Privacy Policy

Introduction

At FUNDACION ATHLETIC FUNDAZIOA, we are committed to the protection of privacy and the correct use of the personal data that we process and that you provide to us, both online on this website and, where appropriate, any of its subdomains, microsites and/or mobile applications, as well as offline.

Please read this policy carefully and make sure that you understand and agree with it before you provide us with your personal data. If you do not agree with it, please do not use this website or its services or provide us with your data.

Who is responsible for processing your data?

Fundación Athletic Club
Postal address: Alameda de Mazarredo 23, 48009 Bilbao
Email: [email protected]
Telephone:  94 661 20 04

How did we obtain your data?

• Obtained from the person concerned:

If you are a member, supporter or user of our website, you have provided them yourself, either off-line or on-line, when applying for membership or registration, or any of our products or services, when making a donation, or when contacting us for information.

By providing us with your details, you warrant that you are entitled to do so, and that the information is accurate, up to date, and does not infringe any contractual restrictions or third party rights. You are responsible for keeping your data correct and up to date, and FUNDACION ATHLETIC FUNDAZIOA declines all responsibility if you do not do so. You undertake not to impersonate other users by using their registration data for the different services and/or contents of the Website.

• Obtained automatically when visiting our website:

When you visit our website we collect information through cookies and other tracking and web analytics technologies. This means that data is sent from your browser to our servers to optimise our services and improve your user experience. This data may be automatically collected and stored by us or by third parties on our behalf. Please refer to our cookies policy.

• Internet re-targeting technology:

Our website does NOT use Internet retargeting technology, but we do use such technologies on Google, social networks, etc. We believe that the display of personalised advertising, based on your interests, is more interesting for our members/supporters than advertising that does not have a personal connection.

To this end, we work with companies that use tracking technologies to display advertisements from us on the Internet. Retargeting technologies may collect information about your visits to our website and your interaction with our communications, including advertising. They analyse their cookies, to show you advertising based on your browsing behaviour, both on our website and on other third party sites. We do not store any personal data about you with this technology, as it is stored in your own browser.

• Obtained from a person other than the data subject:

It is possible that your data has not been provided to us directly by you, but has been provided to us by a third party to whom you have previously provided such data. For example: Someone who decides to register you as a supporter, or entities or organisations with which we reach agreements to develop projects, social, cultural or sporting… In such cases the categories of data we may process are mainly identification data and, circumstantially, data on personal characteristics, data on social circumstances.

With regard to data of other people, you must respect their privacy, taking special care when communicating or publishing their personal data. Only the owner can authorise the processing of their personal data. The publication of third party data without their consent may infringe, in addition to data protection regulations, those relating to the right to honour, privacy or the self-image of such third parties.

It is the responsibility of those who provide data of third parties: a) to have their prior and express consent to use them, and b) to inform them of the processing that we are going to carry out with their data. By accepting this privacy policy, whoever provides third party data expressly guarantees that they have the authorisation for such provision, exonerating us from any liability in the event of any claim by the interested party.

What types of data do we process?

The categories of data that we process may be:

• Obtained from the person concerned: identification data (name and surname, ID card number, Club membership code, image, etc.), contact details (telephone, postal address, email address); financial data (information necessary for the direct debit of fees: bank account), donations made.
• Obtained automatically when visiting our website: the user’s IP address, the date and time of the visit, the URL of the site from which the user came, the pages visited on our website, information about the browser used (browser type and version, operating system, etc.). Also online profile data (information about preferences and interests, browsing habits, what commercial actions have been done or what information has been requested), in order to send you personalised information or exclusive campaigns, etc.
• Communicated by a third party: identification data; personal characteristics data; social circumstances data.

Regarding special categories of data: We do not process special categories of data on this website.

Children’s data: If you are under 14 years of age and you wish to provide us with your data in order to use our web services, request our services or products, or participate in any of the activities we carry out, you may only do so with the authorisation and consent of your parents. Ask them to help you fill in the forms in which we ask for your personal data.

Parents of children under 14 years of age must prevent minors in their care from providing personal data without their supervision, and the Foundation accepts no responsibility in this respect.

In the event that we detect that a minor under 14 years of age has registered without authorisation, parents or guardians may be asked to send the appropriate documents accrediting the aforementioned authorisation. Otherwise, the user or registration will be cancelled as soon as possible.

In the event that parents, guardians or legal representatives of minors detect unauthorised data processing, they may submit their complaints or queries to [email protected].

Why do we process your data and what legitimacy do we have for it?

• The data that you provide us with, as well as all the data generated during the development of the relationship that we maintain with you, can be processed for different purposes and with different legitimacy:

PURPOSE	LEGAL BASIS
– Managing the relationship with you in the case of members or supporters. – Maintaining contact with donors, managing the donation made and issuing certificates. – Managing registration and participation in paid activities and events.	Contractual relationship and fulfilment of legal obligations incumbent on us in tax and audit matters for donations
– To send information about our activities, products and/or services to potential members or supporters by electronic communications. – To participate in events, activities, promotions or free competitions. – Installing non-technical cookies.	Consent
– To send information about our activities, products and/or services to current members or supporters by electronic communication. – Installation of technical cookies – To create a commercial profile on the basis of the information you provide us with and that obtained from your browsing. This helps us to get to know you better and to be able to adapt the information we send you to your preferences. To do so, we will use certain criteria (such as your browsing behaviour, participation, and your interactions on our website [visits, specific clicks on the site or its advertisements, downloads, etc.], your requests for information, your newsletter subscriptions, etc.), to offer you personalised information, based on your profile. – Conducting opinion/satisfaction surveys. – In the case of users of our website, or senders or recipients of an email: to manage requests made online, and to contact you. – In events and activities that are public acts or in places open to the public and in which a relevant cultural interest predominates, such as, for example, matches, player presentations, etc. photographs and/or videos may be taken and published on this website, or on our profiles on any social networks, as well as on YouTube to inform about the event/activity, document it, and form part of the photographic/videographic memory of the event, as long as the image of a specific person appears as merely accessory to the information of the event.	Legitimate interest

• When the legitimacy is based on consent, you may withdraw this consent at any time by sending us an e-mail to that effect to [email protected]. This withdrawal does not condition the processing of your data for the rest of the purposes described.
• If the processing of your data is based on our legitimate interest, we consider it to be proportionate and to have a minimal impact on your privacy, but your interests, rights or freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please send us an e-mail to that effect to [email protected] and we will follow up on your request.
• Specific information regarding the legitimate interest as a legal basis for sending, to members, supporters, information by electronic communications about our activities, products and/or services. This legitimate interest is foreseeable for the data subject as a member or supporter; the impact of the processing on data subjects is very limited; we have a procedure for sending commercial communications in order to comply with data protection regulations; we have carried out a weighting analysis of this legitimate interest that can be requested by the data subject, who can always express their opposition to being sent such information. Therefore, we consider that sending commercial communications is proportionate and has a minimal impact on privacy, but your interests, rights or freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please send us an e-mail to [email protected], and we will follow up on your request.
• Specific information regarding legitimate interest as a legal basis for capturing images. This legitimate interest is foreseeable for the data subject, since in the events/activities the participant can reasonably expect us to capture/disseminate images merely incidental to the event/activity to graphically document it; we have a procedure for capturing and disseminating images to comply with data protection regulations and minimise the data to be processed; we have carried out a weighting analysis of this legitimate interest that can be requested by the data subject, who can always express his/her wish/opposition to the capture/dissemination of his/her image. Therefore, we consider that the capture of images in these activities or events is proportionate and has a minimal impact on privacy, but your interests, rights or freedoms will always prevail over our legitimate interest, so if you do not want us to process your data for these purposes, please let us know at the event/activity itself or send us an e-mail to [email protected], and we will consider your request.

How long will we keep your data?

We will keep the personal data you provide us with for as long as the contractual or pre-contractual relationship is maintained and, once these are terminated, for as long as the interested party does not request their deletion. Even if deletion is requested, we may keep them for as long as necessary and limit their processing, solely for the following purposes:

• o To comply with the legal/contractual obligations to which we are subject,
• o and/or during the legal periods foreseen for the prescription of any liability on our part,
• o and/or the exercise or defence of claims arising from the relationship maintained with the data subject.

In coordination with the above criteria, the deletion of personal data, either in computerised records or on paper, may be carried out, at the organisation’s discretion, depending on logistical needs and/or storage space that make it advisable to delete information or documentation.

To whom may we disclose your data?

The data you provide us with may be communicated to third parties for purposes directly related to the legitimate functions of the transferor and transferee, such as:

1. To banking entities: for the management of collections and payments.
2. To entities or bodies to which there is a legal obligation to communicate data: for example,
   1. The Tax Administration, for compliance with fiscal and tax obligations and to entities that audit the Foundation’s accounts (for example, in the area of donations).
   2. To third parties as required by anti-violence regulations and the Professional Football League for security, access control and compliance with anti-violence regulations in sporting venues.
   3. Banking entities and payment gateway managers for donations.

3. If you are a participant in any of our competitions, the details of the winners will be communicated to the companies responsible for providing the prize and, where appropriate, we may communicate details of the participants to the jury, although we will try to send them a pseudonym.
4. We will communicate them between the Club and the Athletic Foundation in the event that it is necessary to manage the benefits or rights to which the member or supporter is entitled.
5. To third party collaborators and sponsors: for the development of commercial actions by them as long as you have given your consent through the form established for this purpose. However, you may withdraw your consent by sending an e-mail to [email protected].

International Data Transfers

At FUNDACION ATHLETIC FUNDAZIOA, we will ensure that personal data is always processed and located in the European Economic Area. However, in certain circumstances, we may make international data transfers, for example, in the event that it is necessary for the conclusion or execution of a contract, in the interest of the data subject, between FUNDACION ATHLETIC FUNDAZIOA and another natural or legal person; or when using service providers located outside the European Union, who may have access to personal data, for the provision of ancillary services to our activity (hosting, housing, SaaS, remote backups, computer support or maintenance services, e-mail managers, sending e-mails and e-mail marketing, file transfer, etc.) or for the execution of pre-contractual measures taken at the request of the data subject.

These entities may be different and vary over time, but we will endeavour to choose entities either belonging to countries that have a level of protection equivalent to the European level of data protection, or that have the appropriate guarantees to achieve that level, or on the basis of one of the exceptions expressed in the GDPR.

Social networks and instant messaging applications

• Use of WhatsApp instant messaging

In the event that we provide you with an instant messaging app to speed up joint communication, use it responsibly, read the privacy policy of the same and configure it according to your preferences before sending information with personal data by this means.

Although these types of instant messaging applications can be useful in certain circumstances, we remind you that the information you post on the Internet is accessible to many people, known or unknown, so there is a risk to your privacy and that of others.

We recommend that you do not provide personal, private and/or intimate information or information that you wish to keep private through this medium, as there are safer ways to do so. We cannot be held responsible for the operation and availability of the service as it is not provided by us but by third parties.

• Use of social networks

o Users have the opportunity to join pages or groups that the Foundation has on different social networks. They should bear in mind that, unless the Foundation requests their data directly (for example, to answer queries in a private environment), their data will belong to the corresponding Social Network. Users are therefore advised to carefully read the terms and conditions of use and privacy policies of the relevant Social Network, and to ensure that they set their preferences regarding the processing of their data.

• Social Networking Features incorporated on our website

Our services may include certain Social Networking features and widgets, such as ‘Facebook Connect’ connectors, the ‘Like’ button, the ‘Share’ button or other common social media interactive mini-programs. We are not responsible for the proper functioning of these.

The provision of certain registration data, or their use if you are already registered as a member or supporter, and mark the corresponding option on the registration form, or the data from your Facebook profile if you use the Facebook Connect option to register, it will be obligatory in some cases, for example to access certain services or content such as, online supporter, contact, access to viewing or downloading audiovisual content, etc., as this data is essential for the processing for the purposes described above in this section. If the information is not provided, we will not be able to carry out the services requested.

• Rules for the use of social networks:

Please note that if you decide to participate, publish or share content through our official page on a social network, such content will be public, and it will be your sole responsibility to ensure that such content complies with legal regulations. 

You can prevent your personal data associated with such participation from appearing by configuring your privacy settings, or by creating a pseudonym for your data (e.g. by using a ‘Nickname’ or ‘alias’).

We remind you that, with regard to other people’s data, you must respect their privacy and take special care when communicating or publishing their personal data. Only the owner can authorise the processing of their personal data.

The user may only publish on this page, or on our official page on social networks, personal data, photographs and information or other content whose ownership and property belongs to him/her or for which he/she has the authorisation of third parties. If you publish data of third parties, it is your responsibility to obtain their prior and express consent to use and publish them. The publication of data of third parties without their consent may infringe, in addition to data protection regulations, those relating to the right to honour, privacy or self-image of such third parties.

In any case, we may remove from this website and from our pages on social networks, any content published by the user when we detect that it has violated current legislation, and what is indicated in this privacy policy.

Social Networks are not hosted directly on our Services. Your interactions with them are governed by their policies and not ours. Please read the privacy policies of those social networks for detailed information about the collection and transfer of personal data, your rights and privacy settings.

• Data we collect through social networks

We collect data through these applications, in particular, through functional and analytical cookies to enable them to function properly. These cookies may collect information about your IP address, or your browsing.

In addition, if you log in to one of these social networks during your visit to one of our websites or mobile applications, the social network may add that information to your profile and that information will be transferred to the social network. If you do not want this data transfer to take place, please log out of your social network session before entering our websites or mobile applications, as we have no influence over this collection and transfer of data via social connectors.

• Display of other third party pages on our website

We may also offer third party content or services through our website (using framing techniques), preserving the appearance of our website, and displaying within it the appearance of the third party providing the service. Please note that the information you provide will be supplied to those third parties, and not to us, so the policies of those third parties will govern and not ours.

What are your rights when you provide us with your data?

You may, where appropriate, exercise your rights of access, rectification, deletion, limitation and opposition to their processing, as well as other rights, at the postal or email address indicated at the beginning of this privacy policy; in both cases by means of a written and signed request, enclosing a copy of your ID card or passport or other valid document that identifies you. In the event of modification of your data, you must notify us at the same address, and the Club declines all responsibility in the event of failure to do so.

• Right of access: You can ask us what personal data we are processing and even request a copy of it.
• Right of rectification: You can ask us to rectify inaccurate personal data or to complete incomplete personal data, including by means of an additional declaration.
• • Right to erasure (right to be forgotten): You can ask us to delete your personal data when: it is no longer necessary for the purposes for which it was collected, you withdraw your consent, there has been unlawful processing of the data or in compliance with a legal obligation.
• Right to limitation of processing: You can ask us to limit the processing of your data, in which case we will only keep them for the exercise or defence of claims.
• Right to object: You may object to the processing of your data if such processing is based on the legitimate interest of the data controller or is for advertising purposes.

Once we have received any of the above requests, we will respond to you within the legally established deadlines. You may complain to the Spanish Data Protection Agency. If you would like more information about the rights that you can exercise and to request model forms for exercising your rights, you can visit the website of the Spanish Data Protection Agency, www.aepd.es.