RCDE STADIUM – Web oficial

1. Who handles the information?

Identity	REIAL CLUB DEPORTIU ESPANYOL DE BARCELONA, S.A.D.
C.I.F.:	A-08.357.139
Address:	Avenida del Baix Llobregat, 100. Cornellà de Llobregat (08940)
Email:	info@rcdespanyol.com
DPD:	dpd@rcdespanyol.com

2. What data is given to us?

Personal identification and contact data.
Data related to social and personal circumstances that may affect the benefits that can be obtained as a member/season ticket holder and other RCDE benefits.
Economic and financial data: Means of payment used for the registration fee, renewals and transactions carried out for RCDE products and services.
The connection, geolocation and navigation data provided by cookies, or the permissions that have been assigned to the browser from which the web page is accessed, may be captured if accessed by mobile phone.
Academic and professional data: Training/degree, professional experience.
Other types of information that is relevant in a possible incident, investigation or claim.
Any information published or disclosed through the RCDE profiles on social networks. It is recommended that the user review the conditions of use and privacy policy of the social networks.
Other data inferred as a result of the use and activity carried out on the Website (registered user ID; device ID; operating system; device model and telemetry) or interactions with communications sent via web or email notification.

3. For what purpose do we process your data?

Main purposes

Reasons	Legal standing
Requests/Queries. To manage and attend to possible requests/queries. This information will allow RCDE to respond and provide solutions that suit the user’s needs.	The handling can be carried out based on the consent given when sending a query/request.
Members/Season Ticket Holders. Comply with the contractual relationship and its maintenance, and in particular, manage its registration, cancellation, renewal, update of data, discounts due to status of the holder, application of season ticket advantages, allocation of seat when appropriate, issuance and delivery of the corresponding card, economic, accounting, fiscal and administrative management, processing the request for tickets to access matches that are played in our facilities, access control and security, as well as security measures in matches outside our facilities, management of violations of the Disciplinary Regulations; sending communications that are of interest and necessary for the execution of the contract, regarding renewal periods, the deadlines to improve seats, the date of the bank charge, the advantages applicable for being a member, etc.	The handling is necessary for the execution of a contractual relationship and compliance with the regulations to which we are subject (among others, Law 19/2007 against violence, racism, xenophobia and intolerance in sport and the regulations that are involved in it).
Match/event ticket holders. Comply with the contractual relationship and its maintenance, economic, accounting, fiscal and administrative management, entry control and security in our facilities, as well as sending communications that are always of interest and necessary for the execution of the contract.	The handling is necessary for the execution of a contractual relationship and compliance with the regulations to which we are subject (among others, Law 19/2007 against violence, racism, xenophobia and intolerance in sport and the regulations that are involved in it).
Working for RCDE. If you complete the application form to work for RCDE and send your CV and, optionally, a cover letter, we will process your personal data in order to assess and manage your job application and, where appropriate, carry out the necessary actions for the selection and hiring of personnel, in order to offer you positions that fit your profile.	The handling can be carried out based on the consent given when completing the form to work at RCDE, sending us a CV and, optionally, a cover letter.
Escuela RCDE school/Camps. TComply with the contractual relationship and its maintenance, and in particular, process registration for RCDE Soccer School / Skill Courses / Campus, as well as carry out the procedures derived for participation in them. In the undertaking of activities with the purpose of promoting the activities and events of the RCDE Soccer School/ Skill Courses/Summer Camp on social networks, the RCDE website and other media, photographs or videos may be taken in which the attendee could appear individually or in a group, and the corresponding consent will always be requested.	The handling is necessary for the execution of a contractual relationship.
RCDE Tour. Comply with the contractual relationship and its maintenance, economic, accounting, fiscal and administrative management, security in our facilities, as well as sending communications that are always of interest and necessary for the execution of the contract.	The handling is necessary for the execution of a contractual relationship and compliance with regulations to which we are subject.
Prize draws, contests, promotions and games. Manage participation in raffles, contests, promotions and games that RCDE carry out, as well as follow-up, publishing the prizes or any additional relevant information.	The handling can be carried out based on the consent given, prior acceptance of the legal terms of the draw, contest, promotion or game.
Canal.etic@rcdespanyol.com Handle your data to process a complaint and proceed to the review, monitoring and execution of the criminal risk prevention system implemented by RCDE.	The handling can be carried out based on the legitimate interest that RCDE hold in the prevention of criminal responsibilities and in avoiding behaviours contrary to the code of conduct of RCDE, as well as by virtue of the legal obligations for crime prevention..
RCDE Store. Comply with the contractual relationship and its maintenance, and in particular manage purchases (processing of orders, sending the order and managing the billing and collection of the amount to be paid), customer service and management of the communications necessary for the supply of products, orders and requests, management of claims and requests for information in relation to the products purchased.	The handling is necessary for the execution of a contractual relationship in which you are a party.
RCDE Commercial Communications. Send communications and commercial offers for RCDE activities, products and services the same or similar to those previously contracted or acquired.	The handling can be carried out based on the legitimate interest that RCDE holds and we will treat your personal information for these purposes, as long as the user does not oppose said handling.

Additional purposes

Commercial Communications: So that RCDE can send you newsletters and commercial communications related to the activities, products, services and promotions of RCDE and sponsors and collaborators, by any means, including electronic, without implying the communication of personal data to said third parties.

The legal basis for the processing of data for the aforementioned purpose is the consent that given for the specific purposes selected by virtue of the provisions of art. 6.1 a) of the General Data Protection Regulation. Personal data will be kept for this purpose until the user revokes the consent granted.

You have the right to withdraw your consent at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?"”, without affecting the legality of the handling based on consent prior to its withdrawal.

Creation of simple profiles: So that RCDE can send segmented commercial communications via email, SMS, about the content mentioned in the "Commercial Communications" section.

The information mentioned above will be aimed at simple segments (groups of users that are created based on the information provided by them in their profile) that RCDE can prepare taking into account the following:

Low level of detail of the profile. RCDE could create simple segments such as, for example, segments for women over 25 years old.
A limited profile. To create the segments, RCDE will only process the personal data provided on this Website. In particular, the RCDE will use the following personal data:

Country of residence.
Region or province.
Age.
Sex.
City of residence.
Language.
Postcode.

Positive consequences for the user. RCDE may send commercial communications that best suit the profile declared, avoiding unwanted commercial communications or uninteresting content.

The legal basis for the aforementioned purpose is the legitimate interest of RCDE in making effective use of the personal data provided by the user, to achieve greater interest and return on the communications sent. Before doing so, we inform that RCDE has carried out a proportionality analysis between its legitimate interest and the rights and freedoms of its users, the conclusions of which can be requested by sending an email to za href="mailto:"dpd@rcdespanyol.com" title="dpd@rcdespanyol.com">dpd@rcdespanyol.com.

You have the right to oppose the aforementioned purpose at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?"

Elaboration of exhaustive profiles:

Experiences and personalised information: So that RCDE can send personalised commercial communications via email, SMS about the content mentioned in "Commercial Communications"

The information mentioned above will be directed to the exhaustive segments (groups of users that are made based on the information obtained from them) or is inferred from the use they make of the Website based on:

Interactions with communications or notifications received (for example, clicking on the content of a communication);
Data inferred as a result of the use and activity on the Website (device ID, registered user ID, device model, operating system and telemetry, for example, clicking on certain content or the time you remain on the section)

In addition, RCDE will generate said segments taking into account the following profiling techniques:

Measurement of individual performance of campaigns: RCDE will use the information related to opening rates, average click rates, email bounces or the cancellation rates of memberships to measure the performance of a campaign at an individual level and as a consequence carry out segmentations based on the information inferred and the rest of the information declared. 
Campaign optimisation: We will exclude you from advertising campaigns about prize draws in which you have participated, about applications in which you have registered or downloaded, about products that you have purchased or about services that you have previously purchased.
Users similar to your tastes and preferences: Thanks to the profile that RCDE creates, we can send personalised content taking into account other profiles similar to yours.

The legal basis for the processing of data for the aforementioned purposes is the consent given for the processing of data for the selected purposes. Personal data will be kept for these purposes until the user revokes the consent granted.

You have the right to withdraw your consent at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?", without affecting the legality of the handling based on consent prior to its withdrawal.

Elaboration of exhaustive profiles: RCDE will prepare an exhaustive profile to offer personalised advertising, information, services and products by sending personalised commercial communications via email, SMS, or other instant messaging channels, sending personalised push or in-app notifications (always with prior consent for the purpose of "Commercial Communications") or show banners with personalised advertising on websites, applications or social networks about the products and services of RCDE.

In this way, the information mentioned above will be directed to the segments (groups of users that are made based on the information obtained from them or the use made of the Website) that we can prepare based on the following data sources:

Interactions with communications or notifications received.
Data inferred as a result of use of the Website.

In addition, RCDE will generate said segments taking into account the following profiling techniques:

Measurement of the individual performance of campaigns: RCDE will use the information related to the opening rates, average click rates, email bounces or membership cancellation rates to measure the performance of the campaign on an individual level and, as a consequence, perform segmentations based on the information inferred and the rest of the information declared.

Campaign optimization: We will exclude users from advertising campaigns about sweepstakes in which they have participated, about applications in which they have registered or have downloaded, about products purchased or about services previously purchased.

Users similar to your tastes and preferences: Thanks to the profile that RCDE carries out, we can send personalised content taking into account other similar profiles.

User evaluation: RCDE will obtain an unknown variable from known variables provided or inferred, so that they can carry out an analysis of users with the aim of identifying those with a greater propensity to use or contract RCDE products, and in such cases, offer RCDE products and services.

How long will we keep your personal data?

The personal data that we process will be kept as long as the purposes that motivated its collection persist and/or the users do not revoke the consents granted, or the user does not exercise their rights to suppress, oppose or limit the handling.

RCDE will keep personal data, duly secured, for the following conservation period with the sole purpose of meeting legal responsibilities of any kind that may arise during the limitation period of the actions that may arise from the relationship maintained with the interested party.

To which recipients will your personal data be communicated?

In general, RCDE will not transfer your personal data, except in the following cases to competent authorities and bodies, courts, tribunals or any other legitimate third parties in accordance with the applicable regulations.

However, RCDE have contracted the provision of certain services (e.g. virtual infrastructure services, cloud computing, etc.) to providers, who may have access to and/or process personal data. Some of these providers may process and store personal information on servers located outside the user’s country of residence. You can consult the details of these providers by sending an email to: dpd@rcdespanyol.com.

Therefore, depending on the user's location, the transfer of data to other countries could occur. In such case, personal data may be transferred internationally to third parties located outside the European Economic Area ("EEA"), provided that RCDE have the authority to do so and subject to compliance with the appropriate safeguards set out in articles 44 to 50 of the GDPR. Said third parties will only access the data to carry out their services in the name and on behalf of RCDE, under an obligation of confidentiality and always following their instructions and without at any time being able to use said data for their own purposes and/or unauthorised purposes.

In either case, appropriate safeguards include, among others:

Adequacy decision: A declaration by the European Commission that a non-EU State offers an adequate level of data protection and equivalent to that provided by European data protection legislation, so that international data transfer to a third party is possible established in that state outside the EU;
Binding Corporate Rules Applicable to business groups or the union of companies engaged in a joint economic activity, which enables the flow of personal data based on a self-regulation accepted and assumed by each of the signatory entities.;
Standard Corporate Rules (A mechanism signed between the exporter of Personal Data from any of the EEA countries and a third country. It is a contractual agreement the model of which has been approved and published by the European Commission and aligned with the precepts of the GDPR.
Code of conduct or a certification mechanism, together with binding and enforceable commitments made by the recipient in relation to the application of adequate guarantees for the protection of the transferred data.

Personal data may exceptionally be transferred to a third country or international organisation, in application of the mechanisms that may be recognised in this regard by data protection legislation. The content of the standard contractual clauses is available upon request through: dpd@rcdespanyol.com

What are your rights when you provide us with your personal data?

We inform you that, at any time, you can exercise your rights of access, rectification, opposition, deletion and movement, not being subject to automated decisions and limitation of handling by RCDE.

What are your rights as a user?

Right to access: You have the right to obtain confirmation as to whether RCDE process your personal data, as well as to access it.
Right to rectification: You can request the modification or rectification of inaccurate personal data.
Right to deletion: You can request the deletion of your personal data. Remember that as long as the commercial and/or contractual relationship that we maintain with you continues, it is necessary that we process certain personal data to comply with the contract, so while it is in place we will not be able to delete, block or cancel, because to do so would prevent us from complying with the contract.
Right to limitation of handling: In certain circumstances, you may request the limitation of the handling of your data, in which case it will only be kept for the exercising or defence of legal claims.
Right to opposition: You can oppose the processing of your data for the purpose you specify. RCDE will cease processing the data, except for with legitimate reason, or for the exercising or defence of possible legal claims.
Right not to be the subject of automated individual decisions: You have the right not to be the subject of a decision based solely on automated processing, including profiling, which may produce legal effects or significantly affect you in a similar way.
RCDE inform that, without prejudice to the fact that they carry out decisions that are based on automated systems, these decisions (i) do not produce legal effects or significant effects on the interested party; (ii) are not adopted exclusively in an automated way.
Right to transfer: If allowed, you can exercise the right to the portability of your data, in a structured, commonly used and machine-readable format, and to transmit it to another data controller (provided that this is technically possible).

How do I exercise my rights?

By sending an email to: dpd@rcdespanyol.com.

The revocation of the consent given will not affect the legality of the handling based on said consent prior to its withdrawal.

Likewise, if you consider that you have not obtained a satisfactory exercising of your rights, you can contact the RCDE data protection officer at the email address: dpd@rcdespanyol.com or file a claim with the Spanish Agency for Data Protection. through its website www.agpd.es.

In the event that, in the course of a relationship with us, you provide us with the personal data of third parties, we remind you that you are solely responsible for having obtained their prior consent to communicate their personal data to RCDE for the purpose established in each case, as well as having informed you of the content of this Policy.

You are responsible for holding RCDE exempt from any liability arising from the lack of information and/or consent to/from the Third Party.

Does any type of limitation exist?

RCDE inform that users of the Website must be at least 14 years old.

Regarding the use of social networks, we recommend that parents or guardians regularly check and supervise their children's internet activity. Please make sure that your children do not provide us with personal data without asking for your authorisation and consent.

At any time, you can exercise the rights of minors under 14 years of age in your care, by proving your legitimacy.

Date of last update: December 2022