Personal Data Protection Policy
Who is the data controller of your personal data?
BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (“BBVA”) with registered office at Plaza San Nicolás 4, 48005, Bilbao, Spain, which will act under the supervision of its Board of Directors.
Who is the BBVA Data Protection Officer (DPO) and how can you get in touch with it?
The Data Protection Officer isin charge of protecting your fundamental right to personal data protection within BBVA and is in charge of compliance with data protection regulations. You can contact the BBVA Data Protection Officer by writing an e-mail to the following email: dpogrupobbva@bbva.com
For what and why does BBVA need to process my personal data?
BBVA will process the personal data provided that is strictly necessary for the safe and confidential management and processing of communications relating to breaches of European Union Law and/or actions or omissions that may constitute a serious criminal or administrative offense, in the sense established in Law 2/2023 on the protection of persons who report breaches of the law and on combating corruption, as well as possible breaches of BBVA’s Internal Regulations.
BBVA will not process your personal data in the event that you make an anonymous communication.
The different legal basis that allows BBVA to process your personal data will be:
- In the event that the report refers to the commission of criminal offenses or serious or very serious administrative offenses or offenses for which there is a specific obligation to create an Information System, as well as violations of the European Union law, compliance with a legal obligation.
- In the event that the report refers to any other violations of the legal system, the legal basis will be the fulfillment of a mission of public interest.
- In all other events, the legal basis for processing will be the legitimate interest of guaranteeing compliance with the BBVA Group Code of Conduct.
If there is a processing of sensitive categories of personal data, the legal basis will be the one that corresponds according to the previous events, said processing is enabled for reasons of essential public interest.
How long will BBVA retain your personal data?
BBVA will retain your personal data for the time necessary to decide on the appropriateness of initiating an investigation on the reported facts.
In the event that it is proven that the information provided or part of it is not true, it will be deleted from the Information System from the moment in which said circumstance is known, unless said lack of truthfulness may constitute a criminal act, in which case the information will be retained for the necessary time during which the judicial procedure is ongoing.
In any case, after three months elapsed from the report reception without carrying out investigative actions, the personal data will be anonymized in the Information System, unless the purpose of conservation is to evidence the correct operation of the Information System.
If the facts reported have given rise to investigation actions, the information received and the personal data contained will be kept as long as they are necessary for the internal verification actions as well as for the two following years after completion of the investigation actions, in compliance with the protection requirements of the person who report breaches under Law 2/2023.
After two (2) years since the conclusion of the investigation, the personal data related to the information will be blocked in compliance with legal obligations and during the legally applicable limitation periods depending on the nature of the facts reported for the purpose of possible claims or legal actions.
In any case, once ten (10) years have elapsed from the conclusion of the investigation, the personal data will be erased (destructed).
To whom will BBVA assign your data?
BBVA will not assign your personal data to third parties unless BBVA is required to do so by law. In case you report any breach or carrying out a public disclosure, your identity will in any case be reserved and it will not be communicated to the people affected by the facts or to third parties, except the judicial authority, the Public Prosecutor’s Office or the competent administrative body.
Whare are my rights in relation to the personal data process?
You can exercise your rights of access, rectification, deletion, opposition, limitation of treatment and portability by writing to the following address: protecciondedatos.group.cdd@bbva.com.
If you consider that BBVA has not processed your personal data in accordance with the regulations, you can contact the BBVA Data Protection Officer at the following email: dpogrupobbva@bbva.com or derechosprotecciondatos@bbva.com
You can file a claim with the Spanish Data Protection Agency (www.agpd.es).