REAL MADRID C.F. (also REAL MADRID or "the Club"), provides you with the present information concerning the processing of your personal data in order that you have detailed knowledge about:

• Why we need to process your data.
• What data of yours we may have and for how long.
• With whom we share the data.
• What your rights are in this respect and how you can exercise them.

REAL MADRID processes different individual’s personal data in order to carry out various activities. Therefore, your personal data can be used in different ways and shared with different recipients depending on each of the specific purposes for which we need the data. Below, we provide detailed information on each of these data processing. We do not carry out individuals decisions making nor profiling that may seriously affect you, and we do not use your personal data for further purposes other than those reflected in this document.

Who is responsible for the processing of your data?

Identity: Real Madrid Club de Futbol
Postal address: Av. Concha Espina, número 1, 28036, Madrid
Contact Data Protection Office: protecciondedatos@corp.realmadrid.com

With what purpose and legitimacy do we process your personal data?

In general, your data will be processed by the CLUB for the fulfilment of the following purposes:

1. Management of your relationship with the CLUB: Real Madrid will be able to process your data for the management of your relationship with the CLUB, including in this process, the development of any operation necessary for its maintenance.
2. Organisation of services and events: The CLUB organises draws, competitions and promotional events. In these cases, the interested party who wants to participate, will sign up voluntarily by completing the forms that the CLUB provides for this purpose. The CLUB will process the data obtained through the participation forms in these services and events in order to be able to manage the interested party's participation, as well as the publication of the prizes, or any additional information that may be necessary, in the event that it occurs. This process will only be carried out if Real Madrid has the consent of the interested party.
3. Management of requests and applications: In order for Real Madrid to manage those requests and applications that you send us, the CLUB will process the information you provide. This information will allow the CLUB to give you an answer to them, and to put at your disposal solutions that adapt to your needs. The CLUB undertakes to process the data obtained and provided by you as long as they are necessary for the purpose described.
4. Sending newsletters and magazines: Real Madrid will carry out, both by ordinary and electronic means, the sending of newsletters and magazines, as well as information on the activities and services of the CLUB, as long as you have consented to this service.
   Whenever this service is carried out by electronic means, it will be legitimised in satisfying the legitimate interests of the CLUB, by virtue of the provisions of article 21 of Law 34/2002, from July 11, on services of the company of information and electronic commerce, as well as the European Regulation of Commercial Electronic Communications. At any time you can object to this service through contact with the Real Madrid Data Protection Office in the email mentioned above.
5. Conducting surveys on customers or potential customers: In order to verify the quality of communications, the procedures of Real Madrid, the service we provide, as well as the products and services that we provide, the CLUB may conduct satisfaction surveys.
   This process is based on the legitimate interest of the CLUB. In order to improve our procedures, we can contact you to find out your level of satisfaction with them, and thus be able to improve those issues that require your greatest satisfaction. You can always object to receiving any communication of this nature through contact with the Real Madrid Data Protection Office in the email address mentioned above.
6. Communication of your personal data to third parties collaborators and sponsors: Real Madrid may, on certain occasions, communicate your personal data to collaborators and sponsors for the development of commercial actions by them (through post, mailing, fax, SMS, electronic mail and any telematic means) by means of a general nature or adapted to your personal characteristics, as long as you have given your consent through the form established for that purpose. Also, we inform you that you can oppose and/or withdraw your consent for this service at any time.
7. Distribution of correspondence and commercial offers
   1. 7.a) Distribution of correspondence and commercial offers regarding the Club's products and services that are the same or similar to those that you have previously engaged or purchased, on the basis of the legitimate interest that Real Madrid holds in this regard and, in relation to correspondence sent electronically, as stipulated in Article 21 of the Law 34/2000, 11 July, relating to services in the information society and digital business. We will handle your personal data for these purposes as long as you don't oppose such handling.
   2. 7.b) Distribution of correspondence and customised commercial offers of the Club's products and services, as well as, products and services offered by our sponsors and partners, where relevant, as long as you have given us your sent to do so and have not withdrawn your consent or opposed such handling of your personal data. You can withdraw your consent at any time, as is indicated below.
      
      Customisation of commercial and promotional offers: During the maintenance of your relationship with the CLUB, the personal data that you make available to us through any website, web form or application made available to you, or the contracting of products and services, may be subject to automated decisions that have legal implications on your person, as well as the creation of profiles, including automatic techniques that use the current data, navigation data from cookies, historical and statistical, data that can be obtained through other sources of information (third-party sources and social networks), for the optimisation of the product offers that we make available, prices and new proposals, through segmentation in different groups in relation to common patterns. This process will only be carried out if the CLUB has the consent of the interested party.
       

      Additionally, in the event that you are a member of the Club Membership group, you can contact the Online Partner Service Office (https://socios.realmadrid.com), registering and identifying yourself beforehand with your Membership number. In order to oppose and/or withdraw your consent for this at any time.

In addition, if any of the following situations applies to you, your personal data will be processed for the additional purposes indicated below for each case:

MEMBERS

If you are a member of Real Madrid Club de Fútbol, we will process your data in accordance with the following information:

1.   Purpose: Real Madrid Club de Fútbol will process your personal data for the following purposes and in accordance with legitimate grounds indicated in each case:

a.        Management of the relationship with our Members, which includes any action necessary to comply with the Social Bylaws, process the registration as members, management of subscribers, control of ticket sales and groups of relatives and family units of members in order to manage and control the capacity in our events and activities, recognize certain members with badges or by seniority, the organization and promotion of institutional events and provide our members with a series of advantages (priority or privileges in the services and activities of the Club, exclusive discounts, promotions or contests and any other that the Club makes available). All this based on the contractual relationship that the Club maintains with its Members ( Social Bylaws and adopted agreements). Additionally, with the Members prior consent, health data may be processed in order to carry out relocations of seats or arrange certain logistics due to medical reasons.

b.        To identify Club Members in the different Club's enviroments and facilities even in its various digital platforms, including identification through Single Sign On (Official Website, Mobile App, Online Store, Memorabilia, Wifi network in our stadiums and facilities, etc.). This identification process is carried out based on the right of Club members to identify as such in accordance with the Club's Bylaws, as well as based on the Club's legitimate interest in being able to identify its members in order to inform them and provide them with exclusive services and advantages.

c.        To identify Club members to third parties: In case of promotions or activities organized by third party collaborators that require you to be a Member in order to participate. In these cases, if it has not been possible to verify the condition of Club Member at the time of the participation, the third party organizers can send us the list of participants who have declared to be Members so that we can confirm this circumstance. This processing of data is carried out based on the Club´s legitimate interest and on the Member´s legitimate interest in indientifying as such in order to participate in the mentioned activities or promotions.

d.        Accounting and finance: Management and processes resulting from the accounting system, invoicing and compliance with tax obligations, based on the legal tax and accounting obligations which are applicable to the Club.

e.        To provide Member´s with personalized content based on their personal interests. For this purpose, we carry out a profiling process analysing Members preferences, as well as their browsing and consumption habits within the Club environments (official website, mobile application, online stores, etc.) to determine their interests. This processing is carried out by virtue of the Member’s previous consent. You can obtain more information on how this profiling is carried out in the section “How do we carry out profiling?”.

f.        Analytics and loyalty. Analysis of information relating to Members, including their responses to surveys, for a better understanding of our Members and for the development of new products and services or improvement of existing ones, in order to better meet the needs of our Members. The processing is based on the Club´s legitimate interest in knowing in good detail its Members and the market to improve its products, services and activities and in the existing contractual relationship as Members of the Club.

g.        Sending of communications regarding special events, such as birthday greetings , based on our legitimate interest in maintaining a respectful and close relationship with all of our Members.

h.        Historical heritage management. Custody, conservation and, if necessary, digitalization of all types of documents, including images and videos, related to the RMCF for the preservation and dissemination of the history of Real Madrid, based on our legitimate interest in such preservation and dissemination.

i.        Sending of commercial communications of products, services, and activities of the Club and / or its partners and sponsors, provided that you have previously given us your consent to that effect. Members can withdraw their consent for the different types of commercial communications in the subscription center of their private area.

j.        Control, security, legal advice and regulatory compliance. Additionally and only if the case arises, we will also process your data for purposes of control and security, legal advice and regulatory compliance, as necessary to satisfy a public interest, as well as our legitimate interest in the defense of our interests and rights, in the avoidance of conduct contrary to the Club's internal codes and regulations and to comply with legal obligations applicable to us (audit, social discipline, compliance with criminal regulations, protection of personal data, regulations against violence, racism, xenophobia and intolerance in sport...).

2.   Origin of the data: In most cases we will obtain your personal information directly from you, but we may also obtain your personal information from your legal representative.

On an extremely exceptional basis, we may receive other types of information from you through other sources, such as our complaints channel, witnesses, or competent authorities. But in no case will we keep information that we do not really need.

3.  Data retention period: We will keep your data for as long as you continue to be a Member and thereafter, duly blocked, for the legally stipulated period for defence or filing of possible claims, in which case they will be kept until the inspection, procedure or claim is definitively closed.

However, the data processed in relation to the management of the Club's historical heritage will have to be kept for an indefinite period of time, given the nature and historical value of this information.

4. Categories of data:

We will process the following categories of personal data: identification data, contact data, economic data (related to the means of payment), financial and transaction-related data (tickets, transfers and subscriptions, transactions made to obtain Club products and services, discounts, etc.), your preferences for our products, services and activities, as well as, browsing and consumption habits in the Club environments, data relating to your family unit that you want to provide us and health-related data you provide us with so we can carry out any logistical actions needed for medical reasons.

Exceptionally, we may also process other personal information that can be relevant to any possible internal incident, investigation or complaint.

5.  How do we carry out profiling?: You should be aware that you provide us with data in very different ways: In the moment you register as a Member, if at that moment or in any other time you directly inform us about your tastes and preferences, in your private area, when you make use of platforms in the Club environment (for example, browsing habits on the Real Madrid website or the official Real Madrid app or the purchases you make in the Online Store or in the Memorabilia site), when you use the interactive points or services of the Santiago Bernabéu Stadium or in any other official Real Madrid facilities.

All this information contains personal data about you and, in addition to this, we may obtain inferred data relating to your tastes, interests and habits (for example, your favourite players, frequency with which you attend matches, favourite items in the Shop).

With this information, we will be able assign you a specific profile and will be able to offer you services, experiences, and products much more in line with your preferences and interests, seeking to make your experience as a Member as personalised and unique as possible

We consider that this profiling results in an advantage that the Club offers you as a Member, however, you may withdraw your consent to this profiling at any time as explained in the section "What are your rights in relation to the processing of your data and how to exercise them" as well as by unchecking the corresponding box in the "Subscriptions" section of your private Member area.

6.  With whom do we share your data?

We may share your personal data with the following entities and/or persons:

●       Public Administrations, other Public Organisms and entities authorised by law, when required or necessary.

●       Financial entities for the management of charges and payments.

●       Insurance companies in case of any incident involving a Club Member.

●       Collaborating entities for the management of the Club's official stores and platforms (physical stores, online stores and other Club marketplaces) if necessary for the processing of orders and/or applying benefits, as well as through the Single Sign On system.

●       Exceptionally with Courts and Tribunals or other dispute resolution bodies, such as Arbitration Courts and mediators, State Security Forces and Bodies and Notaries and Registrars.

In addition, we may also share your data with our following providers, but only to the extend required to provide us with their service. We make sure that they take the same care as we do, that they apply high protection guarantees and that they can only use it for what is strictly necessary in relation to the purposes detailed above:

●       Legal advice firms, solicitors, consultancy and/or auditing firms

●       Providers responsible for the management of the members database (processing of registrations, unsubscription, etc.), Member Box Office services, translations, and physical and electronic courier services.

●       Companies that provide the collection, structure and storage of information and electronic communications, video streaming, market research providers and data protection management software.

●       Providers for the organization of events and for voting in assemblies and elections of members of the board of directors.

●       Fundación Real Madrid Club de Fútbol for filing information of historical value.

●       Other suppliers that may complement or replace the above-mentioned suppliers.

If you would like specific or more detailed information about any of these providers, you can request it through our contact point (please find the contact point at the end of this document).

7. International Data Transfer:

In relation to the purposes set out above, in most cases your data will not leave or be accessed from outside the European Economic Area, except in the case of:

a) Our provider Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States, a country outside the European Economic Area. For these transfers, we have set the Standard Contractual Clauses approved by the European Commission, which, after appropriate assessments, have been found to provide an adequate level of protection of your rights at the destination.

b)  Our provider, Lava Inc. located in the United States, with whom we have set Standard Contractual Clauses approved by the European Commission, which after appropriate assessments, have been found to provide an adequate level of protection for your rights at destination.

c)  Dice Technology LTD (Endevour Streaming), based in the United Kingdom. The safeguard that applies to this data transfer is the European Commission's Adequacy Decision which states that this country has an adequate level of protection for personal data. You can consult this Adequacy Decision at

https://commission.europa.eu/system/files/2021-06/decision_on_the_adequate_protection_of_personal_data_by_the_u nited_kingdom_-_general_data_protection_regulation_en.pdf.

If you would like further information regarding these Standard Contractual Clauses, you can make a request through our contact point (please find the contact point at the end of this document). Very exceptionally we may need to transfer your personal data to Courts, Tribunals, Arbitration Courts and Mediators outside the EEA, these transfers are necessary for the formulation, exercise, or defence of claims.

Madridista Premium

If you are member of the Madridista Community, we will process your personal data as follows:

a)  Purpose: Real Madrid Club de Fútbol will process your personal data for the following purposes and in accordance with the reasons or legitimate grounds indicated in each case:

o  To manage our relationship with you as a Madridista, including sending satisfaction surveys, as well as to comply with the General Conditions of the Madridista Community. In regard of personal data from any Legal representatives, Parents or Legal Guardians, that act on behave of someone else, we may process their data based on our legitimate interest to comply with the contractual relationship that binds us to the Madridista member they represent.

o  In order to provide you with the services and advantages associated to your Madridista modality and to comply with the General Conditions of the Madridista Community, which includes:

o  To identify you as a Madridista in any of the Madridista Community environments, as well as through your digital ID card.

o  Receive official communications, newsletters, Club magazines and information about benefits you may enjoy in regard of your Madridista membership.

o  Inform you about discounts and promotions and apply them.

o  To provide you with personalized content based on your personal interests, for which we carry out a profiling process analysing your preferences, as well as your browsing and consumption habits within the Madridista Community to determine your interests. This processing is based on the Club's legitimate interest in getting to know your preferences and interests better so that we can make sure you enjoy your Madridista experience to the fullest. (see section "How do we carry out profiling?").

o  Send communications to Madridista Community members regarding special events as we want to make them feel part of this great family, based on our legitimate interest in maintaining a respectful and close relationship with all Madridista members.

o  To recover your Madridista status in the event of any incident related to your subscription, based on the legitimate interest we have in doing so and unless you object (which we would very much regret).

o  Additionally, and only if the need arises, we will also process your data for control in the correct use of the Madridista Community and its platforms, security purposes, legal advice and regulatory compliance, as it is necessary to satisfy our legitimate interest in the defence of our interests and rights, in the avoidance of conduct contrary to the Club´s internal codes and regulations and to comply with legal obligations applicable to us (auditing, compliance with criminal regulations, protection of personal data, regulations against violence, racism, xenophobia and intolerance in sport.. etc.).

If you opt for a payment method, be it Premium or Junior , in addition to all the above purposes we will process your data for the following purposes :

a. Management of the existing relationship with Payers of the Premium or Junior modality in case they paid for the fee but are not personally members of the Madridista Community and in order to comply with the General Conditions of the Madridista Community.

b. For the management of the Club's accountancy, to comply with all legal, fiscal, and accounting obligations.

b) Origin:

In most cases we will obtain your personal information directly from you, but we may also obtain your personal information from your legal representative, your parents or legal guardian if you are a minor, or in case you were a minor when you subscribed to the Madridista Community.

If you choose to subscribe to the Madridista Community via social login, we will receive your details from the social network or platform you have chosen to subscribe as a Madridista.

You should also bear in mind that if you store the digital card or coupons that we send you in the wallet of your mobile or electronic device, it will share with us the unique identifier that has been attributed to you, as well as if you use your card or coupon with any third parties. When you are configurating your wallet you will be able to authorise it to inform us when you are near the Santiago Bernabéu Stadium, our shops and other of our facilities, so that we can send you communications and notices (greeting or promotional) but only with your previous consent through the wallet.

On an extremely exceptional basis, we may receive other types of information from you through other sources, such as our complaints channel, witnesses, or competent authorities. But in no case will we keep information that we do not really need.

c) Storage period of your data:

We will keep your data for as long as you continue to be part of the Madridista Community and thereafter duly blocked, for the legally stipulated period for defence or filing of possible claims, and until the inspection, procedure or claim is definitively closed.

However, unless you object to this if, at any moment,you cease to be a Premium or Junior Madridista, your minimum identification data will be kept for 15 years after your possible permanent withdrawal, so that, in case you wish to regain your membership, you can be assigned the same membership card number.

d) Categories of data processed:

We will process the following categories of personal data: Identification data (including your voice in the case of incidents communicated by telephone), contact data, personal characteristics (date of birth and contact language), economic (related to the means of payment used for the registration fee and renewals of payment methods ), financial and transaction-related data (transactions made to obtain Club products and services or payment incidents), as well as your interests and preferences and browsing and consumption habits in the Madridista Community environments.

Exceptionally, we may also process other personal information that can be relevant to any possible internal incident, investigation or complaint.

e)How we carry out the profiling:

You should be aware that you provide us with data in very different ways: In the moment you register as a Madridista, if at that moment or in any other time you directly inform us about your interests and preferences, in your private area, when you make use of the Madridista Community platforms (for example, browsing habits on the website or the official Real Madrid app or the purchases you make in the Online Store or in the Memorabilia site), when you use the interactive points or services of the Santiago Bernabéu Stadium or in any other official Real Madrid facilities.

All this information contains personal data about you and in addition to this, we may obtain inferred data relating to your tastes, interests and habits (for example, your favourite players, frequency with which you attend matches, favourite items in the Shop).

With this information, we will be able to assign you a specific profile and will offer you services, experiences, and products much more in line with your preferences and interests, seeking to make your experience as a Madridista as personalised and unique as possible.

Please note that, if there are any incidents related to the payment of your subscription fee, we will keep your profile data, as well as the rest of your data, for a reasonable period of time until we can verify that the incident has been resolved.

We consider that this profiling results in an advantage that the Club offers you as a member of the Madridista Community, however, you may object to being subjected to this profiling at any time.

f) Recipients of your data:

Within the context of the Madridista Community and for the purposes described above, we may share your personal data with the following entities and/or persons:

●       Financial entities for the management of charges and payments.

●       The data that identifies you as a Madridista is shared with the partners that manage the different platforms that make up the Madridista Community (such as Legends for the Online Store, Pursuit3 for Memorabilia,), and other partners with whom we have arranged benefits for the Madridista community, to ensure that you obtain all discounts and benefits. We will also share with these partners any other personal information that you indicate through the mechanisms that we provide for this purpose. For example, if you indicate that you

want the payment method you use for your Madridista fee to be used for purchases in the Real Madrid Online Store.

●       Public Administrations, other public entities authorised by law, when required or necessary.

●       Exceptionally with Courts or other dispute resolution bodies, such as Arbitration Courts and mediators, State Security Forces and Bodies and Notaries and Registrars.

In the event that the Club has suspicions that you have provided false information or information of a third party without having the legal capacity to do so, the Club may communicate your data to such third party or its legal representative, as well as to the appropriate administrative, police and judicial authorities. In addition, we may also share your data with our following suppliers, but only to the extend required to provide us with their service. We make sure that they take the same care as we do, that they apply high protection guarantees and that they can only use it for what is strictly necessary in relation to the purposes detailed above:

●       Courier companies and management of postal shipments. .

●       Providers for data storage, ticket sales, processing of registrations, recoveries, communications, video streaming, and management of the Madridistas database.

●       Providers responsible for the management of raffles and competitions.

●       Printed and digital publications or communication platforms.

●       Consulting and data analytics companies.

●       Suppliers for accreditation in the application of discounts and processing of other advantages associated with your Madridista modality.

●       Legal advice firms, solicitors, consultancy and/or auditing firms.

If you would like specific or more detailed information about any of these providers, you can request it through our contact point (please find the contact point at the end of this document).

g)International Data Transfers:

In relation to the purposes set out above, in most cases your data will not leave or be accessed from outside the European Economic Area, except in the case of:

a) Our provider Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States, a country outside the European Economic Area. For these transfers, we have set the Standard Contractual Clauses approved by the European Commission, which, after appropriate assessments, have been found to provide an adequate level of protection of your rights at the destination.

b)  Our provider, Lava Inc. located in the United States, with whom we have set Standard Contractual Clauses approved by the European Commission, which after appropriate assessments, have been found to provide an adequate level of protection for your rights at destination.

c)  Dice Technology LTD (Endevour Streaming), based in the United Kingdom. The safeguard that applies to this data transfer is a European Commission's Adequacy Decision applies, which states that this country has an adequate  level  of  protection  for  personal  data.  You  can  consult  this  Adequacy  Decision  at https://commission.europa.eu/system/files/2021-06/decision_on_the_adequate_protection_of_personal_data_ by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

If you would like further information regarding the Standard Contractual Clauses, you can make a request through our contact point (please find the contact point at the end of this document).

Exceptionally we may need to transfer your personal data to:

●       Sports Organisations and other Clubs outside the European Economic Area (EEA), these transfers are necessary for the correct execution of the Madridista Community Conditions and/or for the execution in your interest of a contractual relationship between Real Madrid and the recipients of the data.

●       Courts, Tribunals, Arbitration Courts and Mediators outside the EEA, these transfers are necessary for the formulation, exercise, or defence of claims.

MEMBERS OF OFFICIAL SUPPORTERS’ CLUBS

If you were a member of one of the official supporters’ clubs associated with the CLUB (hereinafter, "Peñista"), Real Madrid will be able to process your data for the following purposes with additional character:

1. Management of the relationship with the Peñista: The CLUB will be able to process its data for the management of its Peñista status, including this service the development of any operation and, by way of example and not limitation, the modification and/or updating of its data.

LEGAL REPRESENTATIVES AND CONTACT PERSONS

In the event that you are a Legal Representative or Contact Person of any of the entities or individuals with which Real Madrid Club de Fútbol has a relationship, we will process your personal data as informed below:

• Purpose: Real Madrid Club de Fútbol process your personal data in order to control the development and fulfilment of the contracts subscribed by the Club and other entities or persons, as well as to maintain contact with them. The processing of your data is necessary for the fulfilment of the contractual relation, as well as to satisfy the legitimate interest of the Club in the indicated pursued purpose. Your data will not be used by Real Madrid for any ulterior purpose nor will they be the object of automated individual decisions.
• Category and origin of the data: The data of yours that we process are identifying and of a labour or professional nature and of another type (powers of attorney) and may have been provided to us by you or your legal representative, by the entity or person for whom you work or whom you represent and with whom the Club relates and who has been able to provide them to us directly or through another entity by virtue of a contract or commitment signed with the former.
• Storage period: We will store your data for these purposes for as long as the contractual relationship remains in force and subsequently, for an additional and foreseeable period of 5 years (or period that in the future is legally established for the prescription of personal claims) for the purposes of possible exercise or defense of claims.
• Recipients of your data: Your data may be communicated to the sponsoring and collaborating companies of the Club (which you can consult here), as well as to the Fundación Real Madrid provided that you have given us your consent to this effect or that it is necessary for the execution and fulfilment of the contracts subscribed by the Club. Additionally, if necessary, we may share your personal data with Administrations or Public Bodies (in order to obtain licences or project accreditation), Registrators and Notaries, legal service professionals and Courts or other dispute resolution bodies. In the event that any of these recipients is located outside the European Economic Area (EEA), such transfer is justified insofar as it is necessary for the conclusion or execution of a contract that is of interest to you, or because it is necessary for the formulation, exercise or defence of claims.

APPLICANTS, PURCHASERS OF TICKETS TO EVENTS OR MATCHES AND ATTENDEES

In case you request or acquire a ticket for a match/event or attend an event or match organized or co-organized by Real Madrid:

1. Real Madrid Club de Fútbol will process your personal data for the following purposes:

1. Manage the relationship with the Club and associated obligations, including the provision of post-sale service and management, invoicing and collection and the fulfilment of accounting and tax obligations. The Club is entitled to carry out these tasks as they are necessary for the development of the contractual relationship that binds the Club to you, as well as for compliance with the regulations to which the Club is subject.

1. Compliance and security control, which includes advice and legal defence of the Club, control of compliance with regulations, Covid detection and prevention, security in our facilities, including by means of video surveillance, as well as the security of games outside our facilities (including the making of a local supporters list), for which the Club is legitimised by the legitimate interest that the Club has in ensuring the correct development and safety in its activities, as well as being necessary to ensure the public interest and compliance with the regulations to which the Club is subject (among others, Law 19/2007 against violence, racism, xenophobia and intolerance in sports and supporting regulations, and, where applicable, Covid prevention protocols).

1. Diffusion of the event with informative purposes, based on the legitimate interest that assists the CLUB in this matter, the attendees’ image may be captured and diffused, in an accessory manner, during the recording and broadcasting of the event and/or match with informative purposes.

1. Origin and storage period: Your data has been provided to us directly by you or your legal representative or, exceptionally, by third parties: External portals authorized by the Club for the purchase of tickets, external Agencies and the Media which provide us with images of matches and events, as well as, only if applicable, people related to a claim or incident in which you may be involved or interested.
   
   We will store your data on an ordinary basis until the contracted services are provided and, thereafter, duly blocked, for a period of 5 years or the legal period foreseen for the eventual defense or filing of claims. However, the data related to the invoicing and accounting will be kept for a period of up to 10 years from the accrual date derived from the purchase of the ticket, and any data obtained from the recording as an attendee to the event and/or specific match will be stored for as long as the journalistic interest remains and, in any case, for the Club's own newspaper library.

1. Categories of personal data to be processed: For the aforementioned purposes, we process identifying data of personal, economic and/or financial characteristics relating to the transaction, the sales channel, date of the operation, amount of the operation, sector, row, seat, match ID, locator, time of the match, working day, type of entry (VIP or Regular), identification number in case you were a member of Real Madrid Club de Fútbol and/or part of the Madridista Premium Loyalty Program, in the case of out-of-home matches the means of transport to the destination and, only if necessary, data relating to claims or incidents in which you may be involved or interested in. In addition, for certain events, such as the Congress of Medicine and Sciences Applied to Sport, we may also process professional or employment data.

1. Recipients of your data: We may share your data with the following entities and/or individuals:

• Financial entities for the management of collections and payments.
• Sports Organizations, rival Clubs, National Police (in the case of out-of-home matches).
• Tax Agency, Institute of Accounting and Account Auditing and other bodies, competent administrations and entities or that are legally qualified or authorized.
• In the event of eventual claims and/or infringements: Courts and Tribunals and other dispute resolution bodies, such as Arbitration Courts and mediators, State Security Forces and Corps, Notaries, Insurance Companies, Federations and Sports Clubs.
• In the unlikely event of a data protection incident: Spanish Data Protection Agency or other competent Control Authority, as well as other entities involved in a data protection incident to whom said incident has to be reported.
• Diffusion of the images of the match or event to external media, as well as to the general public through the Club's diffusion channels.

On the other hand, the following REAL MADRID providers may need access to some of your personal data that we process, in order to provide the contracted service: 

• Prodware Spain, S.A.
• Onebox Ibérica, S.L.
• Ilunion Outsourcing, S.A.
• Eventísimo, S.L.U.
• Correos and other companies of messaging and management of postal shipments.
• Providers of collection and accounting services.
• Computer and storage services (Microsoft Ireland Operations Limited).
• Professionals and companies of legal advice, consultancy and/or audit.
• Other suppliers that can complement or replace the previous ones.

1. International Data Transfers: As a result of data disclousures and/or the above referred processing agreements, your personal data may be transferred to:

• In relation to the matches, Sports Organizations, Federations and other Clubs outside the European Economic Area (EEA), being this transfer covered due to being necessary for the proper provision of the product/service purchased by you.
• Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States. For these transfers, the Standard Contractual Clauses approved by the European Commission apply, which, after the relevant assessments, have been deemed to provide an adequate level of protection for your rights at the destination.
• In the event of eventual claims and/or infringements involving interested parties outside the EEA: Courts, Tribunals, Arbitration Courts and Mediators, Insurance Entities and Federations and Sports Clubs outside the EEA, the transfer being covered as necessary for the formulation, exercise or defence of claims.

PURCHASER OF TOUR BERNABEU TICKETS

In case that you have acquired a Tour Bernabeu ticket:

a)  Real Madrid Club de Fútbol will process your personal data for the following purposes:

1. Manage the relationship with the Club and associated obligations: including the provision of post-sale service and management, invoicing and collection and the fulfilment of accounting and tax obligations. The Club is entitled to carry out these tasks as they are necessary for the development of the contractual relationship that binds the Club to you, as well as for compliance with the regulations to which the Club is subject.
2. Compliance and security control, which includes advice and legal defence of the Club, control of compliance with regulations, security in our facilities, including by means of video surveillance, as well as the security of games outside our facilities (including the making of a local supporters list), for which the Club is legitimised by the legitimate interest that the Club has in ensuring the correct development and safety in its activities, as well as being necessary to ensure the public interest and compliance with the regulations to which the Club is subject.
3. Photographs of the Tour and Mosaic. In the event that you request photographs and, in any case, for the realization of a live mosaic of the Tour attendees, we are legitimized by the contractual relationship that binds us with you and by your consent to use your image for the live mosaic.

b)  Origin and storage period:

Your data has been provided to us directly by you or your legal representative or, exceptionally, by third parties: external portals authorized by the Club for the purchase of tickets, as well as, only if applicable, persons related to a claim or incident in which you may be involved or interested.

We will store your data on an ordinary basis until the contracted services are provided and, thereafter, duly blocked, for a period of 5 years or the legal period foreseen for the eventual defense or filing of claims. However, the data related to the invoicing and accounting will be kept for a period of up to 10 years from the accrual date derived from the purchase of the ticket.

Your image data, in the event of a request to take photographs, will be kept for a period of 15 days. With regard to the photographs taken for the mosaic, it is continuously updated, so that its image will not be preserved for this purpose beyond the period of permanence in the mosaic of attendees.

c)  Categories of personal data to be processed:

For the aforementioned purposes, we process identifying data of personal, economic and/or financial characteristics relating to the transaction (means of payment), the sales channel, date of the operation, amount of the operation, type of ticket (adult, child, groups, etc.) and, only if necessary, data relating to claims or incidents in which you may be involved or interested in.

d)  Recipients of your data:

We may share your data with the following entities and/or individuals:

• Financial entities for the management of collections and payments.
• Tax Agency, Institute of Accounting and Account Auditing and other bodies, competent administrations and entities or that are legally qualified or authorized.
• In the event of eventual claims and/or infringements: Courts and Tribunals and other dispute resolution bodies, such as Arbitration Courts and mediators, State Security Forces and Corps, Notaries and Insurance Companies.
• In the unlikely event of a data protection incident: Spanish Data Protection Agency or other competent Control Authority, as well as other entities involved in a data protection incident to whom said incident has to be reported.

On the other hand, the following REAL MADRID providers may need access to some of your personal data that we process, in order to provide the contracted service:

• Companies collaborating in the sale of tickets.
• Company entrusted with the taking of photographs in the Tour Bernabéu.
• Correos and other companies of messaging and management of postal shipments.
• Providers of collection and accounting services.
• Computer and storage services (Microsoft Ireland Operations Limited).
• Professionals and companies of legal advice, consultancy and/or audit.
• Other suppliers that can complement or replace the previous ones.

e) International Data Transfers:

As a result of data disclosures and/or the above referred processing agreements, your personal data may be transferred to:

• Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States. For these transfers, the Standard Contractual Clauses approved by the European Commission apply, which, after the relevant assessments, have been deemed to provide an adequate level of protection for your rights at the destination.
• In the event of eventual claims and/or infringements involving interested parties outside the EEA: Courts, Tribunals, Arbitration Courts and Mediators, Insurance Entities and Federations and Sports Clubs outside the EEA, the transfer being covered as necessary for the formulation, exercise or defence of claims.

OFFICIAL CLUB WEBSITES’ USERS

Finally, in the event that you register for any of the official CLUB websites, or the forms that the CLUB makes available to you, Real Madrid may process your data for the following purposes with additional character:

1. Management of registration and cancelations of users:In order for Real Madrid to manage all registrations and cancellations of user registrations made through any website, form or application made available to them, and whenever applicable, the CLUB will treat the information you provide, including that which may be obtained through any website, web form or application that is made available to you. This information will allow the CLUB to know your profile, and thus be able to make better offers, and put at your disposal information that may be of interest to you about events and activities organised by the CLUB. The CLUB undertakes to process the data obtained and provided by you for the maintenance of your registration as a user and for the management of your relationship with the CLUB, provided that this data is necessary for the purpose described, as well as for the management of the rest of purposes that we inform you.
2. The personalisation of our commercial and promotional offers: During the maintenance of your relationship with the CLUB, the personal data that you make available to us through any website, web form or application made available to you, or the contracting of products and services, may be subject to automated decisions that have legal effects on their person, as well as the creation of profiles, including automatic techniques that use the current data, navigation data from cookies, historical and statistical, data that can be obtained through other sources of information (third-party sources and social networks), for the optimization of the product offers that we offer, prices and new proposals, through segmentation in different groups in relation to common patterns. This process will only be carried out if the CLUB has the consent of the interested party.
3. Processing of data relating to own and third party cookies in order to analyse your browsing habits and improve services: You can consult the detail of the information on the cookies policy of Real Madrid in the use of the aforementioned data in the following link https://www.realmadrid.com/en/legal/cookies-policy.

NON-ANONYMOUS WHISTLEBLOWERS

How will minors' data be processed?

Real Madrid will not collect or process personal data for children under fourteen (14) years of age, without fully complying with the requirements established in the applicable data protection regulations, regarding compliance with the duty to inform and obtain those consents that they are necessary.

How long will we keep your data?

Without prejudice to the provisions set out above in relation to the respective processing of data, the personal data that is accessed by virtue of your relationship with the CLUB will be processed as long as they are accurate for the management of the purposes reported. In this sense, the CLUB will keep the personal data once its relationship with you is duly blocked, during the limitation period of the actions that may arise from the relationship maintained with the interested party.

Who will receive your data?

Without prejudice to what is indicated in each case for the previously specified respective processing, Real Madrid will communicate your personal data:

1. In the case of having your consent, the CLUB will communicate your data to its collaborating and sponsoring companies. The list of collaborating and sponsoring companies is accessible through the following link: https://www.realmadrid.com/en/about-real-madrid/the-club/sponsors.
2. Public Organisations, Judges and Courts and, in general, competent Authorities, when the CLUB has the legal obligation to provide them.
3. The CLUB has the collaboration of some third-party service providers that have access to your personal data and that the referred data in the name and on behalf of Real Madrid as a consequence of the provision of services.
   The CLUB follows strict criteria of selection of service providers in order to comply with their obligations in terms of data protection and undertakes to sign with them the corresponding data processing contracts through which they will impose, among others, the following obligations: apply appropriate technical and organisational measures; use the personal data for the agreed purposes and attending only to the documented instructions of the CLUB; and delete or return the data to the CLUB once the provision of services ends. Additionally, the CLUB has contracted the provision of services by the Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States. For these transfers, the Standard Contractual Clauses approved by the European Commission apply, which, after the relevant assessments, have been deemed to provide an adequate level of protection for your rights at the destination.
4. In the event that you are an attendee at events and games: your data may be disclosed to diverse media and specialized websites, which may be based outside the European Economic Area (EEA), in which case the CLUB has adopted the relevant warranties by signing standard contractual clauses, of which, if required, we would provide you with a copy upon request.

What are your rights regarding the processin of your data2?

You may, in relation to the processes that are based on obtaining your consent, withdraw your consent through the procedure detailed in the following paragraph.

You may exercise, if you wish, the rights of access, rectification and deletion of data, as well as request that you limit the processing of your personal data, oppose it, request the portability of your data, as well as not be subject to automated individual decisions, sending a written communication or contacting the CLUB through the following email address: oposicion@corp.realmadrid.com.

You can also contact the CLUB by postal mail at the address: Av. Concha Espina, number 1, Madrid.

Against which authority can you exercise your claims?

You can file a complaint with the CLUB's Data Protection Office, through the address protecciondedatos@corp.realmadrid.com, or in the post to Avenida de las Fuerzas Armadas, number 402, Madrid, in order for us to satisfy your rights in this matter. In any case, you can always go to the Spanish Agency for Data Protection in C/ Jorge Juan number 6, Madrid as the control authority in matters of data protection.

How can I contact the Real Madrid Data Protection Delegate?

For any questions relating to the processing of your data, or if you have any issue or comment that you wish to make that are linked to data processing that Real Madrid carries out, you can contact our Data Protection Delegate using the following means:

Postal address: Avenida de las Fuerzas Armadas, number 402, 28055, Madrid
E-mail: protecciondedatos@corp.realmadrid.com

Additional points::

You declare that the information and data you have given us is accurate and true, reserving the CLUB the right to exclude from the services those interested parties who have provided false information, without prejudice to legal action. You will be solely responsible for any false or inaccurate statements that you make and for the damages caused to the CLUB or to third parties.

All the fields that appear on the Real Madrid forms will be required to be completed, so the omission of any of them may lead to it being impossible for us to meet your request, unless the form itself has fields of voluntary completion.

Personal data will be treated with the degree of protection legally required to avoid any loss, alteration, treatment or unauthorised access.

If by means of a form you provide us with personal data of other people, we warn you that you must do so with their consent and have informed them, in advance, of the details contained in this Privacy Policy. Also, Real Madrid undertakes to provide any third party whose data you provide us with the information that is relevant, in accordance with the provisions of Article 14 of the General Regulations.

If you have any questions regarding data protection you can contact the Real Madrid Data Protection Office through the email protecciondedatos@corp.realmadrid.com.

[1] IMembers will be considered, to all intents and purposes, beneficiaries of the Advantages derived from the subscription of the Madridista Premium Loyalty Program

[2] Real Madrid Club de Fútbol informs you that you can only exercise your rights in accordance with the principles and obligations set out in the General Data Protection Regulations as of May 25, 2018, on the occasion of the full application of the rule.