1. 1. Identification and contact details of the co-responsible parties.

Legends Hospitality España, S.L., domiciled at Paseo de la Castellana, number 53, 1-b, 28046-Madrid, with tax identification number B-88644299, and telephone number +1 212 317 3200 ("Legends") and the Real Madrid, domiciled at Avenida de Concha Espina nº1 de Madrid, Spain, 28036, with tax identification number G-28034718, and telephone number +34 91 398 43 00 ("Real Madrid"). Legends and Real Madrid ("Companies") are jointly responsible for the processing of personal data.

The Privacy Policy is intended to provide information about:

• The use that the Companies will make of your personal data through the Online Store of Real Madrid https://shop.realmadrid.com (the"Website", the"Website" or the"Store").
• Where the Companies process your data jointly and where each one of them processes it separately.
• The legal basis that allows the Companies to process your data for each of the purposes described.
• The period of conservation of your data by the Companies.
• With whom we share your information.
• Your rights under the General Data Protection Regulation ("GDPR").

If you have any questions regarding the processing of your personal data or if you would like to know more about the co-responsibility for processing agreement, please contact the Companies at the following address:

Legends Legal: 61 Broadway, Suite 2400, New York, NY 10006, [email protected]

DPO of the Real Madrid: Avenida de las Fuerzas Armadas, 402, 28055, Madrid [email protected].

2. Purposes and legal basis for processing

2.1. Your data will be processed exclusively by Legends for the following purposes:

1. The provision of the service requested by Clients and Users , which includes:
2. The registration as a User on the Web, if you so choose, in order to remember your data for future transactions.
3. The management of purchases: Processing of the order placed, shipment of the order and management of the invoicing and collection of the amount to be paid.

All of the above for compliance with the Terms and Conditions of the Store.

1. The management of the relationship with the Client and Users, which includes:
2. Customer service and management of communications necessary for the supply of products ordered and requests made by Customers and Users.
3. The management of complaints and requests for information in relation to the products purchased in the Store.
4. The execution of loyalty activities, including the sending of satisfaction surveys, as well as reminders of purchases initiated on the Web and not completed.
5. Statistical analysis of transactions, complaints and claims, as part of a process of continuous improvement of our services.

All of this is based on Legends' legitimate interest in ensuring business continuity and in maintaining a relationship with our Customers and Users that is as satisfactory as possible for them.

1. For the accounting and tax management of the activity, which is necessary to comply with the legal obligations of the owner of the Store.

2.2. Your data will be processed exclusively by Real Madrid for the following purposes:

1. Ensure business continuity, as well as supervise and control the activity carried out by Legends. All this on the basis of the legitimate interest that Real Madrid has in ensuring the proper development and evolution of its official Online Store.
2. If you have given your consent to Real Madrid C.F., in the registration form or in the purchase form, the Club will process your data to send you information and commercial communications, including by electronic means after the completion of a profile, concerning products, services and activities of Real Madrid, including the Online Store, and its sponsors and partners, and the subsequent statistical analysis related to such communications.

2.3. Your data will be processed jointly by Legends and Real Madrid as co-processors for the following purposes:

1. Only if you have given your consent we will process your data for sending, including by electronic means and after profiling, commercial communications concerning the Online Store and its products and for subsequent statistical analysis.
2. Analysis of the use and web traffic of the Online Store, as this is necessary to satisfy our legitimate interest in improving the Online Store, the user experience and the product and service offerings.
   • In addition, and on a very exceptional basis, the Companies, together or separately, may process your data for control and security purposes, for our own regulatory compliance and legal advice, necessary to satisfy our legitimate interest in defending our interests and rights and to fulfill our legal obligations (audit, criminal compliance and data protection).

Please note that if you have given your consent to cookies on the website, your data will also be processed for the purposes indicated in relation to each type of cookie, in accordance with our

3. Necessary and updated information

All fields marked with an asterisk (*) or for which the system requires the completion of the forms provided are mandatory. Failure to complete any of these fields may prevent the services from being received.

So that the information provided is always updated and does not contain errors, you should inform the Companies as soon as possible of any changes and corrections to your personal data at the time of receipt or via the following email address: [email protected].

4. Period of conservation of your data

We will store your data for the duration of the relationship with the Online Store, and once it ends we will keep the data blocked for the legal period provided in each case and the time for the possible formulation or defense of claims.

If you have given us your consent to send you commercial communications, your data will be processed for this purpose until you object. At any time you can request to unsubscribe from this type of communications, either as indicated in the section "Exercising your rights", or or through the unsubscribe system provided in each of the electronic communications we send you.

As for the newsletter, we will retain subscribers' data until they request unsubscription.

If you simply visit our website, please note that both the necessary cookies and any other cookies you have accepted also collect your personal data. In this case, the data will be kept for the periods of time indicated in the cookie banner and in the Shop's Cookie Policy.

5. With whom we share your information

We may communicate your personal data to:

• The Tax Administration and other legally authorized public entities and agencies when required or is necessary.
• Exceptionally, to judges, courts, tribunals or other public bodies for the resolution of conflicts, Security Forces and notaries.

In addition, our following suppliers may have access to some of your data to carry out their functions, but we ensure that they put in place high-level protection safeguards and can only use your data for what is strictly necessary in relation to the purposes detailed above.

Legends Suppliers:

- SHOPIFY, as the platform provider of the SHOPIFY Store

- WEGLOT as a tool for translation services

- THIRD BLINK SOFTWARE, INC (dba Rewind), a Canadian corporation, as a backup solution.

- ESSENTIEL, as a full-service provider of customer support services

-. INFOR Inc, as an Enterprise Resource Planning (ERP) system, which is located in a cloud in Frankfurt. It is used to store customer data that is used to fulfill orders.

- Microsoft Azure in the UK is used by Legends to host middleware and store customer data for business performance analytics and reporting

- Logistics providers as third parties:

- Makito in Madrid, Spain

- WFDS in Victoria, Australia

- Legends Hospitality, LLC dba Legends Global Merchandise in Indianapolis, Indiana, USA

Suppliers of Real Madrid:

- CHEETAH, for the sending of commercial communications

- Microsoft Ireland Operations Ltd.

- M2C Consulting Procedures (data integration)

- SOGETI ESPAÑA, S.L.U. (IT consulting)

- Willis Consulting, S.L., Garrigues, Ernst & Young, Estudio Jurídico Rodriguez Mourullo, Elzaburu S.L.P., and other professionals or law firms for the provision of legal advice, supplies, consulting and auditing services.

- Audisec, S.L. for the registration of data protection incidents.

- Other suppliers that may complement or to replace those mentioned above.

You may request more detailed information about the recipients of your data by sending an email to [email protected], indicating the specific processing for the recipients about whom you would like information.

International transfers of your data

• Your data may be consulted by data processors established outside the European Economic Area.
• In particular, your personal data will be accessed by system, logistics and technology service providers located in the United States and Australia, with whom the Companies have entered into standard contractual clauses approved by the European Commission as an adequate guarantee of the rights of the data subjects.
• These data processors may also be located in Canada. This country has been designated by the European Commission as a country with an adequate level of data protection comparable to that of the European Union, so it already has sufficient guarantees to carry out international transfers of personal data.
• Very exceptionally we may need to transfer your personal data to judges, courts or other bodies for the resolution of disputes outside the European Economic Area, the transfer being legitimate because it is necessary for the formulation, exercise or defense of claims, as the case may be.
• You can request more detailed information about international transfers of your data by sending an email to [email protected] indicating the specific recipients, the destination or the safeguards applied in relation to which you require information.

6. Exercising your rights

You may exercise the following rights:

• the right of access to your personal data to know what data is being processed and what processing operations are being carried out on that data.
• the right to rectify inaccurate data.
• the right to the deletion of your personal data, whenever possible.
• the right to request the limitation of the processing of your personal data when the accuracy, legality or necessity of the data processing is doubtful, in which case we may store your data properly blocked for the exercise or defense of claims.
• the right to object to the processing of your personal data, when the legal basis that allows us to process them, as indicated in point 2, is legitimate interest. The Companies will stop processing your data unless it has a compelling legitimate interest to do so or is necessary for the defense of claims.
• the right to data portability when the legal basis that allows us to process your data, established in point 2, is the existence of a contractual relationship or your consent.
• the right to revoke your consent, when the legal basis that allows us to process your data, set out in the table included in point 5, is your consent.

You may exercise your rights at any time, free of charge, by sending an email to Legends at. [email protected] or at Real Madrid at [email protected]indicating the right you wish to exercise and your personal data.

You can also file a complaint with the Spanish Data Protection Agency if you believe that data protection legislation has been infringed in the processing of your personal data. You can access other European Supervisory Authorities here...

7. Confidentiality

Any personal data we may collect will be treated confidentially and we undertake to maintain the confidentiality of such data in accordance with applicable law.

8. Privacy Policy Update

This Privacy Policy may need to be updated. You should therefore review this policy periodically and, if possible, each time you make a booking with us to ensure that you are properly informed of the type of information that is collected and how it is processed. We will inform you of any changes to this privacy policy that affect the processing of your personal data.