1. Formalisation, management, maintenance and execution of the pre-contractual and contractual phase

Purpose / Description of the processing: As an insurer, we will process your personal data to formalise, manage, maintain and execute the contractual relationship with you, as well as the procedures prior to contracting. This processing involves in the initial phase in which you request the insurance, the processing and management of insurance applications and rates that best suit your demands and needs through the available channels; and, in contractual phase, the formalisation of the insurance contract, as well as the management, maintenance and execution of the operation on the same through the available channels. That is to say, the ordinary management during the life of the insurance contract (modifications of the data initially provided, extensions of coverage, delivery of the mandatory information of the contracted product), the provision of the insured coverage or complementary services included in the insurance policy, management of your queries through the authorised channels, performance of the checks and investigations necessary to determine, where appropriate, the payment of the applicable compensation.

This processing includes the sending of necessary communications and/or those derived from the management of our contractual and/or pre-contractual relationship with you by the means agreed in the policy (i.e. postal letter, e-mail, telephone, including SMS or WhatsApp and push notifications), using for this any of the contact details that you have provided to us during the same (i.e. including that provided during claims management). If you do not want to receive such communications by any of the aforementioned means, please contact us so that we can register your preferences at protecciondedastos@reale.es.

In addition, we inform you that we carry out continuous improvement processes in order to optimise the solutions that allow us to manage the aforementioned purposes, so we can carry out processing methods that include Artificial Intelligence components. These processing methods will not involve decision-making based solely on automated processing of personal data. You can obtain updated information at www.reale.es/es/politica-de-privacidad (www.reale.es/en/privacy-policy)

Data processed:

Those obtained directly from you or your relationship with us:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address, landline, mobile and digital signature.
• Financial and work data / academic data: employment status, profession, level of education, level of income and expenses and bank account identification data.
• Asset solvency data: data on the breach of a debt contracted with us.
• Information regarding family circumstances and socio-economic and socio-demographic data: life cycle, personal data of third parties included in the coverage of the policies offered (e.g. family members or employees), their family connection, types of persons according to age and level of studies living in the geographical environment of the data subject, types of families living in said environment according to the number and characteristics of their members, categories of professional activities existing in the geographical environment in which the data subject resides, purchasing power based on annual income, the level of grouping - detached house or block - and whether there are shopping areas present.
• Information obtained from our business with you and relationship with you: project requests and pricing including details, preferred languages and channels of communication, previous relationships with entities and age, data contained in complaints and claims that you make to us, conversations recorded in the Contact Centre (CC), data obtained in videoconferences, online chat, telephone calls or equivalent means with you and consultations made through the different means offered (CC, Mediator, Private Web Area and App) personal data of third parties included in the coverage of the policies offered (e.g. relatives or employees) and their family connection.
• Historical information on current and past insured risks: information on the policy(ies), the vehicle(s) and drivers, information on the dwelling(s), information on the insured risk in branches other than vehicle and home, age of the contracted policies, discounts and/or commercial actions applied to the policies, reason for cancellation, supplements and/or changes made to the policies and premiums associated with them.
• Historical information on internal claims: reported claims including reasons and dates of occurrence and reporting, status of the claim, associated files, key results, workshops and professionals involved, itemised amount of the claim (both provisions and pending settlements and payments made), identification and contact details of harmed or injured parties, contact information that you have provided us, contact persons and inquiries made.
• Log of your satisfaction/experience information: global and particular satisfaction according to the times an evaluation or opinion has been requested, comments made in the satisfaction surveys, actions carried out as a result of the evaluation or opinion provided, as well as complaints and claims made.
• Information associated with your historical profitability as a customer: earned premium, claims.

We also process personal data obtained from external sources. Specifically:

• Asset solvency data: data on the default of a debt contracted with a private company (including other entities of the Reale Group), data obtained from credit information systems, credit rating companies and fraud prevention information systems. You can consult more information at www.reale.es/es/politica-de-privacidad (www.reale.es/en/privacy-policy) in section 10. Credit Information Systems.
• Information included in common databases protected by codes of conduct of the insurance sector: data obtained from common databases as appropriate for the type of insurance subscribed, these being the Historic Automobile Insurance Database (Sinco), the Total Loss, Theft and Fire Automobile Database and the Miscellaneous insurance fraud prevention database as well as accident certificates from other companies. The age of such data is limited to a maximum of 5 years.
• Information associated with your location and online behaviour: browsing and activity data (i.e. cookie information, device ID, advertising ID, IP address and browsing history) obtained from websites, web Private Area and App or other devices provided by the same (e.g. black box in vehicles) and data inferred from the monitoring and analysis carried out; all this as long as you have given your permission through said devices.
• Aggregated information from external public and private sources about the risk: Google geopositioning information, information associated with the location of the risk obtained from external sources of a public or private nature (i.e. from the INE, AEMET, DGT, registry of tourist rental homes (Airbnb), census data, information from the IGN) and data obtained from other publicly accessible sources such as newspapers and official bulletins, public records, resolutions of the Public Administrations, cadastre, telephone directories, lists of people belonging to professional associations or autonomous, commercial information from Google, satellite images of a home, building, company, and home automation.

Processing of health data: In addition, when necessary for the provision of services, we will process data on your past and/or present physical and mental health status that you have provided directly or that have been obtained during the management or processing of a claim (including those about third parties affected, whom we will also inform), in order to:

• Determine the health care and compensation to which, where appropriate, the injured party is entitled.
• Make the payment to health providers or the reimbursement to the insured or their beneficiaries of the health care expenses that have been incurred within the scope of the insurance contract.

Law 20/2015, of 14 July, on the organisation, supervision and solvency of insurance and reinsurance entities (“LOSSEAR”) covers the processing of these personal data that may be necessary for the execution of the insurance contract and for reasons of public interest in the field of public health.

2. Communication of the data of the policyholder, those of the insured, beneficiary or injured third party to other insurance or reinsurance entities when it is necessary for the execution of the subscribed coinsurance or reinsurance contract, as well as to the insurance broker that has brokered the policy when necessary for the management of thereof.

Purpose / Description of the processing: When we go to a reinsurance entity in relation to your contract, we will communicate only those personal data indicated above that are strictly necessary to these ends for the execution and management of the reinsurance or coinsurance contract, in the terms provided in the LOSSEAR. In addition, for those cases in which your insurance has been mediated by a broker, we must also communicate to the broker certain personal data insofar as this is necessary for the management of your policy, in the terms provided in the regulations governing the distribution insurance.

1. Comply with general obligations under the regulations applicable to insurance entities.

Purpose / Description of the processing: As an insurance company we need to process your personal data in order to comply with the legal obligations set forth in Law 50/1980, of 8 October, on the Insurance Contract (“LCS”), the LOSSEAR and other regulations applicable to insurance companies, as well as general tax and commercial regulations.

These obligations include (i) the communication of your personal data to authorities, regulators or public bodies; (ii) the assessment, selection and pricing of risks (including the preparation of profiles for statistical-actuarial purposes), both prior to contracting and during its term, as well as obtaining information prior to contracting insurance, as well as periodically when appropriate, by evaluating the suitability of the requested product according to your demands and needs; (iii) the adoption of effective measures to prevent, identify, report and remedy fraudulent conduct; (iv) the processing and, where appropriate, communication of your data for the fulfilment of tax obligations and (v) the keeping of the accounting books required by the Code of Commerce and other applicable provisions, as well as the records of accounts, claims, technical provisions, investments, reinsurance contracts and policies, supplements and cancellations issued.

In addition, we will process your data to comply with our obligation to attend to and resolve the complaints and claims that the policyholders, insured, beneficiaries, injured third parties or successors of any of them may present, related to their legally recognised interests and rights. For these purposes, we have our Customer Service and Defence Services, which are responsible for dealing with and resolving complaints and claims.

Finally, and in compliance with our obligations, common databases such as those indicated in the following section will be consulted in relation to the data processed.

Data processed:

• Information included in common databases protected by codes of conduct of the insurance sector: data obtained from common databases as appropriate for the type of insurance subscribed, these being the Historic Automobile Insurance Database (Sinco), the Total Loss, Theft and Fire Automobile Database and the Miscellaneous insurance fraud prevention database, as well as accident certificates from other companies. The age of such data is limited to a maximum of 5 years.

Processing of health data: In addition, when necessary we will process your health data provided in the health questionnaire and, where appropriate, collected through the medical health examination by a doctor or hospital for this purpose. The LCS protects the processing of this personal data that is necessary for compliance with legal obligations and for reasons of public interest in the field of public health (exception Article 9.2 g) of the GDPR).

2. Comply with the regulations on the prevention of money laundering and financing of terrorism.

Purpose / Description of the processing: REALE VIDA needs to process your personal data to carry out the corresponding checks and fulfil its obligations in accordance with the provisions of Law 10/2010, on the Prevention of Money Laundering and the Financing of Terrorism, and its implementing regulations.

Data processed:

Those obtained directly from you or your relationship with us:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address.

We also process personal data obtained from external sources. Specifically:

• Information obtained from FACTIVA: National identity document, sex, criminal record, profession, nationality, postal address.
• Information obtained from the Registry of the General Council of Notaries for the identification of the real owner of the operations: Name, surnames and national identity document.

1. Fraud prevention (including profiling).

Purpose / Description of the processing: We will process your personal data to carry out studies and automatic controls of fraud, defaults, and incidents derived from the products requested or contracted, both in the pre-contractual and contractual phase, for the prevention, detection and control of fraud.

Within the insurance field, in accordance with the LOSSEAR, insurance companies must adopt effective measures to prevent, impede, identify, detect, report and remedy fraudulent conduct related to insurance, whether adopted individually, or through participation in common databases officially created between insurance companies that contain personal data. These measures are aimed at the settlement of claims and actuarial statistical collaboration in order to allow pricing, risk selection, as well as the preparation of insurance technical studies.

This processing also entails the communication of personal data between companies of the Reale Group, with the purpose indicated above (to carry out cross-checks on fraud committed with any of them).

This profiling does not imply decision-making based solely on automated processing of the personal data that we indicate below. Likewise, this profiling is carried out based on the analysis of the existence of debts in order to assess the level of fraud risk, to avoid identity theft, as well as to prevent delinquency.

Data processed:

Those obtained directly from you or your relationship with us:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address, landline and mobile phone and digital signature.
• Asset solvency data: data on the breach of a debt contracted with us."

We also process personal data obtained from external sources. Specifically:

• Asset solvency data: data on the default of a debt contracted with a private company (including other entities of the Reale Group), data obtained from credit information systems, credit rating companies and fraud prevention information systems. You can find more information at www.reale.es/es/politica-de-privacidad (www.reale.es/en/privacy-policy) in section 10. Credit Information Systems.
• Information included in common databases protected by codes of conduct of the insurance sector: data obtained from common databases as appropriate for the type of insurance subscribed, these being the Historic Automobile Insurance Database (SINCO), the Total Loss, Theft and Fire Automobile Database and the Miscellaneous insurance fraud prevention database, as well as accident certificates from other companies. The age of such data is limited to a maximum of 5 years.

Legitimate interest: The legitimising basis for this purpose is the legitimate interest in preventing and hindering fraudulent conduct (such as identity theft) that directly affects your Insurer, the Reale Group (e.g. assuming economic or reputational losses) or the sector in general. We have made a weighting judgement - available on request - to ensure that said legitimate interest prevails and that your interests and rights remain appropriately protected.

2. Conducting satisfaction surveys and studies related to the insurance contract application and management process.

Purpose / Description of the processing: We may contact you to carry out quality surveys and satisfaction studies related to the insurance contract application and management process.

Data processed:

We only process data obtained directly from you for this purpose. Specifically:

• Identification, personal and contact data: name, surnames, identity document, nationality, age, marital status, postal and electronic address, landline and mobile phone.
• Financial and work data / academic data: employment status, profession, level of education, level of income and expenses.
• Information obtained from our business with you and relationship with you: project requests and pricing including details, preferred languages and communication channels, previous relationships with entities and seniority, data contained in complaints and claims that you make to us, conversations recorded in the Contact Centre (CC), data obtained in videoconferences, telephone calls or equivalent means with you and consultations made through the different means offered (CC, Mediator, Private Web Area and App).
• Historical information on current and past insured risks: information on the policy(ies), the vehicle(s) and drivers, information on the dwelling(s), information on the insured risk in branches other than car and home, age of the contracted policies, discounts and/or commercial actions applied to the policies, reason for withdrawal, supplements and/or changes made to the policies and premiums associated with them.
• Historical information on internal claims: reported claims including reasons and dates of occurrence and reporting, status of the claim, associated files, key results, workshops and professionals involved, itemised amount of the claim (both provisions and pending settlements and payments made), identification, contact and health data of harmed or injured parties, contact information that you have provided us and contacts and consultations made.
• Log of your satisfaction/experience information: overall and specific satisfaction according to the times you have been asked for a rating or opinion, comments made in satisfaction surveys, actions carried out as a result of the rating or opinion provided and complaints and claims made.

Legitimate interest: The legitimate basis for this purpose is the legitimate interest of your Insurer in the proper functioning of its services and the company. We have made a weighting judgement - available on request - to ensure that said legitimate interest prevails and that your interests and rights remain appropriately protected.

3. Anonymisation and pseudonymisation of personal data to carry out statistical and historical studies for the monitoring and management of our insurance activity, as well as for the improvement of our products or services.

Purpose / Description of the processing: We will carry out processes of anonymisation of your personal data to (i) carry out studies, statistical analysis, analytical and artificial intelligence models for the development of improvements and new products; (ii) develop and improve analytical and artificial intelligence models to determine purchase intentions and/or retention actions on our products; and (iii) prepare reports on our activity in relation to the market and customers that allow us to efficiently direct and manage our business, as well as create statistical and mathematical models to assist in said task.

The processing of statistical reports and mathematical models is not intended to process personal data individually, but is carried out for the purpose of obtaining statistical and aggregate data, dissociated from the information of their owners, to prepare management reports and algorithmic or mathematical formulas. The processing of your personal data is accessory to the purpose pursued and implies that your personal data will be modified and added in such a way that does not allow you to be identified (anonymisation) or will be processed once encrypted (pseudonymisation).

Data processed:

Those obtained directly from you or your relationship with us:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address, landline and mobile phone and digital signature.
• Financial and work data / academic data: employment status, profession, level of education, level of income and expenses and bank account information.
• Asset solvency data: data on the breach of a debt contracted with us.
• Information regarding family circumstances and socio-economic data and socio-demographic data: life cycle, personal data of third parties included in the coverage of the policies offered (e.g. family members or employees), their family connection, types of persons according to age and level of studies living in the geographical environment of the data subject, types of families living in said environment according to the number and characteristics of their members, categories of professional activities existing in the geographical environment in which the data subject resides, purchasing power based on annual income, the level of grouping - detached house or block - and whether there are shopping areas present.
• Information obtained from our business with you and relationship with you: project requests and pricing including details, preferred languages and channels of communication, previous relationships with entities and seniority, data contained in complaints and claims that you make to us, conversations recorded in the Contact Centre (CC), data obtained in videoconferences, telephone calls or equivalent means with you and consultations made through the different means offered (CC, Mediator, Private Web Area and App).
• Historical information on current and past insured risks: information on the policy(ies), the vehicle(s) and drivers, information on the dwelling(s), information on the insured risk in branches other than car and home, age of the contracted policies, discounts and/or commercial actions applied to the policies, reason for cancellation, supplements and/or changes made to the policies and premiums associated with them.
• Historical information on internal claims: reported claims including reasons and dates of occurrence and reporting, status of the claim, associated files, key results, workshops and professionals involved, itemised amount of the claim (both provisions and pending settlements and payments made), identification, contact and health data of harmed or injured parties, contact information that you have provided us and contacts and consultations made.
• Log of your satisfaction/experience information: overall and particular satisfaction according to the times you have been asked for a rating or opinion, comments made in satisfaction surveys, actions carried out as a result of the rating or opinion provided and complaints and claims made.
• Information associated with your historical profitability as a customer: earned premium, claims and commercial expenses).

We also process personal data obtained from external sources. Specifically:

• Asset solvency data: data on the default of a debt contracted with a private company (including other entities of the Reale Group), data obtained from credit information systems, credit rating companies and fraud prevention information systems. You can consult more information at www.reale.es/es/politica-de-privacidad (www.reale.es/en/privacy-policy) in section 10. Credit Information Systems.
• Information included in common databases protected by codes of conduct of the insurance sector: data obtained from common databases (as appropriate by the type of insurance subscribed, the Historical Automobile Insurance Database (SINCO), the Total Loss, Theft and Fire Automobile Database and the Miscellaneous insurance fraud prevention database) and accident certificates from other companies. The age of such data is limited to a maximum of 5 years.
• Information associated with your location and online behaviour: browsing and activity data (i.e. cookie information, device ID, advertising ID, IP address and browsing history) obtained from websites, Private Area/Apps or other channels of these, other devices provided by them (e.g. black box in vehicles) and data inferred from the monitoring and analysis carried out; all this as long as you have allowed it through said devices.
• Aggregated information from external public and private sources on the risk: geopositioning information on Google, information associated with the location obtained from external sources of a public or private nature (i.e. from the INE, AEMET, DGT, registry of tourist rental homes (Airbnb), census data, information from the IGN) and data obtained from other publicly accessing sources such as official newspapers and bulletins, public registers, resolutions by Public Administrations, cadastre, telephone directories, lists of people belonging to professional associations, satellite images of a home, building, company, and home automation).
• Other data obtained from social networks: social media profiles, comments and posts made publicly on social media (e.g. Facebook, Twitter, Instagram, etc.), blogs, forums, comments and posts made privately on the profiles of the social network entity, provided that you have given us your consent.

Legitimate interest: The legitimate basis for this purpose is our legitimate interest in designing, organising and optimising business and commercial activity in the most efficient way possible. As well as to define or improve the design of our products or services. We have made a weighting judgement - available on request - to ensure that said legitimate interest prevails and that your interests and rights remain appropriately protected.

4. To ascertain your financial solvency and creditworthiness.

Purpose / Description of the processing: your Insurer will consult the common databases related to the fulfilment or breach of monetary obligations. This consultation can be performed before and during the contractual relationship. In the same way and subject to current regulations, the customer is informed that the breach of the monetary obligations assumed by virtue of the contracts that he/she maintains may cause the inclusion of his/her personal data in a common database related to the fulfilment or breach of monetary obligations.

Those obtained directly from you or your relationship with us:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address, landline and mobile phone numbers.
• Asset solvency data: data on the breach of a debt contracted with us."

We also process personal data obtained from external sources. Specifically:

• Asset solvency data: data on the default of a debt contracted with a private company (including other entities of the Reale Group), data obtained from credit information systems, credit rating companies and fraud prevention information systems. You can consult more information at www.reale.es/es/politica-de-privacidad (www.reale.es/en/privacy-policy) in section 10. Credit Information Systems.

Legitimate interest: The legitimising basis for this purpose is its legitimate interest in avoiding fraud and ensuring payment for the products and services that we offer you. We have made a weighting judgement - available on request - to ensure that said legitimate interest prevails and that your interests and rights remain appropriately protected.

1. Centralised management of personal data for organisational purposes of customer management.

Purpose / Description of the processing: We process your personal data jointly for the centralised management of our internal resources, as well as to provide you with a more immediate and complete service upon request. This entails the maintenance of a common database that helps us manage your requests and our internal resources together.

For example, when you go to any of our branches to ask us for help in relation to one or several insurance policies contracted with one or any of us, our agents consult the personal data necessary for said consultation that any of us have in order to have a more and to be able to provide you with a more efficient service.

Data processed:

Those obtained directly from you or your relationship with us:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address, landline, mobile and digital signature.
• Financial and work data / academic data: employment status, profession, level of education, level of income and expenses and bank account details.
• Asset solvency data: data on the breach of a debt contracted with us.
• Information regarding family circumstances and socio-economic data and socio-demographic data: life cycle, personal data of third parties included in the coverage of the policies offered (e.g. family members or employees), their family connection, types of persons according to age and level of studies living in the geographical environment of the data subject, types of families living in said environment according to the number and characteristics of their members, categories of professional activities existing in the geographical environment in which the data subject resides, purchasing power based on annual income, the level of grouping - detached house or block - and whether there are shopping areas present.
• Information obtained from our business with you and relationship with you: project requests and pricing including details, preferred languages and channels of communication, previous relationships with entities and seniority, data contained in complaints and claims that you make to us, conversations recorded in the Contact Centre (CC), data obtained in videoconferences, telephone calls or equivalent means with you and consultations made through the different means offered (CC, Mediator, Private Web Area and App) personal data of third parties included in the coverage of the policies offered (eg relatives or employees) and their family connection.
• Historical information on current and past insured risks: information on the policy(ies), the vehicle(s) and drivers, information on the dwelling(s), information on the insured risk in branches other than car and home, age of the contracted policies, discounts and/or commercial actions applied to the policies, reason for cancellation, supplements and/or changes made to the policies and premiums associated with them.
• Historical information on internal claims: reported claims including reasons and dates of occurrence and reporting, status of the claim, associated files, key results, workshops and professionals who have intervened, itemised amount of the claim (both provisions and pending settlements and payments made), identification and contact details of harmed or injured, contact information that you have provided us, contacts and inquiries made.
• Log of your satisfaction/experience information: overall and particular satisfaction according to the times you have been asked for a rating or opinion, comments made in satisfaction surveys, actions carried out as a result of the rating or opinion provided and complaints and claims made.
• Information associated with your historical profitability as a customer: earned premium, claims.

Legitimate interest: The legitimising basis for this purpose is the legitimate interest of the Joint Data Controllers in maintaining a common repository of your personal data in order to be able to manage our internal resources more efficiently and to be able to provide our services in an integral manner. We have made a weighting judgement - available on request - to ensure that said legitimate interest prevails and that your interests and rights remain appropriately protected.

2. Preparation of “basic” profiles for commercial or promotional purposes only while you are a customer of any of the Joint Data Controllers.

Purpose / Description of the processing: We process your personal data to create “basic” profiles about you using marketing studies, statistical procedures and segmentation techniques for commercial or promotional purposes only while you are a customer of any of the Joint Data Controllers and on the basis of the data we obtain from you and during the relationship with you

MORE INFO: This means that we will develop cross-selling commercial models between the Joint Data Controllers (which do not involve the crossing and/or combination of your personal data held by each Joint Data Controller) and joint customer acquisition, loyalty, development and retention actions.

This profiling will be done without involving decision-making based solely on automated processing, based on simple parameters, to evaluate certain general aspects about you, in particular to analyse and predict or infer aspects related to your preferences or needs to offer you the products and services that we believe may interest you based on your preferences and needs that we have inferred. To prepare the aforementioned profiles, the Joint Data Controllers will take into account the data detailed below, to assess which products may be of interest to you based on models that allow us to assess your intention to purchase.

This profiling does not entail comprehensive processing of your personal data (both in duration –i.e. we will not process personal data older than five (5) years– and in quantity or origin) nor do we process particularly intrusive personal data as sensitive data, external data or data about your online behaviour and geolocation. That is why we call it “basic”. In addition, we will not use this commercial profiling, in any case, for the refusal of any product or service or other purposes that may have a significant impact on you.

Data processed:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address, landline and mobile phone.
• Financial and work data / academic data: employment status, profession, level of education, level of income and expenses, bank account information.
• Asset solvency data: data on the breach of a debt contracted with us.
• Information regarding family circumstances and socio-economic data and socio-demographic data: life cycle, personal data of third parties included in the coverage of the policies offered (e.g. family members or employees), their family connection, types of persons according to age and level of studies living in the geographical environment of the data subject, types of families living in said environment according to the number and characteristics of their members, categories of professional activities existing in the geographical environment in which the data subject resides, purchasing power based on annual income, the level of grouping - detached house or block - and whether there are shopping areas present.
• Information obtained from our business with you and relationship with you: project requests and pricing including details, preferred languages and channels of communication, previous relationships with entities and seniority, data contained in complaints and claims that you make to us, conversations recorded in the Contact Centre (CC), data obtained in videoconferences, telephone calls or equivalent means with you and consultations made through the different means offered by the Joint Data Controllers (CC, Mediator, Private Web Area and App).
• Historical information on current and past insured risks: information on the policy(ies), the vehicle(s) and drivers, information on the dwelling(s), information on the insured risk in branches other than car and home, age of the contracted policies, discounts and/or commercial actions applied to the policies, reason for cancellation, supplements and/or changes made to the policies and premiums associated with them.
• Log of your satisfaction/experience information: global and particular satisfaction according to the times an evaluation or opinion was requested, comments made in the satisfaction surveys, actions carried out as a result of the evaluation or opinion provided and complaints and claims made to the Joint Data Controllers.
• Information associated with your historical profitability as a customer: earned premium, claims and commercial expenses).

Legitimate interest: The legitimising basis for this purpose is the legitimate interest of the Joint Data Controllers in knowing your preferences and interests to offer you services and products that may be of interest to you instead of treating you as a stranger and making generic offers, improving the offer that is sent to you and the customer service provided. We have made a weighting judgement - available on request - to ensure that said legitimate interest prevails and that your interests and rights remain appropriately protected.

3. Sending of commercial communications of own products and services and similar to those previously contracted, by any means only while you are a customer of any of the Joint Data Controllers.

Purpose / Description of the processing: We process your personal data to send you commercial communications about our own products and services (i.e. from any of the Joint Data Controllers or other companies of the Reale Group) and similar to those previously contracted by any means (i.e. postal letter, email, telephone including SMS, WhatsApp and Push notifications) only while you are a customer of any of the Joint Data Controllers.

Data processed: Each Joint Data Controller will send said communications to their own customers processing the identification and contact information of yours that they have. In addition, we will start from the information obtained from profiling provided that you have not objected to or have given your consent to it, as applicable.

Legitimate interest: The legitimising basis for this purpose is the legitimate interest of the Joint Data Controllers in offering you products and services, where appropriate, based on your profile and promoting our insurance activity (after making a weighting judgement - available on request - to ensure that said legitimate interest prevails and that your interests and rights remain appropriately protected), as well as the legal authorisation provided for by the regulations of the services of the information society and electronic commerce with respect to commercial communications by electronic means.

If your insurance has been brokered by a Banca Seguros Broker or Operator, we will only process your data for this purpose if your Insurance Broker/Operator previously authorises us to carry out each action, and in the cases in which it applies, additionally, you have given your consent.

Only if you have given us your consent will we use your data for the following purposes:

In addition, if your insurance has been brokered by a Banca Seguros Broker or Operator, we will only process your data for these purposes if your Insurance Broker/Operator previously authorises us for each action.

You decide!

You can decide whether or not to give us your consent by going to https://consentimientos.reale.es/.

1. Preparation of “advanced” profiles for commercial or promotional purposes.

Purpose / Description of the processing: If you give us your consent, we will prepare “advanced” profiles about you through marketing studies and statistical, analytical and artificial intelligence techniques and procedures, and segmentation with the aim of carrying out commercial and promotional activities that are not generic and that fit your preferences, interests and behaviour (i.e. that are tailored to you). You can grant your consent regardless of whether or not you are a customer.

This profiling will be carried out automatically (without involving decision-making based solely on automated processing) and will allow us to evaluate personal aspects about you in a more exhaustive way in contrast to “basic” profiling (see section 5.A. purpose 2), that is, with a greater amount of data and including external sources, by carrying out cross-selling business models between the Joint Data Controllers or actions to capture, build loyalty, develop and retain joint customers. To prepare the aforementioned profiles, the Joint Data Controllers will take into account the data indicated below, to offer you products, benefits and personalised promotions.

Under no circumstances will this advanced profiling serve as a basis for the refusal of any product or service or other purposes that may have a significant impact on you.

If you have objected to the basic profiling, this processing will not be carried out regardless of whether or not you have given your consent.

Data processed:

• Data processed for the preparation of the basic profiling.
• Capital solvency data: data on the default of a debt contracted with a private company (including other entities of the Reale Group), data obtained from credit information systems (Experian), credit rating companies (Equifax Ibérica, S.L.) and fraud prevention information systems (Confirma and Experian). You can consult more information at www.reale.es/es/politica-de-privacidad (www.reale.es/en/privacy-policy) in section 10. Credit Information Systems.
• Information included in common databases protected by codes of conduct of the insurance sector: data obtained from common databases (as appropriate by the type of insurance subscribed, the Historical Automobile Insurance Database (SINCO), the Total Loss, Theft and Fire Automobile Database and the Miscellaneous insurance fraud prevention database) and accident certificates from other companies. The age of such data is limited to a maximum of 5 years.
• Geopositioning and insured risk information: location, information associated with the location obtained from external sources of a public or private nature (ie from the INE, AEMET, DGT, Google, telephone companies or internet services).
• Aggregated information from external public and private sources on the risk: geopositioning information on Google, information associated with the location obtained from external sources of a public or private nature (i.e. from the INE, AEMET, DGT, registry of tourist rental homes (Airbnb), census data, information from the IGN) and data obtained from other publicly accessible sources such as official newspapers and bulletins, public registers, resolutions by Public Administrations, cadastre, telephone directories, lists of people belonging to professional associations, satellite images of a home, building, company, and home automation).
• Other data obtained from social networks: social media profiles, comments and posts made publicly on social media (e.g. Facebook, Twitter, Instagram, etc.), blogs, forums, comments and publications made privately on the Joint Data Controllers’ profiles on social networks.

Data processed: Each Joint Data Controller will send said communications to their own customers and for this will process the identification and contact information they have on you. In addition, we will start from the information obtained as a result of the preparation of profiles indicated in the previous purposes, provided that you have not objected or have given your consent for it, as applicable.

2. Sending of sales actions for two years once the pre-contractual and/or contractual relationship has ended.

Purpose / Description of the processing: If you give us your consent, we may keep your data for two years once the validity of your insurance, project or pricing application (pre-contractual relationship) and/or your insurance (contractual relationship) has ended, to offer you products, bonuses and participate in promotional campaigns that may prove of interest to you based on the knowledge we have about you. For this we will need to manage and evaluate the data that we have detailed below.

Data processed:

Those obtained directly from you or your relationship with us:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address, landline, mobile and digital signature.
• Financial and work data / academic data: employment status, profession, level of education, level of income and expenses and bank account details.
• Asset solvency data: data on the breach of a debt contracted with us.
• Information regarding family circumstances and socio-economic data and socio-demographic data: life cycle, personal data of third parties included in the coverage of the policies offered (e.g. family members or employees), their family connection, types of persons according to age and level of studies living in the geographical environment of the data subject, types of families living in said environment according to the number and characteristics of their members, categories of professional activities existing in the geographical environment in which the data subject resides, purchasing power based on annual income, the level of grouping - detached house or block - and whether there are shopping areas present.
• Information obtained from our business with you and relationship with you: project requests and pricing including details, preferred languages and channels of communication, previous relationships with entities and seniority, data contained in complaints and claims that you make to us, conversations recorded in the Contact Centre (CC), data obtained in videoconferences, telephone calls or equivalent means with you and consultations made through the different means offered (CC, Mediator, Private Web Area and App) personal data of third parties included in the coverage of the policies offered (eg relatives or employees) and their family connection.
• Historical information on current and past insured risks: information on the policy(ies), the vehicle(s) and drivers, information on the dwelling(s), information on the insured risk in branches other than car and home, age of the contracted policies, discounts and/or commercial actions applied to the policies, reason for cancellation, supplements and/or changes made to the policies and premiums associated with them.
• Historical information on internal claims: declared claims including reasons and dates of occurrence and declaration, status of the claim, associated files, key results, workshops and professionals involved, itemised amount of the claim (both provisions and pending settlements and payments made), identification and contact details of harmed or injured, contact information that you have provided us, contacts and inquiries made.
• Log of your satisfaction/experience information: global and particular satisfaction according to the time an evaluation or opinion has been requested, comments made in the satisfaction surveys, actions carried out as a result of the evaluation or opinion provided, as well as complaints and claims made.
• Information associated with your historical profitability as a customer: earned premium, claims.

Data processed: Each Joint Data Controller will send said communications to their own customers and for this will process the identification and contact information they have on you. In addition, we will start from the information obtained as a result of the preparation of profiles indicated in the previous purposes, provided that you have not objected to or have given your consent for it, as applicable.

3. Sending of promotional and advertising information from Grupo Reale entities and third-party companies, whether or not you are a customer.

Purpose / Description of the processing: If you give us your consent, we may send you, by any means, promotional and advertising information from entities of the Reale Group, affiliated entities and/or other third-party companies with which your Insurer has collaboration agreements belonging to the following sectors of activity: insurance, health-related services and welfare, financial, telecommunications, security, technology, energy, audiovisual, education, leisure, automotive and mass consumption and that may be of interest to you.

You can consult the entities of the Reale Group, investee entities and/or other third-party companies with which your Insurer has collaboration agreements. You can find more information on our website in the Who We Are section.

Data processed:

Those obtained directly from you or your relationship with us:

• Identification, personal and contact data: name, surnames, identity document, sex, nationality, age, marital status, postal and electronic address, landline, mobile and digital signature.
• Financial and work data / academic data: employment status, profession, level of education, level of income and expenses and bank account details.
• Asset solvency data: data on the breach of a debt contracted with us.
• Information regarding family circumstances and socio-economic data and socio-demographic data: life cycle, personal data of third parties included in the coverage of the policies offered (e.g. family members or employees), their family connection, types of persons according to age and level of studies living in the geographical environment of the data subject, types of families living in said environment according to the number and characteristics of their members, categories of professional activities existing in the geographical environment in which the data subject resides, purchasing power based on annual income, the level of grouping - detached house or block - and whether there are shopping areas present.
• Information obtained from our business with you and relationship with you: project requests and pricing including details, preferred languages and channels of communication, previous relationships with entities and seniority, data contained in complaints and claims that you make to us, conversations recorded in the Contact Centre (CC), data obtained in videoconferences, telephone calls or equivalent means with you and consultations made through the different means offered (CC, Mediator, Private Web Area and App) personal data of third parties included in the coverage of the policies offered (eg relatives or employees) and their family connection.
• Historical information on current and past insured risks: information on the policy(ies), the vehicle(s) and drivers, information on the dwelling(s), information on the insured risk in branches other than car and home, age of the contracted policies, discounts and/or commercial actions applied to the policies, reason for cancellation, supplements and/or changes made to the policies and premiums associated with them.
• Historical information on internal claims: declared claims including reasons and dates of occurrence and declaration, status of the claim, associated files, key results, workshops and professionals involved, itemised amount of the claim (both provisions and pending settlements and payments made), identification and contact details of harmed or injured, contact information that you have provided us, contacts and inquiries made.
• Log of your satisfaction/experience information: global and particular satisfaction according to the time an evaluation or opinion has been requested, comments transferred in the satisfaction surveys, actions carried out as a result of the evaluation or opinion provided, as well as complaints and claims made.
• Information associated with your historical profitability as a customer: earned premium, claims.

Data processed: Each Joint Data Controller will send said communications to their own customers and for this will process the identification and contact information they have on you. In addition, we will start from the information obtained as a result of the preparation of profiles indicated in the previous purposes, provided that you have not objected or have given your consent for it, as applicable.