Global Banker Executive Director

BBVA
CCPA Notice at Collection and
Privacy Policy

Last updated date: April 04, 2023

Effective Date: January 1, 2023

The following California Consumer Privacy Act and California Privacy Rights Act
(“CCPA/CPRA”) Notice at
Collection and Privacy Policy shall not apply to the collection, processing, sale or
disclosure of any information
(i) that a consumer provides to us to obtain a financial product or service from us, or (ii)
about a consumer
resulting from any transaction involving a financial product or service between us and the
consumer; or (iii) we
otherwise obtain about a consumer in connection with providing a financial product or
service to that consumer.

To better understand your rights in respect of any such information excluded from the
following CCPA/CPRA
Notice at Collection and Privacy Policy, please instead reference the CIB BBVA Privacy page,
which you may
visit at the following web link: https://www.bbvacib.com/personal-data-protection".

This NOTICE AT COLLECTION AND PRIVACY POLICY FOR CALIFORNIA RESIDENTS supplements
the information
contained in the Consumer Privacy Disclosure of Banco Bilbao Vizcaya Argentaria, S.A. (“BBVA
S.A.”) and each of the
following affiliates of BBVA S.A.: Banco Bilbao Vizcaya Argentaria, S.A. New York Branch; BBVA
Securities Inc.; and
Banco Bilbao Vizcaya Argentaria, S.A. San Francisco Representative Office (collectively, “we,”
“us,”, “our”, or “BBVA”) and
applies solely to residents of the State of California (“consumers” or “you”). We adopt this
statement to comply with the
California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020
(“CCPA/CPRA”), as amended from
time to time, and other California privacy laws. Any terms defined in the CCPA/CPRA have the
same meaning when used
in this statement. For California residents, the provisions of this Notice at Collection and
Privacy Policy prevail over any
conflicting provisions of the BBVA Consumer Privacy Disclosure and/or the BBVA Online Privacy
Policy.

Information We Collect

We collect information that identifies, relates to, describes, references, is
reasonably capable of being associated with, or
could reasonably be linked, directly or indirectly, with a particular consumer or household
subject to the CCPA/CPRA
(“Personal Information”). Some examples of Personal Information which BBVA has collected from
consumers are listed
below; note however, that this may not be an exhaustive list.

Personal Information does not include:

• Publicly available information from government records.


• De-identified or aggregate consumer information.


• Other information to the extent excluded from the CCPA/CPRA's scope, such as:
  
  
  
  • Personal Information covered by certain sector-specific privacy laws,
    including the Fair Credit Reporting
    Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the Family Educational Rights and
    Privacy Act, or
    California Financial Information Privacy Act (CalFIPA), and the Driver's Privacy
    Protection Act of 1994;
  
  
  • health or medical information that constitutes clinical trial data or
    that is otherwise covered by the Health
    Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information
    Technology for
    Economic and Clinical Health Act (HITECH), or the California Confidentiality of
    Medical Information Act
    (CMIA);
  
  
  
  

Sources of Personal Information

With respect to each of the categories of Personal Information listed in the table above, we
obtain such Personal
Information from a variety of sources, including from:

• In the event that our customers provide beneficial owners' personal
  information, it will be the
  responsibility of that customer to communicate the contents of this notice at collection
  to them.

Use of Personal Information

With respect to each of the categories of Personal Information listed in the table above, we may
use or disclose such
Personal Information for any one or more of the following business purposes:

• To provide you with information, products or services that you request from
  us;


• To provide you with email alerts, event registrations and other statements
  concerning our products or services;


• To carry out our obligations and enforce our rights arising from any contracts
  entered into between you and us,
  including for billing and collections;
  


• To detect and protect against security incidents, and malicious, deceptive,
  fraudulent or illegal activity, and
  prosecute the same;


• To debug to identify and repair errors in our systems;


• As otherwise necessary or appropriate to protect the rights, property or
  safety of our business, our employees, our
  customers, consumers, or other natural persons;


• To respond to law enforcement requests and as required by applicable law,
  court order, or governmental
  regulations;


• For such purposes as may be necessary or appropriate in connection with audits
  and reporting relating to
  particular transactions and interactions, including online interactions, you may have with
  us or others on our
  behalf;


• To improve and maintain the quality of our website, applications, products,
  services, and content;


• For testing, research, analysis and product development;


• For short-term, transient use, including but not limited to, contextual
  customization of advertisements;


• To evaluate or conduct a merger, divestiture, restructuring, reorganization,
  dissolution, or other sale or transfer of
  some or all of BBVA ’s assets, including, but not limited to, as part of a bankruptcy,
  liquidation, or similar
  proceeding, in which Personal Information of consumers held by BBVA among the assets
  transferred; and/or


• As otherwise described to you when collecting your Personal Information or as
  otherwise set forth in the
  CCPA/CPRA.

Sharing Personal Information

With respect to each of the categories of Personal Information listed immediately below, we may
disclose such Personal
Information to a third party for a business purpose. When we disclose Personal Information for a
business purpose, we
enter a contract that describes the purpose and requires the recipient to both keep that
personal information confidential
and not use it for any purpose except performing the contract.

In the preceding twelve (12) months, we have disclosed the following categories of Personal
Information for each of the
business purposes identified above:

Category A: Identifiers

Category B: California Customer Records Personal Information categories

Category C: Protected classification characteristics under California or federal law

Category D: Commercial information

Category E: Biometric Information

Category F: Internet or other similar network activity

Category G: Geolocation Data

Category H: Sensory Data

Category I: Professional or employment-related information

Category J: Education information

Category K: Inferences drawn from other Personal Information

With respect to each of the categories of Personal Information listed immediately above, we may
disclose such Personal
Information for a business purpose to the following categories of third parties:

• Our affiliates and subsidiaries


• Service providers


• Federal, state, or regulatory agencies or organizations with oversight over
  BBVA


• Such third parties as you may authorize us, directly or indirectly, to
  disclose your personal information

In the preceding twelve (12) months, we have not sold (as that term is defined by the CCPA/CPRA)
any Personal
Information that we have collected.

Your Rights and Choices

The CCPA/CPRA provides consumers (California residents) with specific rights regarding their
Personal Information. This
section describes your CCPA/CPRA rights and explains how to exercise those rights.

Rights to Know and Access to Specific Information and Your Data
Portability Rights

You have the right to request that we disclose certain information to you about our collection
and use of your Personal
Information over the past 12 months. Once we receive and verify your consumer request, we will
disclose to you:

• The categories of Personal Information we have collected about you.


• The categories of sources for the Personal Information we have collected about
  you.


• Our business or commercial purpose for collecting such Personal Information.
  


• The categories of third parties with whom we share such Personal Information.
  


• The specific pieces of Personal Information we collected about you (pursuant
  to a data portability request).


• If applicable, whether we sold or disclosed your Personal Information for an
  identified business purpose, along
  with two separate lists disclosing:
  
  
  
  • the categories of Personal Information about you that we have sold
    within the meaning of the
    CCPA/CPRA and the categories of third parties to whom the Personal Information was
    sold; and
  
  
  • the categories of Personal Information about you that we disclosed for
    a business purpose.
  
  
  
  

Right to Limit

You have the right to request that we limit the use and disclosure of any of your sensitive
Personal Information, pursuant
to Civil Code section 1798.121 subdivision(a), which we have collected from you and retained,
subject to certain
exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and
direct our service
providers to delete) your Personal Information from our records, unless an exception applies,
due to regulatory or
operational requirements (e.g., in accordance with the provision of services to you).

Right to Correct

You have the right to request that we correct any inaccurate Personal Information that we
maintain about you as set forth
in Civil Code section 1798.106.

Deletion Request Rights

You have the right to request that we delete any of your Personal Information that we have
collected from you and
retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer
request, we will delete (and
direct our service providers to delete) your Personal Information from our records, unless an
exception applies, due to
regulatory or operational requirements (e.g., in accordance with the provision of services to
you or applicable law).

Rights to Opt Out of the Sale/Sharing of Personal Information

You have the right to request that we do not sell any of your Personal Information. As noted
above, we do not sell
Personal Information of California residents.

You have the right to request that we limit or do not share any of your Personal Information.
Please note, we only use or
share Personal Information of California residents for the purposes identified in CPRA § 7027(m)
(“Permissible Purposes”)
and only as necessary and proportionate for such Permissible Purposes.

Right to No Retaliation following the Exercise of Your Rights

We cannot deny goods or services, charge you different prices or rates, including through
granting discounts or other
benefits, or imposing penalties, or provide a different level or quality of goods or services
because you exercised your
rights under the CCPA/CPRA; however, if you refuse to provide your personal information to us or
ask us to delete your
personal information, and that personal information is necessary for us to provide you with
goods or services, we may not
be able to complete the applicable transaction(s).

Pursuant to the CCPA/CPRA, from time to time, we may offer you promotions, discounts and other
deals in exchange for
collecting or keeping your personal information. You may ask us to delete or stop selling your
personal information, but
you may not be able to continue participating in the special deals we offer in exchange for
personal information. If you are
unsure of how your request may affect your participation in a special offer, please ask your
Relationship Manager.

Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a
request to us by:

• Sending an email to privacy.us@bbva.com

The verifiable consumer request must:

• Provide sufficient information to allow us to reasonably verify you are the
  person about whom we collected
  Personal Information or an authorized representative.


• Describe your request with sufficient detail to allow us to properly
  understand, evaluate, and respond to it.

Only you or a person who you authorize to act on your behalf may make a verifiable consumer
request related to your
Personal Information. Under California law, you may designate an authorized agent to make a
request on your behalf.
Your agent may be subject to the same verification procedures that we use to verify consumers
who do not currently have
a relationship with us. Additionally, we may require you to verify your own identity in response
to a request, even if you
have chosen to use an agent, and ask that you directly confirm to us that you have provided the
authorized agent
permission to make a request on your behalf. The foregoing shall not apply if you have provided
your authorized agent
with a power of attorney pursuant to Probate Code sections 4121 to 4130 and either you or your
agent are able to provide
us with a copy of such document.

Only you or a person who you authorize to act on your behalf may make a verifiable consumer
request related to your
Personal Information. Under California law, you may designate an authorized agent to make a
request on your behalf.
Your agent may be subject to the same verification procedures that we use to verify consumers
who do not currently have
a relationship with us. Additionally, we may require you to verify your own identity in response
to a request, even if you
have chosen to use an agent, and ask that you directly confirm to us that you have provided the
authorized agent
permission to make a request on your behalf. The foregoing shall not apply if you have provided
your authorized agent
with a power of attorney pursuant to Probate Code sections 4121 to 4130 and either you or your
agent are able to provide
us with a copy of such document.

The verifiable consumer request must:

Verifying Your Request

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority
to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not
require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request
to verify your identity or authority to make the request. We may otherwise limit our response to your request as permitted
under applicable law.

Whenever feasible, we will match the identifying information provided by you to the Personal Information we maintain, or
use a third-party identity verification service that complies with the CCPA/CPRA. However, if we cannot verify your identity
from the Personal Information that we maintain, we may request additional information from you, including, inter alia, that
you submit a signed declaration under penalty of perjury that you are the consumer whose personal information is the
subject of your request. Any additional information so submitted shall only be used for the purposes of verifying your
identity.

If we have a good faith, reasonable, and documented belief that a consumer request made by you or on your behalf by an
agent is fraudulent or abusive, we may deny the request. In such an event, we will inform you of the denial and provide an
explanation.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within 45 calendar days of its receipt. If we require more time
(up to 90 calendar days), we will inform you of the reason and extension period in writing. We will deliver our written
response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot
comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal
Information that is readily usable and should allow you to transmit the information from one entity to another entity without
hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or
manifestly unfounded. As such, if we determine that the request warrants a fee, we will tell you why we made that
decision and provide you with a cost estimate before completing your request.

If we deny your request in whole or in part, we shall explain the basis for denial, including any conflict with federal or state
law, exception to the CCPA/CPRA, inadequacy in the required documentation, or contention that compliance proves
impossible or involves a disproportionate effort with sufficient details to provide you with a meaningful understanding.

Changes to Our Notice at Collection and Privacy Policy

We reserve the right to amend this privacy statement at our discretion and at any time in accordance with applicable law.
When we make changes to this privacy statement, we will notify you through a statement on our website homepage.

If you use assistive technology and the format of this privacy statement interferes with your ability to access information,
please contact us at privacy.us@bbva.com. To enable us to respond in a manner most helpful to you, please indicate the
preferred format in which to receive the material and your contact information.

Contact Information

If you have any questions or comments about this statement, the ways in which we collect and use your Personal
Information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do
not hesitate to contact us at:

Website: https://www.bbvacib.com/personal-data-protection.

Email: privacy.us@bbva.com