Privacy policy

1. INTRODUCTION

ATHLETIC CLUB is committed to protecting privacy and the correct use of personal data that it processes and that you provide us both online on this website and, where applicable, any of its sub-domains, micro-sites and/or mobile applications, and offline.

Please read this policy carefully and make sure that you understand it and agree to it before providing us with your personal data. If you do not agree with it, do not use this website or its services or provide us with your data.

2. The following are jointly responsible for this treatment...

ATHLETIC CLUB
Postal address: Alameda de Mazarredo 23, 48009 Bilbao
E-mail: [email protected]
Tel: 94 424 08 77

and

FUNDACION ATHLETIC CLUB FUNDAZIOA
Postal address: Alameda de Mazarredo 23, 48009 Bilbao
E-mail: [email protected]
Tel: 94 661 20 04

3. HOW DID WE OBTAIN YOUR DATA?

Obtained from the data subject

You provided your details to us when you applied to become a Club Athletic supporter, or when you contacted us asking for information

By providing us with your details, you guarantee that you are entitled to do so, and that the information is accurate, up to date, and does not infringe any contractual restrictions or third party rights. You are responsible for keeping your data accurate and up-to-date, and ATHLETIC CLUB accepts no liability if you fail to do so. You undertake not to impersonate other users by using their registration data for the different services and/or contents on the website.

Obtained automatically when visiting our website

When you visit our website, we collect information through cookies and other tracking and web analytics technologies. That means that data is sent from your browser to our servers to optimise our services and improve your user experience. These data may be automatically collected and stored by us or by third parties on our behalf. Please see our cookie policy.

Retargeting technology on the Internet

Our website does NOT use retargeting technology on the Internet, but we do use these technologies on Google, social networks, etc. We think that personalised advertising, based on your interests, is more interesting for our members/supporters than advertising with no personal connection.

To do this, we work with companies that use tracking technologies to show our advertisements on the Internet. Retargeting technologies may collect information about your visits to our website and your interaction with our communications, including advertising. They analyse your cookies and will show you advertising based on your browsing behaviour, both on our website and on other third party sites. We do not store your personal data using this technology, as they are stored in your own browser.

Obtained from someone other than the data subject

It is possible that your data were not provided to us directly by you, but by a third party. For example: Someone who decides to give you a Club Athletic supporter’s card as a gift. In that scenario, the categories of data that we may process are mainly related to the identification and contact details of the person who will become a supporter.

As far as the data of other people is concerned, you must respect their privacy, taking particular care when passing on or publishing their personal data. Only the data subject may authorise the processing of their personal data. In addition to infringing the legislation on data protection, the publication of third party data without their consent may also infringe legislation relating to the right to honour, right to privacy or the right to self image of third parties.

Anyone who provides data of third parties is responsible for: a) ensuring that they have their prior and express consent to use it, and b) informing them of the processing that we will carry out with their data. By accepting this privacy policy, anyone who provides third party data hereby expressly warrants that they are authorised to provide such data, thereby exonerating us from any liability in the event of any claim by the data subject.

4. WHAT TYPES OF DATA DO WE PROCESS?

The categories of data we process may include:

Obtained from the data subject or from a third party who decides to give the Club Athletic supporter card as a gift:

IDENTIFICATION DATA AND CONTACT DETAILS:
Name, surname(s), ID number, e-mail, phone number, postal address and shipping address (if they are different), username, supporter number, images of identifiable people on the website.
PERSONAL DATA:
Date of birth, communication preferences, language of communication.
ECONOMIC DATA:
Last 4 digits of credit card number, card expiration date.
GOODS AND SERVICES TRANSACTIONS:
Goods and services received by the data subject; transactions made.

We do not retain information on online transactions, as this information is only managed by the entity that owns the payment gateway.

Obtained automatically when visiting our website:

IP address of the user, date and time of the visit, URL of the site from where the user came, pages visited on our website, information on the browser used (browser type and version, operating system, etc.). Also online profile data (information on preferences and interests, browsing and purchasing habits, commercial actions that have been carried out or information requested), in order to send you personalised information or for exclusive campaigns…

Special data categories:

We do not process special categories of data on this website.

Data from minors

If you are under the age of 14, you can only become a supporter with the permission and consent of your parents. Ask them to help you fill in the forms where we ask for your personal details.

Parents of children under the age of 14 must prevent minors in their care from accessing websites and apps and/or providing personal data without their supervision, and the Club shall accept no responsibility in this regard.

If we find that a child under the age of 14 has registered without permission, we may ask their parents or guardians to send the appropriate documents proving that they have given their permission. Otherwise, the user or registration will be deregistered as soon as possible.

If parents, guardians or legal representatives of minors find that data has been processed without their permission, they may submit their complaints or enquiries by writing to [email protected].

5. WHY DO WE PROCESS YOUR DATA AND WHAT LEGITIMACY DO WE HAVE TO DO SO?

We may process the data you provide to us and all data generated during the development of the relationship we have with you for different purposes with different legal grounds:

PURPOSE

LEGAL BASIS

Contractual relationship

Sending current customers information about our activities, products and/or services similar to those requested, by means of electronic communications.
Installation of technical cookies.
Producing a simple commercial profile based on the information you provide, and information obtained from your browsing. This helps us get to know you better and tailor the information we send you to your preferences. To do this, we will use certain criteria (such as your browsing behaviour, participation and how you interact with our website [visits, specific clicks on the site and its advertisements, downloads, etc.], your requests for information, your newsletter subscriptions, etc.), to provide you with personalised information, based on your profile.
Carrying out opinion polls / satisfaction surveys.
For users of our website, or senders or recipients of an email: managing online requests, and contacting you.
Photographs and/or videos may be taken for events and activities that are public acts or in places open to the public, where a relevant cultural interest predominates, such as matches, player presentations, etc., and published on this website, or on our social network profiles, as well as on YouTube to provide information about the event/activity, to document it, and as part of the photographic/video memory of the event, as long as the image of a specific person appears as a merely incidental part of the information about the event.

Legitimate interest

When the legitimacy is based on our legitimate interest, we believe that the processing of your data described above is proportionate and has a minimal impact on your privacy, but your interests, rights and freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please send us an e-mail to [email protected] and we shall refrain from doing so.

Specific information regarding legitimate interest as a legal basis for sending information to supporters by means of electronic communications about our activities, products and/or services similar to those requested: This legitimate interest is foreseeable for the data subject as a supporter; the impact of the processing on data subjects is very limited; we have a procedure for sending commercial communications to ensure that we comply with data protection regulations; we have carried out a weighting analysis of this legitimate interest that can be requested by the data subject, and they can always express their opposition to these communications being sent. Therefore, we believe that the sending of commercial communications is proportionate and has a minimal impact on your privacy, but your interests, rights and freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please send us an e-mail to [email protected] and we shall refrain from doing so.

Specific information on legitimate interest as a legal basis for capturing images. This legitimate interest is foreseeable for the data subject given the fact that participants at events/activities can reasonably expect us to capture/disseminate images that are merely incidental to the event/activity in order to graphically document it; we have a procedure for capturing and disseminating images to ensure that we comply with data protection regulations and minimise the data to be processed; we have carried out a weighting analysis of this legitimate interest that can be requested by the data subject, and they can always express their consent/opposition to their image being captured/disseminated. Therefore, we consider that capturing images during these activities or events is proportionate and has a minimal impact on privacy, but your interests, rights and freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please let us know at the event/activity itself or send us an e-mail to [email protected], and we shall consider your request.

6. HOW LONG WILL WE KEEP YOUR DATA?

We will keep any personal data you provide us with for the duration of the contractual, pre-contractual or commercial relationship and, once these have ended, for as long as the data subject does not request us to delete them. We may keep them, even if deletion is requested, for as long as necessary, and may limit their processing solely for the purposes of:

In line with the above criteria, the deletion of personal data either in computerised records or on paper may be carried out at the organisation’s discretion, depending on logistical and/or storage space requirements that make it desirable to delete information or documentation.

7. TO WHOM MAY WE COMMUNICATE YOUR DATA?

Any data you provide us with may be disclosed to third parties to fulfil purposes directly related to the legitimate functions of the transferor and transferee, such as:

Banking institutions: and/or to the different institutions that may be required to provide the different collection and payment services arising from them at any given time.
If you are a participant in one of our competitions, the details of winners will be passed on to the companies responsible for providing the prizes and, where appropriate, we may pass on details of participants to the jury, although we will endeavour to send them pseudonymised.
Transport companies: responsible for the logistics of shipping and delivering our services and products.
We will pass data between the Club and the Athletic Foundation where this is necessary to manage the benefits or rights to which the supporter is entitled.
Entities with which agreements have been reached that involve advantages, benefits or discounts for supporters who need to verify their status as such (Castore, for discounts in physical and online shops, La Unión for the Mugituz programme for travel to the stadium on match days, etc.).

INTERNATIONAL DATA TRANSFERS

ATHLETIC CLUB will ensure that personal data is always processed and located in the European Economic Area. However, in certain circumstances, we may make international data transfers. For example, we may do this where it is necessary for entering into or executing a contract, in the interest of the data subject, between ATHLETIC CLUB and another natural or legal person; or where it is necessary to execute a contract between the data subject and ATHLETIC CLUB, for example when using service providers located outside the European Union, who may have access to personal data to provide ancillary services to our business (hosting, housing, SaaS, remote backups, IT support and maintenance services, e-mail managers, sending e-mails and e-mail marketing, file transfers, etc.) or to carry out pre-contractual measures adopted at the request of the data subject.

These entities may be different and vary over time, but we will choose entities either from countries with a level of data protection equivalent to the European level, or with adequate safeguards to achieve that level, or based on one of the exceptions provided for in the GDPR.

8. SOCIAL NETWORKS AND INSTANT MESSAGING APPLICATIONS

Use of instant messaging

If we provide you with an instant messaging App to make it easier to communicate with you, please use it responsibly, read its privacy policy and configure it according to your preferences before sending information with personal data by this means. Although these types of instant messaging applications can be useful in certain circumstances, we would like to remind you that the information you post on the Internet is accessible to many people, both known and unknown, so there is a risk to your privacy and that of others. We recommend that you do not provide personal, private and/or intimate information or information that you wish to keep confidential, as there are more secure ways to do so. We cannot be held responsible for how the service works and its availability, as it is not provided by us but by third parties.

Use of social networks

Users can join the Club’s pages or groups on different social networks. Bear in mind that, unless the Club requests your data directly (e.g. to answer enquiries in a private environment), your data will belong to the social network concerned. Therefore, users are advised to carefully read the terms and conditions of use and privacy policies of the social network concerned, and to make sure that they set their preferences regarding how their data will be processed.

Rules for using social networks
Bear in mind that if you decide to take part in, publish or share content through our official web page on a social network, this content will be public, and it will be your sole responsibility to ensure that such content complies with legal regulations. You can prevent your personal data linked to these entries from appearing by configuring your privacy settings, or by pseudonymising your data (e.g. by using a nickname or alias).

Please remember that, as far as the data of other people is concerned, you must respect their privacy, taking particular care when passing on or publishing their personal data. Only the data subject may authorise the processing of their personal data.
Users may only publish personal details, photographs, information or other content that belongs to them or for which they are authorised to do so by a third party on this website or on our official social media page. If you publish third party data, it is your responsibility to have the prior and express consent of the third party to use and publish it. In addition to infringing the legislation on data protection, the publication of third party data without their consent may also infringe legislation relating to the right to honour, right to privacy or the right to self image of third parties.

In any event, we may remove any content published by the user from this website and from our pages on social networks if we detect that it has violated current legislation, and the provisions of this privacy policy.

The social networks are not hosted directly by our services. Your interactions with them are governed by their policies, not ours. Please read the privacy policies of those social networks for more detailed information about how they collect and transfer personal data, your rights and privacy settings.
Data we collect through social networks
We collect data through these applications, specifically through functional and analytical cookies to enable them to function properly. These cookies may collect information about your IP address and your browsing habits.

If you log in to one of these social networks during your visit to one of our websites or mobile applications, the social network may also add that information to your profile and that information will be transferred to the social network. If you do not want this data to be transferred, please log out of your social network before logging into our websites or mobile applications, as we are unable to exercise any influence over the collection and transfer of data via social plug-ins.
Other third party sites on our website
Likewise, we may offer third-party content or services on our website (using framing techniques), preserving the appearance of our website, and displaying the third party service provider on it. Remember that the information you will be providing will go to those third parties and not to us, so the policies of those third parties will apply and not ours.

9. WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE US YOUR DATA?

Where necessary, you may exercise your rights of access, rectification, deletion, limitation and opposition to the processing of your data, as well as other rights, at the postal or e-mail address indicated at the start of this privacy policy, in both cases by means of a signed request in writing, enclosing a copy of your ID card or passport or other valid document that identifies you. If you wish to modify your data, you must notify the Club at the same address, with the Club disclaiming all liability if you fail to do so.

Right of access:
You can ask us what personal data we are processing and even ask us for a copy of them.
Right of rectification:
You can ask us to rectify inaccurate personal data or to complete those which are incomplete, including by means of an additional statement.
Right of erasure (right to be forgotten):
You can request us to delete your personal data when: they are not necessary for the purposes for which they were collected, you withdraw your consent, they have been unlawfully processed or to comply with a legal obligation.
Right to limitation of processing: You can request us to limit the processing of your personal data, in which case we will only retain them for asserting or defending claims.
Right of opposition: You can object to the processing of your data if such treatment is based on the legitimate interest of the data controller or for advertising purposes.

Once we have received any of the above requests, we shall respond to you within the legally established time frames You may to make a complaint before the Spanish Data Protection Agency. If you would like more information about the rights that you may exercise and to request model forms to exercise your rights, you can visit the website of the Spanish Data Protection Agency at: www.aepd.es.