개인정보 보호정책

1. Identity and contact details of the controllers.

Legends Hospitality España, S.L., domiciled at Paseo de la Castellana, número 53, 1-b, 28046-Madrid,, with employer identification number B-88644299, and telephone number +1 212 317 3200 ("Legends") and Real Madrid domiciled at Avenida de Concha Espina, nº 1 de Madrid, España, 28036, with employer identification number G-28034718 , and telephone number +34 91 398 43 00 ("Real Madrid"). Legends and Real Madrid ("Companies") are the joint-controller of the personal data.

The purpose of this Privacy Policy is to provide information on:

• The use that the Companies will make of your personal data through the Real Madrid Online Store https://shop.realmadrid.com (the "Website", "Web" or "Store").

• Where Companies are processing your data jointly and where each of them process your data separately.

• The legal basis that enables the Companies to process your data for each of the uses indicated.

• The retention period of your data by the Companies.

• Who we share your data with.

• Your rights under the General Data Protection Regulation ("GDPR").

If you have any questions regarding the processing of your data, or if you want to know more about the joint-controller agreement, please contact the Companies at:

Legends Legal: 61 Broadway, Suite 2400, New York, NY 10006, dataprivacy@legends.net

Real Madrid's DPO: Avenida de las Fuerzas Armadas, 402, 28055, Madrid, protecciondedatos@corp.realmadrid.com.

2. Purposes and legal basis of the processing

2.1. Your data will be processed exclusively by Legends for the following purposes:

1. The provision of the service requested by the Clients and Users, which includes:

2. The registration as a User on the Website, if you opt so, to remember your details for future transactions.

3. The management of the purchases: Handling the order placed, shipping of the order and managing the billing and debt collection.

This is all based on compliance with the Store Terms and Conditions.

1. The management of the relationship with Client and Users, which includes:

2. Customer service and the processing of communications necessary for the provision of products and requests made by Customers and Users.

3. The management of claims and requests for information made in relation to products purchased on the Store.

4. To carry out loyalty actions, which includes sending satisfaction survey as well as reminders of purchases initiated on the Web and not completed.

5. The statistical analysis of transactions, complaints and claims, as part of a process of continuous improvement of our services.

This is all based on the legitimate interest of Legends in ensuring business continuity and in keeping with our Clients and Users a relationship as satisfactory as possible for them.

1. For the accounting and tax management of the activity, as it is necessary to comply with the respective obligations legally applicable to the owner of the Store.

2.2. Your data will be processed exclusively by Real Madrid for the following purposes:

1. Ensuring business continuity as well as in order to supervise and control the activity developed by Legends. This is all based on the legitimate interest of Real Madrid in guaranteeing the appropriate development and evolution of its official Online Store.

2. If you have given your consent to Real Madrid, C.F., in the register form or the checkout form, the Club will process your data to send you information and commercial communications, including by electronic means and after profiling, referring to products, services and activities of Real Madrid, including the Online Store, and of its sponsors and collaborators, and the subsequent statistical analysis relating to these communications.

2.3. Your data will be processed jointly by Legends and Real Madrid, as joint controllers, for the following purposes:

1. Only if you have given your consent, we will also process your data for the sending, including by electronic means and after profiling, of commercial communications concerning the Online Store and its products and for their subsequent statistical analysis.

2. Analytics of the use and web traffic on the Online Store, as it is needed to satisfy our legitimate interest in improving the Online Store, the user experience and the offer of products and services.

   • In addition and very exceptionally, Companies, separately or jointly, may also process your data for control and security purposes, own legal advice and regulatory compliance, as it is necessary in order to satisfy our legitimate interest in the defense of our interests and rights and to comply with legal obligations that we are bound to (audit, compliance with criminal law and data protection).

Please also note that, if you have consented cookies through the website, your data will also be processed for the purposes indicated for each type of cookie, in accordance with our Cookie Policy.

3. Necessary, up-to-date information

Completion of all the fields marked with an asterisk (*) or regarding which the system requires completion in the forms provided is compulsory. Failure to fill out any of these fields could prevent you receiving the services.

In order to ensure that the information provided is always up to date and does not contain errors, you should inform the Companies as soon as possible of any amendments to or changes in your data at reception or via the following email: dataprivacy@legends.net.

4. Retention period of your data

We will store your data for the duration of the relationship with the Online Store and after that, we remain the data blocked, for the legal period provided in each case and time for the potential formulation or defense of claims.

If you have given us your consent to send you commercial communications, your data will be processed for this purpose as long as you do not object. At any time you can request the cancellation of this type of communication, either as indicated in the section "Exercise of your rights", or through the unsubscribe system provided in each of the electronic communications we send you.

Regarding the newsletter, we will store the subscribers' data until they request the cancellation of the subscription.

If you simply visit our website, please note that the necessary cookies, as well as any other cookies you have accepted, also collect personal data from you. In such a case, that data will be kept for the periods of time indicated in the cookie banner and in the Store's Cookie Policy.

5. Who we share your data with

We may disclose your personal data to:

• Tax authorities and other public bodies and entities authorized by law, when required or necessary.

• Exceptionally with judges, courts or other bodies for the resolution of conflicts, Security Forces and Notaries.

In addition, our following providers may have access to some of your data in order to to perform their functions, but we make sure that they put in place high level protection guarantees and that they can only use your data for what is strictly necessary in relation to the purposes detailed above.

Legends' providers:

– SHOPIFY, as the provider of the Store's platform.

– WEGLOT, as a translation services tool

– THIRD BLINK SOFTWARE, INC (dba Rewind), a Canadian corporation, as a backup solution

– ESSENTIEL, as a full-service customer service provider

-. INFOR Inc, as a Enterprise Resource Planning (ERP) system, which is cloud housed in Frankfurt. Used to store client data used to fulfill orders

-. INFOR Inc, as a Enterprise Resource Planning (ERP) system, which is cloud housed in Frankfurt. Used to store client data used to fulfill orders

– Third party logistics providers:

– Makito in Madrid, Spain

– WFDS in Victoria, Australia

– Legends Hospitality, LLC dba Legends Global Merchandise in Indianapolis, Indiana, USA

Real Madrid's providers:

– CHEETAH, for sending commercial communications.

– Microsoft Ireland Operations Ltd. (storage).

– M2C Consulting Procedures (data integration)

– SOGETI ESPAÑA, S.L.U. (IT services)

– Willis Consulting, S.L, Garrigues, Ernst & Young, Estudio Jurídico Rodriguez Mourullo, Elzaburu S.L.P., and other professionals or firms of legal advice, procurement, consultancy and/or auditing.

– Audisec, S.L. for the registration of data protection incidents.

– Other suppliers that may complement or replace the above.

You may request more detailed information on the recipients of your data by sending an email to dataprivacy@legends.net indicating the specific processing for the recipients in relation to which you require information.

International Transfer of your data

• Your data may be accessed by data processors established outside the European Economic Area.

• Specifically, your personal data will be accessed by systems, logistic and technology service providers located in the USA and Australia, with whom the Companies have formalized the standard contractual clauses approved by the European Commission as appropriate safeguards for the rights of the data subjects.

• These data processors may also be located in Canada. This country has been designated by the European Commission as having an adequate level of data protection comparable to that of the European Union and therefore already has sufficient guarantees to carry out international transfers of personal data.

• Very exceptionally we may need to transfer your personal data to judges, courts or other bodies for the resolution of conflicts outside de European Economic Area, the transfer being legitimated as it is necessary for the formulation, exercise or defense of claims, as the case may be.

• You may request more detailed information on the international transfers of your data by sending an email to dataprivacy@legends.net indicating the specific recipients, destination or applied safeguards in relation to which you require information.

6. Exercise of your rights

You may exercise the following rights:

• the right of access to your personal data to know which data are being processed and the processing operations that are being performed with that data;

• the right to rectification of any inaccurate data;

• the right to erasure of your personal data, where possible;

• • the right to request the restriction of the processing of your personal data where the accuracy, legality or need to process the data is doubtful, in which case we may store your data duly blocked for the exercise or defense of claims;

• the right to object to the processing of your personal data, when the legal basis that enables us to process them, of those indicated in point 2, is legitimate interest. The Companies will cease to process your data unless it has a compelling legitimate interest to do so or it is necessary for the defense of claims.

• the right to data portability, when the legal basis that enables us to process your data, set out in point 2, is the existence of a contractual relationship or your consent;

• the right to revoke your consent, when the legal basis that enables us to process your data, set out in the table included in point 5, is your consent;

You may exercise your rights at any time, without charge, by sending an email to Legends at dataprivacy@legends.net or to Real Madrid at oposicion@corp.realmadrid.com, indicating the right you wish to exercise and your personal particulars.

You may also lodge a complaint with the Spanish Data Protection Agency if you consider that data protection legislation has been breached in the processing of your personal data. Other European Supervisory Authorities can be accessed here.

7. Confidentiality

The personal data we may collect will be processed as confidential and we undertake to keep such data confidential in accordance with applicable legislation.

8. Updates to the privacy policy

This Privacy Policy may need to be updated. You should therefore review this policy periodically and if possible every time you make a reservation with us in order to ensure that you are duly informed of the type of information collected and its processing. We will inform you of any changes to this privacy policy that affect the processing of your personal data.