Fundación Athletic Club

Privacy Policy


ATHLETIC CLUB is committed to protecting privacy and the correct use of personal data that it processes and that you provide us both online on this website and, where applicable, any of its sub-domains, micro-sites and/or mobile applications, and offline.
Please read this policy carefully and make sure that you understand it and agree to it before providing us with your personal data. If you do not agree with it, do not use this website or its services or provide us with your data.


Postal address: Alameda de Mazarredo 23, 48009 Bilbao
E-mail: [email protected]
Tel: 94 424 08 77


Obtained from the data subject

You provided your details to us when you applied to become a Club Athletic supporter, or when you contacted us asking for information
By providing us with your details, you guarantee that you are entitled to do so, and that the information is accurate, up to date, and does not infringe any contractual restrictions or third party rights. You are responsible for keeping your data accurate and up-to-date, and ATHLETIC CLUB accepts no liability if you fail to do so. You undertake not to impersonate other users by using their registration data for the different services and/or contents on the website.

Obtained automatically when visiting our website

When you visit our website, we collect information through cookies and other tracking and web analytics technologies. That means that data is sent from your browser to our servers to optimise our services and improve your user experience. These data may be automatically collected and stored by us or by third parties on our behalf. Please see our cookie policy.

Retargeting technology on the Internet

Our website does NOT use retargeting technology on the Internet, but we do use these technologies on Google, social networks, etc. We think that personalised advertising, based on your interests, is more interesting for our members/supporters than advertising with no personal connection.
To do this, we work with companies that use tracking technologies to show our advertisements on the Internet. Retargeting technologies may collect information about your visits to our website and your interaction with our communications, including advertising. They analyse your cookies and will show you advertising based on your browsing behaviour, both on our website and on other third party sites. We do not store your personal data using this technology, as they are stored in your own browser.

Obtained from someone other than the data subject

It is possible that your data were not provided to us directly by you, but by a third party. For example: Someone who decides to give you a Club Athletic supporter’s card as a gift. In that scenario, the categories of data that we may process are mainly related to the identification and contact details of the person who will become a supporter.
As far as the data of other people is concerned, you must respect their privacy, taking particular care when passing on or publishing their personal data. Only the data subject may authorise the processing of their personal data. In addition to infringing the legislation on data protection, the publication of third party data without their consent may also infringe legislation relating to the right to honour, right to privacy or the right to self image of third parties.
Anyone who provides data of third parties is responsible for: a) ensuring that they have their prior and express consent to use it, and b) informing them of the processing that we will carry out with their data. By accepting this privacy policy, anyone who provides third party data hereby expressly warrants that they are authorised to provide such data, thereby exonerating us from any liability in the event of any claim by the data subject.


The categories of data we process may include:

Obtained from the data subject or from a third party who decides to give the Club Athletic supporter card as a gift:

We do not retain information on online transactions, as this information is only managed by the entity that owns the payment gateway.

Obtained automatically when visiting our website:

IP address of the user, date and time of the visit, URL of the site from where the user came, pages visited on our website, information on the browser used (browser type and version, operating system, etc.). Also online profile data (information on preferences and interests, browsing and purchasing habits, commercial actions that have been carried out or information requested), in order to send you personalised information or for exclusive campaigns…

Special data categories:

We do not process special categories of data on this website.

Data from minors

If you are under the age of 14, you can only become a supporter with the permission and consent of your parents. Ask them to help you fill in the forms where we ask for your personal details.
Parents of children under the age of 14 must prevent minors in their care from accessing websites and apps and/or providing personal data without their supervision, and the Club shall accept no responsibility in this regard.
If we find that a child under the age of 14 has registered without permission, we may ask their parents or guardians to send the appropriate documents proving that they have given their permission. Otherwise, the user or registration will be deregistered as soon as possible.
If parents, guardians or legal representatives of minors find that data has been processed without their permission, they may submit their complaints or enquiries by writing to [email protected].


We may process the data you provide to us and all data generated during the development of the relationship we have with you for different purposes with different legal grounds:



Contractual relationship
Legitimate interest
When the legitimacy is based on our legitimate interest, we believe that the processing of your data described above is proportionate and has a minimal impact on your privacy, but your interests, rights and freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please send us an e-mail to [email protected] and we shall refrain from doing so.
Specific information regarding legitimate interest as a legal basis for sending information to supporters by means of electronic communications about our activities, products and/or services similar to those requested: This legitimate interest is foreseeable for the data subject as a supporter; the impact of the processing on data subjects is very limited; we have a procedure for sending commercial communications to ensure that we comply with data protection regulations; we have carried out a weighting analysis of this legitimate interest that can be requested by the data subject, and they can always express their opposition to these communications being sent. Therefore, we believe that the sending of commercial communications is proportionate and has a minimal impact on your privacy, but your interests, rights and freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please send us an e-mail to [email protected] and we shall refrain from doing so.
Specific information on legitimate interest as a legal basis for capturing images. This legitimate interest is foreseeable for the data subject given the fact that participants at events/activities can reasonably expect us to capture/disseminate images that are merely incidental to the event/activity in order to graphically document it; we have a procedure for capturing and disseminating images to ensure that we comply with data protection regulations and minimise the data to be processed; we have carried out a weighting analysis of this legitimate interest that can be requested by the data subject, and they can always express their consent/opposition to their image being captured/disseminated. Therefore, we consider that capturing images during these activities or events is proportionate and has a minimal impact on privacy, but your interests, rights and freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please let us know at the event/activity itself or send us an e-mail to [email protected], and we shall consider your request.


We will keep any personal data you provide us with for the duration of the contractual, pre-contractual or commercial relationship and, once these have ended, for as long as the data subject does not request us to delete them. We may keep them, even if deletion is requested, for as long as necessary, and may limit their processing solely for the purposes of:
In line with the above criteria, the deletion of personal data either in computerised records or on paper may be carried out at the organisation’s discretion, depending on logistical and/or storage space requirements that make it desirable to delete information or documentation.


Any data you provide us with may be disclosed to third parties to fulfil purposes directly related to the legitimate functions of the transferor and transferee, such as:


ATHLETIC CLUB will ensure that personal data is always processed and located in the European Economic Area. However, in certain circumstances, we may make international data transfers. For example, we may do this where it is necessary for entering into or executing a contract, in the interest of the data subject, between ATHLETIC CLUB and another natural or legal person; or where it is necessary to execute a contract between the data subject and ATHLETIC CLUB, for example when using service providers located outside the European Union, who may have access to personal data to provide ancillary services to our business (hosting, housing, SaaS, remote backups, IT support and maintenance services, e-mail managers, sending e-mails and e-mail marketing, file transfers, etc.) or to carry out pre-contractual measures adopted at the request of the data subject.
These entities may be different and vary over time, but we will choose entities either from countries with a level of data protection equivalent to the European level, or with adequate safeguards to achieve that level, or based on one of the exceptions provided for in the GDPR.


Use of instant messaging

If we provide you with an instant messaging App to make it easier to communicate with you, please use it responsibly, read its privacy policy and configure it according to your preferences before sending information with personal data by this means. Although these types of instant messaging applications can be useful in certain circumstances, we would like to remind you that the information you post on the Internet is accessible to many people, both known and unknown, so there is a risk to your privacy and that of others. We recommend that you do not provide personal, private and/or intimate information or information that you wish to keep confidential, as there are more secure ways to do so. We cannot be held responsible for how the service works and its availability, as it is not provided by us but by third parties.

Use of social networks

Users can join the Club’s pages or groups on different social networks. Bear in mind that, unless the Club requests your data directly (e.g. to answer enquiries in a private environment), your data will belong to the social network concerned. Therefore, users are advised to carefully read the terms and conditions of use and privacy policies of the social network concerned, and to make sure that they set their preferences regarding how their data will be processed.


Where necessary, you may exercise your rights of access, rectification, deletion, limitation and opposition to the processing of your data, as well as other rights, at the postal or e-mail address indicated at the start of this privacy policy, in both cases by means of a signed request in writing, enclosing a copy of your ID card or passport or other valid document that identifies you. If you wish to modify your data, you must notify the Club at the same address, with the Club disclaiming all liability if you fail to do so.
Once we have received any of the above requests, we shall respond to you within the legally established time frames You may to make a complaint before the Spanish Data Protection Agency. If you would like more information about the rights that you may exercise and to request model forms to exercise your rights, you can visit the website of the Spanish Data Protection Agency at: