Privacy Policy

In the case that you are a member of Real Madrid Club de Fútbol, the CLUB could process your data for the following purposes with additional character:

1. Management of the relationship with the members, basketball season ticket holders and holders of the electronic ticket, including economic, accounting, fiscal and administrative management, among others: The CLUB will be able to process your data for the management of your membership status, including this service, the modification and/or updating of your data, changing of personal data, modification of bank account details, updating the members of the family unit, updating of photos, requesting of duplicates, monitoring of payments and status of social quotas, management of the financing of social quotas, management of the request for the reduction of quotas.
   
   In the same way, your data will be processed for the application of football or basketball subscription management, request for visits to the Sports City, management of the purchase of tickets at the Santiago Bernabéu Stadium and on trips outside the stadium such as basketball and Real Madrid Castilla, in case it is necessary due to its physical condition, the management of the ticket and circulation of the sports grounds, request for tickets for the concerts held at the Santiago Bernabéu Stadium, and the management of complaints, claims and/or suggestions.
2. Management of membership registration and cancellation, registration and cancellation of football and basketball subscribers, whether temporary or permanent, registration and cancellation of electronic tickets: In order for the CLUB to manage all registrations and cancellations of member registrations and subscribers, temporary or definite, football or basketball, the CLUB will treat the information you provide, including that which could be obtained from the navigation through the website. This information will allow the CLUB to know your profile, and thus be able to make better offers, and put at your disposal information that may be of interest to you about events and activities organized by the CLUB. The CLUB undertakes to process the data obtained and facilitated by you for the maintenance of its membership status, and the relationship it maintains with the CLUB, provided that this data is necessary for the purpose described.
3. Management of incidents in the stadium and infractions according to the Disciplinary Rules of the Club: Likewise, you are informed that the CLUB will process your personal data, as long as this relates to altercations, fights, brawls or public disorder in which you may be involved, as well as to deal with infractions stipulated in the Regulations of the Club's Disciplinary Committee. This data may be communicated to the authorities and security forces and bodies for judicial purposes and citizen security. On the other hand, you also know and consent that personal data related to such situations may be notified by these authorities to the CLUB for the purposes indicated above.

Additionally, in the event that you are part of the Madridista Loyalty Program, holding the status of Madridista¹, 

a) Real Madrid Football Club will process your personal data for the following purposes, according to the legal bases for processing indicated in each case:

1. To manage our relationship with you as a Madridista or as payer for the Madridista card, as it is necessary to comply with the General Conditions for the Madridista Loyalty Program and, in the case of legal representatives, parents or legal guardians, because of the legitimate interest we have in fulfilling the legal contract we have with the represented.
2. To allow you to recover your Madridista status in the event of incidents related to the subscription, based on our legitimate interest and unless you object.
3. To manage the Club’s financial records, on the basis of our legal obligations related to accountancy and tax law.
4. To send Madridistas communications related to special events, as we want them to feel like a part of this family, on the basis of our legitimate interest to keep with them a close, respectful relationship.
5. Additionally, and only if needed, we will process your data with purposes related to security and control, legal advice and compliance, on the basis of public interest and our legitimate interest in defending our interests and legal rights, avoiding conducts that do not comply with our internal norms and policies and to fulfil legal obligations (such as auditing, compliance with corporate crime law, data protection law and laws against violence, racism and xenophobia in sports).

b) Origin and retention period.

We have obtained your data from you, your legal representative or, additionally, from third parties: Parents or legal guardians of Madridistas who are considered minors or from a third party who bought you a Madridista card. Exceptionally, we could also receive your information from other sources, such as our internal report channel, witness or authorities. We will not, in any case, keep any unnecessary information.

Usually we will storage your data as long as you continue to be a part of the Madridistas colective and, afterwards, we will keep your data (properly blocked) during the period of time strictly stipulated by law and for the establishment, exercise or defence of legal claims . In the latter case, the data will be kept until the inspection, procedure or claim is finished.

Nevertheless, and unless objected to by a Madridista who decides to unsuscribe, some identification data will be storaged during 15 years after the unsubscription to allow the user to recover the same Madridista card number again, should the user ever decide to subscribe again to the service.
 

c) Categories of data subjected to the processing:

For the aforementioned purposes, the categories of data we process are: ID data (including your voice in the case of reports filled through our telephone number), contact data, data relevant to your personal charasteristics (such as yout birth date or language), economic data (relevant to the method of payment chosen), financial and related to transactions (transactions pertaining to the Club’s products and services). Rarely, we could also process different types of data that are also relevant to a possible incident, investigation or claim.
 

d) Recipients of your personal data:

In the context of the Program and for the previously mentioned purposes, we can share your personal data with the following:

• Financial entities for the management of collections and payments.
• Legends, as manager of the Club's oficial stores and joint controller, to ensure the proper discounts aplicable to Madridistas are correctly applied.
• Sports organizations and other Clubs, in the case you attend to matches, for the fans lists that are necessary by law.
• Public Administrations, other public bodies and other entities authorized by law, when it is required or necessary.
• Exceptionally, with Courts or other dispute resolution bodies (suchs as Arbitration Courts), the police, notaries and registrars.
• In the event you are gifting the Madridista card to someone else, we will be sharing with this other person that it was you who gifted the card.
• If you win any contests, we will share your data with our collaborators who make public the results of said contests.

Besides, the following suppliers have access to some of your personal data so they can provide us with their services, but we make sure they protect your data with as much care as we do and that they can only use your data when it is strictly necessary to the purposes stated above.

• Correos, Pdm and other post management companies.
• Worldline for the management of the Madridistas database.
• Alerce Force to accept subscriptions.
• DaVinci for the Madridistas recovery program.
• INDRA, Hearst and Avalón to manage contests.
• Microsoft Operations Irlenad Limited (storage and communications).
• UBITEX (To properly apply your discount in the photomarketing services of the Bernabéu Tour)
• Willis Consulting, S.L, Garrigues, Estudio Jurídico Rodriguez Mourullo, Elzaburu S.L.P., Ernst & Young and other firms to provide us with legal advice and consulting and auditing services.
• Audisec, S.L. to manage data protection incidents.
• Prodware.
• Other suppliers that can replace or complement the ones that were mentioned.

e) International Data Transfers.

With regard to the aforemetnioned purposes, in most cases your personal data will not leave Europe nor will your data be accessed from outside the EU, except for the case of Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States. For these transfers, the Standard Contractual Clauses approved by the European Commission apply, which, after the relevant assessments, have been deemed to provide an adequate level of protection for your rights at the destination.

Very exceptionally, we may need to transfer your personal data to:

• Sports organizations and other Clubs outside of the European Economic Area (EEA), as said transference is considered necessary on the General Conditions of the Madridistas Loyalty Proramme, on the basis of the contractual relationship between Real Madrid and the receiver of your data.
• Courts, Arbitration Courts and Mediators outside of the EEA, as the transfer is deemed necessary for the defence of our legal rights.

If you are one of our subscribers on the Facebook platform:

• Purpose and Legal Basis: Real Madrid will process your data within the Facebook platform to maintain and manage a proper relationship with you as our subscriber. The processing of your data is based on the Facebook Terms and Conditions applicable to this special and specific service, which determine the contractual relationship between the CLUB and its subscribers.
• Retention period: In relation to this purpose, your data will be processed exclusively as long as you are a subscriber of the CLUB through the platform set up for this purpose by Facebook and, subsequently and duly blocked, during the period legally provided for possible legal claims.
• Recipients of your data: Unless legally obliged to do so, the CLUB will not share your data with anyone.

If you were a member of one of the official supporters’ clubs associated with the CLUB (hereinafter, "Peñista"), Real Madrid will be able to process your data for the following purposes with additional character:

1. Management of the relationship with the Peñista: The CLUB will be able to process its data for the management of its Peñista status, including this service the development of any operation and, by way of example and not limitation, the modification and/or updating of its data.

In the event that you are a Legal Representative or Contact Person of any of the entities or individuals with which Real Madrid Club de Fútbol has a relationship, we will process your personal data as informed below:

• Purpose: Real Madrid Club de Fútbol process your personal data in order to control the development and fulfilment of the contracts subscribed by the Club and other entities or persons, as well as to maintain contact with them. The processing of your data is necessary for the fulfilment of the contractual relation, as well as to satisfy the legitimate interest of the Club in the indicated pursued purpose. Your data will not be used by Real Madrid for any ulterior purpose nor will they be the object of automated individual decisions.
• Category and origin of the data: The data of yours that we process are identifying and of a labour or professional nature and of another type (powers of attorney) and may have been provided to us by you or your legal representative, by the entity or person for whom you work or whom you represent and with whom the Club relates and who has been able to provide them to us directly or through another entity by virtue of a contract or commitment signed with the former.
• Storage period: We will store your data for these purposes for as long as the contractual relationship remains in force and subsequently, for an additional and foreseeable period of 5 years (or period that in the future is legally established for the prescription of personal claims) for the purposes of possible exercise or defense of claims.
• Recipients of your data: Your data may be communicated to the sponsoring and collaborating companies of the Club (which you can consult here), as well as to the Fundación Real Madrid provided that you have given us your consent to this effect or that it is necessary for the execution and fulfilment of the contracts subscribed by the Club. Additionally, if necessary, we may share your personal data with Administrations or Public Bodies (in order to obtain licences or project accreditation), Registrators and Notaries, legal service professionals and Courts or other dispute resolution bodies. In the event that any of these recipients is located outside the European Economic Area (EEA), such transfer is justified insofar as it is necessary for the conclusion or execution of a contract that is of interest to you, or because it is necessary for the formulation, exercise or defence of claims.

In case you request or acquire a ticket for a match/event or attend an event or match organized or co-organized by Real Madrid:

1. Real Madrid Club de Fútbol will process your personal data for the following purposes:

1. Manage the relationship with the Club and associated obligations, including the provision of post-sale service and management, invoicing and collection and the fulfilment of accounting and tax obligations. The Club is entitled to carry out these tasks as they are necessary for the development of the contractual relationship that binds the Club to you, as well as for compliance with the regulations to which the Club is subject.

2. Compliance and security control, which includes advice and legal defence of the Club, control of compliance with regulations, Covid detection and prevention, security in our facilities, including by means of video surveillance, as well as the security of games outside our facilities (including the making of a local supporters list), for which the Club is legitimised by the legitimate interest that the Club has in ensuring the correct development and safety in its activities, as well as being necessary to ensure the public interest and compliance with the regulations to which the Club is subject (among others, Law 19/2007 against violence, racism, xenophobia and intolerance in sports and supporting regulations, and, where applicable, Covid prevention protocols).

3. Diffusion of the event with informative purposes, based on the legitimate interest that assists the CLUB in this matter, the attendees’ image may be captured and diffused, in an accessory manner, during the recording and broadcasting of the event and/or match with informative purposes.

2. Origin and storage period: Your data has been provided to us directly by you or your legal representative or, exceptionally, by third parties: External portals authorized by the Club for the purchase of tickets, external Agencies and the Media which provide us with images of matches and events, as well as, only if applicable, people related to a claim or incident in which you may be involved or interested.
   
   We will store your data on an ordinary basis until the contracted services are provided and, thereafter, duly blocked, for a period of 5 years or the legal period foreseen for the eventual defense or filing of claims. However, the data related to the invoicing and accounting will be kept for a period of up to 10 years from the accrual date derived from the purchase of the ticket, and any data obtained from the recording as an attendee to the event and/or specific match will be stored for as long as the journalistic interest remains and, in any case, for the Club's own newspaper library.

3. Categories of personal data to be processed: For the aforementioned purposes, we process identifying data of personal, economic and/or financial characteristics relating to the transaction, the sales channel, date of the operation, amount of the operation, sector, row, seat, match ID, locator, time of the match, working day, type of entry (VIP or Regular), identification number in case you were a member of Real Madrid Club de Fútbol and/or part of the Madridista Loyalty Program, in the case of out-of-home matches the means of transport to the destination and, only if necessary, data relating to claims or incidents in which you may be involved or interested in. In addition, for certain events, such as the Congress of Medicine and Sciences Applied to Sport, we may also process professional or employment data.

4. Recipients of your data: We may share your data with the following entities and/or individuals:

• Financial entities for the management of collections and payments.
• Sports Organizations, rival Clubs, National Police (in the case of out-of-home matches).
• Tax Agency, Institute of Accounting and Account Auditing and other bodies, competent administrations and entities or that are legally qualified or authorized.
• In the event of eventual claims and/or infringements: Courts and Tribunals and other dispute resolution bodies, such as Arbitration Courts and mediators, State Security Forces and Corps, Notaries, Insurance Companies, Federations and Sports Clubs.
• In the unlikely event of a data protection incident: Spanish Data Protection Agency or other competent Control Authority, as well as other entities involved in a data protection incident to whom said incident has to be reported.
• Diffusion of the images of the match or event to external media, as well as to the general public through the Club's diffusion channels.

On the other hand, the following REAL MADRID providers may need access to some of your personal data that we process, in order to provide the contracted service: 

• Prodware Spain, S.A.
• Onebox Ibérica, S.L.
• Ilunion Outsourcing, S.A.
• Eventísimo, S.L.U.
• Correos and other companies of messaging and management of postal shipments.
• Providers of collection and accounting services.
• Computer and storage services (Microsoft Ireland Operations Limited).
• Professionals and companies of legal advice, consultancy and/or audit.
• Other suppliers that can complement or replace the previous ones.

5. International Data Transfers: As a result of data disclousures and/or the above referred processing agreements, your personal data may be transferred to:

• In relation to the matches, Sports Organizations, Federations and other Clubs outside the European Economic Area (EEA), being this transfer covered due to being necessary for the proper provision of the product/service purchased by you.
• Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States. For these transfers, the Standard Contractual Clauses approved by the European Commission apply, which, after the relevant assessments, have been deemed to provide an adequate level of protection for your rights at the destination.
• In the event of eventual claims and/or infringements involving interested parties outside the EEA: Courts, Tribunals, Arbitration Courts and Mediators, Insurance Entities and Federations and Sports Clubs outside the EEA, the transfer being covered as necessary for the formulation, exercise or defence of claims.

In case that you have acquired a Tour Bernabeu ticket:

a)  Real Madrid Club de Fútbol will process your personal data for the following purposes:

1. Manage the relationship with the Club and associated obligations: including the provision of post-sale service and management, invoicing and collection and the fulfilment of accounting and tax obligations. The Club is entitled to carry out these tasks as they are necessary for the development of the contractual relationship that binds the Club to you, as well as for compliance with the regulations to which the Club is subject.
2. Compliance and security control, which includes advice and legal defence of the Club, control of compliance with regulations, security in our facilities, including by means of video surveillance, as well as the security of games outside our facilities (including the making of a local supporters list), for which the Club is legitimised by the legitimate interest that the Club has in ensuring the correct development and safety in its activities, as well as being necessary to ensure the public interest and compliance with the regulations to which the Club is subject.
3. Photographs of the Tour and Mosaic. In the event that you request photographs and, in any case, for the realization of a live mosaic of the Tour attendees, we are legitimized by the contractual relationship that binds us with you and by your consent to use your image for the live mosaic.

b)  Origin and storage period:

Your data has been provided to us directly by you or your legal representative or, exceptionally, by third parties: external portals authorized by the Club for the purchase of tickets, as well as, only if applicable, persons related to a claim or incident in which you may be involved or interested.

We will store your data on an ordinary basis until the contracted services are provided and, thereafter, duly blocked, for a period of 5 years or the legal period foreseen for the eventual defense or filing of claims. However, the data related to the invoicing and accounting will be kept for a period of up to 10 years from the accrual date derived from the purchase of the ticket.

Your image data, in the event of a request to take photographs, will be kept for a period of 15 days. With regard to the photographs taken for the mosaic, it is continuously updated, so that its image will not be preserved for this purpose beyond the period of permanence in the mosaic of attendees.

c)  Categories of personal data to be processed:

For the aforementioned purposes, we process identifying data of personal, economic and/or financial characteristics relating to the transaction (means of payment), the sales channel, date of the operation, amount of the operation, type of ticket (adult, child, groups, etc.) and, only if necessary, data relating to claims or incidents in which you may be involved or interested in.

d)  Recipients of your data:

We may share your data with the following entities and/or individuals:

• Financial entities for the management of collections and payments.
• Tax Agency, Institute of Accounting and Account Auditing and other bodies, competent administrations and entities or that are legally qualified or authorized.
• In the event of eventual claims and/or infringements: Courts and Tribunals and other dispute resolution bodies, such as Arbitration Courts and mediators, State Security Forces and Corps, Notaries and Insurance Companies.
• In the unlikely event of a data protection incident: Spanish Data Protection Agency or other competent Control Authority, as well as other entities involved in a data protection incident to whom said incident has to be reported.

On the other hand, the following REAL MADRID providers may need access to some of your personal data that we process, in order to provide the contracted service:

• Companies collaborating in the sale of tickets.
• Company entrusted with the taking of photographs in the Tour Bernabéu.
• Correos and other companies of messaging and management of postal shipments.
• Providers of collection and accounting services.
• Computer and storage services (Microsoft Ireland Operations Limited).
• Professionals and companies of legal advice, consultancy and/or audit.
• Other suppliers that can complement or replace the previous ones.

e) International Data Transfers:

As a result of data disclosures and/or the above referred processing agreements, your personal data may be transferred to:

• Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States. For these transfers, the Standard Contractual Clauses approved by the European Commission apply, which, after the relevant assessments, have been deemed to provide an adequate level of protection for your rights at the destination.
• In the event of eventual claims and/or infringements involving interested parties outside the EEA: Courts, Tribunals, Arbitration Courts and Mediators, Insurance Entities and Federations and Sports Clubs outside the EEA, the transfer being covered as necessary for the formulation, exercise or defence of claims.

Finally, in the event that you register for any of the official CLUB websites, or the forms that the CLUB makes available to you, Real Madrid may process your data for the following purposes with additional character:

1. Management of registration and cancelations of users:In order for Real Madrid to manage all registrations and cancellations of user registrations made through any website, form or application made available to them, and whenever applicable, the CLUB will treat the information you provide, including that which may be obtained through any website, web form or application that is made available to you. This information will allow the CLUB to know your profile, and thus be able to make better offers, and put at your disposal information that may be of interest to you about events and activities organised by the CLUB. The CLUB undertakes to process the data obtained and provided by you for the maintenance of your registration as a user and for the management of your relationship with the CLUB, provided that this data is necessary for the purpose described, as well as for the management of the rest of purposes that we inform you.
2. The personalisation of our commercial and promotional offers: During the maintenance of your relationship with the CLUB, the personal data that you make available to us through any website, web form or application made available to you, or the contracting of products and services, may be subject to automated decisions that have legal effects on their person, as well as the creation of profiles, including automatic techniques that use the current data, navigation data from cookies, historical and statistical, data that can be obtained through other sources of information (third-party sources and social networks), for the optimization of the product offers that we offer, prices and new proposals, through segmentation in different groups in relation to common patterns. This process will only be carried out if the CLUB has the consent of the interested party.
3. Processing of data relating to own and third party cookies in order to analyse your browsing habits and improve services: You can consult the detail of the information on the cookies policy of Real Madrid in the use of the aforementioned data in the following link https://www.realmadrid.com/en/legal/cookies-policy.

a) Purpose and legal basis: Real Madrid Club de Fútbol will process your personal data to process your complaint and proceed with the review, monitoring, and execution of the criminal risk prevention system implemented in the Club. Within the execution is understood the filing of complaints, lawsuits, or any other procedure in defense of the interests of the Club. The processing is carried out based on our legitimate interest in the prevention of criminal liability and in avoiding harmful and damaging conduct, as well as under the legal obligations applicable to the Club in terms of crime prevention (art. 31 bis of the Penal Code and concordant regulations).

b) Retention period: We will keep your data for a maximum period of three months after the filing of the complaint if the facts have not been proven and, subsequently, duly blocked if it is not possible to anonymize the information, only during the legal period for the establishment, exercise or defence of legal claims or while they are necessary for evidentiary purposes of due control and supervision in the prevention of crimes. If the facts are proven or with sufficient evidence, the data will be retained as long as necessary for the exercise by the Club of its rights in court. 

c) Recipients of your data: When necessary, we will share your data with the following entities:
 
- Public Administrations, other Public Bodies and entities authorized by law, when required or necessary.
- Courts and Tribunals or other dispute resolution bodies, such as Arbitration Courts and mediators, State Security Forces and Corps, Public Prosecutors and Notaries.
 
In addition, our following vendors have access to some of your personal data in order to provide us with the required services, but we ensure that they apply high protection guarantees and that they can only use the data for what is strictly necessary for the purpose detailed above:
 
- Microsoft Ireland Operations Limited (storage and communications).
- Rodriguez Mourullo Law Firm.
- Other providers that may complement or replace the above.

d) International data transfers: Concerning the purposes indicated above, in most cases your data will not be accessed from outside Europe. However, our supplier Microsoft Ireland Operations Limited, which may transfer your data to servers in the United States. For these transfers, the Standard Contractual Clauses approved by the European Commission apply, which, after the relevant assessments, have been deemed to provide an adequate level of protection for your rights at the destination..
 
In addition, on an extremely exceptional basis, we may need to transfer your data to public administrations and agencies, courts, tribunals and other dispute resolution systems outside the EEA, as necessary for the establishment, exercise or defense of claims, as the case may be.