CECA is a member of

Information on the use of personal details (GDPR) Information on personal data processing (GDPR)

Processing of your personal data

In CECA we process your personal data with the only purpose for which they were requested for. We therefore process them in order to maintain the pre-existing relationship between the bank and the client/supplier/collaborator.

Similarly discuss them with the aim of maintaining the pre-existing relationship between the client/supplier/collaborator and the company. We therefore process them in order to maintain the pre-existing relationship between the bank and the client/supplier/collaborator.

The processing of your personal data with other purposes is not planned and will not be possible without the necessary legitimisation.


Lawfulness of processing

Processing is only legal if at least one of the following conditions is fulfilled: Processing shall be lawful only if and to the extent that at least one of the following applies:

  • the data subject has consented to the processing of his/her personal data for one or more specific purposes; the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
  • processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  • processing is necessary for compliance with a legal obligation to which the controller is subject; processing is necessary for compliance with a legal obligation to which the controller is subject;
  • processing is required to protect the vital interests of the data subject or another individual; processing is necessary in order to protect the vital interests of the data subject or of another natural person;
  • processing is required to perform a task carried out in the public interest or to exercise the official authority conferred upon the controller; processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • processing is necessary to satisfy the legitimate interests pursued by the controller or by a third party, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular when the data subject is a child. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.


CECA’s Data Protection Officer (DPO)

CECA’s DPO is the Compliance Head. You can contact him directly at the following email address arco@cecabank.es


Rights in relation to your personal data

If desired you may exercise the rights stated in GDPR (General Data Protection Regulation) in respect of the personal data already under processing by CECA. We specifically refer to the right of access, to rectification and erasure, to restriction (in respect to the purposes they were requested), to data portability (sending to other entity), and to object automated individual decision-making (not being used to adopt decisions just based on automated processing, including profiling).

Similarly, you may request the limitation of the processing of your personal data (with regard to the purposes for which they are being processed), request the portability of your data (sent to another company), and request that they not be subject to automated individual decisions (not be subject to a decision solely based on automated processing, including preparing profiles, that produces legal effects or significantly affects you in a similar way). Moreover I May also exercise the right to restriction (in respect to the purposes they were requested for), to dates portability (sending them to other entity), and to object to automated individual decision-making (not being used to adopt decisions just based on automated processing, including profiling, which May produces legal effects or significantly affect you in to similar way).

You can exercise your rights by sending a written request to arco@cecabank.es and attaching a copy of your DNI.

We provide forms to enable you to exercise your rights:


Data keeping

We will keep your personal data during the relationship. Once ended, CECA will have them blocked until exceeding the deadlines applicable for legal claims and, in general terms, during the ten years required by the laws on anti money laundering and terrorism financing. As soon as such deadlines are exceeded CECA will erase the data. As soon as such deadlines are exceeded Cecabank will erase the data.


Data disclosure

Data will not be disclosed to third parties unless a legal obligation is applicable or a previous agreement legitimates the entity to do so.



Finally, we inform you that you may withdraw the given consent at any time, without affecting the lawfulness of the processing, by sending a request to the following e-mail address arco@cecabank.es. Please remember to enclose a copy of your ID card or of any similar document proving you identity.