Actions on significant impacts on consumers and end-users and applying approaches to manage significant risks and opportunities related to consumers and end-users, and the effectiveness of these actions (S4‑4), (MDR‑A)

In 2024, we have taken a number of actions to manage significant impacts related to consumers and end users. We are implementing these activities on a continuous basis and will continue and adjust them in future years For more details on ongoing activities and initiatives in the area of consumers and endusers, see subsections S4-1, S4-3.and Chapter VI, “Customer Relations” and Chapter VIII, “Business Development in 2024”.

In accordance with the provisions of the policy, we conduct regular NPS and customer satisfaction attributes surveys for all business segments. Our knowledge about the customer is also enriched by other sources, e.g. additional research on contact channels, analysis of complaints or the customer’s voice in social media.

Based on this information, each of the business segments defines priorities and develops an annual action plan. We identify both positive and negative impacts on clients in order to manage them accordingly. Progress towards customer satisfaction goals is monitored on a quarterly basis including the with the involvement of the Management Board.

The CX policy not only describes the process of managing customer satisfaction in the Bank, but also formalises a set of mandatory customer-centric standards regarding communication and plain language, service across all channels, and research and design of solutions for customers. The role of standards is to continuously improve the quality and consistency of the customer experience, regardless of the communication channel they choose.

As a Group, we have adopted an approach that we call „customer-centricity”. In line with our strategy, we aspire to be a market leader in terms of service quality, focused on the needs and expectations of customers. The standards we have adopted include:

• the „Compass” product and service design standard, which is based on modern customer-centric principles of design,
• the ”Rzecz jasna” (”Clear Thing”) standard of simple communication , which we have implemented both in the process of exchanging information with customers and internally,
• the standard of empathetic service, in which it is increasingly important to combine digital solutions with in-branch customer service.

As part of our commitments to protect human rights in relations with customers and end users, as a Group, we rely on the provisions of the ”General Code of Conduct” and the ”Responsible Banking and Sustainability Policy”. The latter document includes a comprehensive approach to managing issues related to human rights, sustainable development and stakeholder responsibility.

In the period from 1 January to 31 December2024, no incidents of human rights violations were recorded in the Group. The Group has policies in place to manage the impact on the consumer and end-user, including human rights. These processes include responsible sales principles, data protection, and complaint reporting and handling mechanisms – detailed information can be found further down in the statement.

We understand that transparent communication is one of the key elements of effective cooperation with the client. We know how important it is to communicate effectively, have clear rules and regulations and listen to the voice of the customer and learn from them.

In the Group, the standards for communication with customers are defined by:

The Bank is a signatory of the ”Code of Banking Ethics” and the ”Banks’ Declaration on the Plain Language Standard”. We systematically introduce the principles of plain language in contracts and other documents, resulting in their becoming more understandable and readable for customers. When preparing communication, we are guided by the principles of consistency, coherence, transparency and neutrality.

The general rules for preparing and verifying marketing materials are also set out in the ”Handbook of Advertising and Marketing Communication of Santander Bank Polska S.A.”. Detailed standards for a given product group are included in the guidelines developed by the Financial Crime Compliance and Prevention Division. The basic principle is that the marketing material should be reliable, honest, true and written in an understandable and simple language, adapted to the recipient. Before publication, each material is verified to ensure that it meets the standards described in the guidelines. In addition, training and workshops are held periodically for units preparing marketing communication, which strengthen the knowledge and skills of employees.

At the Bank, we are also aware of the fact that customers’ decisions to purchase products are increasingly dictated by the desire to reduce the impact on the environment or to have a positive impact on it. We want to provide customers with reliable and honest information that they can rely on when making purchasing decisions. Therefore, we apply the ”Sustainability Communication and Advertising Guidelines”. We review business projects and new product proposals for greenwashing at an early stage of preparing the offer to make sure that the change does not generate the risk of misleading the customer or greenwashing.

As part of our efforts to improve the quality of communication, the Bank conducts regular language audits to assess the degree of simplicity of the language used in both internal and external communication. The audit is based on the PLI (Plain Language Index), which measures the compliance of the content with the principles of simple and understandable language. We analyse representative samples of texts, including content published on the intranet, formal documents, agreements, responses to complaints and materials available on the Bank’s website. This process identifies areas for improvement, in particular in terms of eliminating banking jargon and using more accessible wording.

These activities are in line with the Bank’s strategy, which is aimed at transparent and friendly communication with customers and improving the experience related to the use of financial products and services.

Due to the nature of our business, we process significant amounts of customer personal data and other confidential and sensitive information. Maintaining standards of customer data security is one of the key areas for us to build trust in the strategic direction of ”Total Responsibility”.

We meet national and EU standards for data protection against cyber threats. The information security management system is certified in accordance with ISO/IEC 27001:2013 and includes supervision over information security in the Group’s business environment and assessment of specific requirements for information and IT systems security.

We monitor regulations and technologies related to IT security and adapt our systems to changing conditions on an ongoing basis. This allows us to continuously improve our internal transaction systems and tools that our clients use on a daily basis.

The security of customer data is our priority, which is why we strive to raise awareness of today’s cyber threats. As a Bank, we conduct regular education campaigns, using various communication channels, including those that reach customers who are less active on the Internet:

Branches are designed and retrofitted according to accessibility guidelines. Solutions used there include, among other things, portable induction loops and independent access for wheelchair users or people with individual needs.

Remote channels – including online and mobile banking, as well as the www.santander.pl portal – are continuously developed and tested for accessibility for all customers, including people with disabilities. In accordance with the Act on Ensuring Accessibility for People with Special Needs, the Bank provides accessible documents upon request, including non-personalized contract and regulation templates.

More details on the barrier-free service and digital accessibility solutions can be found in point 3, Chapter VI “Relations with customers”.

In 2024, there were legal and administrative proceedings relating to our business in the context of customers rights.

The ongoing court cases mainly concerned historically granted CHF-denominated and CHF-indexed mortgage loans. These matters are described in detail in Chapter X ”Financial performance in 2024”.

In 2024, the court of appeal issued ruling regarding the financial penalty imposed on the Bank by the Office of Competition and Consumer Protection (UOKiK) in 2020. The penalty related to provisions in annexes to CHF- and EUR-denominated mortgage agreements concerning the rules for determining foreign exchange buy and sell rates. The Court of Appeal ruled that the violation was unintentional and reduced the penalty from PLN 23.6 to PLN 5.9 million. The Bank published information about the decision on its website, paid the fine, and filed a cassation appeal.

Additionally, in 2024, the Financial Ombudsman imposed a minor financial penalty on the Bank due to an incomplete response to a customer complaint. The Bank paid the required penalty.

In addition, there were ongoing administrative proceedings of the UOKiK against the Bank, which concerned:

• principles of processing unauthorized payment transactions / customer reports of unauthorized payment transactions,
• determination of whether patterns used in consumer trade contain prohibited contractual provisions with regard to changes in rates of fees and commissions for banking activities and modification of other terms of the agreement during its execution,
• early repayment of mortgages, in which the OCC examines whether banks settle correctly with consumers. The proceedings concern settlement after full or partial repayment of a mortgage loan.

In addition, in 2024 the Financial Ombudsman fined the Bank a small value due to an incomplete response to a customer complaint. The Bank paid the due penalty.

In the context of customer data privacy, the Office for Personal Data Protection (UODO) imposed a financial penalty of PLN 1.44 million on the Bank in 2024 for failing to provide information about the data breach in 2018. The Bank appealed against the decision to the Regional Administrative Court. In addition, the President of the UODO issued 9 warnings against the Bank concerning matters of non-financial nature. The Bank appealed against 7, for which, and accepted 2 of them, appropriate corrective measures have been implemented.

In 2024, the Office of Competition and Consumer Protection conducted 2 proceedings against Santander Consumer Bank:

• A proceeding regarding practices infringing collective consumer interests, which concerned unauthorized transactions,
• A proceeding related to an appeal against a UOKiK President’s decision (court proceedings) – this involved an individual customer offer and the inclusion of insurance in the total cost of credit.

As a result of a hacker attack on the IT infrastructure of the PGD Group (Santander Consumer Bank intermediary), documents containing personal data were stolen and then made public on the Darknet.

In May 2024, the Bank detected unauthorized access to a Santander Group database hosted by a third-party provider. In the case of Poland, the data breach did not involve customers, but employees and job applicants. We informed the President of the Office of Personal Data Protection of the breach and took appropriate steps to minimize the impact on those whose data was leaked and to prevent similar cases in the future.