Sepblac

Data protection by Sepblac as Data Processor

Unofficial translation provided for information purposes.

Please note our language policy.

According to Article 43.2 of Law 10/2010 of April 28, on the prevention of money laundering (Law 10/2010), Section Six of the Annex to Order ECC/2503/2014, of December 29, which creates the personal data file called “Centralized banking account register” (FTF, from its initials in Spanish), and Article 50 of the Regulation implementing the aforementioned Law 10/2010 (approved by Royal Decree 304/2014, of May 5), Sepblac is the data processor, with the position of data controller corresponding to the Secretary of State for Economy and Business Support of the Ministry of Economic Affairs and Digital Transformation (Secretary of Economy).

Sepblac, in its capacity as data processor, on behalf of the Secretary of Economy and to ensure the security of systems, confidentiality, integrity, quality, and preservation of personal data, and to address potential cybersecurity risks and threats, manages the FTF in compliance, among others, with Law 10/2010, its implementing regulation; Organic Law 9/2022, of July 28, which establishes rules to facilitate the use of financial and other information for the prevention, detection, investigation, or prosecution of criminal offenses (Organic Law 9/2022); Regulation (EU) 2016/679, of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, and Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation, and prosecution of criminal offenses and the execution of criminal sanctions, which transposes into Spanish law Directive (EU) 2016/680, of April 27, 2016 (Organic Law 7/2021). Additionally, the staff dedicated by Sepblac to the management of the FTF participate in specialized training programs and have the relevant qualification and knowledge of European Union Law and applicable national regulations, including in the field of data protection. Additionally, Sepblac maintains a registry of each access and consultation to the FTF carried out by the competent authorities, subject to the use limitations and retention periods established in Article 6 of Organic Law 9/2022, which is regularly reviewed by Sepblac’s data protection officer and made available to the Spanish Data Protection Agency for the exercise of its legally recognized powers. Additionally, to ensure the proper use of the FTF, Sepblac sends a registry of the fulfilled accesses to the prosecutor designated for this purpose by the Public Prosecutor’s Office every six months.

Access to the information contained in the FTF is regulated in Articles 43 of Law 10/2010, 50 to 57 of its implementing regulation, and 4 and 5 of Organic Law 9/2022. In accordance with this legislation, the content of the FTF is strictly confidential and its use is limited to the purposes expressly provided in Articles 43.1 of Law 10/2010 and 3.1 and 4 of Organic Law 9/2022. Only the institutions and authorities expressly listed in the aforementioned articles can access the FTF data, in the manner and with the requirements provided in this regulation.

In accordance with the provisions of Articles 23.1 of Regulation (EU) 2016/679, and 12.5 of Organic Law 3/2018, the processing of the data contained in the FTF is regulated by Organic Law 7/2021, in which Sepblac is one of the authorities expressly included in this Organic Law.

Pursuant to the provisions of Article 15 of Regulation (EU) 2016/679, Article 13 of Organic Law 3/2018, and Articles 20 and 30 of Organic Law 7/2021, the treatment for rights regarding personal data corresponds to the data processor. Therefore, where applicable, interested parties, upon proper identification, must submit their requests to exercise their rights over their personal data to the Secretary of State for Economy and Business Support, following the general procedure made available by the Ministry of Economy, Trade, and Business at its Electronic Office or, alternatively, by any other means that provides proof of sending and receipt, to: Secretary of State for Economy and Business Support (Ministry of Economy, Trade, and Business), Paseo de la Castellana, 162 – 28046 Madrid. Likewise, when an interested party does not agree with the resolution of their request to exercise rights, they may report a complaint or claim with the Data Protection Officer of the Ministry of Economy, Trade, and Business (dpd@economia.gob.es), or with the Spanish Data Protection Agency, c/ Jorge Juan, 6. 28001 Madrid – https://www.aepd.es/en as well as exercise the judicial actions that may be appropriate.