Cookies Use Policy

1. Entity responsible

By way of this notice, Banco Santander S.A., a company registered at the Bank of Spain under registration number 0049, with registered offices at Santander, Paseo de Pereda, 9-12 and the Tax ID Number A-39000013 owner of this website www.santanderx.com (the “Bank” or the “Editor” indistinctly), informs the users of the website (the “Website” and the “Users” or the “User” respectively) about its Cookie Policy, so that they are aware of the cookies that will be used while browsing through the Website and can give their consent to them.

2. What are cookies?

Cookies can be defined as any type of data storage and retrieval device used in the terminal equipment of a user (computer/smartphone/tablet) when browsing the Internet with the purpose of storing information and retrieving information that has already been stored.

Cookies can be installed either directly by the websites visited by the user or by third parties to which the website is related, giving the website knowledge of their activities on the site or on others to which this website is related, for example: the location from which users access the site, connection time, the device used (fixed or mobile), the operating system and browser used, the pages most frequently visited, the number of clicks and data concerning the user's behaviour on the Internet.

For more information on how websites and apps use cookies, click here: https://www.allaboutcookies.org.

3. Personal data protection?

Under certain circumstances, the use of data storage and retrieval devices on recipients' terminal equipment, such as cookies, may involve the processing of personal data. Such data processing shall be deemed legitimate on condition that the users of the Website have given their consent after having been provided with clear and comprehensive information on the use of this data, in particular on the purposes of the data processing, as regards the protection of personal data.

For these purposes, it should be noted that the Cookies Policy (hereinafter, 'Cookies Policy') is complemented by the Privacy Policy of this Website.

4. Types of Cookies used

This website uses the following types of cookies:

4.1. Technical and strictly necessary cookies

These are those cookies inserted by the Publisher that are necessary for the proper functioning of the website or to provide a service requested by the user, respectively. In this sense, personalisation or preference cookies are considered necessary to remember information for the user to access the service with certain characteristics that may differentiate their experience from that of other users, such as the language or the number of results to be displayed in a search.

Technical cookies include, for example, user interface personalisation cookies, those used by the Publisher to monitor traffic and data communication, to identify the session, cookies to share content on social networks, etc.

As established in art. 22.2 of the LSSI, consent is not required for its use.

More detailed information about this type of cookie can be found in the table below:

OWNER (GUEST)	NAME	PURPOSE	LIFE
santanderx.com	nlbi_XXXXXXX	It encapsulates DDoS protection and the Web Application Firewall: Load Balancing Cookie, to ensure that a client's requests are sent to the same origin server.	Session
santanderx.com	OptanonConsent	This cookie is set by OneTrust's cookie compliance solution. It stores information about the categories of cookies the site uses and whether visitors have consented or withdrawn their consent to the use of each category. This allows website owners to prevent cookies from each category from being installed in users' browsers, when consent is not given. The cookie has a normal lifespan of one year, so returning visitors will remember their preferences. It does not contain information that can identify the site visitor.	One year
santanderx.com	visid_incap_XXXXXX	Incapsula DDoS Protectiona and Web Application Firewall: Cookie to link certain sessions to a specific visitor (visitor representing a specific computer). In order to identify customers who have already visited Incapsula.	One year
santanderx.com	OptanonAlertBoxClosed	This cookie is set by websites that use certain versions of OneTrust's cookie compliance solution. It is installed after visitors have seen a cookie information notice and, in some cases, only when they actively close the notice. Allows the website to not display the message more than once to a user. The cookie lasts for one year and does not contain any personal information.	One year
santanderx.com	incap_ses_*	Incapsula DDoS Protectiona and Web Application Firewall: cookie to link HTTP requests to a certain session (AKA visit). Reopening the browser and accessing the same site are recorded as different visits. To maintain existing sessions (i.e. the session cookie).	Session
sso.santanderx.com	AUTH_SESSION_ID_LEGACY	This is a user login cookie that serves to keep the user logged in across multiple sessions.	Session
sso.santanderx.com	mboxEdgeCluster	This cookie is associated with Adobe Target and is used to communicate the correct edge cluster to at.js, so that Target profiles can be kept in sync as users navigate the site.	Session
santanderx.com	First-login	This cookie is used to detect the first login of a new user.	A few seconds
sso.santanderx.com	KC_AUTH_SESSION_HASH	This cookie stores a hash of the authentication session state. It is used to verify the integrity of the session and detect changes or tampering.	A few seconds

- From third parties:

OWNER (GUEST)	NAME	PURPOSE	LIFE
doubleclick.net	Test_cookie	This cookie is used by DoubleClick to verify that the user's browser supports cookies.	A few seconds
universia.net	visid_incap_xxxxxxx	This cookie is used to link certain sessions to a specific visitor (a visitor representing a particular computer). It is used to identify customers who have already visited Incapsula.	One year.
twitter.com	__cf_bm	This cookie is part of Cloudflare's bot management service and helps manage incoming traffic that matches the criteria associated with bots.	A few seconds
universia.net	nlbi_XXXXXXX	This cookie is part of Incapsula's web application firewall and therefore has a security function. Its specific function is load balancing, ensuring that requests from a client are sent to the same origin server.	Session
t.co	__cf_bm	This cookie is part of Cloudflare's bot management service and helps manage incoming traffic that matches the criteria associated with bots.	A few seconds
universia.net	incap_ses_xxxxxxxxxxxxxxxx	This cookie is used to link HTTP requests to a certain session (also known as a visit). When you close and reopen your browser and access the same site again, they are recorded as different visits. Its purpose is to maintain existing sessions (i.e. it is a session cookie).	Session
youtube.com	__Secure-xxxxxxx	This cookie helps detect fraud and abuse. It' s based on the user's activities on other devices where they sign in with their Google Account.	5 months

4.2. Analytical or Performance Cookies

These cookies can be their own or third-party cookies and allow the Publisher to monitor and analyse the behaviour of users when they browse the Website or use its services. Thanks to them, the Publisher can know which pages are the most or least visited, how visitors navigate the site and analyse the navigation, allowing it to make improvements based on the analysis of this usage information. The information that is handled does not allow the user to be uniquely identified.

Among the analytical cookies used on this website are GOOGLE ANALYTICS cookies. GOOGLE ANALYTICS is a web analytics service provided by Google Ireland. Specifically, the use of Google Analytics allows the Publisher to monitor how visitors use the Website, compile reports and help improve the Website.

If you consent to the installation of web analytics or performance cookies on your device, please note that GOOGLE ANALYTICS cookies will be installed. The installation of these cookies may involve Google Ireland carrying out international data transfers to the United States, which could mean, in very isolated and specific cases, access to the data by the authorities of this country in the development of investigative and national security tasks. However, in line with our high standards of privacy compliance, we inform you that Google Ireland and its subcontractors in the United States are entering into the Standard Contractual Clauses approved by the European Commission on June 4, 2021 as a guarantee mechanism recognized by the GDPR with the aim of preserving the security of data that may be subject to an international transfer. We also take additional steps to protect the confidentiality and integrity of personal information.

More detailed information about this type of cookie can be found in the table below:

OWNER (GUEST)	NAME	PURPOSE	LIFE
santanderx.com	_hjSession_xxxxxx	A cookie that contains the data of the current session. This ensures that subsequent requests within the session window will be attributed to the same Hotjar session.	A few seconds
santanderx.com	_gclxxxx	Google Conversion Tracking Cookie.	Three months
santanderx.com	_gid	It is a cookie used by Google Analytics that enables the unique visit control function. The first time a user enters the website through a browser, this cookie will be installed. When this user re-enters our website with the same browser, the cookie will consider them to be the same user. Only in the event that the user changes browsers, Google analytics will consider them as another user. It is used to collect information from website usage statistics without personally identifying visitors.	One day
santanderx.com	_hjSessionUser_xxxxxx	A Hotjar cookie that is set when a user first enters a page using the Hotjar script. It is used to persist the Hotjar user ID, unique to that site in the browser. This ensures that behavior on subsequent visits to the same site will be attributed to the same user ID.	One year
santanderx.com	_ga	This cookie is used to distinguish unique users by assigning a randomly generated number as a customer identifier. It's included in each page request for a site and is used to calculate visitor, session, and campaign data for site analytics reports. By default it is set to expire after 2 years, although this is customizable by website owners.	Two years
santanderx.com	_hjTLDTest	When the Hotjar script runs, we try to determine the path of the more generic cookie to use, rather than the hostname of the page. This is done so that cookies can be shared across subdomains (where applicable). To determine this, we try to store the _hjTLDTest cookie for different URL substring alternatives until it fails. After this check, the cookie is deleted.	Session
Santanderx.com	_ga_xxxxxxxxxx	It is used to distinguish users.	One year
santanderx.com	_ga_ABCDE	This cookie is used by Google Analytics to identify and track an individual session with your device.	One year
sso.santanderx.com	_ga_xxxxxxxxxx	This cookie is used by Google Analytics to identify and track an individual session with your device.	One year
www.santanderx.com	_ga_ABCDE	This cookie is used by Google Analytics to identify and track an individual session with your device.	One year
app.santanderx.com	_ga_xxxxxxxxxx	This cookie is used by Google Analytics to identify and track an individual session with your device.	One year

4.3. Personalisation or Functional Cookies

These cookies allow the website to provide better functionality and personalization. They may be set by the Publisher or by third parties.

More detailed information about them can be found in the table below:

- Own:

HOLDER (GUEST)	NAME	PURPOSE	LIFE
www.santanderx.com	___utmvxxxxxxxxxxxxxx	This is a cookie that, in the case of using the user-defined report in Google Analytics and having coded something on your site for personalized segmentation, will be installed on the user's computer, so that Google Analytics will know how to classify that visitor.	A few seconds
App.santanderx.com	___utmvxxxxxxxxxxxxxx	This is a cookie that, in the case of using the user-defined report in Google Analytics and having coded something on your site for personalized segmentation, will be installed on the user's computer, so that Google Analytics will know how to classify that visitor.	A few seconds
sso.santanderx.com	___utmvxxxxxxxxxxxxxx	This is a cookie that, in the case of using the user-defined report in Google Analytics and having coded something on your site for personalized segmentation, will be installed on the user's computer, so that Google Analytics will know how to classify that visitor.	A few seconds
santanderx.com	mbox	This cookie is used by Adobe Target to generate dynamic content in an on-page marketing box. It contains the following values: PC ID – identifier of the visitor's browser. It is deleted when the cookie is deleted. Session ID – a unique identifier for the user's session. Verification – check if cookies are enabled. It is set on each page load.	A few seconds
assets.santanderx.com	at_check	This cookie is used by Adobe Target to check whether cookies are enabled or compatible with your browser.	A few seconds
santanderx.com	at_check	This cookie is used by Adobe Target to check whether cookies are enabled or compatible with your browser.	Session

- From third parties:

OWNER (GUEST)	NAME	PURPOSE	LIFE
twitter.com	Personalization_ld	This cookie tracks activities on and off Twitter to provide a personalized experience.	2 years
doubleclick.net	IDE	This cookie allows content to be displayed that is tailored to the user's preferences.	One year
youtube.com	VISITOR_INFO1_LIVE	This cookie contains a unique ID that Google uses to remember your preferences and other information, such as your preferred language, the number of search results you want to be displayed per page, and is also used to detect and resolve problems with the service.	5 months

4.4. Advertising or Targeted Cookies

These are cookies that store information on users' behaviour obtained through the continuous observation of their browsing habits or their behaviour when they use the Website's services, which allows a specific profile to be developed in order to show them advertising based on it. They also allow the Editor to make improvements based on the analysis of the data. The information that is handled does not allow the user to be uniquely identified. They may be inserted into the Website either by the Publisher or by a third party.

More detailed information about them can be found in the table below:

- Own:

OWNER (GUEST)	NAME	PURPOSE	LIFE
santanderx.com	_fbp	A cookie used by Facebook to deliver a range of advertising products, such as real-time offers from third-party advertisers.	Two months
santanderx.com	_gcl_au	This cookie is used by Google AdSense to test the effectiveness of advertising on different websites that use its services.	Two months

- From third parties:

OWNER (GUEST)	NAME	PURPOSE	LIFE
linkedin.com	li_gc	This domain is owned by LinkedIn, the business networking platform. It typically acts as a third-party host where website owners have placed one of their content sharing buttons on their pages, although their content and services can be embedded in other ways. Although these buttons add functionality to the website they are on, cookies are set regardless of whether or not the visitor has an active profile on Linkedin, or whether they agree to its terms and conditions. For this reason, it is classified as a crawling/destination domain primarily.	Two years
linkedin.com	Lidc	This domain is owned by LinkedIn, the business networking platform. It typically acts as a third-party host where website owners have placed one of their content sharing buttons on their pages, although their content and services can be embedded in other ways. Although these buttons add functionality to the website they are on, cookies are set regardless of whether or not the visitor has an active profile on Linkedin, or whether they agree to its terms and conditions. For this reason, it is classified as a crawling/destination domain primarily.	One day
linkedin.com	bscookie	This domain is owned by LinkedIn, the business networking platform. It typically acts as a third-party host where website owners have placed one of their content sharing buttons on their pages, although their content and services can be embedded in other ways. Although these buttons add functionality to the website they are on, cookies are set regardless of whether or not the visitor has an active profile on Linkedin, or whether they agree to its terms and conditions. For this reason, it is classified as a primary target/crawl domain.	Two years
Youtube,com	VISITOR_PRIVACY_METADATA	It is a YouTube cookie that is used in the context of visitor privacy on websites. It is used to store information about the visitor's privacy settings, such as whether they have accepted or declined the use of cookies or whether they have opted out of tracking.	5 months
youtube.com	YSC	YouTube is a Google-owned platform for hosting and sharing videos. YouTube collects user data through videos embedded on websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors on a wide range of its own and other websites.	Session
twitter.com	guest_id_marketing	This domain is owned by Doubleclick (Google). The main business activity is: Doubleclick is Google's real-time advertising exchange.	One day
twitter.com	guest_id_ads	This domain is owned by Twitter. The main business activity is: Social Media Services. When Twitter acts as an external host, it collects data using a variety of plugins and integrations, which are primarily used for tracking and targeting.	One year
doubleclick.net	receive-cookie-deprecation	This cookie is used as a unique identifier to track video viewing.	Five months
doubleclick.net	ar_debug	This cookie allows content to be displayed that is tailored to the user's preferences.	One year
twitter.com	guest_id	This cookie is used to identify users who access Twitter without logging in (unauthenticated users). Twitter assigns a unique identifier to each visiting browser and stores it with this cookie.	One year
t.co	Muc_ads	This is a cookie set by twitter.com. It is used to optimize the relevance of advertisements by collecting browsing data from visitors.	One year

5. What is the legal grounds for the use of cookies?

Except in the case of strictly necessary technical cookies that do not require the User's informed consent to be used, the Publisher will only install cookies on the User's computer with the User's prior informed consent. In this regard, users may give their consent either by clicking on the 'Accept all cookies' button or by adjusting the settings for those cookies that the user freely chooses to accept via the cookie settings panel that the Publisher has made available to them when they first access the Website or App.

6. Can you withdraw your consent?

Once the cookies have been installed, users may withdraw their consent and delete them at any time. To do so, users can:

Use the content and privacy settings available in the browser you are using to browse the website. The following are some examples of procedures for withdrawing consent and deleting cookies, depending on the browser used:

Reconfigure the cookies accepted via the cookie settings panel that the Publisher makes available to you at all times and which you can access via the following link.

7. Update to the Cookies Policy and contacts

This Cookies Policy may change depending on the cookies used. In the event that new types of cookies are included for which informed consent is required, the Publisher will duly inform the User and seek their consent.

Without prejudice to the previous paragraph, the Publisher recommends that you review this policy each time that you access our website so that you are properly informed about how and for what purpose we use cookies and are aware of any changes in the type of data collected.

If the User has any questions about the Website's Cookie Policy, they can contact the Publisher via the following Contact form, indicating 'Cookies Policy' in the subject field.