The party responsible for this website is Banco Santander, S.A., with tax no. A‑39000013 and registered office at Paseo de Pereda, 9-12, Santander.

Basic information on data protection

Controller: Banco Santander, S.A.

Postal address: Avda. de Cantabria s/n, 28660 Boadilla del Monte

Attn. Physical Security department

Contact details of the data protection officer: privacidad@gruposantander.es

Purposes and lawful basis: Processing of suggestions made by data subjects, management of the telephone customer service requested by data subjects and compliance with legal obligations.

Recipients: Their data will not be disclosed to third-party recipients.

Rights: Data subjects may exercise their rights of objection, access, portability, rectification, restriction and erasure of data at any time.

Additional information: Further details of the information included in this table are given below it.

Additional information on data protection

Banco Santander, S.A (the Bank) fully complies with the personal data protection regulations and, in particular, with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the GDPR), such that personal information provided by an interested shareholder (the data subject) when requesting a virtual meeting in the Shareholders' Area of the bancosantander.com website (the Website) will be processed in compliance with the required safeguards and statutory requirements.

In compliance with the regulation in force, the Bank has implemented the appropriate technical and organisational measures to guarantee an adequate level of security, and to prevent the loss, misuse, alteration, unauthorised access and theft of the data provided by data subjects. The Bank also warrants that it complies with the duty of secrecy and confidentiality regarding the personal data provided by data subjects on this Website.

The communication of personal data by data subjects, if applicable, will be a requirement for them to receive the service requested.

I. Who is the data controller?

Details of the data controller are provided below:

• Identity: Banco Santander S.A., with tax no. A-39000013

• Contact details of the data controller:

 Postal address: Avda. de Cantabria s/n, 28660 Boadilla del Monte, Madrid.

II. Who is the data protection officer and how can you contact them?

The data protection officer is the party responsible for ensuring effective compliance with the GDPR in order to ensure the protection of the personal data provided by data subjects on the website.

To contact the data protection officer, data subjects may send a communication to the following email address: privacidad@gruposantander.es

III. What personal data do we process and who provides them? For what purpose and on what lawful basis do we process your personal data?

1.      Data source

The data are supplied by the data subject.

2.      Types of data we process

We process the following personal data: name and surname of the data subject, ID number of the person concerned, their e-mail address and telephone number.

3.      Purpose of processing the data

• Processing of the suggestion made by the data subject. The lawful basis in this case is the consent given by the data subject as the suggestion has been expressly made by them.

• Managing the telephone customer service requested by the data subject. The legitimate basis in this case is also the consent of the data subject, who has expressly requested the call.

• Maintaining the relationship with the data subject and sending commercial communications. The basis for this processing is legitimate interest.

• Compliance with statutory requirements.

IV. How long will we retain your data?

The personal data provided will be retained for as long as needed to process the suggestion made or call requested and, where appropriate, for the duration of the subsequent relationship with the data subject. The data will be retained for as long as the data subject remains a shareholder and will be erased when he or she ceases to be a shareholder, and the data will remain blocked until the statute of limitation on any legal action that may be taken expires.

V. Will your data be disclosed?

With regard to the disclosure of data, it is expressly stated that the personal information of data subjects will not be disclosed to third parties, nor will it be transferred to third countries or international organisations.

VI. What are your rights when providing us your data?

Data subjects may exercise, if they so wish and at any time, the rights of access, rectification and erasure of data, as well as request that the processing of their personal data be restricted, object to such processing, request the portability of their data, as well as request that they not be subject to automated individual decision-making, by sending a written notification to the following email address: protecciondedatosaccionistassan@gruposantander.com, providing, in all cases, their ID or official document evidencing the identity of the data subject.

Not withstanding any other administrative appeal or legal action, data subjects may in any case file a claim with the Spanish Data Protection Agency, especially if they have been unable to exercise their rights, by visiting www.agpd.es