Zintra Capital
enes

Privacy policy

This policy has been prepared in accordance with the provisions of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, the “LOPDD”) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”).

1. DATA CONTROLLER

Identity: ZINTRA CAPITAL CREDIT, S.L. (hereinafter, “Zintra Capital Credit”).

Tax Identification Number (N.I.F.): B-06963698

Registered at:

Postal Address: Calle Príncipe de Vergara, 131, 3rd Floor, 28002 Madrid, Spain.

Telephone: +34 914 326 400

Email: contacto@zintracapital.com

Data Protection Officer (DPO): Seguridad y Privacidad de Datos S.L. – FORLOPD

DPO Contact: infodpo@forlopd.es | www.forlopd.es

2. PERSONAL DATA WE COLLECT

If you have contacted us by telephone, email or through this website, the data collected may generally include:

1. Identification and contact data: first and last name, National Identity Document (DNI), address, email, etc.

2. Personal characteristics data: profession, current employment, country of birth, country of residence, etc.

3. Socio-demographic data: age, province, family situation, gender, etc.

4. Browsing data: in accordance with the provisions of the Cookie Policy.

3. PURPOSES AND LEGAL BASES FOR PROCESSING

The processing operations we carry out with your personal data are diverse and serve different purposes and are based on different legal grounds.

– USERS/VISITORS OF THE CIMD GROUP WEBSITE

We will process the personal data provided through our web forms and other electronic means for the following purposes:

  • a) To handle requests and incidents submitted through the channels provided on the website.

    Legal basis/legitimacy: the consent of the data subject (which may subsequently be withdrawn or revoked, or objected to at the time the personal data is collected), in accordance with Article 6.1(a) of the GDPR. Providing your personal data is necessary to carry out the processing for the purposes indicated. Refusal to provide your personal data will make it impossible for us to handle and manage your request.

  • To handle communications submitted through the whistleblowing channel:

    Legal basis/legitimacy: in cases where required by applicable regulations, compliance with a legal obligation (Law 2/2023 of February, regulating the protection of persons reporting regulatory and corruption-related violations, Law 10/2010 on the prevention of money laundering and terrorist financing, and Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of preventing, detecting, investigating and prosecuting criminal offences and enforcing criminal sanctions), as established in Article 6.1(c) of the GDPR.

    The communication of the data subject’s personal data is necessary to comply with the legal obligations applicable to our activities, including in relation to the reported person, who may not object to the processing of their personal data for this purpose. (Without prejudice to the possibility of submitting anonymous reports in accordance with applicable regulations).

  • Additionally, in those cases where communication is not mandatory under applicable regulations, the legal basis may be the public interest (Article 8.2 LOPDD), in accordance with Article 6.1(e) of the GDPR.

    In this case, the data subject (the reported person) may not object to the processing of their personal data due to the existence of compelling grounds for such processing.

    With regard to the right of access, reported persons and other interested third parties (such as persons who may be mentioned in the report) may not access the identity of the reporting person. The identity of the informant or reporting person will remain strictly confidential throughout the process and may only be disclosed to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation. Anonymous reports may also be submitted.

  • b) To handle complaints and claims submitted through our customer service channels, as well as data protection claims and the exercise of data protection rights by data subjects.

    Legal basis/legitimacy: compliance with a legal obligation (Law 44/2002 of 22 November on measures for the reform of the financial system and Order ECO/734/2004 of 11 March on customer service departments and services and the customer ombudsman of financial institutions, with regard to complaints and claims, and the LOPDD and GDPR with regard to personal data protection), as established in Article 6.1(c) of the GDPR.

    Providing your personal data is necessary to carry out the processing for the indicated purpose. Refusal to provide your personal data will make it impossible for us to handle your complaint or request.

  • c) Use of cookies and similar technologies on the website.

    Legal basis/legitimacy: the consent of the data subject (which may subsequently be withdrawn or revoked, or objected to at the time the personal data is collected), in accordance with Article 6.1(a) of the GDPR.

    Refusal to provide your personal data will make it impossible to process your data for the aforementioned purposes.

  • d) To protect, exercise and defend our rights and interests in any administrative, pre-litigation and/or judicial proceedings arising from or related to the relationship established with you, or to respond to claims of any kind.

    Legal basis/legitimacy: the satisfaction of the legitimate interest pursued by Zintra Capital Credit or by a third party in guaranteeing and enforcing their right to effective judicial protection and/or defending their rights and interests, provided that your interests or fundamental rights and freedoms do not override such legitimate interest, as established in Article 6.1(f) of the General Data Protection Regulation (GDPR).

    In this case, the data subject may not object to the processing of their personal data due to the existence of compelling grounds for such processing.

– JOB APPLICANTS

We will process the personal data provided by submitting your Curriculum Vitae (CV) through our web form for the following purposes:

  • a) To manage your application.
  • b) To contact you to keep you informed about the status of the recruitment process and your application.
  • c) To send communications regarding new job vacancies that may be relevant to your needs, provided that you have previously authorized us to send you such information.
  • d) To transfer your data to entities belonging to Zintra Capital Credit.

Legal basis/legitimacy: the consent of the data subject (which may subsequently be withdrawn or revoked, or objected to at the time the personal data is collected), in accordance with Article 6.1(a) of the GDPR.

Providing your personal data is necessary to carry out the processing for the indicated purpose. Refusal to provide your personal data will make it impossible for us to handle and manage your request.

4. RECIPIENTS

Your data may be disclosed to:

  • Courts and Tribunals.
  • Public Administrations.
  • State Security Forces and Corps.
  • Banks, Financial Institutions and Investment Services Companies.
  • Authorities and Official Bodies.
  • Bodies responsible for supervising financial and securities markets.
  • Companies belonging to Zintra Capital Credit, for the purpose of handling your requests and complying with the legal obligations applicable to our activities.
  • Other professionals within the financial sector, where such disclosure is required by law or is necessary for the performance of the services you have contracted.

5. INTERNATIONAL DATA TRANSFERS

Your personal data is processed within the European Economic Area. We will not transfer or disclose it to third parties outside the EEA, unless we are legally required to do so.

6. RETENTION PERIODS

The personal data provided will be retained for as long as necessary to fulfil the purposes for which it was initially collected.

Retention of consent-based authorizations: we will process your data until you withdraw your consent or request the deletion of your data.

If you have provided us with your CV, we will retain your data for a maximum period of one year from the date it was received by any of the entities belonging to Zintra Capital Credit, unless you have authorized us to retain your data for a longer period.

Personal data obtained through reports submitted via the Whistleblowing Channel will be retained in the system for the time necessary for their investigation (3 months, which may be extended by an additional 3 months), in accordance with the applicable regulations, Law 2/2023. Once this period has elapsed, the data may be processed by the department designated for this purpose in order to provide evidence of the operation of the Group’s Crime Prevention Model.

Retention for compliance with legal obligations and the filing, exercise and defence of claims:

Once the data is no longer necessary for the relevant processing, you have withdrawn the authorizations for the use of your data by withdrawing your consent, or the contractual relationships established with us have ended, the data will remain duly blocked, where appropriate, to make it available to the competent Public Administrations and Public Bodies, Judges and Courts or the Public Prosecutor’s Office, for the limitation period applicable to any actions that may arise from the contractual relationship maintained with the customer and/or for the legally established retention periods.

Data destruction:

Personal data will be destroyed once the retention periods imposed by the regulations governing Zintra Capital Credit’s activities and the limitation periods for administrative or judicial actions arising from the relationships established have elapsed.

7. RIGHTS

Data subjects may exercise, at any time and completely free of charge, their rights of access, rectification and erasure, as well as request the restriction of processing, object to processing, request the portability of their data (where technically possible) or withdraw the consent previously given, and, where applicable, the right not to be subject to a decision based solely on automated processing, including profiling.

You may exercise your rights by submitting a written request addressed to the data controller: Zintra Capital Credit

– Compliance Department, at the following address: c/ Príncipe de Vergara No. 131, 3rd Floor, 28002 Madrid, or by email to: contacto@zintracapital.com

In both cases, you may be asked to provide a copy of your DNI or equivalent document for the purpose of verifying your identity.

We will analyse your request and/or complaint in order to provide a response and resolve the issue as quickly as possible.

Likewise, we inform you that Zintra Capital Credit has a Data Protection Officer (DPO), whom you may contact with any questions, complaints or incidents concerning the processing of your data or the exercise of your rights (for example, if you do not understand any section of this Policy, if you have questions regarding our legitimate interests, or if you have already submitted a complaint and have not received a satisfactory response, among other matters you may consider relevant). For this purpose, you may contact the registered office or the email address indicated in the relevant section above.

You may also lodge a complaint with the competent Data Protection Supervisory Authority (Spanish Data Protection Agency), through its website: www.aepd.es, if you believe that your data protection rights have been infringed, if you consider that you have not obtained satisfaction in exercising your rights, or if you have not received a response to requests or complaints submitted by you.

8. AUTOMATED DECISION-MAKING AND PROFILING

The entity does not carry out automated decision-making or profiling.

9. ACCURACY OF DATA

The data subject guarantees that the information provided is true, accurate, complete and up to date, and undertakes to inform us of any changes to the data provided through the channels made available for this purpose and indicated in section one of this policy. The data subject shall be responsible for any direct or indirect damage that may arise as a result of failure to comply with this obligation.

10. AMENDMENTS / UPDATES TO THIS POLICY

This Privacy Policy may be amended and/or updated in accordance with applicable legal requirements or for the purpose of adapting it to instructions issued by the Spanish Data Protection Agency or to changes to our website. For this reason, we recommend that users regularly review our Privacy Policy.

If you have any questions regarding this policy, you may contact ZINTRA CAPITAL CREDIT, S.L. at the following email address: contacto@zintracapital.com.