Privacy Policy

Personal Data Protection Policy

In accordance with the provisions of Regulation EU 2016/679, of the European Parliament and of the Council of April 27, 2016 (GDPR), Kutxabank informs you that by accepting this Privacy Policy, you explicitly, freely and unequivocally give your informed consent, so that the data you provide to Kutxabank are processed by the information systems for which Kutxabank is Data Controller and that are covered by adequate security, technical and organisational measures as foreseen in the regulations in force.

Identification of the Data Controller

The Data Controller for this website is Kutxabank, S.A. with Tax ID Number A95653077 and registered office at Gran Vía 30-32, 48009, Bilbao. Their contact email address is and that of the corporate data officer is

Processing Origin, processed data categories and foreseen transfers

On this website, personal data is obtained directly from users and their legal representative or agent.

Therefore, Users' data will be exclusively communicated in the event of legal authorisation or if Users consent to processing by Group companies and authorities and official bodies in other countries located both inside and outside the European Union in the context of the fight against fraud, the prevention of money laundering and monetary offences of similar nature or the management of risks and information in matters of asset and credit solvency, as well as Courts and State Security Forces and Bodies in case of requisition and any other entities that act as necessary collaborators in certain procedures.

On the other hand, Kutxabank informs you that it does not transfer data to other companies located or whose servers are located outside the European Economic Area. However, in the exceptional cases in which such international transfers occur, Kutxabank will adopt the necessary measures so that they are made to a country or organisation that has offered adequate guarantees or that may be based on the normatively established legitimising principles.

Purpose and Legitimation of Data Processing

Users are hereby informed that, depending on the channels and services consumed by users, their data may be subject to processing with the following purposes:

1. Regarding the processing of Users' data on this website.

In order for Kutxabank to study a possible service request from any interested party, in order to analyse the viability of the contract, Kutxabank will carry out, among others, admission management, reporting and capital calculation activities, as well as the verification of the feasibility of buying a product. In this case, the processing of the data is necessary for the application of pre-contractual measures and, where appropriate, the formalisation of the contract requested by the interested party.

With the same purpose, Kutxabank will carry out risk assessments in credit or purchase matters and will be able to draft a profile of your credit capacity, which is necessary for the analysis of the feasibility of executing the requested contract. In these cases, Kutxabank may process, where appropriate, in compliance with its legal obligation to analyse the solvency and operational risks that are inherent to the request of the interested party, the data obtained from different entities that issue information on asset and credit solvency, including the Risk Information Centre of the Bank of Spain.

The maintenance of the contractual relationship established with Kutxabank also legitimates the management, administration, provision, expansion and improvement of the services that Users decide to request, the adequacy of said services to the preferences and tastes of Users, the study of the use of the services by Users and the design of new services regarding them.

2. Regarding the fulfilment of obligations of a different nature.

We would like to inform that in order to comply with regulatory compliance requirements regarding accounting, tax or administrative matters, we might need to process or transfer different types of data to bodies with expertise in the field, check information files on creditworthiness and credit, obtain information that enables us to comply with additional requirements in terms of prevention of money laundering and to prevent possible fraudulent behaviour.

3. Regarding the management of possible information queries or claims that are made through the website.

Kutxabank is allowed to process the data of the interested parties (whether or not they are clients of the entity) in order to guarantee the correct assistance with their requests.

4. Regarding the sending of commercial communications.

The entity will send promotional communications (by traditional mail, email, fax, SMS and any other means), be they of a general nature or adapted to personal characteristics, as well as to offer Users products and/or manage the requests of Users of products and services marketed by the Bank or other companies of the Kutxabank Group and collaborating third parties in the banking and financial, insurance, real estate and services sectors, which could be of interest.

Said communications will be sent under the legitimate interest of Kutxabank for the promotion of its activity or, when applicable, with the consent of the interested parties. In any case, said consent will be revocable and the client may also oppose said processing at any time.

For the purposes of this Policy, Grupo Kutxabank is comprised, among others, by the following companies: Kutxabank, S.A., Cajasur Banco, S.A.U., Kutxabank Gestión S.G.I.I.C., S.A.U., Kutxabank Vida y Pensiones, S.A.U., Kutxabank Aseguradora, S.A.U., Bilbao Bizkaia Kutxa Fundación Bancaria-Bilbao Bizkaia Kutxa Banku Fundazioa, Fundación Bancaria Kutxa-Kutxa Banku Fundazioa and Caja Vital Kutxa Fundación Bancaria. You can always check detailed and updated information on Grupo Kutxabank at any Kutxabank branch.

5. Regarding the organisation of promotions and draws.

Kutxabank sometimes organises promotions and draws that could be understood as being of interest to Users. In these cases, Kutxabank will put the appropriate procedures in place in order to ensure compliance with the provisions of the applicable regulations on data protection.

6. Regarding the recording of calls from customers, potential customers and other interested parties.

We would like to inform you that, due to compliance requirements, Kutxabank may record the calls or electronic communications with Users, as well as keep computer and telematic records of access to services, based on a legitimate interest, for the purposes of quality and safety control, or as a consequence of compliance with legal obligations. In the event that it is necessary, Kutxabank may use said recordings as a means of proof in court, administrative and arbitration proceedings or of any other nature that may arise. In this sense, Kutxabank will inform Users on all calls and/or communications that will be subject to recording.

7. Regarding the processing of data of candidates that are received physically or telematically.

In order to participate in current or future recruitment processes that Kutxabank may require, these data will be processed in the internal information systems and will be kept unless otherwise indicated, provided that these personal data have a validity in recruitment processes according to the professional profile of the candidates. This processing will always be carried out after consent or the positive action of candidates (either face-to-face or telematically), and an explicit acceptance may be required to continue with the processing before their personal profile becomes part of the internal candidate database. No transfer will be made without the explicit consent of the interested party.

8. Regarding the processing of own and third party cookies.

Users can check the detailed information of the policy of Kutxabank regarding the treatment of the mentioned data through the following link:

9. Regarding the processing of third-party data.

Kutxabank may process third-party data provided by Users. In this sense, Users guarantee that they have informed and obtained the consent of said third parties for the processing of their personal data by Kutxabank. Users also guarantee they have informed these third parties of their rights in terms of data protection, who can exercise their rights by writing to the registered office of Kutxabank and attaching a photocopy of their ID.

In the cases in which the personal data are provided by the persons holding parental authority or by legal representatives of persons who are incapacitated, they will be the ones who authorise the collection of the data, as well as their use and processing by Kutxabank with the purposes described in this Privacy Policy.

Security and Rights of Website Users

For the security of the telematic services provided, Kutxabank informs you of the existence and use of computerised mechanisms that do not have to identify Users but that can collect browsing, technical and usage data or data on the use of pages and contents for the purpose of obtaining usage and operation statistics, solving incidents and proposing and development of new services and products. Users may at any time set their browser in such a way as to prevent obtaining said information.

Kutxabank maintains a firm commitment regarding the protection of personal data and the confidentiality of Users' information.

Kutxabank guarantees compliance with appropriate organisational and technical security measures to ensure a level of security that is appropriate to the risk that may arise from data processing, in order to ensure the security and integrity of personal data and avoid their alteration, loss, unauthorised processing or access, taking into account the state of technology, application costs, the nature of the stored data, the scope of the processing, as well as the risks to which they are exposed and the impact that this could have on the rights and freedoms of natural persons, whether they come from human action or from the physical or natural environment, thus fulfilling what is required by current legislation.

However, Users are informed and accept that security measures on the Internet are not unassailable.

Users may at any time, in the event of disputes related to the processing of personal data, contact the data protection officer of Kutxabank on, file a claim with the competent control authority, as well as exercise their rights of access, rectification, deletion, opposition, limitation of processing, portability and no longer being subject to automated individual decisions regarding their personal data. These rights can be exercised by writing the registered office of Kutxabank indicated above, attaching a photocopy the ID of the user.

In relation to the processing horizon, data will be processed and stored as long as it is necessary for the relationship established with Users. Data will also be kept to comply with the requirements of the applicable regulations, prevent illegal actions, resolve disputes or solve several types of controversies. Once the processing of your data is not necessary, Kutxabank will proceed to its deletion and/or blocking in accordance with the corporate data retention and deletion policy and the established statutorily limitation periods.

Any changes made to this Privacy Policy will be posted on this website, without retroactive changes that reduce the rights to privacy unless legally required, involving Users in these cases to obtain, where appropriate, the relevant consent for the performed processing.

call center