Who are we and what do we do?
We are Hoist Finance Spain, SL, a company with registered office at Avenida de Manoteras 44, 1ª planta 28050, Madrid, Spain, part of Hoist Finance AB (publ), a financial group specialized in the acquisition and management of portfolios composed of performing and non-performing loans.
What information do we store, why do we process it and how long do we keep it?
We only use your information for debt collection and associated processes. In some cases we have outsourced our activities to third parties, who manage debt collection activities on our behalf.
This Privacy Policy describes the various processing activities that we, as data controllers, carry out with your personal data in the context of our activities.
To pursue the aforementioned purposes, we process personal data as data controllers when we receive and store customer data.
Further details on these data processing operations are provided below
Processing purposes related to customer recovery operations
|
Type of information |
Reason for Treatment |
Legal basis for processing |
How long we keep your data |
| Contact account information, such as your name, address and details of previous communications with us, for example, records and emails and letters .
|
To be able to contact you, to keep records of any previous conversations or correspondence, and generally to maintain a complete and current picture of your circumstances and dealings with us. This is necessary to handle your case fairly and in your best interest. . |
The legal basis for the processing of this information is the execution of the credit agreement.
|
10 years since the closing of the debit position and termination of the contractual relationship
|
|
Payment information, such as your bank account number, to set up direct debit or process your payments. |
In order to process payments and payment requests |
The legal basis for the processing of this information is the execution of the credit agreement .
|
10 years since the closing of the debit position and termination of the contractual relationship
|
|
Litigation information, such as court information and specific outcomes and costs.
|
As part of our collection strategy, we may decide to take legal action against you. You will be notified before any action is taken, but in the event that we have to do so, we will maintain current and relevant information about all actions and outcomes so that we can act as fairly as possible |
The legal basis for the processing of this information is the execution of the credit agreement.
|
5 years from the judicial resolution.
|
|
Credit reference information, such as historical addresses, credit application data and credit score information . |
We need this information to help form a complete picture of your circumstances, as well as to improve the accuracy of the information we already have |
The legal basis for the processing of this information is the execution of the credit agreement
|
10 years from the closing of the debit position and termination of the contractual relationship
|
|
Voice recordings such as the content of telephone conversations
|
For the control of the quality of the service provided, the exercise and defense of rights in case of litigation and/or claims in relation to the credits managed
|
The legal basis for the processing of this information is the execution of the credit agreement.
|
10 years from the closing of the debit position and termination of the
contractual relationship
|
|
Sensitive information, such as information relating to your health or any other factor that may have an impact on your dealings with us
|
In order to provide them with the most appropriate and fair results, especially in vulnerability. Cases of Therefore, in the act of debt collection, the treatment of sensitive information can be crucial to ensure that customers are treated fairly and appropriately. |
This sensitive information will only be processed with your consent. You have the right to withdraw this consent at any time.
|
10 years from account closure or withdrawal of consent, |
|
Management of the whistle-blowing process for whistle-blowing purposes .
|
Information regarding complaints, personal and contact details (if provided)
|
Legal obligation
|
Reports with negative results will be deleted/anonymized upon completion of the investigation. Reports with positive results will be retained for 10 years. years after the adoption of any disciplinary action. |
Where do we get the information from?
Initially, your personal data is provided by the credit holder.
However, we also obtain information directly from you, for example, when you speak to one of our agents or send us a letter, email or text message in which you provide us with your new address, payment details or other information.
Finally, we may also obtain information from third parties to increase the accuracy of the information we have and/or to learn more about your circumstances. These third parties are credit reference agencies, government public records and other organizations that provide services to improve the quality of the data we have about you.
We may also retain records of your access to and use of our website to enhance your experience. For more information, please see the cookies page.
Disclosure of your information
We do not disclose your information, except in the following limited circumstances:
We may share your personal information within the Hoist Finance group of companies to which we belong. For example, our IT infrastructure is managed at group level. This helps keep our systems operational and secure, enabling us to provide you with the best possible services.
Any exchange is subject to security and privacy requirements.
We may share your personal data with organizations, which must meet our strict security and privacy requirements and follow our guidelines, for the following purposes:
- To help us manage your account and/or maintain the accuracy of information we have about you. An example of this would be reports from credit reference agencies.
Finally, we may also disclose your personal information to third parties:
- In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
- If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use, or to protect our rights, property, or safety. This includes the exchange of information with other companies and organizations for fraud protection and credit risk reduction purposes, or with authorities for tax information or anti-money laundering purposes.
- In general, your information will be kept within the EU/EEA or in countries that the European Commission considers having an adequate level of protection; only for limited purposes and on a temporary basis may data be transferred to other This is particularly the case when we need 24/7 technical support to maintain our IT infrastructure, and when the support teams of our service providers are located outside the EU/EEA.
- In all cases, however, we have technical, organizational, and contractual safeguards in place to keep information secure and ensure an adequate level of protection.
Contractually, transfers outside the EU/EEA to countries without an adequacy decision by the European Commission will be based on the standard data protection clauses adopted by the European Commission. on Data Protection
Processing purposes related to our online portal
To offer our customers the best overview of their situation and easy management of payment orders, installment plans and individual repayments, we offer our own online customer portal.
To use the functions of the online customer portal it is necessary to create an individual user account.
To maintain confidentiality, it is necessary to properly verify the personal data used to create the user account. This is done in two essential steps, which we would like to inform you about
below.
Verification of your customer status
If you decide to register an individual user account to use the customer portal, we will first ask you to verify that you are our customer. In order to verify and register an account we will need to collect some personal information from you. The information you provide will be checked against our database solely for the purpose of verifying your authorization to use the portal and to provide you with user credentials to access your account.
Set up a login (login via your social networks or email account)
If the first step has been carried out successfully, you will reach the second step, where you will need to set up a login to register for our online customer portal. In addition to the usual registration process by entering a valid email address, you have the option to set up a social login via your selected social media provider.
This gives you the advantage of being able to log in when accessing the online customer portal in the future by simply entering the user data of your preferred social media account linked to our portal (eg Facebook, Linkedin, Google, etc.).
If you decide to set up a login to social networks, after selecting the social network account you wish to link, you will be redirected to its login page by clicking on the logo of the respective provider, where you can verify yourself as usual by entering your login data.
If you only wish to use your preferred e-mail account, simply enter your e-mail address and the password you wish to use to log in to our online customer portal in the input mask provided for this purpose.
You will then receive a verification email, which you must first confirm. Simply click on the verification link provided for this.
If your selected social media or email provider has been successfully verified, it will transmit the corresponding verification data to us via the authentication routine we use for this purpose, where the verified social media account or your email address can be used to log in to our online portal.
The personal data processed in this method are solely for the purpose of linking your social media or e-mail account with our online portal, which are transmitted via an encrypted connection (SSL / TLS encryption). Knowledge of the security-critical login data used by you (in particular passwords) by us is technically excluded as part of the linking process.
In this particular case, we will receive your personal data from the social networks with which you link your Hoist Finance portal account
Your Data Protection Rights
Right of Access: You have the right to request a copy of the information we hold about you. If you would like a copy of all or part of your personal information, please contact us. We will respond to your request within one month.
Right to rectification: We want to make sure that your personal information is accurate and up to date. You may ask us to correct or delete information that you believe is inaccurate. We may ask you to provide reasonable evidence to verify your request.
Right to restrict processing: If you believe that the personal information, we hold is inaccurate, unlawful or that we do not have a legitimate interest, you may request that we restrict any processing until it is rectified.
Right to object to processing: You may object to our processing of your data for the performance of a task carried out in the public interest or based on our legitimate interest.
Right to data portability: This right allows you to obtain in a structured and commonly used format, and to reuse the information you have provided to us for your own purposes and to have it transmitted directly to different services. This applies only to information that we use on the basis of your consent or on a contractual basis.
Rights related to automated decision making and profiling: You have the right to be protected against the risk of potentially harmful decisions being made without human intervention. This right applies when a decision is based solely on automated processing and produces a legal effect or similar significant effect. If this is the case, we must ensure that you can obtain human intervention, express your point of view and have the opportunity to challenge it. We will also explain the rationale for the decision.
Profiling is defined as any form of automated processing intended to evaluate certain personal aspects of an individual for the purpose of analyzing or predicting aspects of his or her personal circumstances, behaviors or abilities. The processing must be fair and transparent, use appropriate mathematical or statistical procedures, employ appropriate controls to minimize inaccuracies, and protect personal data.
We do not use automated individual decision making
Right to erasure ("right to be forgotten"): You can ask us to delete information we hold about you when it is no longer necessary for the purposes for which it was collected; when you withdraw any consent you have given to its processing; when you object to our processing it (see above); or when our processing is unlawful. But please note that we are subject to certain legal obligations that prevent us from immediately deleting all of your information. For example, we are required
by law to retain certain data for anti-money laundering purposes for at least five years. However, any data that we are prohibited from deleting will be blocked and, when we are no longer obliged to retain it, it will be deleted.
Right to file a complaint: You have the right to file a complaint with the Spanish data protection supervisory authority, Spanish Data Protection Agency https://www.aepd.es/es .
Changes to this privacy policy
Hoist Finance reserves the right to change the content of this privacy policy at any time. The most current privacy policy will be the version posted on our website. Any changes will be effective from the date the revised version is posted.
This privacy policy was last updated: 18/03/2025
How to contact us
You can contact our Group Data Protection Officer directly at: Data Protection Delegate of Hoist Finance Spain, SL
E-mail: protecciondatos@hoistfinance.com
Address: Avenida de Manoteras 44, 1st floor 28050, Madrid.
