Privacy Policy

This Privacy Policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, or GDPR), as well as Organic Law 3/2018 of 5th December on Personal Data Protection and the Guarantee of Digital Rights, together with all other applicable legislation.

The purpose of this Privacy Policy is to inform individuals who provide their personal data, and/or the personal data of the person they represent, about the specific aspects of how their data is processed, including the purposes of the processing, the contact details for exercising their rights, the applicable data retention periods and the security measures in place, among other matters.

WHO IS THE DATA CONTROLLER?

For the purposes of data protection legislation, VILLARREAL C.F. S.A.D. is the Data Controller in relation to the processing of personal data carried out by the organisation.

The Data Controller’s contact details are as follows:

• Data Controller: VILLARREAL CF SAD (Tax ID: A12362927)
• Registered address: Calle Miralcamp s/n, 12540 Vila-real (Castellón), Spain
• Email: info@villarrealcf.es

Telephone:  +34 964 50 02 50

WHAT PERSONAL DATA DO WE PROCESS?

All information collected by VILLARREAL C.F. S.A.D. is processed fairly, lawfully and transparently.

The personal data requested for each processing activity is limited to the information that is strictly necessary to fulfil the specific purpose communicated in each case.

Accordingly, the personal data collected will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. Personal data will only be collected for specified, explicit and legitimate purposes and will not subsequently be processed in a manner that is incompatible with those purposes. It will also be kept up to date whenever necessary.

WHERE DO WE OBTAIN PERSONAL DATA?

As a general rule, personal data is collected directly from the data subject. However, in certain circumstances, data may be obtained through third parties, organisations or services other than the data subject.

Where this occurs, the data subject will be informed through the relevant privacy notices provided at the point of data collection or, where applicable, within a reasonable period or at the time of the first communication.

FOR WHAT PURPOSES AND IN WHICH SPECIFIC CASES DO WE PROCESS PERSONAL DATA?

As a general rule, personal data is processed for the following purposes:

Communications: To keep you informed, by post and/or electronic means, about activities organised by the club, whether organised directly by the club or by third parties, as well as products and services within the sporting sector, with the aim, among others, of promoting sport among members and season ticket holders.

Contact: To respond to your enquiry, we will process the data that is strictly necessary, which will generally include your contact details (such as your email address) together with information relating to your request, order or any issue you report. We will also use this information to respond to requests for information regarding the products and services we offer, or to any other enquiry submitted through the contact channels made available to you.

If you contact us through social media, please avoid including personal data in your messages. Please note that we have no control over the information entered on these platforms, and we therefore recommend that you carefully read the privacy policy of the relevant social media platform before contacting us.

Season tickets: To manage new season ticket applications, renewals and other services relating to club members and season ticket holders.

Guided tours: To manage guided tours of both the Estadio de la Cerámica and the Ciudad Deportiva training ground.

Supporters’ clubs and members (including junior members): To manage registration as an official supporters’ club or supporters’ club member, and to fulfil the rights and obligations set out in the Official Supporters’ Clubs Regulations published on the Villarreal CF website.

Surveys: To conduct customer service and/or product quality surveys carried out by the Data Controller or by companies within its corporate group. Your personal data will be processed for the purpose of obtaining feedback on our products and the service provided by our customer support team, enabling us to improve our services.

Customers: To manage the sale of goods and services, invoicing, accounting, collections, outstanding payments, quotations, contracts, customer service, communications and commercial relationships.

Suppliers: To manage purchasing, accounting, payments, delivery notes, orders, communications and commercial relationships.

Video surveillance: To monitor access to the organisation’s facilities and ensure the safety and security of people and property.

Job applicants: To carry out current and future recruitment and selection processes.

Profiling: To use your data to create a commercial profile based on your purchasing habits and your personal and social characteristics. Under no circumstances will profiling result in automated decision making that could adversely affect you.

No automated decision making will be carried out on the basis of the personal data collected.

In any event, the specific purposes for each processing activity are set out in the privacy notices provided through the various methods by which personal data is collected, including web forms, paper forms, recorded messages, notices, invoices, contracts and any other documents containing personal data.

WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA?

As a general rule, before processing your personal data, we will inform you of the legal basis that authorises the processing in each specific case.

Personal data may be processed on the following legal bases:

Compliance with legal and regulatory obligations: This includes, but is not limited to, compliance with the General Law for the Protection of Consumers and Users, the General Tax Law, the Corporate Income Tax Law, the Audit Law, the Value Added Tax Law, the Civil Code, the Commercial Code, and any other law or regulation that authorises or requires the processing of personal data. Where applicable, the relevant legal basis will be identified in the corresponding privacy notice.

Performance of a contract: To carry out activities necessary prior to entering into a contract, to perform a contract for the provision of products or services, and to manage any subsequent matters arising from that contractual relationship.

Consent: Certain processing activities are based on your explicit and unambiguous consent. Consent is obtained through informed consent clauses included in the various methods used to collect personal data, and may be provided by means of a declaration, a clear affirmative action, such as ticking the relevant box, signing the appropriate document, or submitting personal data through the contact methods provided. We also inform you that we will only process your personal data in accordance with this Privacy Policy and, as a general rule, we will request your consent if we wish to use your data for purposes other than those for which it was originally collected.

Legitimate interests: We may process your personal data on the basis of our legitimate interests, primarily to send you information about products, services or events similar to those you have previously contracted or purchased. In accordance with Article 21.2 of the Law on Information Society Services and Electronic Commerce, this processing will only take place where you are an existing customer and you have not expressly objected either at the time your data was collected or through any subsequent communication we have sent you.

HOW LONG DO WE RETAIN PERSONAL DATA?

Personal data will be processed for as long as necessary to fulfil the purpose for which it was collected, while the relevant service, employment or contractual relationship remains in force, where there is a mutual legitimate interest, and for any additional period required under the applicable legislation.

Once the applicable retention periods have expired, the personal data will be deleted. Prior to deletion, the data will be blocked and retained only for the purpose of making it available to Public Authorities, Courts and Tribunals where necessary to deal with any liabilities arising from the processing, for the duration of the applicable statutory limitation period. Once that period has expired, the information will be permanently destroyed.

In the case of video surveillance recordings, personal data will be retained for a maximum period of one month.

WITH WHOM DO WE SHARE PERSONAL DATA?

As a general rule, VILLARREAL C.F. S.A.D. does not disclose or transfer your personal data to third parties unless required to do so by law or where you have given your consent.

Where disclosure or transfer of personal data is necessary, you will be informed through the relevant privacy notices provided at the point at which your personal data is collected.

INTERNATIONAL TRANSFERS OF PERSONAL DATA

As a general rule, no international transfers of personal data are carried out outside the European Economic Area (EEA).

Should an international transfer outside the EEA become necessary, VILLARREAL C.F. S.A.D. will ensure that appropriate safeguards are in place in accordance with the requirements of the General Data Protection Regulation before any such transfer takes place.

¿QUÉ DERECHOS PUEDES EJERCER?

Under European data protection legislation, you are entitled to exercise the following rights:

Right of access: The right to obtain confirmation as to whether your personal data is being processed and, where that is the case, to access that personal data.

Right to rectification: The right to request the correction of personal data that is inaccurate or incomplete.

Right to object: The right to object to the processing of your personal data in certain circumstances or to request that such processing cease.

Right not to be subject to automated decision making: The right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning you or similarly significantly affects you.

Right to restriction of processing: The right to request that the processing of your personal data be restricted in certain circumstances.

Right to erasure (“right to be forgotten”): The right to request the deletion of your personal data where applicable.

Right to data portability: The right to receive your personal data in a structured, commonly used and machine readable format, or to request that it be transferred directly to another data controller where technically feasible.

Right to lodge a complaint: The right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data does not comply with the applicable data protection legislation.

HOW CAN YOU EXERCISE YOUR RIGHTS?

You may exercise your rights by using either of the following methods:

• By email to rgpd@villarrealcf.es, enclosing documentation that verifies your identity (for example, a copy of your National Identity Document or an equivalent form of identification).
• You may also lodge a complaint with the Spanish Data Protection Agency through its official website.

Your request will be handled as quickly as possible and within the time limits established by the applicable data protection legislation.

WHAT HAPPENS IF YOU DO NOT PROVIDE THE REQUESTED INFORMATION?

The personal data requested in fields marked with an asterisk (*) or provided through the relevant forms, documents or other information collection methods is strictly necessary for the purpose for which it is collected, for the proper provision of the requested service, to comply with a legal obligation applicable to the Data Controller or because it is required to enter into a contract. Providing information in all other fields is voluntary.

If the required information is not provided, we cannot guarantee that the information or services offered will fully meet your needs.

Where the mandatory personal data is not provided, or is inaccurate or incomplete, we may be unable to process your request, provide the information requested or deliver the relevant products or services.

You also confirm that any information submitted through our forms is true, accurate and relates to your own personal data.

The services available through our website are not intended for children under the age of 14. Accordingly, only individuals aged 14 or over may register. If this requirement is not met, any liability arising from the use of our website by a minor shall rest with the child’s parents or legal guardians.

To help prevent underage use of our services, we seek to verify users’ ages during the registration process by requesting their date of birth.

HOW DO WE CARRY OUT PROFILING?

VILLARREAL C.F. S.A.D. may create a commercial profile based on the information you provide and your interactions with the content we offer, in order to send you personalised information about our products and services, including by electronic means.

The legal basis for this profiling is the legitimate interest of VILLARREAL C.F. S.A.D. in understanding your preferences so that we can provide you with information and content tailored to your interests and activity. No automated decisions will be made on the basis of this profile. You may object to the profiling of your personal data at any time through the appropriate contact channel.

Subscription to our newsletters

We will process your identification and contact details to send you personalised information about our products, promotions and offers, as well as products and offers from our partners.

To provide this personalised information, we create a user profile based on your browsing habits, purchase history and, where applicable, information collected through the use of cookies and similar technologies. For further information on the use of cookies, please refer to our Cookie Policy.

Other marketing and advertising purposes

We may use your personal data to recommend products or offers based on your purchase history, the products you view while browsing our platforms or products left in your shopping basket when a purchase is not completed.

These recommendations may be delivered through push notifications, banners or emails, including reminders about abandoned shopping baskets.

We may also process your personal data to display advertising on other websites, applications or social media platforms that you use. Such advertising is generally based on a profile created from your purchase history, browsing activity and preferences.

WHAT SECURITY MEASURES HAVE WE IMPLEMENTED?

The security measures adopted by VILLARREAL C.F. S.A.D. comply with the requirements set out in Article 32 of the General Data Protection Regulation (GDPR).

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, together with the varying likelihood and severity of the risks to the rights and freedoms of individuals, VILLARREAL C.F. S.A.D. has implemented the appropriate technical and organisational measures to ensure a level of security appropriate to the identified risks.

These measures are designed, among other things, to:

• Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
• Restore the availability of, and access to, personal data promptly in the event of a physical or technical incident.
• Regularly test, assess and evaluate the effectiveness of the technical and organisational measures implemented to ensure the security of processing.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be updated from time to time in order to reflect changes in applicable legislation, changes to the way we collect or use personal data, the introduction of new services or the discontinuation of existing services.

Any changes will become effective upon publication on this website. We therefore recommend that you review this Privacy Policy regularly to ensure that you remain informed of any updates.