Customer Protection

Personal Data Protection

The Personal Data Protection Policy defines the criteria that must be observed by all employees at Grupo Financiero Santander México as part of their activities to prevent, manage and control compliance risks regarding personal data protection that could affect Santander Mexico. Furthermore, it establishes the criteria that the Bank must establish in order to assure proper risk management measures for data protection compliance.

Our responsibility as a financial institution is to comply with data security standards in order to safeguard the personal data and sensitive information of our customers.

It is becoming more and more necessary to have data privacy and protection laws, which is why, through our Data Security Incident Management Policy and Privacy Notice, we ensure the proper handling of our customers’ information, as well as providing them with opportune information about their rights.

Furthermore, to consolidate personal data protection measures for our customers, we have implemented the following actions:

• • The creation of compliance areas within the Bank to identify the parties responsible for personal data protection.
• • The classification of information and the creation of data inventories for the information being used.
• • The creation of training manuals and courses, available to all our employees, that focus on data protection.

Principles of Consumer Protection

Our Consumer Protection Policy stipulates specific criteria to identify, regulate and exercise our customer’s rights in terms of their relationship with us, in addition to stipulating specific compliance supervision and control criteria.

In 2018, we implemented the Principles of the Financial Consumer in our operations to ensure ethical business practices. There are ten indicators in total:

• 1. Transparency in Communication.
• 2. Fair and Respectful Treatment.
• 3. Responsible Pricing.
• 4. Design of Customer-Centric Products and Services.
• 5. Asset Protection.
• 6. Complaint Management.
• 7. Vulnerable Customers.
• 8. Financial Education.
• 9. Responsible Innovation.
• 10. Personal Data Protection.

Our first line of defense has a number of multi-level customer service channels and policies:

• • Social networks.
• • larification.
• • Complaints and Customer Ombudsman.
• • Branches.
• • E-mail.
• • Online banking.

In 2019, and as a second line of defense, the Compliance and Conduct area incorporated the Consumer Protection division, which monitors compliance with these ten indicators that focus on safeguarding the interests of the Bank's customers through ensuring transparency in communication, fair and respectful treatment, and personal data protection.

Through the analysis of quality surveys and social networks, we constantly bolster our methodology of the Ten Principles for the Financial Consumer in order to document the plans of action that help improve customer experiences. During 2020, we recorded an advance of 70%, and we will continue redoubling our efforts to perfect our methodology by establishing risk limits and implement a range of plans of action.

Our goal is to continue generating these indicators on a monthly basis, in addition to ensuring that each of these principles that measure consumer protection remain green, avoiding issues that could become a conduct risk or reputational risk or result in a fine being levied by the authorities.

We continue consolidating our culture of data protection through internal communication campaigns aimed at all employees within the Bank, in addition to promoting the proper use of these indicators to help safeguard our customers’ data at all times.

Cybersecurity

Technologies are becoming more and more ubiquitous in our everyday activities, allowing us to use new tools to facilitate the use and management of our processes, as well as improving communication with our stakeholders.

We firmly believe that technology plays a key role in achieving success and streamlining our processes; however, we are aware of the dangers that exist by using these tools, which is why we strive to bolster our cybersecurity on an on-going basis.

We have a policy that focuses on the technological risks facing Grupo Financiero Santander México (GFSM), and we have implemented good practices to help safeguard data. We raise awareness among employees of the importance and the responsible use of data and the information technologies that are available to them.

The goal of the Cybersecurity Risk Management Policy is to define, identify and manage risks that could compromise information of the web or mobile application assets at GFSM, in order to minimize the risk that these represent. As such, we have implemented a methodology, metrics and specific indicators that govern data security and mitigate the risk of cyberattacks that could have an impact on operations, reputation and electronic fraud.

Furthermore, the Bank has a Cybersecurity Incident Management Policy and a Cybersecurity Incident Response Process and Plan that determine how to respond to a cybersecurity incident. Cybersecurity incidents are detected by Global SOC (Security Operation Center), and a preliminary analysis is undertaken to rule out any false positives.

In the event of a cybersecurity incident, Global SOC sends an alert to the local cybersecurity incident response team and, based on the category of the incident, analysis is then undertaken about whether or not to follow a specific playbook. Stemming from this analysis, the local team can then declare a cyber-incident has occurred and implement the activities outlined in this Cybersecurity Incident Response Process.

Through training sessions, internal communication campaigns and other activities, we raise awareness among our employees of the importance of cybersecurity to help them avoid falling victim to malicious e-mails, calls, text messages or messages via social networks, which is also known as phishing, a tool used by criminals to steal information. The Awareness Program encompasses:

• • Ethical phishing campaigns for all employees (at least four campaigns per year).
• • Hacktober: a web seminar which is part of a continuous training initiative.
• • Cyber Heroes: a cyber security recertification initiative.
• • Corporate communication regarding data security controls, behaviors and external events that focus on cybersecurity.

We have a channel that our employees can use to report any suspicious activity by sending an e-mail to the following e-mail addresses: csirt@santander.com.mx or cybersecurity@gruposantander.com and adding a screenshot.

Events that should be reported include:

• • The theft or loss of information belonging to Santander, Santander IT systems, or personal devices that contain information about Santander, including computers, mobile devices, storage devices and documents.
• • Suspicious phone calls or information requests about Santander.
• • Suspicious external devices connected to computers.
• • Signs of unauthorized access. For example, unexplained pop-up windows or sign-in requests.
• • Extortion or ransom demands that affect technological, services, infrastructure or information systems, or threats to distribute information via the media or other public channels that could affect Santander's reputation.
• • Any e-mail that is suspected of being a phishing scam.

Customer Ombudsman

The opinions of our customers play a fundamental role in helping us improve the services we offer as a financial institution, which is why we have an institutional model to listen to them.

The Customer Ombudsman model has been perfected since it was first implemented more than ten years ago. It is coordinated by third parties, meaning that the conflict resolution process is objective, efficient and transparent.

As a result of the public health crisis, the Customer Ombudsman – which falls under the auspices of the Customer Service area – was force to modify the way in which it operates, focusing now on a remote working model, which is why customers have not been offered face-to-face service, instead focusing on providing support via e-mail and social networks.

*As a result of the COVID-19 pandemic, the Customer Ombudsman started working remotely in March, which is why the 82 reports made via telephone correspond to the months of January and February and the first 13 days of March.
**This area does not include internal and external recommendations, reports channeled to other areas, and social networks, among other avenues.

Business Practices

In a globalized world, the economy and business practices are in a state of constant evolution. In our role as a Responsible Bank, we are firmly committed to society and to the environment, helping to contribute to a better future, which is why we must comply with competitive business practices.

At Santander, we strive every single day to guarantee that our products and services are not only innovative but also sustainable, in addition to ensuring our employees offer the highest levels of service that our customers deserve.

As part of our strategy to engage with our clients, we use responsible marketing and conscious partnerships, in addition to measuring the social and environmental impact of our operations.

Responsible Marketing

Marketing is fundamentally important to any business as it helps ensure that customers are aware of their products and services. As a socially responsible bank, we use marketing help drive the visibility of our social and environmental campaigns, in addition to our commitment to people, companies and the environment in which we operate.

During 2020, we implemented the following measures:

• • Reduction in the amount of printed advertising at branches. As a result of the pandemic, printed materials were kept to a minimum and we incentivized the use of online banking billboards.
• •Suppliers of outdoor advertising use biodegradable inks.
• • Focus on using digital billboards rather than traditional printed ones.

Our 2020 Image and Brand Tracking achieved the following results:

• • Within the top three banks in the Brand Visibility indicator among the eight leading banking brands in the country.
• • Within the top three banks in Top of Mind Advertising Visibility.
• • One of the banks with the lowest levels of rejection among non-customers.
• • In Image indicators for “Simple, Personal and Fair”, Santander is positioned within the top three as a bank that is easy to work with and has flexible and simple processes.

In Image and Positioning indicators regarding brand building, we are positioned within the top three in the following areas:

• • Leading bank.
• • Reliable bank.
• • Innovative bank.

During the pandemic, in accordance with the Global Barometer, our customers perceived us to be:

• • The bank doing the most to help society during the pandemic.
• • An institution that is implementing measures to be able to continue handling customer transactions as usual.

We have seen improved performance in:

• • Security when using credit and debit cards while shopping online.
• • Digital channel experiences (Supermóvil/Supernet).
• • Communication with customers.

Social Networks

The use of social networks as a communication and advertising channel has allowed us to interact with our stakeholders in a constant and active manner. Through Facebook, Twitter and YouTube, we share videos, infographics and news relating to areas such as financial education and data protection, among others, in addition to social campaigns.

As a result of the COVID-19 pandemic, during 2020 we promoted a range of campaigns to help tackle this crisis, including:

• • #YoMeQuedoEnCasa: the first awareness campaign about quarantining in our homes was deployed in March, making us pioneers within the Mexican banking industry regarding COVID-19 communication. We reached 950,854 users.
• • Three-month support programs for customers: this campaign was launched to inform customers of the support available to them as a result of the pandemic. We reached 5,587,175 users.
• • Support for doctors: we donated personal protection equipment and a range of medical supplies to frontline medical workers. We reached 881,603 users.

Campaigns and Sponsorship

In previous years, we have listened to what our customers have had to say and responded by coordinating sponsorship agreements for cultural, sporting or entertainment events; however, as a result of the public health crisis, during 2020 it was impossible for us to focus on any sponsorship. It is a fact that we will continue focusing on the needs and interests of our stakeholders.

New product marketing and transparency

We are aware that ensuring transparency when launching new products is a major challenge, but we are convinced that it is our obligation to inform our customers about the benefits and possible drawbacks.

We have a Local Marketing Committee (CLC) that is tasked with evaluating and mitigating any conduct, reputational and operational risks that may exist during the design, sale and after-sales processes for product marketing. This committee is also responsible for guaranteeing that the products and services comply with market requirements and customer needs.

We also have a Local Product and Service Monitoring Committee, through which we monitor the behavior of approved products and services. In the event that any of these products or services do not comply with the stipulated terms, they are dropped.

We currently have a number of working groups that are developing initiatives that focus on customer opinions and combine processes and products to meet their most recent needs, transforming the concept of how we market products and services by putting our customers before the business and market conditions. One of these initiatives is to create a figure to serve as a focal point for the needs of the Bank’s internal and external customers, in addition to finding solutions to the most deteriorated processes and renewing them, in keeping with the vision of our customers.

All communication with customers must comply with the transparency guidelines established in the laws governing Credit Institutions and Multiple Purpose Financial Institutions, both of which are regulated and supervised by CONDUSEF.

Furthermore, we have established procedures to ensure that all communication is reviewed by Legal and Compliance prior to being published, specifically through the Consumer Protection area, which guarantees that the information communicated to customers is ethical, transparent, legal and in compliance with the criteria contained in the Principle of Transparent Communication, which is contained in Consumer Protection Policy.

During 2020:

• • We focused on creating a service protocol for vulnerable and diverse customers at our branches.
• • We implemented standards of conduct for recovery and collections.
• • We promoted our Compliance channel , through which we focus on providing continuous training to employees in the areas of compliance and conduct.

Customer actions during the COVID-19 pandemic

Debtor Support Programs

We listened to 130,000 of our customers who registered for this support program in order to better understand their emotional and financial situation, in addition to their needs as a result of the pandemic. Through the collaboration of more than 30 areas within the Bank, we successfully handled renewals and collections for this group of customers by implementing communication and management best practices to improve their overall experience.

Branches

As a result of the pandemic, some of our branches throughout the country have been operating intermittently. We work in compliance with the protocols established by the authorities, implementing all necessary hygiene and safety measures. We provided 25,000 sanitizing kits (antibacterial gel, facemasks and a bag) and 100,000 facemasks for employees and customers.

During the pandemic, the service capacity at our branches has been reduced; we started with 50% of our employees being available at the branch, a number that increased gradually until reaching 75%. The goal of this measure was to guarantee the safety of our customers and our employees. We also created a 10X10 service protocol based on the fact that the maximum capacity allowed within the branch at any one time was ten people.

e-SPUG Launch

Another measure employed to mitigate the impact caused by the public health crisis and to support businesses in the country was the launch of an app to make payments immediately without the need for a terminal nor an online payment gateway. It is so simple to use that you only need to have a cellphone or a computer, access the website and sign up, be it with a Santander account or an account from any other bank. Then, e-SPUG generates a payment link that can be shared via any instant messaging app. This process encompasses the highest security measures and allows businesses to make the sales process more agile, in addition to promoting remote sales.