15.- Verification of the transfer payee.
A new section has been added to regulate the processing of personal data necessary to verify the match between the name of the payee and the account identifier (IBAN) in transfer operations. This processing is intended to prevent possible errors in the execution of transfers and to avoid erroneous or fraudulent payments, in accordance with the legal obligation laid down in Regulation (EU) 2024/886 of the European Parliament and of the Council on immediate transfers.

Changes introduced in the June 2026 version:

Anti Money Laundering.
For the purposes of complying with the applicable regulations, point 2.2 has been reworded as follows: 2.2 The Bank is required to notify the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Infractions of:
- The identifying details of all account holders, representatives or authorised signatories, and any other persons with powers of disposal over current accounts, savings accounts, term deposits and any other type of payment account, as well as safe deposit box rental agreements and their rental period, regardless of their trade name, together with any changes thereto;
- The date of opening and closure, and any other mandatory information arising from the aforementioned deposit accounts and safe deposit boxes.
These data will be processed under the responsibility of the Secretariat of State for the Economy and Business Support (Calle Alcalá, 48, 28014, Madrid) for the purpose of preventing and combating money laundering and the financing of terrorism. The Bank shall send information on this obligation to the address agreed upon in the contract or agreement to send correspondence and the data subject who receives this correspondence shall be duty bound to inform the other data subjects of the Bank's legal obligation.

Point 2.4 is added to allow the Bank to consult the Central Register of Beneficial Ownership in order to verify the identity of the beneficial owner of a legal entity and thus comply with its legal obligations. The Bank may contact the beneficial owner to clarify any discrepancies.

Point 2.5 is added to enable Banco Sabadell to share the necessary data with insurance companies and management entities within the group in order to comply with anti-money laundering and counter-terrorist financing regulations. The client may object at any time in accordance with the provisions set out in the Annex.
Processing and disclosure of data for fraud prevention and for the Account Ownership Service (AOS).
A new point 4.6 has been added to allow the Bank, when a client carries out a money transfer via its app (for example, a bank transfer), to determine whether the client is simultaneously on a phone call. The purpose is to prevent fraud, and the Bank will not access the content of the call. Consent for this processing may be withdrawn at any time via the device settings.
Processing for commercial purposes.
A new point 9.3 has been added to allow the Bank to process personal data to check that the conditions for participation in Bank promotions are met, to verify whether the data subject is or has been a customer in promotions for new customers, and to manage, control and execute such promotions.
Recording of calls to non-clients and satisfaction surveys.
Section 10.1 has been amended. In addition to being able to receive calls, the Bank includes the possibility of making calls to non-customers for satisfaction surveys as part of its telephone operations.

A new point 10.2 has been added to allow the Bank to use personal data of non-customers to send them surveys and improve its services. The data subject may object to this processing at any time.

A new point 10.3 has been added to allow the Bank to process the data obtained from surveys to analyse your satisfaction and improve services. Wherever possible, such data will be anonymised and sensitive data such as health, racial origin, sexual orientation or beliefs will never be used.
Recording of calls to clients and satisfaction surveys.
Section 11.1 has been amended. In addition to receiving calls, it is expressly stated that the Bank may also make calls to clients for the purpose of conducting satisfaction surveys.

Do you have any questions?
We're here to help you

Branches and ATMs

Find a branch

Find a branch or

request an appointment

Premium service

Exclusive telephone service for customers, attended by business specialists.
962 000 610 from Monday to Thursday from 8 a.m. to 5 p.m. and Friday from 8 a.m. to 3 p.m.

Customer Service Dept

Helpdesk on X

Customer Service Department @Sabadell_Help

Detailed information on the protection personal data