1. IDENTIFICATION

• Data Controller / Responsible Entity: CLUB ATLÉTICO DE MADRID, S.A.D. (hereinafter, the “Club”)
• TAX ID (NIF): A-80373764
• Registered address: Av. de Luis Aragonés, 4 – 28022 Madrid
• Email address: [email protected]
• Data Protection Officer: [email protected]

2. INFORMATION

By accepting this Privacy Policy, the user (hereinafter, the "User" or, where applicable, the "Users") is informed that the personal data provided to the Club, as well as those generated during access to and use of the "Atleti Business Club" platform (hereinafter, the "Platform"), will be processed by the Club in accordance with the provisions herein.

The User must carefully read this Privacy Policy, which has been drafted in a clear and simple way, to facilitate its understanding, enabling the User to freely and voluntarily decide whether to provide their personal data to the Club.

3. MANDATORY NATURE OF DATA PROVISION

The data requested in the Platform forms are, in general, mandatory (unless otherwise specified in the required field) to fulfill the purposes for which they are collected.

Therefore, if the User does not provide such data or does not provide it correctly, the User's requests will not be able to be processed, without prejudice to the fact that the User may freely view certain Platform content.

4. SOURCE OF THE DATA

The data processed by the Club for the purposes listed in the following section come from:
 

• From the User: data provided by the User through the different Platform forms, data obtained from the User's use of the Platform and browsing activity (through cookies or data storage and retrieval devices), based on the consents given, where applicable.
• From third-party sources: only where the User has given consent, for example, where the User has agreed to the Club creating a profile using their personal data to send tailored commercial communications. In particular, the Club may obtain information about the User’s browsing activity.

5. HOW WILL THE CLUB PROCESS THE USER’S DATA?

Personal data provided through the Platform or other means made available to Users will be processed by the Club as follows:

a) Managing registration and access to the Platform:

• Purpose: to manage, process and register Users on the Platform, so that they can access the services offered.
• Legal basis: the processing of data derived from this purpose is the fulfilment of the contractual relationship between the Club and the User, by accepting the Terms and Conditions of access to the Platform.
• Categories of data processed:
  • Identification data: name, surname, date of birth (optional).
  • Contact details: email address, telephone number (optional).
  • Professional data: company and position or position held.
  • Data related to the image: photograph (optional).
  • Other types of data: link to social networks (optional).
• Retention period: data will be retained for as long as the User remains within the Club’s sponsor network, or until they expressly request their removal from the Platform.

b) Responding to User inquiries:

• Purpose: to manage and respond to requests, incidents, complaints, or inquiries submitted via contact channels.
• Legal basis: the processing of data derived from this purpose is the consent that the User may withdraw at any time. In the event that the User withdraws consent, the query or question raised may not be processed.
• Categories of data processed:
  • Identification data: name, surname.
  • Contact details: email address.
  • Professional data: company and position or position held.
  • Other data: any data that the User may provide in relation to the query or request raised.
• Retention period: data will be retained for the period necessary to process and respond to your request and, once this has ended, during the limitation period for the legal actions arising from the aforementioned request.

c) Publication and, where appropriate, sending of commercial and promotional communications by the Club on products and services of the Club and its sponsors:

• Purpose: the Club may make available to the User, within the Platform, content, promotions, offers, benefits or commercial communications related to products and services of the Club or its sponsors. Such content, promotions or offers will be reviewed, approved and published, in any case, by the Club, without this implying the communication of the User's personal data to sponsors or commercial collaborators for this purpose.
• Legal basis: the processing derived from this purpose is legitimised on the basis of legitimate interest based on the exception provided for in article 21.2 of the Law on Information Society Services and the provisions of recital 47 of the General Data Protection Regulation. The legitimate interest is based on the Club's interest in offering the User content, promotions, offers and benefits associated with the Platform. The User has the right to oppose the sending of these communications, in the event that they are issued by any means.
• Categories of data processed:
  • Identification data: name and surname.
  • Contact details: email.
• Retention period: data will be processed in accordance with this purpose until the User opposes the sending of the data.

d) Activity logging and Platform administration:

• Purpose: The Club may process certain data derived from the use of the Platform in order to manage, administer and supervise its proper functioning, including the maintenance of an activity log that allows the identification of certain actions carried out by Users within the platform, such as sending messages, making publications or executing other available functionalities.
  This activity log will have a purely operational and security purpose, and will be available only to authorized administrators of the platform. In particular, the registration will make it possible to know which User has carried out a certain action and the time at which said action took place, but it will not include the content of the messages or, where appropriate, the recipients of the same.
• Legal basis: the processing derived from this purpose is legitimised by the Club's legitimate interest in guaranteeing the correct management, administration, security, traceability and operation of the Platform, as well as in preventing misuse, resolving technical incidents and accrediting certain actions carried out in the Platform's environment.
• Categories of data processed:
  • Identification data: name and surname and internal identifier.
  • Professional data: company to which the User belongs.
  • Platform usage data: actions performed, date and time of performance of the action and, where applicable, technical identifiers associated with the registered activity.
• Retention period: the data will be processed for the time necessary to manage the Platform, attend to possible incidents, guarantee its security and comply with the responsibilities arising from its use. After this period, the data will be deleted or, where appropriate, kept duly blocked for the legally required periods.

In the event that the User provides data from third parties, he/she declares that he/she has their consent and/or sufficient legitimacy and undertakes to transfer the information contained in the Privacy Policy to them, exempting the Club from any liability in this regard. However, the Club may carry out the appropriate verifications to verify this fact, adopting the corresponding due diligence measures, in accordance with data protection regulations.


6. WITH WHOM WILL THE USER'S DATA BE SHARED?

All personal data provided by the User through the Platform may be communicated to:
 

• a) The company Bundeling, B.V., with registered office at Protonenlaan 25405 NE Uden, to the extent necessary for the provision of the services offered through the Platform, based on the fulfilment of the contractual relationship with the Club. You can obtain more information about the data processing by Bundeling via e-mail [email protected].
• b) Public Administrations, in the cases provided for by law, based on compliance with a legal obligation.
• c) Courts and Tribunals, in the cases provided for by law, based on compliance with a legal obligation.

In addition, the Club will have the collaboration of third-party service providers who may have access to your personal data, which will process in the name and on behalf of the Club due to the provision of services. The Club follows rigorous supplier selection procedures in order to comply with its data protection obligations, including entering into the relevant data processing contract in accordance with Art. 28 GDPR.

Specifically, the Club will have the provision of services by third-party providers who carry out their activity, including but not limited to, in the sectors of activity: legal advice and technological and computer services.

7. INTERNATIONAL DATA TRANSFERS

In order to carry out the processing purposes described, we may additionally use authorised subcontractors acting on behalf of the Club, acting as processors (e.g. internet service providers, data hosting and technical support providers, email providers, general service providers and physical security service providers, etc.) and contractually subject to our instructions, only for the lawful purposes described and for the period of time strictly necessary for this purpose.

Where authorised subcontractors acting on behalf of the Club or the aforementioned recipients are located or process your data outside the European Economic Area, we will be carrying out an international transfer of your data in accordance with the provisions of data protection regulations. In general, we will avoid international transfers and your data will be processed within the European Economic Area. However, in the event that it is necessary to carry them out, we will adopt the organisational, technical and contractual measures that are necessary to ensure the protection and security of your data, such as, for example, signing with the authorised subcontractor or third party transferee of the European Commission's Standard Contractual Clauses ("SCCs"), carrying out impact assessments on the international transfer in question to assess the risk and adopting measures to assess the risk mitigation, encryption of data in transit or at rest, pseudonymisation of data subject to international transfer, the possibility for the data subject to claim damages directly against the authorised subcontractor or third-party transferee, etc.

8. COMMERCIAL AND PROMOTIONAL COMMUNICATIONS

Law 34/2002, of 11 July, on information society services and electronic commerce allows commercial communications to be carried out through the use of the internet and other electronic means, provided that they can be identified as such, as well as the entity from which they are made.

One of the purposes for which the Club processes the personal data provided by Users (whether they have authorised it or have not objected to the processing) is to send them commercial communications with information relating to products, services, promotions, offers, events or news relevant to Users.

In the event that the User wishes to stop receiving commercial or promotional communications from the Club, they may request the cancellation of the service by sending an email to the following email address: [email protected], or by clicking on the link that will appear at the bottom of the commercial communications sent.

9. USER´S LIABILITY

The User represents and warrants that has at least fourteen (14) years of age and that the personal data provided is accurate, complete and up to date. To this end, the User is responsible for the accuracy of all data they provide and shall keep the information provided suitably up to date, so that it reflects their actual situation.

Similarly, the User warrants that they have informed any third parties whose data they provide, where applicable, of the matters set out in this document. Furthermore, the User warrants that they have obtained their authorisation to provide their data to the Club for the purposes indicated.

In any event, the User shall be liable for any false or inaccurate information provided via the Platform and for any direct or indirect damages caused thereby to the Club or to third parties.

10. EXERCISE OF RIGHTS

As the owner of the data, the User may send a letter to the Club, at the address indicated in the heading of this Privacy Policy, or by email to the address: [email protected], proving his/her identity, at any time and free of charge, to exercise the following rights to the extent that they are exercisable:
 

• a) Right of access: You have the right to be informed by the Club as to whether or not it is processing your personal data and, if so, to be able to access such data and receive information on the purposes for which they are processed, the categories of data affected by the processing, the recipients to whom your personal data were communicated and the intended period of data retention, among other information.
• b) Right of rectification: You have the right to request the rectification of inaccurate data concerning you when, among other reasons, these are no longer necessary for the purposes for which they were collected.
• c) Right to erasure: You have the right to request the deletion of personal data provided that the legal requirements are met.
• d) Restriction of processing, revocation of consent and total or partial objection to processing: In certain circumstances (for example, in the event that the applicant contests the accuracy of their data, while the accuracy of the data is verified), they may request that the processing of their personal data be restricted, which will only be processed for the exercise or defence of claims.
  
  You also have the right to revoke the consent given and to object to the processing at any time, on grounds relating to your particular situation, if the processing is based on our legitimate interest or on the legitimate interest of a third party (including processing for the purpose of direct marketing and profiling). In this case, the Club will cease processing, unless there are legitimate reasons.
• e) Portability of your data: You will have the right to receive the personal data you have provided to the Club in a structured, common and machine-readable format, and to be able to transmit them to another data controller without being prevented from doing so by the person responsible to whom you have provided them, in the cases legally provided for this purpose.
• f) Automated individual decisions: In addition, to the above-mentioned rights, in the event that automated decisions are taken, including profiling, you have the right to obtain human intervention from the Club and to express your views and to challenge the decision.
• g) Others: Similarly, where personal data is transferred to a third country or to an international organisation, you have the right to be informed about how appropriate safeguards relating to the transfer can be accessed or obtained.

Likewise, you may file a complaint regarding the protection of your personal data with the Spanish Data Protection Agency at the address C/ Jorge Juan, 6, 28001 - Madrid, when the interested party considers that the Club has violated the rights that are recognized by the applicable regulations on data protection.

11. SECURITY MEASURES

The Club will treat the User's data at all times in an absolutely confidential manner and will maintain the mandatory duty of secrecy with respect to them, in accordance with the provisions of the applicable regulations, adopting for this purpose the necessary technical and organisational measures to guarantee the security of their data and prevent their alteration. loss, processing or unauthorised access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed.

12. CHANGES OF THIS POLICY

The Club reserves the right to revise its Privacy Policy at any time it deems appropriate, in which case it will be communicated to Users. For this reason, we ask the User to regularly check this privacy statement to read the most recent version of the Club's Privacy Policy.

13. ACCEPTANCE OF THE PRIVACY POLICY

The User declares to have been informed of the conditions on the protection of personal data, accepting the content of this Privacy Policy.

Last updated: May 2026

Copyright © CLUB ATLÉTICO DE MADRID, S.A.D.

All rights reserved.