Protecció de Dades

Purpose of the Personal Data Protection Policy:

This Personal Data Protection Policy aims to inform you about the processing of your personal data that we perform through our Myandbank app (the App).

When you acquire products or services from Andorra Banc Agricol Reig, S.A., personal data will be processed in accordance with what is established in the corresponding document.

The App is owned by Andorra Banc Agricol Reig, S.A. For more information about the bank and the App, see the Terms of Use.

In this document, we inform you about the processing of the information that the bank obtains through the App, but it is not applicable to any information which may be obtained by third parties on other websites or apps, even if links to them are provided in the App.

We would like to remind you of the importance of reading this Personal Data Protection Policy every time you use the App, as it may be subject to change.

The Data Controller:

• Identity: the data controller for customers’ personal data is Andorra Banc Agrícol Reig, S.A. (hereinafter, ‘-Andbank’ or the ‘Bank’), with tax registration number (NRT) A-700158-F and banking entity registration number EB 01/95.
• Registered office/postal address: Carrer Manuel Cerqueda i Escaler, 4-6, Escaldes-Engordany, AD700, Principality of Andorra.
• Website: https://www.andbank.com/.
• Telephone: +376 873 300.

Contact details of the Data Protection Officer: dpo@andbank.com

  Purposes of the processing and legal basis for processing:

1 Contract/transaction management and maintenance:

1. To manage a data subject’s request when acquiring Andbank products and services.
2. To manage the contractual relationship that unites Andbank with the customer. If the request to start a contractual relationship with Andbank is viable, the latter will process the personal data for the purpose of developing, controlling and maintaining the contractual relationship for the performance and provision of the products and services under the contract between the customer and Andbank. Andbank shall proceed with customer registration and shall process the customer data required to formalise the acquisition of the chosen product or service, as well as, if the customer so requests, the data necessary for managing digital personal banking.
3. To manage any incidents, complaints, queries, claims and suggestions. The personal data obtained when the customer’s query, complaint or claim was formulated must be processed to be able to manage the incident reported and/or improve the services provided or offered. The processing of such information is therefore necessary to execute the contract signed between the customer and Andbank.
4. Internal management of the web platform and any other platform operated Andbank at any given time.
5. To manage the services requested by the customer, it is sometimes necessary to obtain information from third parties regarding guarantors (sureties, guarantors, etc.) or third parties (beneficiaries, relatives, etc.) affected by the contract signed by the customer as authorised parties in bank accounts. The customer expressly warrants that the third-party information communicated is truthful and accurate, and that they have informed about the communication of this data and obtained consent to communicate such personal data in the corresponding process.
6. Processing of the personal data of minors acquiring products or affected by contracts signed by the customer (e.g. authorised parties). The minor’s information will be required depending on the type of service requested by the legal representative for the execution of such a request and for provision of the contracted services. Andbank shall only process this information relating to the minor with the due signed authorisation of the legal representative (parent/guardian).
7. To obtain and provide information to and from credit institutions and other payment service providers, as well as from and to the payment systems themselves and related technological service providers, sending them the data necessary to perform transactions related to the means of payment contracted by customers, such as transfers, cheques, bills of exchange, promissory notes and credit and debit cards requested by the customer.

Basis for the processing: execution of a contract.

2.Prevention of Money Laundering and Terrorist Financing:

1. Within the framework of the fight against the financing of terrorism and serious forms of organised crime and the prevention of money laundering and, in accordance with the governing regulations, Andbank is obliged to conduct the formal and real identification of those involved or applicants for our products and services, as well as the identification of the professional or business activity. In compliance with the aforementioned regulations, customers must be required to provide those documents considered necessary and appropriate to prove the declared activity or to obtain information about it from sources other than the customer. The right to prevent any transaction until such documents are delivered in compliance is reserved.
2. To communicate certain transactions and any other personal data to the Financial Intelligence Unit of Andorra (UIFAND).
3. To communicate to the Register of Financial and Similar Accounts, an administrative register managed by the Ministry of Finance to which banking, payment and electronic money entities operating in the Principality of Andorra are obliged to declare the identification details of the holders or beneficial owners relating to the opening or cancellation of bank and payment accounts and information on safety deposit boxes.
4. Obtenir informació de fonts públiques, inclús aquella disponible a internet, sobre els seus clients titulars o intervinents en els comptes, representants legals i titulars reals d’aquests.

Base del tractament: for the purposes indicated in Sections a), b), c) and d), the basis of processing is compliance with a legal obligation.

       5. To communicate the identification details of the holder, used for contracting, and the account balances of data subjects to the entities in the Andbank Group detailed on andbank.com, to facilitate compliance with their legal obligations in matters of money laundering prevention, including the sending of such information to the corresponding authorities.

Basis for the processing of the data indicated above: Consent.

      6.  Data processing in fund transfers. Credit institutions as payment service providers send personal data to perform transactions and may be obliged to provide personal data relating to the transaction to banking correspondent and custody entities, within the framework of the prevention of money laundering and terrorist financing.

Basis for the processing of the data indicated above: execution of a contract.

3.Compliance with monetary obligations:

To evaluate the solvency and credit risk of the data subject. In order to analyse the risk of the data subject, Andbank shall process the information that the data subject provides, as well as that which we obtain from consulting internal files.

Basis for the processing of the data indicated above: legitimate interest

4.Transfer of data for fraud prevention:

Andbank may share customers’ personal data with the rest of the entities in the Andbank Group, third parties or common systems on the exchange of fraudulent conduct, exclusively for purposes related to fraud prevention.

Basis for the processing of the data indicated above: legitimate interest.

 5.Profile creation:

Creation of profiles using the data provided by the customer and generated in the relationship with Andbank. Andbank may complete customer data with information obtained through internal databases, historical behaviour (e.g. transactions) in operations that have been able to be subscribed to in the past, commercial interests provided by the customer in the use of the service, as well as information identified or estimated by Andbank based on the credit risk that the customer shows in their contractual relationship.

Basis for the processing of the data indicated above: legitimate interest.

6.Video surveillance:

Andbank conducts video surveillance work in its offices under the terms established in the private and public security law.

Basis for the processing of the data indicated above: compliance with legal obligations and legitimate interest.

7.Biometric data:

Andbank uses devices or tablets for digitising writing and signatures available through its offices or agents, as well as the online app and platform for the customer to open accounts and acquire products and services, perform transactions, requests, instructions, contracts, orders and declarations or process documents of any kind, for which subscription through said devices requires the processing and retention of the customer’s biometric data obtained by recording their image and digitising their signature and recording said data in order to be able to prove the identity of the signatory and the authenticity of the documentation or transaction subscribed.

Basis for the processing of the data indicated above: legal obligation and execution of a contract.

8.Commercial purpose:

1. To send commercial communications, both by ordinary and electronic means, in relation to products, services and promotions from third parties, companies in the Andbank Group, subsidiaries and investees (the list of companies can be found at https://www.andbank.com), as well as companies with which Andbank has a collaboration agreement and is also part of some of the following types of products: banking products or services, insurance, pensions, investment services, collective investment, movable assets, consumer products and services and any other similar products and services, in the different possible forms of marketing, either directly, as an auxiliary or jointly with others. To this end, Andbank may develop commercial and risk profiles based on analysing and evaluating your personal data to adjust the commercial communications and offers that we send you in accordance with the profile, potential interests or possible preferences that result from said analyses and evaluations.
2. To send Andbank products, services and promotions both by ordinary means (post and telephone) and electronically (email, SMS, instant messaging, app). The customer may always object to said processing at the time of signing the contract, as well as in each communication addressed to the data subject, or at any time.
3. To transfer personal data of customers to other entities in the Andbank Group so that they can send you personalised marketing communications, both by ordinary means (post and telephone) and electronically (email, SMS, instant messaging, app).

Basis for the processing of the data indicated above: consent of the data subject and/or legitimate interest as appropriate.

9.Recording customer calls:

Andbank may record calls with its customers where it is legally required to record such content. The reason for this recording is to be able to prove the content of different procedures or requests submitted in accordance with the signed contract or, on occasion, to be able to assess or control the quality of the services provided. The customer will be informed that the call will be recorded and may object to its recording.

Basis for the processing of the data indicated above: legitimate interest and compliance with a legal obligation.

10.Data processing after the commercial relationship has ended:

Once the contractual relationship has ended, Andbank will process your data in order to seek good conditions for you as a former customer and attempt to keep you banking with Andbank. For this purpose, Andbank may contact you, both by ordinary and electronic means, with the aim of offering you services or promotions for its own products or for the products of Group or third-party collaborators.

Basis for the processing of the data indicated above: consent.

11.Data processing through the anonymisation and pseudonymisation process:

Andbank, through certain processes, may anonymise the aggregated data of its customers without this information being able to be associated with any customer, making it an irreversible process. Data processing will therefore occur in the anonymisation process, and there will subsequently be no impact on personal data.

Basis for the processing of the data indicated above: legitimate interest.

12.Communication of data to the competent authorities:

Sending of data to the Andorran judicial authorities, the Andorran Tax Agency and any other competent authority in the Principality to comply with legal requirements.

Basis for the processing of the data indicated above: compliance with a legal obligation.

13.Verification and adequacy of data:

Updating personal data. Customers’ personal data may be updated with their own sources (databases relating to customers) or through data that the data subject has made manifestly public or another public source (official registers, professional lists, etc.).

Basis for the processing of the data indicated above: legitimate interest.

 – Types of data we process

Andbank may process data from both potential and existing customers. With respect to the aforementioned groups, Andbank may process, among others, the following types of data:

• Identification and contact details
• User data and content related to digital interaction with ANDBANK: IP address, cookies, geolocation, device identifier, ANDBANK applications and pages on social networks
• Nationality
• Biometric data, such as fingerprint, iris, face or voice capture
• Personal information: nationality, family, professional or academic situation
• Data of a tax or fiscal nature
• Data relating to solvency and risk
• Data relating to the contracting of specific products, including banking, financial and transactional data
• Data related to customer preferences
• Data on claims or legal proceedings
• Telephone conversation data
• Data obtained as a result of operations arising from regulations on the prevention of money laundering or securities and terrorist financing
• Video surveillance
• Card payment data and, specifically, location data on cash withdrawal locations and payments made

Hereinafter and jointly referred to as ‘personal data’. Any and all of the personal data outlined may be required by Andbank at certain specific times during the contractual relationship with the customer. Depending on the product acquired, data must be provided on a mandatory basis to process the corresponding application. The above is understood without prejudice to any other data that may be requested by Andbank in accordance with the applicable regulations at the time of managing said requests and the refusal to provide such data could mean that certain products cannot be acquired.

– Origin of the data

Any and all personal data that Andbank processes about its customers is data provided by customers or persons authorised by customers through Andbank’s data collection documents, as well as data delivered to Andbank at the time of formalising the acquisition of our products and services, or through our website and apps, the electronic banking service (call centre), as well as in person at bank branches or financial agencies, which we can collectively call ‘branches’.

Likewise, ANDBANK may obtain data through:

• Public records
• Official bulletins
• Fraud prevention agencies
• Databases for money laundering prevention purposes
• Internet, commercial and property registers

– Data retention period

ANDBANK will retain customers’ personal data for the duration of the contractual relationship or as long as they are necessary for the specific purpose of each processing. Once deleted, ANDBANK will keep blocked those data that are necessary for the fulfilment of legal obligations; in particular:

• Five years in application of the regulations on the prevention of money laundering and terrorist financing, counting from: (i) the date of termination of business relationships with customers; and (ii) the date of the occasional transaction
• During the maximum period of time established in the regulation on the calculation of capital and provisions
• During the legal limitation periods for the exclusive purposes of claims or legal actions

Once these deadlines have passed, ANDBANK will destroy customers’ personal data.

ANDBANK may communicate the following personal data to the following third parties:

• Supervisory authorities of the Principality of Andorra, such as the AFA or the UIFAND
• Tax authorities in other countries
• The Mayor’s Office, Public Prosecutor’s Office, Debt Collector, Tax Office and/or the competent Public Administrations
• Notaries and public registers
• Entities managing credit information systems or similar
• Professional advisers, counterparties, correspondents and third-party service providers These third parties may act as data processors when they need to process customer data to comply with legal obligations. These data communications, which may be conducted on an occasional basis, are necessary to manage the contractual relationship between ANDBANK and its customers.
• Entities belonging to the ANDBANK GROUP
• Potential buyers or investors in portfolios owned by Andbank

– Information relating to companies in the Andbank Group

As detailed in all the information regarding data protection, Andbank may transfer personal data to the different entities in the Andbank Group for each of the purposes detailed in each of the previous sections. Customers can find out about the Group’s entities through the link www.andbank.com, any of which may be established either within the European Economic Area (hereinafter, the ‘EEA’) or in countries whose level of protection is equivalent to that of the latter, as well as in third countries whose level of protection is not. In this regard, Andbank has taken the appropriate guarantees that standards set out for these international data transfers, such as the corresponding risk analysis of the international transfer, as well as the signing of a contract that includes the standard clauses approved by the European Commission for these international transfers. If you wish to obtain a copy, you may request a copy from the Andbank Data Protection Officer using the contact details provided in the header.

– The data subjects’ rights

Customers may exercise the following rights over their personal data:

• Access: customers will be able to consult the personal data that ANDBANK has about them.
• Rectification: customers may request that their data be changed if it is inaccurate or incomplete.
• Erasure: customers may request the erasure of their data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Restriction of processing: customers may request the restriction of processing of their data in the event that it is inaccurate, the processing is unlawful, it is necessary for the formulation of claims or ANDBANK’s legitimacy for the processing is under review.
• Data portability: customers may request that personal data be sent to another entity in a commonly used electronic format
• Objection: customers may request that personal data not be processed for specific purposes, except for processing necessary to continue with the contractual relationship.
• Additionally, customers have the right not to be subject to a decision that produces legal effects that affect them, when this decision is based solely on automated data processing intended to evaluate certain aspects of personality, including the creation of profiles, despite the legally provided exceptions.

To exercise their rights regarding data protection, customers may contact ANDBANK’s Data Protection Officer, via email at dpo@andbank.com or by written communication to the following address: Carrer Manel Cerqueda i Escaler, 4-6, Escaldes-Engordany, AD700, Principality of Andorra, specifying the right they wish to exercise and sending a photocopy of their valid passport, identity card or equivalent ID document.

Additionally, the data subject may, at any time, revoke the consent granted for processing through the aforementioned means.

Exercising these rights is free of charge.

Similarly, you can request from our DPO (dpo@andbank.com) the essential elements of the weighting analyses performed, in which the application of legitimate interest as an enabling basis for the processing of personal data is understood to be appropriate.

– Complaints

A customer who has seen their data protection rights violated or has any claim regarding their personal information can contact ANDBANK at any time via email at dpo@andbank.com or in writing to the following address: Carrer Manuel Cerqueda i Escaler, 6, Escaldes-Engordany, AD700, Andorra.

Customers can at any time contact the Andorran Data Protection Agency (APDA), the Andorran control authority in matters of data protection, www.apda.ad, General Council Building, Carrer Doctor Vilanova, 15-17 (planta 5) in Andorra La Vella (Principality of Andorra). Telephone (+376) 808 115.