GDPR notice for customers

Santander Consumer Finance, S.A., a credit institution established under the law of Spain, which has its registered address in Spain (Av. de Cantabria s/n 28660 Boadilla del Monte –Madrid, NIF: A-28122570), acting through its Greek Branch under the name “Santander Consumer Finance SA Greek Branch” which is duly established and operates in Greece with registered address at Athens, 6-8 Agissilaou str., Maroussi, Greece (GEMI No. 157543860001). With regards to the activities carried out in Greece, the above entities act as Joint Controllers and are jointly referred hereinafter as “Santander” or “the Bank” or “we”.

Santander Consumer S.A. is considered as the main establishment.

This Notice is addressed to any existing or prospective customer of Santander, including, to the extent applicable, any individuals acting as guarantors or on behalf of legal persons (hereinafter “the Customer” or “you”).

Santander has established an automated risk assessment system of your creditworthiness, based solely on automated processing. This system, which is deemed necessary for the initiation of our business relationship and the execution of the credit agreement between us, follows a scoring logic which takes into account personal and financial information:

• (i) derived from the information and documentation you have provided to the Bank either directly or through the eGov-KYC application upon your consent to transmit your data to the Bank;
• (ii) contained in Santander's files on your performance in other transactions - both current and cancelled - signed with both Santander and other Group entities;
• (iii) contained in the databases of “Tiresias S.A.” to which we have access, namely information regarding default financial obligations (e.g. bounced cheques, unpaid bills of exchange and promissory notes, termination of loans, payment orders, bankruptcy applications and decisions),  financing of any kind by credit and financial institutions (e.g. loans, credit cards, letters of guarantee), your credit scoring (you may find more for Tiresias files and data processing on www.tiresias.gr website); and 
• (iv) publicly available sources (promotional census, lists of people belonging to professional groups or social networks, international market standards among others, court files, Government Gazette, GEMI etc.).

The result of the assessment of such information may lead to the approval or rejection of the credit application, depending on the conclusion reached regarding the probability of the loan repayment.

We do clarify that we perform periodic reviews to the risk assessment system to avoid any possible mismatch, error or inaccuracy. Notwithstanding the above, if you are not satisfied with the result of your assessment, you may challenge it by providing the information you consider relevant to refute the decision taken, and request human intervention with one of our analysts to express your view and contest the decision.

Furthermore, Santander maintains an automated system for assessing the risk of money laundering and terrorist financing. The assessment takes into account identification data, data relating to or affecting your financial profile, and transaction data that has come to the Bank's attention through previous or existing contractual relationships with you. Finally, data included in official sanctions lists of competent authorities, internal lists of the Santander Group, and data from publicly available sources are also taken into account.

Santander shall retain the personal data of the Customer for a period of twenty (20) years after the termination of your relationship with us on the condition that the full debt has been paid-of.

In case your credit application has been rejected or has been approved but you have not entered into a contract with the Bank, as well as in the event that no contractual relationship or cooperation is established, the data provided will be kept for a period of five (5) years after its collection. After such period we may keep it anonymized only for statistical purposes.

In the above cases, if there are pending legal proceedings that directly or indirectly concern you, or if we need to defend our rights, the above data retention periods will be extended until a final court decision is issued.

In case you have started the process of submitting a credit application online but have not submitted the application, the data you have entered will be retained for forty-five (45) days for your convenience if you wish to continue the application process.

Records of telephone conversations with representatives of the Bank or affiliated providers acting on behalf of the Bank are kept for one (1) year, unless their retention is requested by the Customer or a competent authority, or their retention for a longer period is necessary to support the Bank's legitimate interests.

Data processed for testing and training purposes of models based on Artificial Intelligence will be deleted after the completion of testing.

In case a shorter or longer storage period is foreseen by the law or regulatory acts the retention period of your personal data will be amended accordingly.

Santander Consumer may share your personal data to fulfill its legal or contractual obligations or to serve its legitimate interest with the following third parties: 

• public services and authorities, supervisory, administrative, tax, judicial, prosecutorial and investigative authorities, municipal land customs authorities and/or third parties, provided that the transmission or notification of data is required by law or court judgment;
• payment service providers, credit and financial institutions, corresponding banks or entities that are necessarily involved in the execution of payment orders, such as DIAS, SWIFT, SEPA, etc, as required for the performance of the contract;
• the company under the name “BANKING INFORMATION SYSTEMS S.A.” and distinctive title “TIRESIAS S.A.” which is authorized to keep interbank records of data of financial behavior, in the context of the protection of credit and financial transactions. Pursuing to ensure the legitimate interest of the entire local banking system, we share data with regards to your credit or loan agreements, their performance and any termination of them. TIRESIAS S.A. is controller of all the data kept (1 Alamanas str., 15125, Maroussi, 2103676700). Please visit TIRESIA’s website www.tiresias.gr, on which there is detailed information about the data collected and kept by TIRESIAS S.A., its personal data protection policy and how you can exercise your rights;
• third party providers engaged by Santander to support day-to-day business, such as information technology (IT) service providers responsible for the development, support and maintenance of the systems and platforms, security service providers to ensure the security of banking systems, providers of electronic communications services, cloud computing, service providers executing phone calls or communications on behalf of Santander, companies carrying out marketing activities;
• To the electronic invoicing provider named "Information Systems Impact Single-Member Société Anonyme for the Provision of Information Technology Services," whose software has been approved by AADE, in order to issue electronic invoices on behalf of Santander and transmit the data to AADE, as required by the applicable legislative framework.
• Debt Collection Companies established under Law 3758/2009 as in force and specifically to “Mellon Debtors Information Company SA” provided that due debts exist for longer than 10 days, Loan Servicer Companies under the provisions of Law 4354/2015, prospective investors or other credit institutions for the securitization or transfer of loans, trusted service providers for the issuance of e-signature certificates; 
• Santander Group companies to the extent needed for accounting, anti-money laundering and financial crime prevention purposes; 
• companies responsible for the storage of either physical or digital records and contracts, retention, filing, management and destruction of files and data; 
• persons cooperating with the Bank to ensure fulfillment of its obligations or for its good operation, such as accountants, auditors, printing companies, courier companies, the Greek post etc;
• cooperating law firms and independent legal practitioners for the conduct of any judicial or out-of-court proceedings, notaries and court bailiffs (and their associates) in the context of their legal duties;
• insurance and/or insurance mediation companies cooperating with the Bank to offer you bancassurance products and services upon your request and consent.

In case we need to share personal data with service providers located outside the EU, data transfers will be carried out on the basis of a European Commission adequacy decision for this specific country of destination or in accordance with approved standard contractual clauses or other equivalent data protection safeguards to countries that do not provide an adequate level of personal data protection. Currently, we have been engaged Salesforce Inc., a company located in USA, to provide us with marketing services. The international transfer of personal data shall be carried out on the basis of standard contractual clauses already executed by Salesforce providing adequate safeguards.

• Right of access: You have the right to request confirmation as to whether or not Santander is processing personal data concerning you, and if so, to have access to your personal data requesting us to provide information about the personal data we hold about you and process.  
• Right to rectification: You can at any time correct, complete and update your personal details.
• Right to restriction of processing: Under certain circumstances, you may request that we limit the processing of your data that are no longer necessary for the performance of our contract, in which case we will only keep them for the exercise or defense of claims.
• Right to request for human intervention: You will have the right to challenge the decision that has been made in a fully automated manner. To exercise this right, you may request the human intervention of one of our analysts and to express your point of view, so that your request can be reassessed.
• Right to Erasure: You may ask us to delete your personal data, however we may need to keep them for lawful reasons.
• Right to objection: You can object to the use of your personal data in case the processing is based on our legitimate interests, unless we demonstrate that there are overriding legitimate grounds for processing.
• Right to data portability: Where possible we can share a digital copy of your data obtained electronically with you or another data controller upon your request.

In order to exercise your rights you may contact us by filling out the contact form available on our website (https://www.santanderconsumer.gr/επικοινωνία.html) or by post addressed to Santander Consumer Finance S.A. Greek Branch, 6-8 Agissilaou str., 15123, Maroussi, Athens. In any case, you need to specify the right exercised and attach a copy of your identity card.

You may lodge a complaint either to the Spanish Data Protection Authority, which acts in our case as Lead Supervising Authority (Calle Jorge Juan, 6 28001 Madrid , Spain - www.aepd.es) or to the Hellenic Data Protection Authority either through its website www.dpa.gr or to its address, Kifissias Avenue 1-3, 115 23, Αthens.

This notice was updated on December 1, 2025, and will be updated as necessary. Each updated version will always be available on our website at www.santanderconsumer.gr.