Terms of data protection

Who is the data controller of your personal data?

The information and/or personal data you provide to us is stored on a database whose data controller is:

Why we process your personal data

The company will process all personal data voluntarily provided by interested parties for the following purposes:

  • Handling requests submitted.
  • Carrying out statistical studies and calculations, surveys, market trend analyses and quality controls.
  • Pooling and generally handling your data with the various entities in the Crèdit Andorrà Group.

All data collected, as well as those processed for the above purposes, are required or related to the proper handling of requests submitted and the requirements of the interested parties following requests for information made, and the suggestions and/or opinions they may give.

Unless you have expressly exercised your right to object, the use made of your data falls within the purposes accepted on sending you information and publicity, including via email, about offers, products, recommendations, services, promotional articles and loyalty programmes of the company and the various entities in the Crèdit Andorrà Group (www.creditandorragroup.com) or any third-party entities with which any of the companies in the Crèdit Andorrà Group has entered into collaboration agreements.

Based on the information provided, (except data belonging to special categories), we draw up different profiles depending on your interests and requirements, as well as on the Crèdit Andorrà Group’s business strategy and, therefore, automated decisions will be taken. Under no circumstances will the data of minors be used to draw up profiles. In any event, you are entitled to human assistance, express your opinion and challenge any individual automated decisions taken through the channels established in the section “What are your rights when you provide us with your personal data?”.

How long we will keep your personal data

The personal data provided will be kept on record for the specific time limits based on the following criteria: (i) the legally binding storage period; (ii) the time required to fulfil the purpose for which your data have been collected; and (iii) the right to erasure if requested by the interested party whenever entitled to do so. 

Legal basis for processing your data

The legal basis for processing your personal data for the purposes included in the section “Why we process your personal data” is a legal right in respect of information voluntarily provided by filling in the relevant forms. Offers that made be made in the future on products and services included in the section “Why we process your personal data” are based on the consent that you have given, if applicable.

To which recipients will your data be disclosed

The company may disclose your personal data for the sole purposes set out in the section “Why we process your personal data” to other entities belonging to the Crèdit Andorrà Group (www.creditandorragroup.com) and other natural or legal persons with which the various entities in the Crèdit Andorrà Group enter into collaboration agreements.

In the framework of the disclosures set forth in the above paragraph, international transfers of personal data may be made to third countries or international organisations, about which the European Commission may or may have not taken a decision on their compliance. International transfers to countries unable to ensure a suitable level of protection shall only occur under exceptional circumstances and subject to the relevant authorisation from the competent supervisory body.

Your rights when you provide us with personal data

Under the terms and within the scope provided for by the laws in force, all persons are entitled to:

  • Check whether or not the company has processed their personal data, and to access them and all information related to their processing.
  • Request the rectification of inaccurate information.
  • Request the erasure of their data whenever, amongst other grounds, they are no the company shall cease to process them unless in the exercise of its rights or to defend itself in potential lawsuits.
  • Request a restriction on the processing of their data, in which case they may only be processed with their consent, except if they must be kept on record for use by the company in the exercise of its rights or to defend itself in lawsuits, or with a view to protect the rights of another natural or legal person, or on the grounds of major public interest for the European Union or a certain member state.
  • Object to the processing of their data, in which case the bank shall cease to process them unless to defend itself in potential lawsuits.
  • Receive their personal data submitted to the bank in a structured, commonly used, machine-readable and interoperable format, or request the bank that they be directly sent to another data controller whenever technically possible. 
  • Withdraw the consent granted, if permissible, for the purpose set forth in the section “Why we process your personal data”, whereby this shall not affect the lawfulness of data processed based on consent prior to its withdrawal.

The above rights to access, rectification, erasure, restriction, to object and portability may be directly exercised by the holder of the data or through a legal representative or proxy by writing to Crèdit Andorrà Asset Management Luxembourg, S.A., 30 Boulevard Royal, 2449 Luxembourg.

Interested parties may submit complaints to Commission Nationale pour la  Protection des Données (CNPD), particularly if they believe that they have not obtained satisfaction in the exercise of their rights, via the web page set up for these purposes by the relevant Supervisory Body.