Privacy Notice

Last updated: May 2025

1. WHO ARE WE?

PagoNxt Payments Services S.L. provides end-to-end payments and messaging solutions through a modern and scalable platform for (hereinafter we or PagoNxt). Our clients are companies and financial institutions (legal entities, hereinafter the Client or the Clients).

2. WHAT IS THE OBJECTIVE OF THIS POLICY?

The purpose of this privacy policy is to explain in a transparent, clear and simple way how we collect, process and protect your personal information and to ensure that PagoNxt does not trade in personal information and that it allows data subjects to handle it in accordance with applicable regulations.

3. TO WHOM IS THIS POLICY ADDRESSED?

This policy is aimed at data subjects who are the holders of the personal information that PagoNxt processes. Specifically, we distinguish the following types of data subjects to which we will refer throughout this document:

1. Users: These are the data subjects who browse our website.
‍2. Applicants: data subjects who request information through one of our contact channels.
‍3. Representatives: data subjects representing one of the companies or institutions that are customers of PagoNxt or are in the process of becoming so. This group includes the following:Legal representatives or representatives.Contact persons.Authorized persons. This being understood to mean those persons authorized by our clients to access the different portals that PagoNxt makes available to them such as the Developer Portal, the Quantum Portal, the Incident Portal or any others.
‍4. Developers: Developer Portal users.
‍5. Candidates: data subjects who have applied for one of PagoNxt’s job offers. The information regarding the processing of their data is collected at the end of this notice (here).

AT A GLANCE: BASIC INFORMATION

To facilitate understanding, we include the most relevant information in the table below. You can find more detailed information in the following heading and contact our Data Protection Officer (DPD) for any clarification or additional queries by writing to privacy.trade@pagonxt.com or through any of our channels.

WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?	PagoNxt Payments Services S.L. N.I.F.: B-87959326 Address: Avenida de Cantabria 5 – Edifico Alhambra Pl 1, CP 28660, Boadilla del Monte (Madrid) Contact DPO: privacy.trade@pagonxt.com
HOW DO WE USE YOUR DATA?	We process your data to; i) be able to contact you or your company if you have asked us for information, ii) to maintain commercial and legal relations with the company you represent and provide the contracted services, iii) to comply with our legal obligations, to send commercial communications to your company, iv) if you are a developer to allow you to use our APIS, v) to send you commercial communications if you have consent and vi) in the case of users of our website to, provided they have accepted its use, insert cookies with various functions.
WHAT LEGAL BASIS DO WE USE TO PROCESS YOUR DATA?	It depends on the processing, but the main legal bases are legitimate interest, compliance with legal obligations and consent.
WITH WHOM DO WE SHARE YOUR DATA?	We can share your data with: Authorities and courts in the legally provided cases. With third parties that provide services to us, that act on our instructions and with whom we have signed a data processor agreement in accordance with the provisions of Article 28 of the GDPR.
WHERE DO WE GET YOUR DATA FROM?	The data we process may have been collected directly from you, may have been given to us by a third party or confirmed by the company for which you are proxy, contact, they may be included in the information given to us by one of the companies of the Santander Group or PagoNxt of which your company is already a customer and whose communication has authorized.
WHAT ARE YOUR RIGHTS?	You can always write to us at privacy.trade@pagonxt.com or use any of our channels available on the private portal to exercise your rights of: Access: Or what is the same, let us tell you what data we have about you and provide you with a copy of it. Rectification: That we correct the information we hold about you if it is incorrect. Cancellation or deletion: That we delete your data when it is no longer necessary or when we are processing it because you have given us your consent. Objection: When the processing of your data is based on a legitimate interest. Limitation of processing: For example, when you have challenged the accuracy of themselves Portability: Requesting that we communicate your data to a third party in a structured, commonly used and machine-readable format, wherever possible, or to yourself. Right not to be subject to automated decisions. You can also file a claim with the AEPD at www.aepd.es
ADDITIONAL INFORMATION	You can find more detailed information in the second layer.

DETAILED INFORMATION ABOUT PRIVACY (SECOND LAYER)

1. DO I HAVE TO SHARE MY DATA?
‍Yes. PagoNxt requests data from you directly, for example, when you contact us to request information or when we request data from your company, such as proxies or contact persons authorized to use different portals. Providing this data is necessary for the purposes for which it is requested and therefore mandatory.

2. WHY DO WE PROCESS YOUR DATA? WHAT LEGAL BASIS DO WE USE? WHAT DATA ARE THEY AND WHERE DO THEY COME FROM?

DATA SUBJECT	WHAT DATA DO WE PROCESS ABOUT YOU AND WHAT IS ITS ORIGIN?	WHAT DO WE PROCESS YOUR DATA FOR?	WHAT IS THE LEGAL BASIS OF THE PROCESSING?
User	We treat the information we receive through the use of cookies if you have accepted them. This information may include your IP or unique identifiers that, although they do not allow us to uniquely identify you without additional information, are considered personal data and originate from your navigation on our websites. More information can be found in our cookie policy.	Depending on the type of cookies you have accepted, we will use them to improve our website by analyzing your usage or personalizing it. More information can be found in our cookies policy.	Consent
Applicant	Depending on the means you use to contact us, we may process: Name and surname Email Telephone Position in your company The data is obtained directly from you.	We process the data to meet your request and to inform you about our products or services.	Legitimate interest in responding to your proactive and express request for information. This is expected by you and does not infringe on your rights.
Representative (includes proxies, contact persons, and authorized persons)	The data that we may process includes those listed below and may have been communicated by you directly, if, for example, you signed your company’s contract with us or registered with the Developer Portal, or by your company (when you provide us with a list of authorized persons). Name and surname Professional location data (address, email, mobile, and post) NIF Any other information included in the documentation provided for client registration Access credentials IP, time, and location of the device from which the services are accessed Voice in case of telephone recordings (in these cases, you will be previously informed of the recording)	1) Register our Client and maintain the contractual and commercial relationship with it. 2) Send communications regarding the contracted services. 3) Send commercial communications (directed to your company) about products similar to those already contracted. 4) Prevent and control the use of PagoNxt for illegal or unauthorized purposes. 5) Send commercial communications of our own or of third parties for which we have requested consent. 6) Send satisfaction surveys about the service. 7) Use voice recordings to evaluate service quality and as proof of instructions received or service provided, if necessary.	1) Legitimate interest of both our Client and PagoNxt in maintaining a contractual and commercial relationship. 2) Legitimate interest. 3) Legitimate interest in informing our client about products similar to those contracted. 4) Legitimate interest in ensuring that PagoNxt is not used for illicit purposes and managing any illegal conduct. 5) Consent. 6) Legitimate interest in knowing the degree of customer satisfaction and seeking improvements. 7) Legitimate interest in improving service quality and exercising our rights.
Developers	The data we process may have been given to us by you or the company for which you work. The types of data are: Name and surname Professional location data (address, email, mobile and post).	Register you and your company on the website and allow you, depending on the case, to use the APIS made available by PagoNxt in sandbox, pre or live and request support.	Legitimate interest in maintaining a contractual or commercial relationship with the company for which you work and with which either PagoNxt has a contract for the provision of services or a commercial relationship of another type.
Any data subject	The data we process may have been given to us by you or the company for which you work. The data is processed is your email.	Send you commercial communications.	Consent

3. WITH WHOM CAN WE SHARE YOUR DATA?

TYPE OF INTERESTED	WITH WHOM CAN IT BE SHARED?	WHY CAN DATA BE SHARED?	ON WHAT LEGAL BASIS?
Any interested party (users, applicants, representatives)	1.With third parties (data processors): PagoNxt uses third parties in the framework of its activity. Some of these third parties may access the personal information processed by PagoNxt but will always do so under a data processing agreement and under the instructions of PagoNxt. These third parties may belong to sectors such as cloud services, technology, communications, etc. 2.With the following: Public administrations Courts and courts State Security Forces and Corps	1.To provide services to PagoNxt. 2.To respond to the specific requests of the same always complying with the applicable regulations or to exercise our rights.	1.This communication is always supported by a processing order that will comply with the requirements of art. 28 of the General Data Protection Regulation, treating the data in charge of the processing on behalf and following the instructions of PagoNxt. 2. Compliance with legal obligations and legitimate interest in exercising our rights.

4. INTERNATIONAL DATA TRANSFERS
No international transfers are carried out outside the European Economic Area, except in the case of the incident portal that is located whose services are provided by a processor besieged in the United States that is certified under the Data Privacy Framework which provides it with adequate guarantees.

‍5. HOW LONG WILL WE KEEP PERSONAL INFORMATION?

INTERESTED	CONSERVATION PERIOD
User	We treat the information we collect through the use of Cookies for the periods indicated in the cookie policy that you can review here
Applicants and developers (if they do not represent a PagoNxt client)	For the period necessary to respond to the inquiry or request for information. After that period, the data will be blocked for 3 years and will be deleted. The 3 years are the maximum limitation period for actions in matters of data protection collected by the LOPDyGDD (Organic Law 3/2018).
Representative	For the entire duration of the contractual relationship plus 5 years as a general rule, unless there are longer applicable limitation periods, in which the data will be kept blocked. In cases where data is processed in order to comply with legal obligations, these will be kept for the period indicated therein.

6. What are my rights and how to exercise them?
‍You have the following rights:
‍
· Access: in other words, we tell you what information we have about you.
· Rectification: we correct the information we hold about you if it is incorrect.
· Cancellation or deletion: we delete your data when they are no longer needed or when we are processing them because you have given us your consent.
· Opposition: when the processing of your data is based on a legitimate interest.
· Limitation of processing: for example, where you have challenged the accuracy of the data themselves.
· Portability: by requesting that we communicate your data to a third party in a structured, commonly used, machine-readable format, where possible, or to you.
· The right not to be subject to automated decisions: that we do not base a decision that has legal effect on you or significantly affects you on automated processing, with some exceptions.

You can also file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

If you want more information about rights in the framework of data protection you can access the infographic about the AEPD here.

You can exercise your rights through your private portal, by writing an email to privacy.payments@pagonxt.com or by contacting us through any of our channels, indicating that this is a request to exercise your rights of GDPR. Remember if we need to confirm your identity we may ask you for some kind of documentation about it.

7. WHAT SECURITY MEASURES DO WE APPLY?
At PagoNxt we are committed to security, and we apply technical and organizational measures aimed at guaranteeing the integrity, unavailability and confidentiality of your data.

For example, all persons who can access personal information are subject to a contractual obligation of confidentiality, we use Data Lost Prevention (DLP) measures, encryption of information in transit and at rest, access control, establishment of secure passwords, etc.

8. OTHER IMPORTANT INFORMATION
8.1 ON THE COMMUNICATION OF PERSONAL INFORMATION OF A THIRD PARTY
As we have already explained in some cases the personal information, we collect is not received directly from you as a data subject, but rather from another person, that represents or provides services for our Client is the one that communicates to us that information or it is information that we access in the framework of the provision of our services.If you are that person, you declare that you have sufficient authorization both to act on behalf of our Client and to communicate such personal information that, in addition, you guarantee that it is true, accurate, complete and up to date. In addition, on behalf of the Client you will inform the interested party of the communication and indicate that you can review this document on our website or, if applicable, show a physical copy of this document.

8.2. ABOUT CHANGES TO THIS POLICY AND INQUIRIES
If it is necessary for us to change the content of this privacy policy we will inform you of the relevant aspects indicating the date from which they will be applicable. We will also publish it on our website.

9. PRIVACY NOTICE CANDIDATES
9.1. Purpose of the processing and legal basis

	3) Management of the selection process
Purpose	We will process your personal data to evaluate your suitability for the job you have requested and to manage the selection process. Linked to this processing and in the event that you turn out to be the candidat@ selected, we may carry out a series of pre-hiring checks that may include: We request information related to your working life issued by official bodies in order to carry out the necessary checks before hiring. We carry out an analysis to verify the reliability, integrity and honesty of the canditat@ and to be able to comply with the legal requirements that may apply to us and with the internal policies of the PagoNxt Group.
Lawfulness	The legal basis for this processing is the execution of the contract or the application of pre-contractual measures. If we ask you for the working life issued by official bodies, the processing will be based on our legitimate interest in verifying the truthfulness and experience that you reflect in your request. The legal basis for integrity analysis, reliability and honesty of the candidat@ will be the legitimate interest of PagoNxt that is specified in that PagoNxt for the type of activity it carries out and for the fact of being part of a financial group must guarantee that the people who occupy certain positions and perform certain functions are the ones suitable considering the risks associated with these functions, this being expected by the candidates, without imbalancing their rights.
Types of data processed	Contact and identification data (name, surname, address, telephone numbers); date of birth, gender, work and educational history, and any other information contained in your CV. Data derived from participation in tests during the selection process (group dynamics, interviews, language tests, etc.). The legal basis for integrity analysis, reliability and honesty of the candidat@ will be the legitimate interest of PagoNxt that is specified in that PagoNxt for the type of activity it carries out and for the fact of being part of a financial group must guarantee that the people who occupy certain positions and perform certain functions are the ones suitable considering the risks associated with these functions, this being expected by the candidates, without imbalancing their rights. Working life. Data publicly communicated by you in your social media profiles.

	3 (b) Resolution and management of consultations
Purpose	Answer the queries you can make during the selection process and after it.
Lawfulness	Our legitimate interest in answering any questions that may arise during the selection process or subsequently.
Types of data processed	Identification and contact data (name, surname, email, telephone). Any data that may be included in the consultation.

	3 (c) Candidate Examination
Purpose	For the purpose of confirming the suitability of the job seeker, the data of the candidate selected for checking that do not appear on the official sanctions lists (in particular in accordance with EU Regulations 2580/2001, 881/2002, 753/2011) are processed. This verification is done through the "Worldcheck" tool before making a firm offer to the selected candidate. For this purpose, personal data is verified only once.
Lawfulness	Depending on the entity that carries out the processing, or the fulfillment of legal obligations or the legitimate interest in fulfilling the obligations of due diligence and avoiding the possible damages (including possible fines) that may arise from the hiring of sanctioned persons.
Types of data processed	Name and surname Date of birth Nationality

Additional information on the use of AI tools to assess whether the candidate meets the requirements of the offer for which he or she is applying

1. How does the automated tool used by PagoNxt work?
During the initial selection of candidates, PagoNxt can use an analysis tool based on artificial intelligence to assess whether the characteristics of the candidates contained in the information provided by them (mostly CVs) meet the requirements of the job offer.

The system analyses this information and generates different scores showing the percentage of matching between the candidates and the job offer based on the information they have provided. The result generated by the tool does not in itself determine a final decision. Candidate selection decisions are made exclusively by human beings, who may or may not consider the results generated by the tool. In any case, there is always human supervision during the evaluation process.
‍
2. What type of information is processed by the automated tool and what is the legal basis for the processing?

The tool only processes the information provided by the candidate at the time of applying for the vacancy, in particular the information contained in the CV.
‍
Candidates participate in the recruitment process on a voluntary basis and the processing of their data is based on the adoption of pre-contractual measures. However, the automated processing of personal data through the tool is legally based on the legitimate interest of PagoNxt.

This legitimate interest is specified in the need to use technological tools to improve efficiency, objectivity and traceability, to optimise the management of the recruitment process and to ensure an initial technical evaluation based on previously defined criteria.

Candidates may, at any time, object to their application being evaluated by the automated tool and request that their profile be reviewed manually by the person responsible for the selection process. To do so, the candidate should contact PagoNxt by e-mail at privacy@pagonxt.com.We may share your personal information with companies that provide services to us and with whom we have entered into a data processing agreement in accordance with applicable law. These will process your data on our behalf and following our instructions.

9.2 Who do we share your data with?
1. With service providers
We may share your personal information with companies that provide services to us and with whom we have entered into a data processing agreement in accordance with applicable law. These will process your data on our behalf and following our instructions.

2.International transfers of data‍
In exceptional cases, as we may use service providers located outside the EEA, or our EEA-based providers may sub-contract to providers outside the EEA, your data may be transferred outside the EEA to countries such as Brazil, Chile, Mexico or others which do not provide a similar or adequate level of protection to that provided in the EEA, we will provide adequate safeguards in accordance with data protection legislation. If you wish to request a copy of these guarantees or additional information, you may do so by contacting the relevant DPO.

9.3 How long do we keep your personal data?

We will process your personal data for as long as the selection process lasts and, where appropriate, as necessary to manage queries. Once the process is complete, we will retain your information in case of future opportunities in which you may be interested in a maximum period of 18 months. After that period, we will proceed to block the information and delete it after the period of exercise of actions.

If you are applying for a job position in Germany, we will process your personal data during the recruitment process. In case you do not receive a job offer from us, we will delete your data after 6 months.

If you are applying for a job position in the UK, we will process your personal data during the recruitment process. In case you do not receive a job offer from us, we will delete your data after 12 months.

9.4. Exercise of rights

You can exercise your rights of access, rectification, erasure, limitation of processing, portability, opposition and the right not to be subject to automated individual decisions including profiling, sending an email to mailbox privacy.payments@pagonxt.com as well as filing a claim with the Spanish Data Protection Agency at www.aepd.es

PRIVACY NOTICE PAGONXT EMONEY EDE, S.LPRIVACY NOTICE PAGONXT PAYMENTS UK Ltd

Last updated: May 2025

PRIVACY NOTICE PAGONXT EMONEY EDE, S.L

1. WHO ARE WE?
PagoNxt Emoney EDE, S.L. is an electronic money institution (hereinafter referred to as We or PagoNxt). Our clients are companies and banking or non-banking financial institutions (legal entities, hereinafter referred to as the Client(s)).
‍
2. WHAT IS THE PURPOSE OF THIS NOTICE?
The purpose of this privacy notice is to explain in a transparent, clear, and simple way how we collect, process, and protect personal information. It is also to ensure that PagoNxt does not trade with personal information and that it allows data subjects to handle it in accordance with applicable law.We may share your personal information with companies that provide services to us and with whom we have entered into a data processing agreement in accordance with applicable law. They will process your data on our behalf and following our instructions.
‍
3. TO WHOM IS THIS NOTICE ADDRESSED?
This notice is addressed to individuals whose personal information may be processed by PagoNxt Payments UK. There are different types of data subjects to which we will refer in this document:

Users: these are data subjects who browse our website.
Applicants: data subjects who request information through one of our contact channels.
Representatives: data subjects who represent a company or an institution that is already a PagoNxt Payments UK client or is in the process of becoming a client. This group includes the following:
a. Proxies or legal representatives.
b. Contact persons.
c. Members of the Board of Directors.
d. Beneficial owners, i.e. individuals who ultimately control and benefit from an entity and the income it may generate.
Payers and payees: these are individuals who either order a payment or are payees of a payment and whose information is processed by Us to service Our clients.
Bank Code: 6722

4. AT A GLANCE: BASIC INFORMATION
‍For ease of understanding, we have included the most relevant information in the table below. You can find more detailed information in the following section and contact our Data Protection Officer (DPO) for any further clarification or query by writing to privacy.payments@pagonxt.com or through any of our contact channels.

WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?	PagoNxt Payments Services S.L. N.I.F.: B-87959326 Address: Avenida de Cantabria 5 – Edifico Alhambra Pl 1, CP 28660, Boadilla del Monte (Madrid) Contact DPO: privacy.trade@pagonxt.com
WHAT DO WE USE YOUR DATA FOR?	We process your data to contact you or your company if you have asked us for information, to maintain commercial and legal relations with the company you represent, to comply with our legal obligations, to send commercial communications to your company or in the case of users of our website, if you have accepted them, to analyze the functioning of our website through cookies.
WHAT LEGAL BASIS DO WE HAVE TO PROCESS YOUR DATA?	It depends on the processing, but the main legal bases are legitimate interest, compliance with legal obligations and consent.
WITH WHOM DO WE SHARE YOUR DATA?	We can share your data with: Authorities and courts in the legally provided cases. With third parties that provide services to us, that act on our instructions and with whom we have signed a data processor agreement in accordance with the provisions of Article 28 of the GDPR.
WHAT IS THE ORIGIN OF THE DATA WE PROCESS?	The data we process may have been collected directly from you, may have been given to us or confirmed by the company for which you are a proxy, contact, board member or beneficial owner, or may be included in the information given to us by one of the companies of the Santander Group or PagoNxt of which your company is already a customer and whose communication you have authorized.
WHAT ARE YOUR RIGHTS?	You can always write to us at privacy.trade@pagonxt.com or use any of our channels available on the private portal to exercise your rights of: Access: Or what is the same, let us tell you what data we have about you and provide you with a copy of it. Rectification: That we correct the information we hold about you if it is incorrect. Cancellation or deletion: That we delete your data when it is no longer necessary or when we are processing it because you have given us your consent. Objection: When the processing of your data is based on a legitimate interest. Limitation of processing: For example, when you have challenged the accuracy of themselves Portability: Requesting that we communicate your data to a third party in a structured, commonly used and machine-readable format, wherever possible, or to yourself. Right not to be subject to automated decisions. You can also file a claim with the AEPD at www.aepd.es
ADDITIONAL INFORMATION	More detailed information can be found in the second layer below.

5. DETAILED INFORMATION (SECOND LAYER)
5.1. DO YOU HAVE TO SHARE WITH US YOUR PERSONAL DATA?

Yes, the data that PagoNxt requests either directly from you, for example when you contact us for information, or from your company when We ask you to provide us with your proxies and send us the powers of attorney or confirm who are the members of your board of directors, or provide us with a contact, are necessary for the purposes for which they are requested and therefore mandatory.

5.2. WHICH TYPE OF DATA DO WE PROCESS, WHAT IS IT ORIGING, WHY DO WE PROCESS IT AND WHAT ARE THE LEGAL BASIS TO DO SO?

DATA SUBJECT	WHAT DATA DO WE PROCESS ABOUT YOU AND WHAT IS ITS ORIGIN?	WHAT DO WE PROCESS YOUR DATA FOR?	WHAT IS THE LEGAL BASIS OF THE PROCESSING?
User	We treat the information we receive through the use of cookies if you have accepted them. This information may include your IP or unique identifiers that, although they do not allow us to uniquely identify you without additional information, are considered personal data and originate from your navigation on our websites. More information can be found in our cookies policy.	Depending on the type of cookies you have accepted, we will use them to improve our website by analyzing your usage or personalizing it. More information can be found in our cookies policy.	Consent
Applicant	Depending on the means you use to contact us, we may process: Name and surname Email Telephone Position in your company The data is obtained directly from you.	We process the data to meet your request and to inform you about our products or services.	Legitimate interest in responding to your proactive and express request for information. This is expected by you and does not infringe on your rights.
Representative (includes proxies, contact persons, and authorized persons)	The data that we may process includes those listed below and may have been communicated by you directly, if, for example, you signed your company’s contract with us or registered with the Developer Portal, or by your company (when you provide us with a list of authorized persons). Name and surname Professional location data (address, email, mobile, and post) NIF Any other information included in the documentation provided for client registration Access credentials IP, time, and location of the device from which the services are accessed Voice in case of telephone recordings (in these cases, you will be previously informed of the recording)	1) Register our Client and maintain the contractual and commercial relationship with it. 2) Send communications regarding the contracted services. 3) Send commercial communications (directed to your company) about products similar to those already contracted. 4) Prevent and control the use of PagoNxt for illegal or unauthorized purposes. 5) Send commercial communications of our own or of third parties for which we have requested consent. 6) Send satisfaction surveys about the service. 7) Use voice recordings to evaluate service quality and as proof of instructions received or service provided, if necessary.	1) Legitimate interest of both our Client and PagoNxt in maintaining a contractual and commercial relationship. 2) Legitimate interest. 3) Legitimate interest in informing our client about products similar to those contracted. 4) Legitimate interest in ensuring that PagoNxt is not used for illicit purposes and managing any illegal conduct. 5) Consent. 6) Legitimate interest in knowing the degree of customer satisfaction and seeking improvements. 7) Legitimate interest in improving service quality and exercising our rights.
Developers	The data we process may have been given to us by you or the company for which you work. The types of data are: Name and surname Professional location data (address, email, mobile and post).	Register you and your company on the website and allow you, depending on the case, to use the APIS made available by PagoNxt in sandbox, pre or live and request support.	Legitimate interest in maintaining a contractual or commercial relationship with the company for which you work and with which either PagoNxt has a contract for the provision of services or a commercial relationship of another type.
Any data subject	The data we process may have been given to us by you or the company for which you work. The data is processed is your email.	Send you commercial communications.	Consent

5.3. WITH WHOM CAN WE SHARE YOUR DATA?

WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?	PagoNxt Payments Services S.L. N.I.F.: B-87959326 Address: Avenida de Cantabria 5 – Edifico Alhambra Pl 1, CP 28660, Boadilla del Monte (Madrid) Contact DPO: privacy.trade@pagonxt.com
WHAT DO WE USE YOUR DATA FOR?	We process your data to contact you or your company if you have asked us for information, to maintain commercial and legal relations with the company you represent, to comply with our legal obligations, to send commercial communications to your company or in the case of users of our website, if you have accepted them, to analyze the functioning of our website through cookies.
WHAT LEGAL BASIS DO WE HAVE TO PROCESS YOUR DATA?	It depends on the processing, but the main legal bases are legitimate interest, compliance with legal obligations and consent.
WITH WHOM DO WE SHARE YOUR DATA?	We can share your data with: Authorities and courts in the legally provided cases. With third parties that provide services to us, that act on our instructions and with whom we have signed a data processor agreement in accordance with the provisions of Article 28 of the GDPR.
WHAT IS THE ORIGIN OF THE DATA WE PROCESS?	The data we process may have been collected directly from you, may have been given to us or confirmed by the company for which you are a proxy, contact, board member or beneficial owner, or may be included in the information given to us by one of the companies of the Santander Group or PagoNxt of which your company is already a customer and whose communication you have authorized.
WHAT ARE YOUR RIGHTS?	You can always write to us at privacy.trade@pagonxt.com or use any of our channels available on the private portal to exercise your rights of: Access: Or what is the same, let us tell you what data we have about you and provide you with a copy of it. Rectification: That we correct the information we hold about you if it is incorrect. Cancellation or deletion: That we delete your data when it is no longer necessary or when we are processing it because you have given us your consent. Objection: When the processing of your data is based on a legitimate interest. Limitation of processing: For example, when you have challenged the accuracy of themselves Portability: Requesting that we communicate your data to a third party in a structured, commonly used and machine-readable format, wherever possible, or to yourself. Right not to be subject to automated decisions. You can also file a claim with the AEPD at www.aepd.es
ADDITIONAL INFORMATION	More detailed information can be found in the second layer below.

5.4. INTERNATIONAL DATA TRANSFERS

International transfers outside the European Economic Area are not carried out. In the event that at any time these should be carried out they will be carried out with the appropriate guarantees (such as the Standard Contractual Clauses approved by the European Commission), which, will, after request, be available to the data subjects.

Notwithstanding the provisions of the preceding paragraph, transfers outside the European Economic Area to countries without an equivalent level of protection may be made where such transfers are strictly necessary for the performance of a contract between PagoNxt and a third party in the interest of the data subject (art. 49.1.c GDPR). This is the case when we provide payment services and the payment is to an account in an entity outside Europe and therefore it is necessary to communicate the data either directly to the beneficiary's bank or to correspondent banks, payment operators or payment systems outside Europe.For more information about international transfers, please write to privacy.trade@pagonxt.com.

5.5. HOW LONG WILL WE KEEP PERSONAL INFORMATION?

INTERESTED	CONSERVATION PERIOD
User	We treat the information we collect through the use of Cookies for the periods indicated in the cookie policy that you can review here
Applicants and developers (if they do not represent a PagoNxt client)	For the period necessary to respond to the inquiry or request for information. After that period, the data will be blocked for 3 years and will be deleted. The 3 years are the maximum limitation period for actions in matters of data protection collected by the LOPDyGDD (Organic Law 3/2018).
Representative	For the entire duration of the contractual relationship plus 5 years as a general rule, unless there are longer applicable limitation periods, in which the data will be kept blocked. In cases where data is processed in order to comply with legal obligations, these will be kept for the period indicated therein.

5.6. WHAT ARE MY RIGHTS AND HOW TO EXERCISE THEM?
‍
You have the following rights:

Access: you have the right to ask us to inform you about what data we hold about you and provide you with a copy of it.
Rectification: you have the right to ask us to correct the information we hold about you if it is incorrect.
Cancellation or deletion: you have the right to ask us to delete your data when it is no longer necessary or when we are processing it because you have given us your consent.
Objection: you have the right to ask us to stop processing your data when we are processing it based on our legitimate interest, for example when you receive commercial communications on behalf of your company about products or services similar to those you already have contracted with us.
Limitation of processing: you have the right to ask us to limit the processing of your data when, for example, you have contested the accuracy of the data.
Portability: you have the right to ask us to communicate your data to a third party in a structured, commonly used and machine-readable format, wherever possible, or to yourself.
Right not to be subject to automated decisions: you have the right to ask us not to base a decision that has legal effect for you or significantly affects you on automated processing, with some exceptions.

You can also file a complaint with the Spanish Data Protection Agency (AEPD) atwww.aepd.es.
If you would like more information on data protection rights, you can access the AEPD's infographic on the subject here.

5.7. HOW CAN I EXERCISE MY RIGHTS?
‍To exercise your rights, please send us an email to privacy.trade@pagonxt.com or contact us through any of our channels indicating that you are exercising your rights under the GDPR. Remember you may have to provide some documentation to prove your identity, for example your ID card.

5.8. WHAT SECURITY MEASURES DO WE APPLY?
‍At PagoNxt we are committed to security and apply technical and organizational measures to ensure the integrity, availability and confidentiality of your data. For example, all persons who can access personal information are subject to a contractual obligation of confidentiality, we use Data Lost Prevention (DLP) measures, encryption of information in transit and at rest, access control, secure passwords, etc.

5.9. OTHER IMPORTANT INFORMATION
5.9.1. ABOUT THE COMMUNICATION OF PERSONAL INFORMATION OF A THIRD PARTY
‍As We have already explained, in some cases the personal information We collect is not received directly from the data subject, but is communicated to us by another person who represents or provides services for our Client.
‍
If you are such a person, you represent that you have sufficient authority to both, act on behalf of our Client and to communicate such personal information to us, and you warrant that the communicated information is true, accurate, complete and up to date. In addition, on behalf of the Client, you will inform the data subjects of the communication and indicate that he/she may review this document either online at emoney.pagonxt.com or, if applicable, show him/her a physical copy of this document.

5.9.2. ABOUT COMMERCIAL COMMUNICATIONS
‍Remember that any commercial information about PagoNxt products or services or about products of Santander Group entities (including PagoNxt Group) that you may receive to the professional mail We may have from you as a Representative or Applicant, is addressed to our Client, never to you as an individual. Even so, you can at any time express your opposition or the one of the Client you represent, to receive such communications or withdraw your consent in the case of communications based on the same.

5.9.3. ON CHANGES TO THIS POLICY AND CONSULTATIONS
‍If it becomes necessary for us to change the content of this privacy policy, we will inform you of the relevant aspects and indicate the date from which they will apply. We will also publish the changes on our website.

6. EMPLOYMENT CANDIDATES’ PRIVACY NOTICE

6.1. Purpose of the processing and legal basis

	3) Management of the selection process
Purpose	We will process your personal data to evaluate your suitability for the job you have requested and to manage the selection process. Linked to this processing and in the event that you turn out to be the candidat@ selected, we may carry out a series of pre-hiring checks that may include: We request information related to your working life issued by official bodies in order to carry out the necessary checks before hiring. We carry out an analysis to verify the reliability, integrity and honesty of the canditat@ and to be able to comply with the legal requirements that may apply to us and with the internal policies of the PagoNxt Group.
Lawfulness	The legal basis for this processing is the execution of the contract or the application of pre-contractual measures. If we ask you for the working life issued by official bodies, the processing will be based on our legitimate interest in verifying the truthfulness and experience that you reflect in your request. The legal basis for integrity analysis, reliability and honesty of the candidat@ will be the legitimate interest of PagoNxt that is specified in that PagoNxt for the type of activity it carries out and for the fact of being part of a financial group must guarantee that the people who occupy certain positions and perform certain functions are the ones suitable considering the risks associated with these functions, this being expected by the candidates, without imbalancing their rights.
Types of data processed	Contact and identification data (name, surname, address, telephone numbers); date of birth, gender, work and educational history, and any other information contained in your CV. Data derived from participation in tests during the selection process (group dynamics, interviews, language tests, etc.). The legal basis for integrity analysis, reliability and honesty of the candidat@ will be the legitimate interest of PagoNxt that is specified in that PagoNxt for the type of activity it carries out and for the fact of being part of a financial group must guarantee that the people who occupy certain positions and perform certain functions are the ones suitable considering the risks associated with these functions, this being expected by the candidates, without imbalancing their rights. Working life. Data publicly communicated by you in your social media profiles.

	3 (b) Resolution and management of consultations
Purpose	Answer the queries you can make during the selection process and after it.
Lawfulness	Our legitimate interest in answering any questions that may arise during the selection process or subsequently.
Types of data processed	Identification and contact data (name, surname, email, telephone). Any data that may be included in the consultation.

	3 (c) Candidate Examination
Purpose	For the purpose of confirming the suitability of the job seeker, the data of the candidate selected for checking that do not appear on the official sanctions lists (in particular in accordance with EU Regulations 2580/2001, 881/2002, 753/2011) are processed. This verification is done through the "Worldcheck" tool before making a firm offer to the selected candidate. For this purpose, personal data is verified only once.
Lawfulness	Depending on the entity that carries out the processing, or the fulfillment of legal obligations or the legitimate interest in fulfilling the obligations of due diligence and avoiding the possible damages (including possible fines) that may arise from the hiring of sanctioned persons.
Types of data processed	Name and surname Date of birth Nationality

9.2. Data communications
We can share your data with:

1. With service providers
We may share your personal information with companies that provide services to us and with whom we have entered into a data processing agreement in accordance with applicable law. They will process your data on our behalf and following our instructions.
‍2. International data transfers
‍Your data is not transferred directly outside the EU. However, we utilise the services of the company Workday, which provides 24/7 incident support. This could lead to a limited and specific access to your personal data from the United States in exceptional circumstances. It should be noted that the USA does not offer the same level of data protection as the EU. In these instances, we have implemented robust safeguards in line with data protection regulations and have put in place additional measures to ensure the security of your data. Should you require further information, please do not hesitate to contact the relevant DPO.

‍
9.3. How long do we keep your data?
We will process your personal data for as long as the selection process lasts and, where appropriate, as necessary to manage queries. Once the process is complete, we will retain your information in case of future opportunities in which you may be interested in a maximum period of 18 months. After that period, we will proceed to block the information and delete it after the period of exercise of actions.

If you are applying for a job position in Germany, we will process your personal data during the recruitment process. In case you do not receive a job offer from us, we will delete your data after 6 months.

If you are applying for a job position in the UK, we will process your personal data during the recruitment process. In case you do not receive a job offer from us, we will delete your data after 12 months.

9.4. Exercise of rights
You can exercise your rights of access, rectification, erasure, limitation of processing, portability, opposition and the right not to be subject to automated individual decisions including profiling, sending an email to mailbox privacy.trade@pagonxt.com as well as filing a claim with the Spanish Data Protection Agency at www.aepd.es

PRIVACY NOTICE PAGONXT PAYMENTS UK Ltd

1. WHO ARE WE?
PagoNxt Payments UK Ltd., is an electronic money institution (hereinafter referred to as We, Us or PagoNxt Payments UK). Our clients are companies and banking or non-banking financial institutions (legal entities, hereinafter referred to as the Client(s)).
‍
2. WHAT IS THE PURPOSE OF THIS NOTICE?
The purpose of this privacy policy is to explain in a transparent, clear, and simple way how We collect, process, and protect personal information. It is also to ensure that PagoNxt Payments UK does not trade with personal information and that it allows data subjects to handle it in accordance with applicable law.

3. TO WHOM IS THIS NOTICE ADDRESSED?
This notice is addressed to natural persons whose personal information may be processed by PagoNxt Payments UK. There are different types of data subjects to which we will refer in this document:

Users: these are data subjects who browse our website.
Applicants: data subjects who request information through one of our contact channels.
Representatives: data subjects who represent a company or an institution that is already a PagoNxt Payments UK client or is in the process of becoming a client. This group includes the following:
a. Proxies or legal representatives.
b. Contact persons.
c. Members of the Board of Directors.
d. Beneficial owners, i.e. individuals who ultimately control and benefit from an entity and the income it may generate.
Payers and payees: these are persons who either order a payment or are payees of a payment and whose information is processed by Us to service Our clients.
Employment candidates: individuals that want to participate or are participating in a recruitment process. The information regarding processing of data can be found in a specific privacy notice at the end of this document (here).

4. AT A GLANCE: BASIC INFORMATION
For ease of understanding, we have included the most relevant information in the table below.You can find more detailed information in the following section and contact our Data Protection Officer (DPO) for any further clarification or query by writing to privacy.trade@pagonxt.com or through any of our contact channels.

WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?	PagoNxt Payments UK Ltd. No. 12057109 Address: 2 Triton Square, Regent's Place, London, NW1 3AN, United Kingdom Contact DPO: privacy.trade@pagonxt.com
WHAT DO WE USE YOUR DATA FOR?	We process your data to contact you or your company if you have asked us for information, to maintain commercial and legal relations with the company you represent, to comply with our legal obligations, to send commercial communications to your company or in the case of users of our website, if you have accepted them, to analyze the functioning of our website through cookies.
WHAT LEGAL BASIS DO WE HAVE TO PROCESS YOUR DATA?	It depends on the processing, but the main legal bases are legitimate interest, compliance with legal obligations and consent.
WITH WHOM DO WE SHARE YOUR DATA?	We can share your data with: Authorities and courts in the legally provided cases. With third parties that provide services to us, that act on our instructions and with whom we have signed a data processor agreement in accordance with the provisions of Article 28 of the GDPR.
WHAT IS THE ORIGIN OF THE DATA WE PROCESS?	The data we process may have been collected directly from you, may have been given to us or confirmed by the company for which you are a proxy, contact, board member or beneficial owner, or may be included in the information given to us by one of the companies of the Santander Group or PagoNxt of which your company is already a customer and whose communication you have authorized.
WHAT ARE YOUR RIGHTS?	You can always write to us at privacy.trade@pagonxt.com or use any of our channels available on the private portal to exercise your rights of: Access: Or what is the same, let us tell you what data we have about you and provide you with a copy of it. Rectification: That we correct the information we hold about you if it is incorrect. Cancellation or deletion: That we delete your data when it is no longer necessary or when we are processing it because you have given us your consent. Objection: When the processing of your data is based on a legitimate interest. Limitation of processing: For example, when you have challenged the accuracy of themselves Portability: Requesting that we communicate your data to a third party in a structured, commonly used and machine-readable format, wherever possible, or to yourself. Right not to be subject to automated decisions. You can also file a claim with the AEPD at www.aepd.es
ADDITIONAL INFORMATION	More detailed information can be found in the second layer below.

5. DETAILED INFORMATION
5.1. DO YOU HAVE TO SHARE YOUR PERSONAL DATA WITH US?
Yes, the data that PagoNxt Payments UK requests either directly from you, for example when you contact us for information, or from your company when We ask you to provide us with your proxies and send us the powers of attorney or confirm who are the members of your board of directors, or provide us with a contact, are necessary for the purposes for which they are requested and therefore mandatory.

5.2. WHICH CATEGORIES OF DATA DO WE PROCESS, WHAT IS ITS ORIGIN, WHY DO WE PROCESS IT AND WHAT ARE THE LEGAL BASIS TO DO SO‍

DATA SUBJEC	DATA SUBJECT WHAT DATA DO WE PROCESS ABOUT YOU AND WHERE DOES IT COME FROM?	WHY DO WE PROCESS YOUR DATA?	WHAT IS THE LEGAL BASIS FOR THE PROCESSING?
User	cookies if you have accepted them. This information may include your IP or unique identifiers which, although they do not allow us to identify you univocally, are personal data and the origin of this information is the browsing you carry out on our websites. More information can be found on our Cookie Policy.	Depending on the type of cookies you have accepted, We will use them to improve our website by analysing how you use it, to serve you advertising or to personalise it, for example. More information can be found on our Cookie Policy.	Consent
Applicant	Depending on the means you use to contact us we can process: - Name and surname - E-mail address - Telephone number The data is obtained directly from the Applicant.	We process the data to deal with your request and to inform you about our products or services	Legitimate interest in responding to the proactive and express request for information that you have made to us. This being expected by you and without detriment to your rights.
Representative	The data that we may process are those listed below and may have been communicated by you directly, if, for example, you have carried out the online onboarding of your company or by your company. Data: Name and surname - Professional location data (email and mobile). NIF Business address Nationality Date of birth Any other information included in the documentation provided for the registration of our client. Electronic signature. Access credentials. Image and biometric template in case you decide to verify your identity via video call. IP, time and location of the device from which the services are accessed. Voice in case of telephone recordings (in these cases you will be previously informed of the recording).	To register our Client and maintain the contractual and commercial relationship. Verify the details of our Client's beneficial owners: within the framework of the contract, we will consult the public registers in order for our Client to validate the details of the administrators and/or beneficial owners of the Company, which are contained therein or, in the event of any discrepancy, to provide the correct details. Verify your identity. Perform strong authentication: under the provisions of the Payment Services Regulations, strong authentication is required for execution in some cases. Analysis of the risks arising from the engagement of PagoNxt Payments UK’s services by the Representative on behalf of our Client. Commercial actions on products similar or related to those already contracted or on new functionalities of the platform and customer recovery actions. Prevention and control of the use of PagoNxt Payments UK for illegal or unauthorised purposes, with or without economic purpose. Sending commercial communications of its own or of third-party companies of the Santander Group. Sending satisfaction surveys on the service. With regard to the voice, we may use the recordings for the purpose of assessing the quality of the service and use the recordings as evidence of the instructions received and/or the service provided - in court and out of court - if necessary.	Legitimate interest of both our Client and PagoNxt Payments UK in maintaining a contractual and commercial relationship. To take precontractual measures, as well as to execute a contract to which the company of which you are a representative is a party, it is necessary to process your data. legal obligation: anti-money laundering and payment regulations. The lawful basis for identity verification is the existence of a legal obligation. Biometric templates are used based on that legal obligation and on the data subject's consent. Legal obligation and substantial public interest. Legitimate interest: consisting of the minimisation of the financial risks assumed by PagoNxt Payments UK in the provision of its services. Legitimate interest. Legitimate interest: recognised by law and based on ensuring that the functionalities of PagoNxt Payments UK are not used for illegal purposes or contrary to what has been agreed and, in case of occurrence, to manage, process and remedy possible unlawful conduct. Consent. PagoNxt Payments UK's legitimate interest in knowing the degree of satisfaction of its Clients with the service and seeking ways to improve it. Legitimate interest in improving the quality of service and in exercising our rights.
Payers and payees	The data is communicated by our Client when requesting the execution of a specific payment. Data: - Name and surname of the payee and payer. - Account numbers.	Comply with our obligations to prevent money laundering and terrorist financing. Execute the payment service.	Legal obligation, performance of a contract.

5.3. WITH WHOM CAN WE SHARE YOUR DATA?

Category of data subject	With whom can the data be shared with?	For what purposes can the data be shared?	Under which lawful base can the data be shared?
Any data subject (users, legal represent atives, etc.)	With data processors: PagoNxt Payments UK uses some processors during its activities. Processors may have access to personal information processed by PagoNxt Payments UK but they will always do so under a processing agreement and under the instructions of PagoNxt Payments UK. With: Public administrations Courts and tribunals State Security Forces and Corps	So that processor s can provide services to PagoNxt Payment s UK. To comply with law.	This communic ation of data is made under the terms of the UK GDPR. The complianc e of legal obligations
Legal represent atives 1. With Santander or PagoNxt Group entities if your Company has consented in the commun	Group entities if your Company has consented in the commun With Refinitiv and Dun & Bradstreet entities that help us comply with our anti-money laundry and anti-bribery regulations. You can find more about how they process personal data at https://www.refinitiv.com/en/ policies/privacystatement and https://www.dn b.com/utility-pages/privacypolicy.html With PagoNxt Trade Services S.L. (owner of the App Santander ID), if you are authorised by your company to approve payment transactions. To enable your use of the App, We need to communicate your name and surname, as well as your business telephone number to Santander ID.	With Santander Group and PagoNxt Group companies: When contracting, during the registration so that they can carry out their KYC processes and comply with the applicable legislation, offering a more agile service by not having to request this information from the Customer company. To offer products and services that may be of interest to the Client. With compani es that help us meet our legal obligations arising from compliance with antimoney laundering regulations to comply with them. With Santander ID to authenticate you when you carry out transactions on behalf of your company, in compliance with payment regulations, a reinforced authentic ation may be necessary, and the App is used for this purpose. Also, to open the e-money account.	With Santander & PagoNxt Group entities: Legitimate interest of the Company to whom you represent and of the Santander or PagoNxt Group entity with whom your company wants to maintain a commercial relationship in speeding up the on boarding process and being more efficient. Specific consent to received commercial communic ations (even if they are addressed to the Company and not to the specific individual). To Refinitiv and Dun & Bradstreet our legitimate interest in complying with our legal obligations To Santander ID: legitimate interest of both the company you represent to use PagoNxt Payments UK's services, for which it is a prerequisite that the requireme nts of strong authentica tion are met before trading, and PagoNxt Payments UK's interest in providing the services under the contract with your company and fulfilling its legal obligations
Payers and payees	With banks, intermediary banks, payment agents, payment system operators, f inancial institutions, counterparties.	When necessary to perform paid services or to fulfil our contractual obligations.	Legitimate interest in fulfilling our contractual obligations and providing payment services, as well as compliance with legal obligations in certain cases.

5.4. INTERNATIONAL DATA TRANSFERS

International transfers outside the European Economic Area are not carried out. In the event that at any time these should be carried out they will be carried out with the appropriate guarantees, which, will, after request, be available to the data subjects.

Notwithstanding the provisions of the preceding paragraph, transfers outside the European Economic Area to countries without an equivalent level of protection may be made where such transfers are strictly necessary for the performance of a contract between PagoNxt Payments UK and a third party in the interest of the data subject (art. 49.1.c UK GDPR). This is the case when we provide payment services and the payment is to an account in an entity outside Europe and therefore it is necessary to communicate the data either directly to the beneficiary's bank or to correspondent banks, payment operators or payment systems outside Europe.For more information about international transfers, please write toprivacy.trade@pagonxt.com.

5.5. HOW LONG WILL WE KEEP PERSONAL INFORMATION?‍

INTERESTED	RETENTION PERIOD
User	We process the information we collect using cookies for the periods indicated in the cookie policy that you can review here.
Applicants	For the period necessary to respond to the query or request for information. Once this period has elapsed, the data will be blocked for a period of 3 years and will be deleted. The 3 years are the maximum period of limitation of actions in the field of data protection set out in the UK GDPR.
Representative	For the period necessary to respond to the query or request for information. Once this period has elapsed, the data will be blocked for a period of 3 years and will be deleted. The 3 years are the maximum period of limitation of actions in the field of data protection set out in the UK GDPR. Contact person: for the duration of the contractual relationship plus 5 years as a general rule, unless longer limitation periods apply, during which time the data will be blocked.

5.6. WHAT ARE MY RIGHTS AND HOW TO EXERCISE THEM?
You have the following rights:

Access: in other words, we tell you what information we have about you.
Rectification: we correct the information we hold about you if it is incorrect.
Cancellation or deletion: we delete your data when they are no longer needed or when we are processing them because you have given us your consent.
Opposition: when the processing of your data is based on a legitimate interest.
Limitation of processing: for example, where you have challenged the accuracy of the data themselves.
Portability: by requesting that we communicate your data to a third party in a structured, commonly used, machine-readable format, where possible, or to you.
The right not to be subject to automated decisions: that we do not base a decision that has legal effect on you or significantly affects you on automated processing, with some exceptions.

You can also file a complaint with the Information Commissioner’s Office (ICO) athttps://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/
‍If you would like more information on data protection rights, you can access the ICO’s information on the subject here.

To exercise your rights, please send us an email toprivacy.trade@pagonxt.comor contact us through any of our communication channels indicating that you are exercising your rights under the GDPR. Remember you may have to provide some documentation to prove your identity, for example your Driving Licence.

5.7. WHAT SECURITY MEASURES DO WE APPLY?
At PagoNxt Payments UK we are committed to security and apply technical and organisational measures to ensure the integrity, availability and confidentiality of your data.For example, all persons who can access personal information are subject to a contractual obligation of confidentiality, we use Data Lost Prevention (DLP) measures, encryption of information in transit and at rest, access control, secure passwords, etc.

5.8. OTHER IMPORTANT INFORMATION
5.8.1. ABOUT THE COMMUNICATION OF PERSONAL INFORMATION OF A THIRD PARTY

As We have already explained, in some cases the personal information We collect is not received directly from the data subject but is communicated to us by another person who represents or provides services for our Client.

If you are such a person, you represent that you have sufficient authority to both, act on behalf of our Client and to communicate such personal information to us, and you warrant that the communicated information is true, accurate, complete and up to date. In addition, on behalf of the Client, you will inform the data subjects of the communication and indicate that he/she may review this document either on line at our website or, if applicable, show him/her a physical copy of this document.

5.8.2. ABOUT COMMERCIAL COMMUNICATIONS
Remember that any commercial information about PagoNxt Payments UK products or services or about products of Santander Group entities (including PagoNxt Group) that you may receive to the professional mail We may have from you as a Representative or Applicant, is addressed to our Client, never to you as an individual. Even so, you can at any time express your opposition for the Client you represent, to receive such communications or withdraw your consent in the case of communications based on the same.

5.8.3. ON CHANGES TO THIS POLICY AND CONSULTATIONS
If it becomes necessary for us to change the content of this privacy policy, we will inform you of the relevant aspects and indicate the date from which they will apply. We will also publish the changes on our website.
‍

6. EMPLOYMENT CANDIDATE PRIVACY NOTICE
6.1. Purpose of the processing and lawful base

	a) Management of the recruitment process
Purpose	We will process your data to manage your participation on the recruitment process. Related to this processing activity We may in certain cases: Request information related to your employment history issued by official bodies to carry out the necessary checks prior to recruitment (e.g., when you are a finalist in the selection process). If you are the chosen candidate and you’ve applied to certain positions, access your public profiles of non-employment social networks for the purpose of assessing specific risks with respect to the function. If you are applying for a position in Germany and if you receive a job offer from us, we might request your Certificate of good conduct (Führungszeugnis) issued by official bodies.
Lawful basis	The legal basis for this processing is the application of pre-contractual measures. If we ask you for the working life issued by official bodies, the processing will be based on our legitimate interest in verifying the truthfolness and experience that you reflect in your request. If We ask you for your employment history issued by official bodies, the processing will be based on our legitimate interest in verifying the truthfulness and experience you state in your application. If We access and process the data you have posted on your public social media profiles because you have been shortlisted and the type of position requires a risk assessment of the function to be performed, the legal basis will be our legitimate interest in complying with any due diligence obligations We may have and in mitigating certain risks associated with the performance of the function. With regards to the Certificate of good conduct, We have a legitimate interest in hiring Employees with good conduct in order to work in sensitive positions when dealing with financial and payment information.
Type and categories of data processed	Contact and identification data (name, surname, address, telephone numbers) Date of birth, gender, work and educational history, and any other information contained in your CV. Data derived from participation in tests during the selection process (group dynamics, interviews, language tests, etc.). Working life. Data communicated publicly by you on your social media profiles.

	a) Management of the recruitment process
Purpose	Answer any queries you may make to us during the selection process and after it.
Lawful basis	Our legitimate interest in answering any questions that may arise during the selection process or subsequently.
Type and categories of data processed	Identification and contact data (name, surname, email, telephone). Any data that may be included in the query.

	a) Management of the recruitment process
Purpose	In order to confirm that the job applicant can be reliable to work with us, personal data is examined on the basis of sanction lists. The sanctions list include EU lists (in particular pursuant to the EU regulations 2580/2001, 881/2002, 753/2011). Such verification is conducted via the tool “Worldcheck” before receiving a job offer. For this purpose, personal data is vetted only once.
Lawful base	Our legitimate interest in complying with the anti-money laundry and financial crime regulations
Type and categories of data processed	Name and surname Birth date Nationality

6.2. DATA SHARING
We may share your personal data:

6.2.1. With service providers
We may share your personal information with companies that provide services to us and with whom we have entered into a data processing agreement in accordance with applicable law. These will process your data on our behalf and following our instructions.

6.2.2. International transfers of data
We do not directly transfer your data outside the EU. But, among the service providers we have, mainly cloud service providers or certain applications, some offer support for 24/7 incidents, which that, in very limited and specific cases, limited access can occur (in time, form and scope) to your personal data from a location outside the EU. For these cases we have provided adequate guarantees in accordance with the data protection regulations. If you want to request additional information you can do so by contacting the corresponding DPO.

6.3. RETENTION PERIODS
We will process your personal data for as long as the selection process lasts and, where appropriate, as necessary to manage queries. Once the process is complete, we will retain your information in case of future opportunities in which you may be interested in a maximum period of one year unless you indicate your wish not to do so (right of objection). After that period and unless you expressly authorise us to keep them for a longer period, we will proceed to block the information and delete it after the period of exercise of actions (5 years).

6.4. WHAT ARE YOUR PERSONAL DATA RIGHTS?
You have the following rights, that can be exercise by email to privacy.trade@pagonxt.com :

Access: in other words, we tell you what information we have about you
Rectification: we correct the information we hold about you if it is incorrect.
Cancellation or deletion: we delete your data when they are no longer needed or when we are processing them because you have given us your consent.
Opposition: when the processing of your data is based on a legitimate interest.
Limitation of processing: for example, where you have challenged the accuracy of the data themselves.
Portability: by requesting that we communicate your data to a third party in a structured, commonly used, machine-readable format, where possible, or to you.
The right not to be subject to automated decisions: that we do not base a decision that has legal effect on you or significantly affects you on automated processing, with some exceptions.

You can also file a complaint with the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/data-protectioncomplaints/data-protection-complaints/ If you would like more information on data protection rights, you can access the ICO’s information on the subject here.