Privacy
policy

Privacy policy and processing of personal data

The purpose of this privacy policy is to explain —in accordance with the provisions of Qualified Law 29/2021, of 28 October, on personal data protection (hereinafter, “QLDP”), and its implementing regulations— the way in which CRÈDIT ANDORRÀ, SA will process the personal data it may collect from its customers and users of this website.

CRÈDIT ANDORRÀ, SA undertakes to protect your privacy and to develop technology that gives you the most secure experience on this website.

This privacy statement applies to the websites of Creand group and it governs the collection and use of data. By accepting this privacy policy, you consent to the practices explained in this statement.

Any personal data and information you provide us with will be processed by CRÈDIT ANDORRÀ, SA in its capacity as the data controller. CRÈDIT ANDORRÀ, SA is the owner of this website, and its identification details are:

Identity: Crèdit Andorrà, SA, A-700068-C
Postal address: Avinguda de Meritxell, núm. 80, AD500 Andorra la Vella
Telephone: 00 376 888888
E-mail: info@creand.ad
Contact of the Data Protection Officer: dpo@creandgroup.com

In compliance with the provisions of the QLDP and its implementing regulations, users of this website are informed that the data subject to processing are those categorised in the following section (CATEGORIES OF DATA SUBJECT TO PROCESSING).

All personal data collected directly from the data subject or through their account manager, marketer or any type of collaborator, including the documents that contain said data, as well as data that may be obtained through the recording of telephone conversations, biometric and geolocation data, before, during and after the formalisation of an application, pre-contract or service relating to any of the products marketed by CRÈDIT ANDORRÀ, SA, which are necessary for the study, issuance, development and execution of the contractual relationship, will be subject to processing.

In general, the personal data of minors will only be processed when their parents or legal guardians have given their consent for the processing necessary in the execution of the corresponding contract or service, in compliance with a legal obligation or legitimate interest after the appropriate weighing of rights has been carried out and without prejudice to the exercise of the rights granted to the data subject by personal data protection regulations.

In general, the personal data categories subject to processing in the issuing of an offer, pre-contract or contract that CRÈDIT ANDORRÀ, SA may provide by any means will be data identifying the data subject, as well as those relating to their personal characteristics and/or social circumstances, or any other data that may be necessary for its execution.

More specifically:

Data relating to policies for the contracting and maintenance of products and services marketed to you (our own or those of third parties), in particular:

Contracting data: products and services taken out and/or requested, status of the account holder, authorised account holder, categorisation data according to the regulations on securities markets and financial instruments (MiFID regulations), information on investments made and their evolution, and information on the movements of financing operations.
Basic financial data: current and historical balances of products and services, as well as payment history of contracted products and services.
Data of third parties contained in current account statements and receipts: information relating to entries and movements that third-party issuers may make on your accounts.
Details of your possible status as a shareholder of the entity.
Data of communications with you: any communications we may have obtained from chats, video calls, recorded telephone calls or other equivalent means.
First-party browsing data: the data we may obtain from your browsing of our website, possible mobile applications, device ID, IP address, and whether you have accepted the use of cookies.

Data obtained from publicly accessible sources, public registers or external sources.

Lastly, in the contact forms, in any format, that CRÈDIT ANDORRÀ, SA makes available to you once the information prior to the collection of data has been provided with reference to this privacy policy, the data necessary to establish the requested contact will also be processed.

CRÈDIT ANDORRÀ, SA may process your personal data for the purposes described below, provided you consent to the processing in part or in full:

Purpose 1: For the commercial offering and advertising of all kinds of products and services through any of the channels that the bank has in operation related to the banking-financial and insurance sector by the entities that form part of the Creand group.

Purpose 2: For the analysis and study of your data for the purposes of segmenting and developing profiles for risk assessment and preparing new commercial product proposals.

Purpose 3: For the transfer of data to third parties, in particular so that the bank can transfer your data to investee companies of Crèdit Andorrà, as well as others with which the bank may have agreements, whose activities are related to the banking sector, investment services, share holding, venture capital and real estate, distribution of goods and services, and insurance, so that they can make commercial offers for the products they market.

We also inform you that the express consent you give us will remain in force until you withdraw it or, otherwise, for the duration of the contractual relationship between you and the bank, with the exceptions set out in the clause relating to the period of data retention.

The processing of personal data for the prevention of fraud and/or money laundering and terrorist financing, and other regulatory purposes, has its legal basis in compliance with a legal obligation of CRÈDIT ANDORRÀ, SA in its capacity as the data controller.

Your personal data will be processed for the duration of your contractual relationship and commercial and business relationships, or for the duration of the consent given for the specific purposes referred to above.

Once the contractual relationship has ended or the consent given has been withdrawn, any data that is no longer necessary for the purposes for which it was collected will cease to be processed and will only be kept to comply with the legal obligations imposed on the bank or subsidiaries of the Creand group, and for the formulation, exercise or defence of legal claims, during the limitation period for actions arising from the contractual relationships entered into.

In general, CRÈDIT ANDORRÀ, SA will not disclose your data to third parties if we do not have your express consent to do so. In order to fulfil the above-mentioned purposes, and only when necessary, your personal data may be passed to:

i) CRÈDIT ANDORRÀ, SA’s data processors, who must process your personal data in relation to the purpose in question, which they will do according to the instructions of CRÈDIT ANDORRÀ, SA, in its capacity as the data controller, in accordance with its privacy policy and any appropriate security and confidentiality measures established by CRÈDIT ANDORRÀ, SA.

ii) Competent public administrations, in the cases provided for by the law and for the purposes defined therein.

Within the framework of the aforementioned disclosures, and when it is necessary to perform international data transfers, this will only be carried out in those countries where there is an adequacy decision by the European Commission. In the case of third countries, additional guarantees shall be required under the terms of the regulations in force.

We inform you that, as the data subject, you may exercise your rights of access, rectification, objection, erasure, restriction, portability and withdrawal of consent in accordance with the provisions of the law referred to above by sending a written communication to dpo@creandgroup.com or Crèdit Andorra, SA, Avinguda Meritxell, 80, AD500 Andorra la Vella. You must attach or enclose a copy of your passport or other identity document so that we can verify your identity (the data you provide in this case will only be processed for the exclusive purpose of handling the exercise of your rights).

If you believe that your rights have not been satisfied, or in the event of any violation, you may file a complaint with the Andorran Data Protection Agency (APDA).

The formalisation of a contract or a service entered into with CRÈDIT ANDORRÀ, SA

The express consent of the data subject for the purposes described in the corresponding section and required in this privacy policy

Legitimate interest under the terms set down in the regulations in force

The consent given for any of the specific purposes referred to above may be withdrawn at any time, without prejudice to the lawfulness of the processing based on the consent prior to withdrawal. In these cases, CRÈDIT ANDORRÀ, SA will cease to process the personal data or, where appropriate, will cease to do so for that specific reason, with the exception of imperative legitimate reasons, or the exercise or defence of possible claims.

CRÈDIT ANDORRÀ, SA guarantees that the processing of your personal data is subject to the strictest duty of confidentiality, and that the necessary technical and organisational measures have been put in place to ensure the security of your personal data and prevent its alteration, misuse, loss, theft and unauthorised processing and/or access.

This privacy policy is subject to possible changes in accordance with the legislation in force at any given time. In any case, you will be duly notified of any modifications to this privacy policy so that you are informed of the changes and can give your express consent to those changes.