Skip to main content

DATA PROTECTION

PRIVACY POLICY AND DATA PROTECTION

1. PROCESSING OF PERSONAL DATA

Confirmación de Solicitudes de Crédito Verifica, S.A.U.’s (“VERIFICA”) primary business is Debt Collection. In this regard, it is necessary to process personal data, which protection is essential, and we pay close attention to the fulfilment of our obligations under the General Data Protection Regulation (“GDPR”) and the Spanish Organic Law of Data Protection and Guarantee of Digital Rights (LOPDGDD).

VERIFICA acts as the controller or co-controller of the processing in those cases where it has the ownership of the debt files or occupies the position of the current creditor. In this case, the obligations present in this Privacy Policy could be addressed to both co-responsible parties:

  • Confirmación de Solicitudes de Crédito Verifica, S.A.U. trade register no.: A84727809; contact details: Calle Eucalipto 33, 28016, Madrid.
  • Ultimo Portfolio Investment S.A. trade register no.: LU 209 703 19; contact details: 9, rue Joseph Junck, L-1839 Luxembourg.
  • Data Protection Officer: contact details: Data Protection Officer form ( https://www.verifica-sa.com/en/data-protection  ).

We want to help you understand how we collect, use, store, share, and process your personal information based on this privacy policy; additionally, what personal information we process and why we process them.

2. HOW WE COLLECT YOUR PERSONAL DATA FROM:

  • From the assignment agreement whereby, we acquire the position of the creditor on your receivable;
  • Persons authorized to communicate with us on your behalf (e.g., lawyers, debt counsellors, etc.);
  • Public institutions and government bodies, etc., which perform a service of general interest;
  • Databases that are publicly available or based on a contractual relationship (external sources) ensure that the information we have about you is kept up to date. By external sources is meant public institutions, public registers, electronic databases;
  • Directly from you or in some cases from others - primarily related to the collection of claims and repayment of any overpayments.

3. WE PROCESS THE FOLLOWING CATEGORIES OF PERSONAL INFORMATION:

  • Personal identification: first and last name, identification number, date of birth, domicile address, e-mail, phone numbers, recording of your voice.
  • Financial information: receivable’s value and interests, economic situation.
  • Sensitive information: health data provided by you and when it is required by law.
  • Internet communicators ID, WhatsApp ID.
  • Asset information: identification of the assets registered to secure the receivable.
  • Any other relevant information gathered during the amicable collection process or legal proceeding.

4. VERFICA PROCESSES YOUR PERSONAL INFORMATION ONLY TO THE EXTENT THIS INFORMATION IS NECESSARY FOR AND BASED ON THE FOLLOWING LEGAL BASIS:

PURPOSES LEGAL BASIS
Providing the debt collection process
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Reporting and checking your financial situation published on the creditworthiness files
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Analysis of your financial situation and source of income so that we can assess your repayment ability, as well as find a solution that is appropriate for your individual situation
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Communication and correct identification
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Implementing legal procedures for the collection of claims and finding favourable solutions for all parties
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Processing and answering your inquiries
  • Processing is necessary for compliance with a legal obligation – GDPR art.6(1)c.
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Accomplishing the scope of the internal and external audits
  • Processing is necessary for compliance with a legal obligation – GDPR art.6(1)c. Commercial Code.
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Conducting surveys on the quality of our collection management
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
The valuation of new non-performing loan portfolios
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Responding to requests from government agencies or other public authorities
  • Processing is necessary for compliance with a legal obligation – GDPR art.6(1)c.
Optimization of the debt collection process, including profiling
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Including your personal data (contact details and financial information) in the creditworthiness files ASNEF – EQUIFAX and EXPERIAN.
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Managing of third-party payments
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Self-service debt platform
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data – GDPR art.6(1)f.
Whistleblowing Channel
  • Processing is necessary for compliance with a legal obligation – GDPR art.6(1)c. Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption. If you want more information about this treatment you can obtain it through the following link: https://report.whistleb.com/es/b2holding .

5. TRANSFER OF DATA TO THIRD COUNTRIES

During the processing, personal data could be transferred outside the European Economic Area (EEA) to the third countries, which are not subject to the European Commission adequacy decision. Additionally, under certain conditions, processors acting on behalf of VERFICA may transfer personal data outside the EEA, as well. In such cases, the personal data will be transferred in compliance with the General Data Protection Regulation articles 46, 47, or 49(1), especially, Standard Contractual Clauses with further security measures applied. The information about the transfers can be obtained through contact on the following form: https://www.verifica-sa.com/es/proteccion-de-datos.

6. PROFILING

Regarding the GDPR art. 6(1)f, on the legal base of the legitimate interest to the extent necessary to effectively perform debt recovery, gathered personal data described in the notice, including liability, economic situation, history of repayments, contacts related to the debt settlement, behavioural information created in the debt collection process, can be used for the profiling based on statistical models and expert rules. As a result, the decision on the method of the debt collection may be made, in particular, what form the communication process will be taken, what settlement offers will be selected, and what amicable and judicial measures will be applied.

Be also informed that you have the right to object to the profiling on grounds relating to your particular situation. In that case, please provide the information on the following form: https://www.verifica-sa.com/es/proteccion-de-datos .

7. WHO IS THE RECIPIENT OF YOUR PERSONAL DATA

During the debt collection process execution, it may be necessary to transfer your personal data to business partners, like IT providers, B2Holding Group companies to which VERIFICA belongs, law firms, bailiffs, public bodies such as courts or address registers, debt registers, which support the process. In addition, we may also disclose personal information when we are legally obliged to do so or if permitted by law.

Here are a few examples:

  • lawyers or other legal representatives;
  • public bodies such as the courts and supervisory authorities;
  • debt registers such as ASNEF-EQUIFAX and EXPERIAN.
  • financial, Information technology and legal providers that help us improve our services or develop, implement or manage business systems or operational processes;
  • auction house; and
  • others engaged in the debt collection process.

8. RETENTION PERIOD

The personal data will be processed for a period of six (6) years from the day the debt collection process is closed, according to Commercial Code regulation. However, if particular circumstances are justified, the period could be extended up to fifteen (15) years. Additionally, the personal data could also be processed as long as required to secure the legitimate interest of VERIFICA in case of any litigation.

9. DATA SUBJECTS RIGHTS

As the data subject, you are protected by the following rights under the GDPR:

  • Right of access to your personal data: you may request information about the personal data we process;
  • Right to rectification: you may request the modification of data that is inaccurate or incomplete;
  • Right to object: you may request the termination of the processing of your data under the legally established requirements. You may also revoke the consent previously given at any time.
  • Right to restriction of processing: you may request that measures be applied to the data in order, among other things, to prevent their modification or, where appropriate, their erasure or deletion.
  • Right to erasure: you may revoke the consent given and request the erasure of your personal data; and
  • Right to data portability: you may request that your information be provided in a clear and structured format to another data controller.

To execute the rights, please contact on the following form: https://www.verifica-sa.com/es/proteccion-de-datos . You can also contact by regular mail to Calle Eucalipto 33, 28016, Madrid.

Additionally, each data subject in a case related to personal data processing has the right to file a complaint to the Spanish Data Protection Agency - https://www.aepd.es/es , or Luxemburgish Data Protection Agency - https://cnpd.public.lu , in case of joint-controlling.

Forms

Acces form

RIGHT OF ACCESS

Drag and drop files here or Browse
Insert DNI / Passport / NIE, that both sides of the DNI appear (max 5M)
I communicate my intention to exercise the [insert mechanism to request more than one right] following data protection rights covered by the General Data Protection Regulation and the Organic Law on Guarantees and Digital Rights before Confirmation of Credit Applications Verifica, S.A.U.

I request that the right of access be provided free of charge by that person in charge within one month from the receipt of this request, and that it be sent to the address Above, the following information:

-Copy of my personal data that is processed by that person in charge.

-The purposes of the treatment, as well as the categories of personal data that are processed.

The recipients or categories of recipients to whom my personal data has been communicated, or will be communicated, including, where appropriate, recipients in third parties or international organizations.

-Information on the Adequate guarantees regarding the transfer of my data to a third country or to an international organization, where appropriate.

-The expected period of conservation, or if not possible, the criteria for determining this period.

-If there are automated decisions, including the elaboration profiling, significant information on the logic applied, as well as the importance and expected consequences of said treatment.

-If my personal data has not been obtained directly from me, the information available about its origin.

-The existence of the right to request rectification, deletion or limitation of the treatment of my personal data, or to oppose such treatment.

-The right to file a claim with a supervisory authority.

Rectification form

RIGHT OF RECTIFICATION

Drag and drop files here or Browse
Insert DNI/Passport/NIE, so that both sides of the DNI appear (max 5M)
I communicate my intention to exercise the [insert mechanism to be able to request more than one right] following data protection rights protected by the General Data Protection Regulation and the Organic Law of Guarantees and Digital Rights upon Confirmation of Credit Requests Verify , S.A.U.
I request that the rectification of my personal data be agreed upon, that it be carried out within a period of one month from the receipt of this request, and that I be notified in writing of the result of the rectification carried out.
Data on which I request the right of rectification:
Drag and drop files here or Browse
Máximo 5 Megas, formatos png,jpg,gif,zip,rar,txt,doc,pdf
That in the event that it is agreed that it is not appropriate to carry out the requested rectification, it is communicated to me with reasons in order to, where appropriate, claim before the corresponding Control Authority. Likewise, in the event that my personal data has been communicated by that person in charge to other data controllers, this rectification is communicated to them
Removal form

RENOVAL FORM

Drag and drop files here or Browse
Insert DNI/Passport/NIE, so that both sides of the DNI appear (max 5M)
That in the event that it is agreed that the requested deletion should not be practiced in whole or in part, it should be communicated to me in a motivated manner in order, where appropriate, to file a complaint with the appropriate Control Authority. In the event that my personal data has been communicated by that controller to other data controllers, this deletion is communicated.
Right of limitation form

RIGHT OF LIMITATION FORM

Drag and drop files here or Browse
Insert DNI/Passport/NIE, so that both sides of the DNI appear (max 5M)
That my request is attended to in the terms set forth above within a period of one month, and that this limitation is communicated to each of the recipients that the data controller has communicated my personal data.
Portability form

PORTABILITY FORM

Drag and drop files here or Browse
Insert DNI/Passport/NIE, so that both sides of the DNI appear (max 5M)
Opposition form

OPPOSITION FORM

Drag and drop files here or Browse
Insert DNI/Passport/NIE, so that both sides of the DNI appear (max 5M)
Furthermore, I request that the indicated activity of processing my personal data be discontinued and that I be notified in writing of the result of the opposition, agreeing or motivatingly disapproving it, to the email address indicated above within one (1) month. Notwithstanding that it is the responsibility of the controller to prove compelling legitimate reasons that prevail over my interests, rights and freedoms (in the first two cases), or a mission carried out in the public interest (in the third case) ), I credit as a personal situation to oppose the treatment of my personal data
Data Protection Officer

DATA PROTECTION OFFICER

Drag and drop files here or Browse
Insert DNI/Passport/NIE, so that both sides of the DNI appear (max 5M)