Personal Data Protection Policy

For the purposes of the General Data Protection Regulation ("GDPR") and the European and Portuguese legislation on the protection of personal data, Banco Bilbao Vizcaya Argentaria S.A. - Portugal Branch, with corporate address at Avenida da Liberdade 222, 1250-148 Lisbon (hereinafter referred to as "BBVA"), the permanent representative of Banco Bilbao Vizcaya Argentaria SA, with headquarters at Plaza San Nicolás 4, 48005 Bilbao - Spain, furnishes this Privacy Policy to inform users (hereinafter referred to as the "User" or "Users") of the bbva.pt website (hereinafter referred to as the "Website") of its protection policy for the personal data collected from Website Users so that they may freely and voluntarily decide whether to provide BBVA any personal data that may be required of them or obtained from them when accessing and using the Website.

The only personal data that BBVA will have access to through the Website will be that which the User voluntarily provides. This data will be processed in accordance with the provisions of the General Data Protection Regulation ("GDPR"). In this regard, it is necessary that the User understands that, in order for certain services to be provided through the Website, he or she must give the requested personal data. In terms of the specific data expressly indicated as such, if the User does not provide them, he or she will not be able to access or use the corresponding services and contents.

In accordance with current legislation, BBVA expressly states that it has taken all necessary technical and organizational measures to ensure the security and integrity of the processed personal data, as well as to prevent its possible loss, alteration, and/or access by unauthorized third parties.

In accordance with the provisions of the GDPR, BBVA hereby describes how we use the personal data provided by the User:

1.1. Data Collection on the Website

The personal data that collected from the User provides on the Website will be entered into a personal data file owned by BBVA, the personal data controller responsible for processing the User's personal data.

At the time of collection of the data on the Website, the User provides a series of data to BBVA that will be processed in order to provide access to the services and products offered by BBVA. The legal basis for such data processing is the fulfillment and eventual development of the contractual relationship with the User.

1.2. Business goals

BBVA also intends to:

iii. Communicate any BBVA promotional or advertising initiative regarding its products or services similar to those already transacted with the User.

iv. Get to know the User better and customize the promotional and advertising initiatives destined for him or her, as follows:

- BBVA also wants to make the customer experience as satisfying as possible through a personalized relationship tailored to the User's customer profile and needs. To achieve this, it will be necessary to evaluate the products and services contracted or sold by BBVA, its operations – payments, deposits, transfers, debits, receipts –, and the use of BBVA's products, services, and channels, as well as its financial performance. We will use statistical and classification methods to correctly configure the User's profile. Thanks to this analysis, we can get to know the User better and assess new features, products, and services that we believe match his or her profile (own or marketed by BBVA), as well as personalized offers with prices that are adjusted accordingly.

1.3. Improve the quality of BBVA's products and services:

We will use the User's information anonymously, without any identifying characteristics, to increase his or her customer satisfaction, meet his or her expectations, improve our internal procedures, improve the quality of existing products and services, develop new own or third-party products and services and carry out statistics, surveys, actuarial calculations, averages and/or market studies that may be of interest to BBVA or third parties.

1.4. Service relationship management and compliance with obligations

i. BBVA also processes personal data to comply with the contractual obligations assumed with the User or, if acting on behalf of a company, with the company the User represents, in order to respond to queries, requests, or complaints, as well as to manage and expedite the Company's relationship with the customer.

ii. Comply with the following obligations under applicable law: measures preventing money laundering and terrorist financing; Banco de Portugal warnings and instructions and letters to the European Banking Authority (EBA); communications to the Credit Risk Registry of Banco de Portugal; standards and/or communications from the CMVM (Securities Market Commission) and Euronext S.A.; requirements from the Markets in Financial Instruments Directive (MiFID II); measures to combat organized crime; measures imposed by the National Data Protection Commission; legal framework governing check without provision; use of video surveillance cameras; and any other obligations that may legally arise.

iii. Communicate the User's data to BBVA S.A. (Spain) for centralized management of his or her contractual relationship with BBVA.

iv. Conduct internal audits and undertake fraud prevention measures to assess and improve the effectiveness of BBVA's risk management, control, and governance processes.

1.5. Additional Purposes

BBVA may process the User's personal data for additional purposes not related to the management of his or her contractual relationship as specified below and provided consent has been given:

i. Should the User act on behalf of a company, and said company does not formalize any contract with BBVA, the personal data provided may be kept in order to control and manage any future requests;

ii. Should the User act on behalf of a company, and said company does not formalize any contract with BBVA, it may communicate any BBVA promotional or advertising initiative;

iii. Communicate the User's data to group companies dedicated to the overall management of the contractual relationship; pension and investment fund management; insurance activities; specialized consumer and trade credit or credit in partnership with companies dedicated to mortgage lending, insurance activities, or others that bring financial or non-financial benefits and advantages; so that these may inform the User of their promotional or advertising initiatives. Where the User gives his or her authorization, BBVA will process the personal data for the purpose of sending him or her, by any means – including by electronic means – offers and promotions for products or services offered by BBVA Group companies. These companies may be consulted here.

The following are the legal bases justifying the processing of the User's personal data:

i. BBVA's legitimate interest in the fulfillment and development of the contractual relationship with the customer, which allows BBVA to use the contacts made available to it to promote its own products and services similar to those already transacted. This way, BBVA can get to know the customer better, customize the promotional and advertising initiatives that are addressed to him or her, and improve the quality of its products and services. Whenever the User provides us with personal data and does not agree with the processing of his or her personal data for these purposes, he or she should select the corresponding text boxes contained in the Data Protection Policy provided.

ii. Compliance with obligations under applicable law.

iii. The User's consent, if given to us through the corresponding boxes contained in the Data Protection Policy, for the following purposes:

- Communicating the User's data to Group companies dedicated to the overall management of the contractual relationship; pension and investment fund management; insurance activities; specialized consumer, trade, and car rental credit or credit in partnership with companies dedicated to offering mortgage loans, insurance and other activities that provide advantages and benefits; so that these companies may inform the User about their promotional or advertising initiatives through SMS, email, telephone calls, and postal mail.

- If acting on behalf of a company, safeguarding the User's personal data, even if the company that he or she represents does not formalize any contract with the Company, for the purpose of communicating any promotional or advertising initiative.

BBVA hereby informs the User that it is mandatory to collect the data necessary for requesting the services available through the Website, except where indicated that said data is optional.

The User is responsible for the truthfulness and accuracy of the personal data submitted; BBVA reserves the right to exclude any User who has provided false information from the registered services, without prejudice to other actions that are permitted by Law. In no case shall the User register on the Website with third party data.

In the event of any modification of the data, BBVA requests that Users report such changes as soon as possible in order to keep this data updated. In this sense, the User undertakes to provide correct information as it concerns their personal data.

Personal data will not be transferred to third parties unless there is a legal provision to do so, if it is a necessary requirement for compliance with the contract, or if we obtain the User's consent.

In this regard, BBVA may communicate the User's personal data to the following addressees and in accordance with their legal basis:

1. BBVA Group Companies:

• BBVA, S.A. (Spain) – legitimate interest;

• BBVA Fundos – Sociedade Gestora de Fundos de Pensões, S.A. – consent;

• BBVA Seguros – Sociedade Anónima de Seguros y Reseguros – Portugal Branch – consent;

• BBVA Automercantil – Comércio e Aluguer de Veículos Automóveis, Lda. – consent;

• BBVA IFIC – Instituição Financeira de Crédito, S.A. – consent.

2. Companies with which BBVA establishes partnerships and which may bring financial and non-financial advantages, in the event consent is obtained, such as:

• Companies specializing in mortgage lending.

• Insurance companies.

• Companies with benefit and incentive-based savings and loyalty programs.

n addition, in order to manage the relationship we have with the User or the customer the User represents, when acting on behalf of a company, we hereby inform that the categories of companies listed here, who provide services to BBVA, may handle personal data on behalf of BBVA.

Only persons over the age of 18 with full legal capacity to act on their own behalf may register on the Website. BBVA reserves the right to verify the age of Users at any time and may exclude them if it finds that the User is a minor.

Free text fields may appear on the Website. These could be forms, evaluations, observations, etc., and are made available to the User for the sole and exclusive purpose of gathering information to improve the quality of services.

In the event that the User, through his or her comments, provides data on ideology, beliefs, religion, union affiliation, health, sexual life or race, which are in no case requested by BBVA, the delivery of his or her data implies that he or she expressly consents to BBVA's processing thereof.

We retain the User's personal data for the duration of the contractual relationship and, if on behalf of a company, for the duration of the contractual relationship between the company the User represents and BBVA.

Once the contractual relationship is finalized, we will keep the User's data for a maximum of 10 years.

Should the User act on behalf of a company, and said company does not formalize any contract with BBVA, we retain the personal data for a period of 1 year following the last contact with the customer, in order to control and manage any future requests.

In addition, to manage the relationship we have with the User or the customer he or she represents, if acting on behalf of a company, we hereby provide information on other retention periods for the purposes listed here.

BBVA guarantees the User's rights of access, rectification, suppression, opposition, limitation of processing and portability, as well as revocation of the granted consents. In order to exercise these rights, he or she must send a written request to the following email address: protecaodados.pt@bbva.com. The User must indicate his or her full name and the right he or she wishes to exercise, along with a copy of an identification document proving identity. In addition, the User may contact the BBVA Data Protection Officer at dpo.pt@bbva.com.

On the other hand, if the User considers that a breach of data protection law has been committed with regard to the processing of his or her personal data, he or she may file a complaint with the National Data Protection Commission at www.cnpd.pt.