If you need a loan Santander is your place. Information for individuals about Santander products, cards and car loans

Who is the person in charge of processing your data?

Santander Consumer Finance, S.A., a credit institution established under the law of Spain, which has its registered address in Spain (Av. de Cantabria s/n 28660 Boadilla del Monte –Madrid, NIF: A-28122570), acting through its Greek Branch under the name “Santander Consumer Finance SA Greek Branch” which is duly established and operates in Greece with registered address at Athens, 6-8 Agissilaou str., Maroussi, Greece (GEMI No. 157543860001). With regards to the activities carried out in Greece, the above entities act as Joint Controllers and are jointly referred hereinafter as “Santander Consumer” or “the Bank” or “we”.

Santander Consumer S.A. is considered as the main establishment.

This Notice is addressed to any existing or prospective customer of Santander Consumer, including, to the extent applicable, any individuals acting as guarantors or on behalf of legal persons (hereinafter “the Customer” or “you”).

What type of data we collect about you?

Type of personal data	Description (indicatively)
Identification data	First name, family name, father’s name, date of birth, place of birth, nationality, identification document (e.g. ID card, valid passport), Tax Identification Number (TIN)
Contact data	Home address, email address, mobile phone number, home telephone number, business address
Financial profile related data	Professional details, including profession, years of employment, name of employer, family data, number of dependents, marital status, remuneration, tax clearance certificate, tax declarations
Creditworthiness data	Data derived from Tiresias’ databases regarding financial behavior, namely default debts, total lending, mortgage and pre-notation data and credit scoring
Transaction data	Data relating to the payments of the loan
Communications data	Any communication between us, either written or verbal, any requests or complaints submitted, as well as records of phone calls.

Why, and under which legal basis, do we process your personal data?

Legal Basis	Processing Purposes
Processing necessary prior to entering into a contract	Credit assessment: Upon your request and before entering into a business relationship with you, we need to process the information you provide us with in the credit application (e.g. name, surname, ID, Tax ID, profession, address, income etc.), and that obtained from consulting internal and external files/databases detailed below, in order to manage your financing application, assess properly your creditworthiness and avoid any over-indebtedness. We have established an automated risk assessment system for individuals, based solely on automated processing. This system, which is deemed necessary for the execution of any credit agreement, follows a scoring logic that takes into account your personal and financial information. Please find in section 4 more details about the above automated process. Alternatively, the credit assessment process can be carried out by our analysts based on the same criteria. The credit assessment is necessary to be performed so that we are able to (i) respond properly to your request of financing, (ii) evaluate your creditworthiness in compliance to our legal obligation prior to providing you a financing and (iii) protect our legitimate interest controlling any risks assumed.
Performance of Contract	Fulfillment of our contractual obligations: Provided that you have entered into a loan/credit agreement with us, we need to process your personal data in order to meet our contractual obligations, i.e. to keep you updated for the credits and charges of your loan account and for your future installments, to manage your requests or complaints, if any, and to provide you support with any matter that may arise out of our contract. Debts collection: In case of overdue debts, we may process your personal data pursuing to collect any outstanding amount due as per the loan agreement.
Legal Obligation	As a regulated credit institution, we are subject to the applicable legal and regulatory framework, as each time in force. We process your personal data whenever required in order to comply with the applicable national and European law and with the regulatory requirements set by the Supervision Authorities, such as Bank of Spain, Bank of Greece, European Central Bank, European Banking Authority. In particular: Compliance with the anti-money laundering and counter-terrorist financing legal framework: Under the “Know Your Client” principle, prior to entering into any contract with you, we need to verify your identity. To this end, you are always requested to provide us with your identification, contact and financial profile related data and supporting documents. Any denial to provide such data will result in our abstention from the execution of our contract. You must keep us updated for any change of the data provided throughout our contractual relationship. Furthermore, we cross-check, the data provided and perform additional checks when required, while, in parallel, we assess your profile in terms of money-laundering risk. In addition we monitor the transactions relating to the loan repayment in order to be able detect any suspicious or unusual behavior. Compliance with our regulatory reporting to the supervisory authorities: We process your data in order to fulfil our regulatory obligations to submit reports to the supervisory authorities. Reporting obligations: Subject to applicable legislation, we may share some of your data with third parties and especially with Public, Tax and Judicial Authorities, upon their request submitted in the context of their responsibilities.
Legitimate Interests	We may need to process your personal data in order to protect and ensure our legitimate interests, except where such interests are overridden by your interests or fundamental rights and freedom. We pursue our legitimate interest in the following cases: Fraud prevention: We may consult your data in internal sources and those of Santander Consumer Group to create a list or an alert system that will enable us to verify your identity and to detect possible inconsistencies or irregularities in the documentation and information you provide. In this case, and unless there is a circumstance of public interest, we will inform you of this and, if necessary, request additional information. Likewise, as a precautionary measure, and until we carry out the appropriate fraud prevention checks, the status of the credit application will be suspended. We would do all this based on our legitimate interest to detect and prevent possible attempts at fraud. Compliance with our corporate rules: We shall share your personal data for administrative purposes with Santander Group entities in order to allow such companies to comply with the Group´s Financial Crime Compliance internal policies, Recording of our communications: We keep records of any kind of our communication, either oral or in writing, as well as of any request or complaint submitted. Such recording enable us to prove, in case of an audit or a legal dispute that we have fulfilled our contractual or legal obligations. Exercise of claims and defense of our rights: We may need to exercise our legal claims or defend our rights before judicial and other authorities in the context of any legal or out-of-court dispute.
Consent	Marketing communications: Only after your specific, freely given consent we send you out marketing offers tailored to your profile based on the information we already have for you in the context of our contractual relationship. Also, upon your consent we share your data to Santander Group companies so that you receive marketing offers of their products, including insurance products and services. Your consent may be freely withdrawn at any time by contacting us through any available channel. Any processing of data will become unlawful after revocation.

Risk assessment system and sources from which we collect information about you

Santander Consumer has established an automated risk assessment system based solely on automated processing. This system, which is deemed necessary for the initiation of our business relationship and the execution of the credit agreement between us, follows a scoring logic which takes into account personal and financial information:

(i) derived from the information and documentation you have provided us with;
(ii) contained in Santander Consumer's files on your performance in other transactions - both current and cancelled - signed with both Santander Consumer and other Group entities;
(iii) contained in the databases of “Tiresias S.A.” to which we have access, namely information regarding default financial obligations (e.g. bounced cheques, unpaid bills of exchange and promissory notes, termination of loans, payment orders, bankruptcy applications and decisions), financing of any kind by credit and financial institutions (e.g. loans, credit cards, letters of guarantee), your credit scoring (you may find more for Tiresias files and data processing on www.tiresias.gr website); and
(iv) publicly available sources (promotional census, lists of people belonging to professional groups or social networks, international market standards among others, court files, Government Gazette, GEMI etc.).

The result of the assessment of such information may lead to the approval or rejection of the credit application, depending on the conclusion reached regarding the probability of the loan repayment.

Finally, we do clarify that we perform periodic reviews to the risk assessment system to avoid any possible mismatch, error or inaccuracy. Notwithstanding the above, if you are not satisfied with the result of your assessment, you may challenge it by providing the information you consider relevant to refute the decision taken, and request human intervention with one of our analysts to express your view and contest the decision.

How long will we keep your data?

Santander Consumer shall retain the personal data of the Customer for a period of twenty (20) years after the termination of your relationship with us on the condition that the full debt has been paid-of. We may be required to keep it for longer if there is a legal dispute or we need to defend our rights.

In case your credit application has been rejected, the data provided will be kept for a period of five (5) years after its collection. After such period we may keep it anonymized only for statistical purposes.

In case a shorter or longer storage period is foreseen by the law or regulatory acts the retention period of your personal data will be amended accordingly.

To which recipients will your data be communicated?

Santander Consumer may share your personal data to fulfill its legal or contractual obligations or to serve its legitimate interest with the following third parties:

public services and authorities, supervisory, administrative, tax, judicial, prosecutorial and investigative authorities, municipal land customs authorities and/or third parties, provided that the transmission or notification of data is required by law or court judgment;
payment service providers, credit and financial institutions, corresponding banks or entities that are necessarily involved in the execution of payment orders, such as DIAS, SWIFT, SEPA, etc, as required for the performance of the contract;
the company under the name “BANKING INFORMATION SYSTEMS S.A.” and distinctive title “TIRESIAS S.A.” which is authorized to keep interbank records of data of financial behavior, in the context of the protection of credit and financial transactions. Pursuing to ensure the legitimate interest of the entire local banking system, we share data with regards to your credit or loan agreements, their performance and any termination of them. TIRESIAS S.A. is controller of all the data kept (1 Alamanas str., 15125, Maroussi, 2103676700). Please visit TIRESIA’s website www.tiresias.gr, on which there is detailed information about the data collected and kept by TIRESIAS S.A., its personal data protection policy and how you can exercise your rights;
third party providers engaged by Santander Consumer to support day-to-day business, such as information technology (IT) service providers responsible for the development, support and maintenance of the systems and platforms, security service providers to ensure the security of banking systems, service providers executing phone calls or communications on behalf of Santander Consumer, companies carrying out marketing activities;
Debt Collection Companies established under Law 3758/2009 as in force and specifically to “Mellon Debtors Information Company SA” provided that due debts exist for longer than 10 days, Loan Servicer Companies under the provisions of Law 4354/2015, prospective investors or other credit institutions for the securitization or transfer of loans, trusted service providers for the issuance of e-signature certificates;
Santander Group companies to the extent needed for accounting, anti-money laundering and financial crime prevention purposes;
companies responsible for the storage of either physical or digital records and contracts, retention, filing, management and destruction of files and data;
persons cooperating with the Bank to ensure fulfillment of its obligations or for its good operation, such as accountants, auditors, printing companies, courier companies, the Greek post etc;
cooperating law firms and independent legal practitioners for the conduct of any judicial or out-of-court proceedings, notaries and court bailiffs (and their associates) in the context of their legal duties;
insurance and/or insurance mediation companies cooperating with the Bank to offer you bancassurance products and services upon your request and consent.

In case we need to share personal data with service providers located outside the EU, data transfers will be carried out on the basis of a European Commission adequacy decision for this specific country of destination or in accordance with approved standard contractual clauses or other equivalent data protection safeguards to countries that do not provide an adequate level of personal data protection. Currently, we have been engaged Salesforce Inc., a company located in USA, to provide us with marketing services. The international transfer of personal data shall be carried out on the basis of standard contractual clauses already executed by Salesforce providing adequate safeguards.

What are your rights when you provide us with your data?

Right of access: You have the right to request confirmation as to whether or not Santander Consumer is processing personal data concerning you, and if so, to have access to your personal data requesting us to provide information about the personal data we hold about you and process.
Right to rectification: You can at any time correct, complete and update your personal details.
Right to restriction of processing: Under certain circumstances, you may request that we limit the processing of your data that are no longer necessary for the performance of our contract, in which case we will only keep them for the exercise or defense of claims.
Right to request for human intervention: You will have the right to challenge the decision that has been made in a fully automated manner. To exercise this right, you may request the human intervention of one of our analysts and to express your point of view, so that your request can be reassessed. You can do this by sending an e-mail to dataprotection@santanderconsumer.com .
Right to Erasure: You may ask us to delete your personal data, however we may need to keep them for lawful reasons.
Right to objection: You can object to the use of your personal data in case the processing is based on our legitimate interests, unless we demonstrate that there are overriding legitimate grounds for processing.
Right to data portability: Where possible we can share a digital copy of your data obtained electronically with you or another data controller upon your request.

In order to exercise your rights you may contact us either via e-mail sent to dataprotection@santanderconsumer.com, or by post addressed to Santander Consumer Finance S.A. Greek Branch, 6-8 Agissilaou str., 15123, Maroussi, Athens. In any case, you need to specify the right exercised and attach a copy of your identity card.

You may lodge a complaint to the Spanish Data Protection Authority, which acts in our case as Lead Supervising Authority (Calle Jorge Juan, 6 28001 Madrid , Spain - www.aepd.es). You may also lodge a complaint before the Hellenic Data Protection Authority either through its website www.dpa.gr or to its address, Kifissias Avenue 1-3, 115 23, Αthens.

We may update this notice when needed. Any updated version shall always be available at our website www.santanderconsumer.gr.

GDPR notice for customers

PRIVACY NOTICE

Type of personal data

Description (indicatively)

Legal Basis

Processing Purposes

Contact Section