Privacy Policy

  1. What is this End User Privacy Policy for?

This End User Privacy Policy describes how we, the entity Banco Santander S.A. (hereinafter, "Banco Santander", the "Bank" or "we"), with registered office at Paseo de Pereda, 9-12, Santander, Spain; we process the personal data of users who use the entrepreneurship platform accessible through https://www.santanderx.com/ (hereinafter, "Santander X" or the "Platform") on their own behalf (hereinafter, the "End User(s)" or "you"), in order to consult and register for any of the calls for entrepreneurship training programmes, events, challenges and awards (the "Calls") published by Banco Santander or by the universities and affiliated entities (hereinafter, the "Institutions") on the Platform, or to collaborate with other End Users in the entrepreneurial projects of which they are the owners ("Entrepreneurial Projects") or the companies they represent ("Companies").

Santander X is a space created by Banco Santander that brings together End Users like you and Institutions from different countries, in order to complete and promote entrepreneurship projects and create an entrepreneurial ecosystem. Through Santander X, End Users can register for the Calls for training programmes, events, awards and challenges for entrepreneurship and/or any other content related to entrepreneurship published by both Banco Santander and the Institutions. Specifically, the service provided by Banco Santander includes access to calls for training programmes, events to promote entrepreneurship, awards for growth support, challenges related to entrepreneurship and internationalisation of entrepreneurial businesses or any other functionality that may be added in the future and of which we expressly inform you. In addition, Banco Santander offers free of charge to End Users a catalogue of access training courses with unlimited places ("Courses with Unlimited Places") aimed at offering tools for the growth and transformation of their business to End Users and completing their training. Finally, Users may also access content aimed at facilitating learning and strengthening their skills with entrepreneurship (hereinafter, the "Content"). The Courses with Unlimited Places and the Contents aim to train End Users in order to achieve greater opportunities for business development and growth. All of the above functionalities collectively make up the "Service". You can find more details about our Service in the End User Terms of Service.In addition to the Institutions, the Service offered may have been financed by third parties (the "Promoters"), with whom the Institution may jointly manage the Calls or allow access to details about it, due to the fact that they have financed such Calls.

Under certain conditions, certain End Users may gain access to additional digital communities offered by Banco Santander ("Santander Communities"). These are digital communities in the form of social networks that seek to connect highly qualified entrepreneurs and facilitate their relationships with other members of the entrepreneurial ecosystem. The Santander Communities are accessible through a specific section of the Platform that will only be available to specific users. There may be different communities ("Communities") within the Santander Communities section, each one will have a specific audience and particular conditions. Access to each specific Community within the Santander Communities section is granted as a prize to users who have been selected by the Institutions as winners and/or finalists of specific Calls that specify it.

Likewise, End Users may access benefits and discounts offered by third parties outside Banco Santander ("Strategic Allies") for the simple fact of registering on the Platform ("Benefits"). These benefits consist of access to valuable services for entrepreneurs under advantageous conditions. Banco Santander will not transfer any personal data of End Users to Strategic Partners.

This End User Privacy Policy details the purposes for which we process your personal data, the reasons why the processing is lawful, the periods of time for which we keep the data, the entities with whom it is shared, the rights you can assert and other issues that we consider relevant so that you are clear about what we are going to do with your data when you enjoy our Service.

When we talk about "personal data", we mean any information relating to you that you have provided directly to us, that you have generated when using our Service, that we have inferred about you whenever you are happy for us to analyze your profile or that has been provided to us by third parties ("Data"). Specially protected data or information considered "sensitive" will not be processed.

In addition, we inform you that as a result of your use of the platform we may also process other types of information that is not related to you, but to the Entrepreneurial Projects and Companies that you register on the platform ("Entrepreneurship Information"). This information is not considered to be of a personal nature and, therefore, is not subject to data protection regulations or the provisions of this Privacy Policy. However, you can contact Banco Santander at any time for any concerns, queries or requests related to the Entrepreneurship Information.

We inform you that the Data marked with an asterisk is necessary for you to enjoy the Service, so if you do not provide such Data, you will not be able to enjoy the Service. In this sense, we may ask you for additional data in some functionalities, for example, to enroll in an entrepreneurship training program you may be asked for academic and/or employment data.

In addition, for those Users who are customers of Banco Santander (Spain), registration on the Platform can be done directly through a registration form through its app (hereinafter, "Santander App"). This is a space available to the app to facilitate the entry of Users into our services. Both the Santander App and the Santander X space are the responsibility of Banco Santander.

Please note that the processing of your Data that is carried out in the programmes, content,  events and awards published on the Platform by Banco Santander or by the Institutions will be subject to their own privacy policies, so we recommend that you consult them beforehand.

You can find more details about the ways in which we process your Data in the following sections of this End User Privacy Policy.

2. Who is responsible for the processing of your Data?

Identity of the Data Controller

Banco Santander S.A. with N.I.F. A-39000013; entity registered with the Bank of Spain under registration number 0049 and registered in the Mercantile Registry of Santander, Sheet 286, Folio 64, Book 5 of Companies, Entry 1a.

Contact details of the Controller

Postal address: Ciudad Grupo Santander, Avda. de Cantabria s/n, Santander Universidades, 28660 Boadilla del Monte (Madrid).

\u2012 Contact form for privacy purposes: Contact form.

\u2012 Contact Data ProtectionOfficer: dpo@universia.net

3. What data do we process? How do we get your data?

At Banco Santander we process Data that you have provided us directly, both in the registration process and subsequently, Data that you have generated when you use our Service, when you register for Calls, Courses with Unlimited Places, access the Content or simply browse the Platform.

In some cases, we may obtain the Data from the User's registration process from other sources or services provided by Banco Santander, such as, for example, the Santander App.

In particular, we obtain the following personal data: (i) on the one hand, data provided directly by the User such as names, surnames, gender, address, personal e-mail, professional email, date of birth, job position, link with Entrepreneurial Projects or Companies, telephone number, identification number (CIF or NIF/Tax ID in the case of self-employed workers,) ("Form Data"); and,  (ii) on the other hand, data relating to browsing and use of the Platform (such as IP address, registrations in Calls, Courses with Unlimited Places, consultation of Benefits, profile data or content) ("Browsing Data").

In addition, although it is not personal data, we inform you that we may process the following Entrepreneurship Information about the Entrepreneurial Projects or Companies that you register: company name and identification of the project or company in question, address or registered office, profile of the company according to its size (micro-enterprise, start-up, scale-up, SME or others), constituent data of the company in question,  identification of the founders of the project or company and their current role in relation to them, identification of the company's management positions, the company's web address, description of the project or the company's activity and its products or services, number of employees, location, state of internationalization of the company's activity,  Economic and financial information of the company (turnover, annual growth, customer volume, share capital, results of financing rounds), description of the company's investor profiles and participation in incubation or acceleration programmes.

On other occasions, in order to enjoy the Service, the Platform may require you to provide you with the minimum necessary information about your Company or Entrepreneurial Project in the form of questions, for example, to access the Courses with Unlimited Places or the Benefits (the "Minimum Information"). This information will be the following: company name, company position, company CIF and corporate email.

Finally, we inform End Users that we obtain information about browsing habits through cookies. For more information on this, we recommend End Users to consult our Cookie Policy.

4. For what purpose do we use your Data? With what legal justification?

Within the framework of Santander X, we will process your Data for the purposes described below. We always use your Data lawfully, so for each purpose, we specify the basis we use to justify that the purpose is in accordance with data protection regulations.

Santander X General Operations

a) Create your Santander X account and allow you to use it to identify yourself, access and enjoy the Service.

The main purpose of the processing of your Data and, as applicable, of the Entrepreneurship Information on Companies, is to manage your registration as an End User on the Platform, so that you can identify yourself and that we know who you are, as well as so that you can enjoy the Service that the End User uses, such as registration in Calls and Courses with Unlimited Places or the Content offered on the Platform.

In this sense, once registered, we will use your Data and Entrepreneurship Information for all the processing that is necessary to allow you to use any of the functionalities of the Platform. This includes managing your access to the different Calls for Training Programs, Courses with Unlimited Places, Content, events, challenges and entrepreneurship awards published in Santander X and sharing your Data.

In addition, when the nature of the Calls for training programs, Courses, events, challenges and entrepreneurship awards requires it, the Responsible Party and/or the corresponding Institution will use the personal data of the Users to certify their attendance or participation in it, being necessary to evidence the training in front of third parties. For certification, the User's Form Data and his/her attendance or participation in the Course will be processed.

The Data that you may provide in the registration process or in the use of the Services ("Form Data") includes: names, surnames, address, personal e-mail, professional email, date of birth, job title, connection with Entrepreneurial Projects or Companies, telephone number, and identification number (CIF or NIF/Tax ID in the case of the self-employed),  and, in the case of Users who register an Entrepreneurial Project, gender.  In addition, you may provide certain Entrepreneurship Information depending on your use of the Platform.

What is the legitimizing basis that allows us to do so?

The legitimate basis for data processing is the performance of a contract that materializes with the acceptance of the Terms of Service for End Users.

b) Prevention of fraud in calls for programmes and courses.

When required by the nature of the Calls for Entrepreneurship programs, Courses, events, challenges and awards, the Responsible Party may use the Users' personal data to prevent fraud in the application, registration, attendance or participation in them. To this end, the Data Controller will use technical and organisational measures to check the operation of the Calls for Entrepreneurial programmes, Courses, events, challenges and awards and to identify behaviour that could be considered fraudulent (e.g., multiple registrations; identity theft in registration, application or participation).

For the verification and prevention of fraud, data such as the User's Form Data and Navigation Data will be processed, as well as their attendance or participation in the Calls for Calls for Entrepreneurship Programs, Courses, Events, Challenges and Awards.

What is the legal basis that legitimises this processing?

This processing is carried out based on the legitimate interest of Banco Santander and the Institutions in preventing fraud in the Calls for Calls for Entrepreneurship programmes, courses, events, challenges and awards to which it offers access. Fraud prevention is necessary to maintain the quality and value of the Calls for Entrepreneurship programs, Courses, events, challenges and awards, so it results in a benefit for the Users themselves.

We have carried out a weighting analysis to assess whether we could indeed carry out this processing based on our legitimate interest. Users can request it from us through the contact details indicated. However, we advance some of the main conclusions of this analysis below: fraud prevention represents a real interest, both for us and for the Institutions and the rest of the Users, which is totally lawful, it is proportionate because there are no less invasive measures that allow us to develop our interest without processing the Users' data in a lawful way,  it does not represent damage to the User (on the contrary, it allows to guarantee the quality and value of the Calls for Calls, Courses, events, challenges and entrepreneurship awards in which they participate), the processing of data is not unbalanced, and, in addition, it is a common practice in the sector.

c) Auto-completion of information in the User registration process.

When requested, Banco Santander may process the Users' Data to fill in some of the data requested during the registration process in advance, i.e. creation of your account with Santander X and registration as a User. The purpose of the processing is to facilitate the User's registration in the services offered by Banco Santander, in those cases in which the User already has the relevant information. The User may modify any data in the registration forms that is completed in advance, before sending it to Banco Santander for the creation of the user account. The data processed will only be those indicated in the registration form of the Platform. Depending on the context in which the User's registration process is carried out, Banco Santander may obtain the data from a different source:

- Registration from the Santander App of Banco Santander (Spain)

When the User is a customer of Banco Santander (Spain) and registers on the Platform through its Santander App, Banco Santander will obtain the account details that the User has previously created when registering on the Santander App. This Santander App is also the responsibility of Banco Santander, as is this Platform (see the specific privacy policy of the Santander App).

There is no transfer or communication of personal data in the registration from the Santander App because the processing of personal data of the service involved is the responsibility of Banco Santander. Even so, the Users' consent will always be requested for the auto-completion of their Data.

What is the legal basis that legitimises this processing?

The legal basis for carrying out this data processing is the express consent of the User.

In the event that the User does not give their consent initially or, having given it, revokes it in the future, it will not mean the loss of their status as a User nor will this affect the enjoyment of the service.

d) Transfer of Data to the Institutions that organise the training programmes, events, challenges and entrepreneurship awards and/or to the Institutions that promote or sponsor the training programmes, challenges, events and entrepreneurship awards.

When you register for a Call for a training program, courses, challenges, event or entrepreneurship award, we will transfer your Data and, as applicable, Entrepreneurship Information about Companies to the Institution that organizes it and/or to the Institution that has promoted, granted or sponsored it, if different, including its Collaborators,  Evaluators and Mentors that they designate, with the sole purpose of allowing you to participate in it. In addition, on some occasions the Training Programmes imply that the training is taken in an Institution other than the one that has granted it, to which Banco Santander will also transfer the Data in order to manage the necessary procedures to be able to take the Training Programme. In summary, the following cases can occur:

-          Case I: There is a Promoter that finances a Training Programme, challenge, event or prize and an Institution that grants the Training Programme, challenge, event or prize and simultaneously where the End User takes the training, so that Banco Santander will transfer the data to the Promoter and the Institution in question.

-          Case II: There is a Promoter that finances the Training Programme, event, challenge or prize and on the other hand, an Institution that grants them and finally a third Institution where the End User takes it, in this case Banco Santander will transfer the data to the Promoter, to the Institution that grants the Training Programme, event,  challenge or prize and to the Institution where the End User performs it.

The transfer of Data to the organising and/or promoting Institutions is necessary to participate in the selected training programme, challenge, event or entrepreneurship award. On some occasions, the organising and/or promoting Institutions are located in unsafe countries or located outside the European Union. In the section "6.2.- International data transfers to third countries" you will find the name and details of the Institutions affiliated to Santander X that are outside the European Union.

The data that would be transferred are: names, surnames, gender, address, personal e-mail, professional email, date of birth, job position, link with Entrepreneurial Projects or Companies, telephone number, identification number (CIF or NIF/Tax ID in the case of the self-employed). In addition, certain Entrepreneurship Information on the Entrepreneurial Projects or Companies that you submit will be transferred to the Calls and Courses with Unlimited Places.

What is the legitimizing basis that allows us to do so?

The legal basis that allows this processing to be carried out is the execution of a contract that materialises with the acceptance of the Terms of Service for End Users, as well as the Legal Conditions of the Call for the training programme, challenges, prizes or event in question. In addition, we consider that transfers to Organizing Institutions and/or promoters in whose Calls you register are occasional assignments, since we will only do so when you decide to register for them. Both of these things justify the international transfers that we may make when we transfer your data to Institutions located outside the country in which you are located, in countries not recognized as safe by the data protection authorities.

e) Contact mailbox.

Banco Santander will process the Data in order to be able to respond to requests for information that you may submit, such as incidents, privacy rights, queries about calls for training programs, challenges, Courses with Unlimited Places, Contents, events and entrepreneurship awards published or other aspects of Santander X, sent by the End User (registered or not) through the contact form provided,  as well as the actions and operations that may arise from them.

What is the legitimizing basis that allows us to do so?

This processing is carried out based on our legitimate interest in adequately resolving the concerns raised by End Users and increasing satisfaction with the Service, as well as, where appropriate, in compliance with legal obligations regarding customer service.

We have carried out a weighting analysis to assess whether we could indeed carry out this processing based on our legitimate interest. End Users may request this from us using the contact details set out in section 2). However, we advance some of the main conclusions of this analysis below: the resolution of doubts and queries represents a real interest for us that is totally lawful, it is proportionate because there are no less invasive measures that allow us to develop our interest without processing the data of the End Users in a lawful way, it does not represent damage to you (on the contrary,  allows fluid communication with Banco Santander), data processing is not unbalanced, and, in addition, it is a common practice in the sector.

f) Sending of its own communications related to the content and improvement of the Santander X Service by any means, including electronically. Banco Santander will use the personal data you provide when registering on the Platform to send communications that help you in your day-to-day life within the framework of the Service, such as, for example, the sending of an automatic notification in the event that you start and do not complete the registration for any Call and Courses with Unlimited Places offered through Santander X,  with the aim of offering you the help mechanisms you may need to finish it. Likewise, we will also send you communications to know your satisfaction with the Service and the possible improvements that we may introduce and communications related to those Calls for training programs, challenges, Courses with Unlimited Places, Contents, events and entrepreneurship awards active in Santander X that may be of interest to you.

What is the legitimizing basis that allows us to do so?

This data processing is based on Banco Santander's legitimate interest. In particular, Banco Santander is interested in its End Users being aware of the different functionalities or opportunities offered on the Platform and thus helping them to enjoy the Service to the fullest and, in addition, to know how it can improve it.

At Banco Santander we have carried out a weighting analysis to assess whether we could effectively carry out this processing based on our legitimate interest. End Users may request this from us through the addresses indicated in section 2). However, some of the main conclusions of this analysis are advanced below: the sending of our own communications related to the content and the improvement of the Service represents a real interest for us that is totally lawful; it is proportionate because there are no less invasive measures that allow us to develop our interest in you knowing the opportunities we offer; it does not represent harm to you, but it results in us sending you offers, calls that we believe will facilitate your training; you can object to us doing it at any time, from the beginning; and, in addition, it is a common practice in the sector.

g) Profiling for marketing purposes and sending by any means, including electronically, of its own commercial communications and about third-party products or services. Our intention is to provide you with content of interest at all times. Banco Santander may send you its own commercial communications and/or third-party products or services that may deal, by way of example, with banking products, insurance products, telecommunications, education, leisure, research, automotive, mass consumption, employment, culture, career opportunities, textiles, transport, insurance, catering, technology, food, television, radio, internet portals and comparators.

Commercial communications will be personalised based on your profile, as we are not interested in sending you generic communications. This profile would be created using factors such as (i) your Data (including your basic identification data and your browsing habits on our Platform, such as the type of Calls for Applications in which you register or the type of Courses with Unlimited Places, Content, the type of Benefits you consult, etc.), (ii) other data about you that we may have because you have previously provided us outside the Platform,  (iii) data about you that originates from third-party platforms that belong to the same advertising network as us (in the latter case, only where you have consented to the installation of cookies or other tracking devices when accessing the Platform), or (iv) Entrepreneurship Information relating to the Companies to which you are linked.

What is the legitimizing basis that allows us to do so?

The legal basis for enabling this data processing is your express consent. If you do not give your consent initially or, having given it, revoke it in the future, it will not mean the loss of your status as an End User nor will this affect your participation in Santander X.

h) Transfer of Data by Banco Santander to the entities of Grupo Santander domiciled in your country of residence*, so that they can send you, by any means, including electronically, their own and third-party personalised commercial communications. If you consent, we will communicate your Data and, as appropriate, Business Entrepreneurship Information, to the Santander Group entities domiciled in your country of residence so that they can send you, separately, their own commercial communications and about third-party products or services that may deal, by way of example, with banking products, insurance products, telecommunications, etc.  Education, leisure, research, automotive, mass consumption, employment, culture, career opportunities, textiles, transport, insurance, catering, technology, food, television, radio, internet portals and comparators. Commercial communications will be personalized, since they are not interested in sending generic communications, based on the profile that each of them has about you, which will be made up of (i) the Data that we provide them (can be consulted below) and (ii) the data that they already had about you that you may have given them outside the Platform,  in the event that they have any.

If you are a resident of the United Kingdom, provided that you have given your consent, the Data Controller may only send you commercial communications about its own products or services with the intention of providing you with information of interest at all times.

*You can consult the list of entities of the Santander Group to which we may transfer your Data, depending on your country of residence, in this link.

The Data that would be transferred are: (i) names, surnames, gender, address, personal e-mail, professional email, date of birth, job position, link with Entrepreneurial Projects or Companies, telephone number, identification number (CIF or NIF/Tax ID in the case of self-employed workers) and (ii) data related to the navigation and use of the Platform (e.g. IP address and registrations in types of Calls and Courses with Unlimited Places,  Content or consultation of types of Benefits), together with certain Entrepreneurship Information when applicable.

What is the legitimizing basis that allows us to do so?

The legal basis for enabling this data processing is based on your express consent. In the event that you do not give your consent initially or if you have given it, you revoke it in the future, it will not mean the loss of your status as an End User nor will this affect your participation in Santander X. This consent also covers the performance of data transfers that would be made by the Controller if the End User resides in a "non-secure" country. Further details on international transfers can be found in section 6) of this Privacy Policy.

i) Conducting raffles, promotions and competitions. From time to time, Banco Santander may organize actions to promote our Service, other of our products or services or products or services of third parties through the Platform or social networks.

What is the legitimizing basis that allows us to do so?

If you decide to participate in them, the legitimate basis for the processing of your Data will be the acceptance of the legal bases of the corresponding promotional action.

j) Carrying out statistical analyses on the operation of the technology that supports the Service in order to make technical, security, operational, usability and commercial improvements.

We will obtain metrics on the technical performance of our technology so that we can improve it commercially, correct errors and make it safer and easier to use. Therefore, we may use information that you generate through interaction with the Platform and the Service in aggregate form with that of other Users for the purpose described.

What is the legitimizing basis that allows us to do so?

The legal basis that legitimises this processing of Data is the legitimate interest of Banco Santander. Our interest lies in being able to use the information on the use of the Service in an aggregated form to know the impact and usefulness of the Calls, Courses with Unlimited Places, the Contents or Benefits, as well as to be able to correct and technically improve our Service, make it safer, more fluid, useful and simpler and that it responds to the real needs of End Users.

We have carried out a weighting analysis to assess whether we could indeed carry out this processing based on our legitimate interest. End Users may request this from us using the contact details set out in section 2). However, we advance some of the main conclusions of this analysis below: the performance of statistical analyses represents a real interest for us that is totally lawful, it is proportionate because there are no less invasive measures that allow us to develop our interest, it does not represent damage to you and, in addition, it is a common practice in the sector.

k) Anonymization of Personal Data. We will anonymize End User Data and analyze it in aggregate form along with Startup Information and other anonymized data to learn patterns and extract insights and intelligence from startup trends, improve the security of our technology, and other purposes. The anonymous information may be used for the preparation of reports or aggregated reports for internal purposes of the Santander Group.

The Data that would be processed are: (i) names, surnames, gender, address, personal e-mail, professional email, date of birth, job position, link with Entrepreneurial Projects or Companies, telephone number, identification number (e.g. ID card, passport) and (ii) data related to the navigation and use of the Platform (e.g. IP address and registrations in types of Calls and Courses with unlimited places,  Content or consultation of types of Benefits), together with certain Entrepreneurship Information when applicable.

What is the legitimizing basis that allows us to do so?

This purpose is lawful because we believe that we have a legitimate interest in improving the security of our Service and in generating intelligence that allows us and third parties to know entrepreneurial trends, as well as to leverage that knowledge for other purposes. Please note that the insights and learnings we gain from aggregated analysis of anonymous information will not directly affect you.

We have carried out a weighting analysis to assess whether we could indeed carry out this processing based on our legitimate interest. End Users may request this from us using the contact details set out in section 2). However, we advance some of the main conclusions of this analysis below: anonymisation represents a real interest for us that is totally lawful, it is proportionate because there are no less invasive measures that allow us to develop our interest, it does not represent damage to you and, in addition, it is a common practice in the sector.

l) Compliance with legal obligations. Finally, Banco Santander may process the Data to comply with any applicable legal obligations. For example, obligations of a fiscal nature, compliance with requirements of the Courts of Justice, etc.

What is the legitimizing basis that allows us to do so?

This purpose is lawful, as we need to process your Data in order to comply with our obligations under the law.

Specific operations of Comunidades Santander

m) To allow you to identify yourself, access and enjoy the Santander Communities Service and its different functionalities.

The main purpose of the processing of your Data and, as applicable, of the Business Entrepreneurship Information, is to manage your access, use and enjoyment of Santander Communities, so that you can identify yourself and that we know who you are, as well as so that you can enjoy the functionalities of the Community of which you are a part.

You do not need to carry out an additional registration procedure for this. We will use the data you have provided when creating your Santander X account to provide you with access and to allow you to use the Santander Communities section. In this way, the interaction between the Platform and Santander Communities allows you to access this section using the same access credentials that you would use to access the main Santander X service.

In this regard, we will use your Data and Entrepreneurship Information for all processing that is necessary to allow you to use any of the functionalities of Comunidades Santander or the Community in which you participate, such as managing your access, publishing content, registering for events published by other users or contacting other users of Comunidades Santander.

Please note that the use of Santander Communities has the following implications:

• Public profile. When you activate your account in Santander Communities, your user profile and the content you publish will be visible to the rest of the Santander Communities users. Therefore, certain data that you used to carry out your registration in Santander X may be visible to these users. This data includes: your first name, last name, and country of residence, as well as the name and description of the Business Project or Company to which you are linked, along with certain Entrepreneurship Information.
• Event registration. when you register for an event, your Data will be communicated to the company or institution that convenes, organizes or manages it. This company or institution will process your personal data under its own responsibility and in accordance with its data protection practices. We recommend that you consult the corresponding privacy notice of that company or institution to find out the particularities regarding the processing of your Data.
• Messaging. Please be aware of the information you send through messaging features and use them diligently. It is not permitted to include personal data of third parties in messages exchanged through the Community.

What is the legitimizing basis that allows us to do so?

The legitimate basis for data processing is the performance of a contract that materializes with the acceptance of the Terms of Service for End Users.

n) Transfer of Data by Banco Santander to Investors and Third Party Users so that they can contact the End Users.

If provided for in the Legal Conditions that regulate your experiences associated with a specific Community, we may offer you to communicate information relating to you, your Entrepreneurial Project or your Companies to potential Investors or other Third Party Users who participate in your Community. This may include communicating your Data and/or, as applicable, Entrepreneurship Information.

Specifically, in this case, Banco Santander would analyse the characteristics of the Entrepreneurial Projects and Companies linked to your profile and communicate them together with your Data to potential Investors with matching investment needs or Third Party Users who can offer you appropriate valuable experiences. They may contact the Companies for investment, business development, networking, mentoring, among others.

Please note that, once the data has been communicated by Banco Santander, Investors or Third Party Users will process the Data received under their own responsibility and in accordance with their data protection practices. We recommend that you consult its corresponding privacy notice to find out the particularities regarding the processing of your Data.

The data provided would be: name, surname, address, e-mail, along with certain Entrepreneurship Information related to the Companies.

What is the legitimizing basis that allows us to do so?

The legal basis for enabling this processing of your Data or, as appropriate, of Business Entrepreneurship Information is based on the Legal Terms and Conditions that govern your experience associated with a specific Community. These Legal Conditions are those that govern the Call for Applications by which you submit your application to be part of the Community. If you do not want to share this information with potential investors, you can let us know at any time as described in the following sections of this Policy.

5. How long will we keep your Data?

The Data will be retained for as long as the contractual relationship between us and you, regulated by the End User Terms of Service, is maintained.

However, for the purposes for which we have asked for your consent or on which you have the possibility to object, we will stop processing your Data sooner if you withdraw your consent or if you object to our further processing of your Data, in the latter case provided that our legitimate interests do not continue to override.

If the End User revokes his/her consent or exercises his/her right to erasure, his/her personal data will be kept blocked for the periods established by law to attend to the possible liabilities arising from the processing of the same, for the formulation, exercise or defence of potential claims whenever permitted by applicable legislation, or to make the Data available to judges and courts or to the competent public authorities. During this additional period, Banco Santander will keep your Data blocked. This means that we will not use them for the initial purposes, but only for those described in this paragraph and during the limitation periods of any liability actions that may exist. Once this extra period has ended, we undertake to cease processing all your Data.

6. Who do we share your Data with?

Recipients of your Data

Your Data is shared with the following entities:

Santander X General Operations

- Service providers. They are entities that help us with different issues related to the management of the Service, such as, for example, technological infrastructure, storage, sending commercial communications or customer service to the End User. At Banco Santander we ensure that all our service providers who may have access to your Data act confidentially and comply with the applicable regulations on data protection. We have entered into agreements with them that govern the use of your Data limited to the provision of the Service and the security measures they must adopt to protect it. These providers never use your Data for their own purposes, but simply to help us provide you with the Service you are enjoying.

Users can consult what specific Data is transferred to the above Recipients in section 4 of this Privacy Policy.

- Institution affiliated to Santander X that organizes and/or sponsors calls for training programs, challenges, events or entrepreneurship awards, as well as its Evaluators, Collaborators, Mentors and Juries. The Data and files provided by the End Users during the application process will be transferred to the Institution that organizes the training program, challenges, event or entrepreneurship prize to which the End User has decided to register and/or to the Institution that sponsors it, in case they are different, as well as to its Collaborators,  Evaluators, Mentors and Juries, who are part of these Institutions, or collaborate with them on their own account, with the sole purpose of enabling their participation in it.

- Santander Group entities. Banco Santander will communicate the Data of End Users who give their consent to other entities of the Santander Group domiciled in your country of residence, based on the criteria established in section "4. For what purpose do we use your Data? With what legal justification?" In the following link, are the entities of the Santander Group to which we may communicate your data if you give your consent for them to send you personalised commercial communications, as referred to in purpose f).

- Public authorities and bodies for the performance of their functions. On some occasions, the applicable regulations require the sharing of information with public authorities or bodies so that they can carry out their functions. For example, tax authorities or courts of law, who would use your Data for their own purposes.

Specific operations of Comunidades Santander

- Other users of Communities. Please note that depending on how you participate in the Communities and use their functionalities, other Santander Communities users may be able to access your Data, including data derived from your use of the Community such as your posts, messages and the like.

- Companies or institutions organising events. In the event that you decide to register for an event organised by a third party, Banco Santander will communicate the Data you include in the registration form to the company or institution that manages, organises or convenes the event in order to process your attendance.

- Potential investors. When provided for in the Legal Conditions of a specific Community, Banco Santander will communicate the Data of certain End Users, together with Entrepreneurship Information relating to the Entrepreneurial Projects or Companies to which they are linked, to potential investors with investment needs that coincide with the characteristics of the Companies, based on the criteria established in section "4. For what purpose do we use your Data? With what legal justification?"

International data transfers to third countries

- Institution affiliated to Santander X that organizes and/or sponsors calls for entrepreneurship programs, events or awards, as well as its Evaluators, Collaborators, Mentors and Juries. Santander X is international in nature, and End Users and Institutions, located outside and within the European Union, can register with it. If the End User registers for a Call for a program, event or entrepreneurship award organized and/or sponsored by an Institution, located outside the European Union, your Data will be transferred to said Institutions, including their Collaborators, Evaluators, Mentors and Juries. In this regard, we inform you that the processing of data outside the European Union may pose a risk to the security of your data, which would no longer be covered by the guarantees required by European regulations, due to the absence of an adequacy decision by the Commission with respect to the third country in question. Banco Santander is not responsible for and cannot guarantee the security of the data transferred. These international transfers are legal because they are necessary for the execution of the End User Terms of Service and because they are of an occasional nature, as they will only occur when you decide to register for their Calls for Programs, Events or Awards.

- Santander Group entities. It is necessary to inform you that there are entities of the Santander Group that are located outside the European Union, including in territories considered "unsafe" for the purposes of the European Commission, therefore, unless otherwise provided, we will exclusively transfer your Personal Data in accordance with Standard Contractual Clauses approved by the European Commission. End Users may request additional information in relation to international transfers of personal data of the relevant protection measures implemented by sending a communication to the email address indicated in section "7. What are your privacy rights?" As reflected above, in the case of the United Kingdom, only commercial communications of its own products or services may be sent.

- Service providers. Some of these service providers are located in or may access End User Data from outside the European Economic Area, so we have put in place appropriate safeguards to ensure that the Data is treated with a level of protection equivalent to that which exists in the European Economic Area. In these cases we speak of "international data transfers". In particular, these transfers may be supported by the adoption of Standard Contractual Clauses approved by the European Commission, which you can consult at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_es or in which our providers have binding corporate rules. You can request more information about international transfers and the appropriate safeguards we use in each individual case via email dpo@universia.net.

7. What are your privacy rights?

Reference to the exercise of rights

End Users have the right to access their Data, as well as to request the rectification of inaccurate Data, the limitation of its processing or, where appropriate, request its deletion when, among other reasons, the Data is no longer necessary for the purposes for which it was collected, as well as not being subject to automated individual decisions. In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their Data; Banco Santander will cease to process the Data, except for compelling legitimate reasons, or the exercise or defence of possible claims. Likewise, End Users will have the right to request the portability of their Data.

The owners of the Data may contact Banco Santander with registered office for these purposes at Avda. de Cantabria s/n, Ciudad Grupo Santander, Santander Universidades, 28660 Boadilla del Monte, (Madrid) and/or the following Contact form.

Right to withdraw consent given

The End User has the right to withdraw his/her consent at any time by contacting the addresses indicated above.

Right to complain to the Supervisory Authority

Data subjects have the right to contact the Spanish Data Protection Agency at Calle Jorge Juan 6, 28001, Madrid, to file a complaint, especially when they have not obtained satisfaction in the exercise of their rights, through the www.aepd.es website.

8. Modification of the End User Privacy Policy

We may amend this End User Privacy Policy in accordance with applicable law at any time, but we will inform you of any significant changes that have a material impact on your privacy in good time. In addition, we will post the amended End User Privacy Policy on our Platform, where you can check the last updated date. If necessary depending on the nature of the modification we make, we may ask you to grant us new consents.

Last updated: 10/07/2025