1. 1. Identification and contact details of the co-responsible persons.

Legends Hospitality España, S.L., domiciled at Paseo de la Castellana, number 53, 1-b, 28046-Madrid, with tax identification number B-88644299, and telephone number +1 212 317 3200 ("Legends") and the Real Madrid, domiciled at Avenida de Concha Espina nº1, Madrid, Spain, 28036, with tax identification number G-28034718, and telephone number +34 91 398 43 00 ("...").Real Madrid"). Legends and Real Madrid ("Companies") are jointly responsible for the processing of personal data.

The Privacy Policy is intended to provide information about:

  • The use that the Companies will make of your personal data through the Online Shop of Real Madrid https://shop.realmadrid.com (the"Website", the"Website" or the"Shop").
  • Where the companies process your data jointly and where they process it separately.
  • The legal basis that enables the Companies to process your data for each of the uses indicated.
  • The retention period of your data by the Companies.
  • With whom we share your data.
  • Your rights under the General Data Protection Regulation ("GDPR").

If you have any questions regarding the processing of your data, or if you want to know more about the joint-controller agreement, please contact the Companies at:

Legends Legal: 61 Broadway, Suite 2400, New York, NY 10006, dataprivacy@legends.net

DPO of Real Madrid: Avenida de las Fuerzas Armadas, 402, 28055, Madrid protecciondedatos@corp.realmadrid.com.

2. Purposes and legal basis for processing

2.1. Your data will be processed exclusively by Legends for the following purposes:

  1. The provision of the service requested by Clients and Users , which includes:
  2. The registration as a User on the Website, if you opt so, to remember your details for future transactions.
  3. The management of the purchases: Handling the order placed, shipping of the order and managing the billing and debt collection.

This is all based on compliance with the Store Terms and Conditions.

  1. The management of the relationship with Client and Users, which includes:
  2. Customer service and management of the communications necessary for the supply of products ordered and requests made by Customers and Users.
  3. The management of claims and requests for information made in relation to products purchased on the Store.
  4. To carry out loyalty actions, which includes sending satisfaction survey as well as reminders of purchases initiated on the Web and not completed.
  5. The statistical analysis of transactions, complaints and claims, as part of a process of continuous improvement of our services.

This is based on Legends' legitimate interest in ensuring business continuity and in maintaining a relationship with our Clients and Users that is as satisfactory as possible for them.

  1. For the accounting and tax management of the activity, which is necessary to comply with the legal obligations of the shop owner.

2.2. Your data will be processed exclusively by Real Madrid for the following purposes:

  1. To ensure business continuity, as well as to supervise and control the activity carried out by Legends. All of this is based on the legitimate interest that Real Madrid has in guaranteeing the correct development and evolution of its official Online Shop.
  2. If you have given your consent to Real Madrid C.F., in the registration form or in the purchase form, the Club will process your data to send you information and commercial communications, including by electronic means after the completion of a profile, concerning products, services and activities of Real Madrid, including the Online Shop, and of its sponsors and collaborators, and the subsequent statistical analysis relating to such communications.

2.3. Your data will be processed jointly by Legends and Real Madrid as joint control lers for the following purposes:

  1. Only if you have given your consent will we process your data for the purpose of sending, including by electronic means and after profiling, commercial communications concerning the Online Shop and its products and for subsequent statistical analysis.
  2. Analysis of the usage and web traffic of the Online Shop, as this is necessary to satisfy our legitimate interest in improving the Online Shop, the user experience and the supply of products and services.
    • In addition, and on a very exceptional basis, the Companies, together or separately, may process your data for monitoring and security purposes, for our own regulatory compliance and legal advice, necessary to meet our legitimate interest in defending our interests and rights and to comply with our legal obligations (audit, criminal compliance and data protection).

Please note that if you have given your consent to cookies on the website, your data will also be processed for the purposes indicated in relation to each type of cookie, in accordance with our

3. Necessary and up-to-date information

All fields marked with an asterisk (*) or for which the system requires the completion of the forms provided are mandatory. Failure to complete any of these fields may prevent the services from being received.

In order to ensure that the information provided is always up to date and does not contain errors, you should inform the Companies as soon as possible of any changes and corrections to your personal data at the time of receipt or by sending an e-mail to the following address: dataprivacy@legends.net.

4. How long your data will be kept

We will store your data for the duration of the relationship with the Online Shop, and once it has ended we will keep the data blocked for the legal period provided in each case and the time for the possible formulation or defence of claims.

If you have given us your consent to send you commercial communications, your data will be processed for this purpose until you object. You may unsubscribe from this type of communication at any time, either as indicated in the section "Exercising your rights", or or by using the unsubscribe system provided in each of the electronic communications we send you.

For the newsletter, we will retain subscribers' data until they request to unsubscribe.

If you simply visit our website, please note that both the necessary cookies and any other cookies you have accepted also collect your personal data. In this case, the data will be kept for the periods of time indicated in the cookie banner and in the Shop's Cookie Policy.

5. Who we share your data with

We may disclose your personal data to:

  • Tax authorities and other public bodies and entities authorized by law, when required or necessary.
  • Exceptionally, to judges, courts, tribunals or other public bodies for the resolution of conflicts, security forces and notaries.

In addition, our following suppliers may have access to some of your data to carry out their functions, but we ensure that they put in place high-level protection safeguards and can only use your data for what is strictly necessary in relation to the purposes detailed above.

Legend’s providers:

- SHOPIFY, as provider of the Shop platform

- WEGLOT as a tool for translation services

- THIRD BLINK SOFTWARE, INC (dba Rewind), a Canadian corporation, as a backup solution.

- ESSENTIEL, as a full service provider of customer care services

-. INFOR Inc. as an Enterprise Resource Planning (ERP) system, which is located in a cloud in Frankfurt. It is used to store customer data that is used to fulfil orders.

- Microsoft Azure in the UK is used by Legends to host middleware and store customer data for business performance analysis and reporting.

- Logistics providers as third parties:

- Makito in Madrid, Spain

- WFDS in Victoria, Australia

- Legends Hospitality, LLC dba Legends Global Merchandise in Indianapolis, Indiana, USA

Suppliers of Real Madrid:

- CHEETAH, for the sending of commercial communications

- Microsoft Ireland Operations Ltd. (storage).

- M2C Consulting Procedures (data integration)

- SOGETI ESPAÑA, S.L.U. (IT consultancy)

- Willis Consulting, S.L., Garrigues, Ernst & Young, Estudio Jurídico Rodriguez Mourullo, Elzaburu S.L.P., and other professionals or law firms for the provision of legal advice, supplies, consultancy and auditing services.

- Audisec, S.L. for the registration of data protection incidents.

- Other providers that can complement or replace those mentioned above.

You can request more detailed information about the recipients of your data by sending an e-mail to dataprivacy@legends.net, indicating the specific processing for the recipients about whom you would like information.

International transfers of your data

  • Your data may be accessed by data processors established outside the European Economic Area.
  • In particular, your personal data will be accessed by system, logistics and technology service providers located in the United States and Australia, with whom the Companies have entered into standard contractual clauses approved by the European Commission as an adequate guarantee of the rights of data subjects.
  • These data processors may also be located in Canada. Canada has been designated by the European Commission as a country with an adequate level of data protection comparable to that of the European Union and therefore already has sufficient safeguards for international transfers of personal data.
  • Very exceptionally we may need to transfer your personal data to judges, courts or other bodies for the resolution of disputes outside the European Economic Area, the transfer being legitimate because it is necessary for the formulation, exercise or defence of claims, as the case may be.
  • You may request more detailed information about international transfers of your data by sending an e-mail to dataprivacy@legends.net indicating the specific recipients, destination or the safeguards applied in relation to which you require information.
6. Exercising your rights

You may exercise the following rights:

  • the right of access to your personal data to know what data are being processed and what processing operations are being carried out on those data.
  • the right to rectify inaccurate data.
  • the right to the deletion of their personal data, where possible.
  • the right to request the restriction of the processing of your personal data where the accuracy, lawfulness or necessity of the data processing is in doubt, in which case we may store your data appropriately blocked for the exercise or defence of claims.
  • the right to object to the processing of your personal data, where the legal basis allowing us to process your personal data, as set out in point 2, is legitimate interest. The Companies will stop processing your data unless it has a compelling legitimate interest in doing so or is necessary for the defence of claims.
  • the right to data portability where the legal basis allowing us to process your data, as set out in point 2, is the existence of a contractual relationship or your consent.
  • the right to withdraw your consent, where the legal basis allowing us to process your data, as set out in the table under point 5, is your consent.

You may exercise your rights at any time, free of charge, by sending an e-mail to Legends at dataprivacy@legends.net or to Real Madrid at oposicion@corp.realmadrid.com, indicating the right you wish to exercise and your personal data.

You can also lodge a complaint with the Spanish Data Protection Agency if you believe that data protection legislation has been infringed in the processing of your personal data. You can access other European Supervisory Authorities here...

7. Confidentiality

Any personal data that we may collect will be treated confidentially and we undertake to keep such data confidential in accordance with applicable law.

8. Privacy policy update

This Privacy Policy may need to be updated. You should therefore review this policy periodically and, if possible, each time you make a booking with us to ensure that you are properly informed of the type of information that is collected and how it is processed. We will inform you of any changes to this privacy policy that affect the processing of your personal data.