Processing of your personal data

At CECA we process your personal data for the exclusive purpose for which they were collected. Specifically, we process said data in order to manage the contracts/operations/actions requested or contracted.

We also process the data for the purpose of maintaining the pre-existing relationship between the customer/provider/collaborator and the entity.

The processing of your personal data for other purposes is not envisaged and cannot be carried out without prior legitimisation.

Legitimisation for the use of the data

Processing is only legal if at least one of the following conditions is fulfilled:

• the data subject has consented to the processing of their personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is required to protect the vital interests of the data subject or another individual;
• processing is required to perform a task carried out in the public interest or to exercise the official authority conferred upon the controller;
• processing is necessary to satisfy the legitimate interests pursued by the controller or by a third party, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular when the data subject is a child.

CECA’s Data Protection Officer (DPO)

CECA's DPO is the Director of Regulatory Compliance. You can get in touch directly by emailing arco@cecabank.es

Your rights regarding the use of your data

If so desired, you may exercise the rights provided for in the regulations regarding the use of your personal data. Specifically, we refer to the rights of access (access to the data that CECA holds in relation to you), rectification (rectification of the data previously provided) and deletion of the data (deletion, whenever legally possible, of the data held by the entity).

Similarly, you may request the limitation of the processing of your personal data (with regard to the purposes for which they are being processed), request the portability of your data (sent to another entity), and request that they not be subject to automated individual decisions (not be subject to a decision solely based on automated processing, including preparing profiles, that produces legal effects or significantly affects you in a similar manner).

You can exercise your rights by sending a written request to arco@cecabank.es, attaching a copy of your ID.

Attached are forms that may facilitate the exercise of your rights:

• Right of access form
• Right of opposition form
• Form on the right not to be subject to individual automated decisions
• Right of data portability form
• Right of rectification form
• Right of deletion form

Storage of personal data

We will retain your personal data for the duration of the relationship. Once the relationship has ended, CECA will retain your personal data blocked during the legal statute of limitations for actions and, in general, for the 10 years required by the regulations on the prevention of money laundering and financing of terrorism. After the legal statute of limitations has expired, we will destroy your data.

Data disclosure

CECA will not disclose your personal data to third parties, unless the entity is obliged to do so by law or because there is a prior agreement in this respect that legitimises such disclosure.

Finally, you can withdraw your consent at any time, without this affecting the legality of data processing, by sending a request to arco@cecabank.es. Please remember to accompany your request with a copy of your National Identification Document or equivalent document proving your identity.