Privacy Policy

This Privacy Policy has been developed taking into account the provisions of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter the GDPR, as well as Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Digital Rights (hereinafter, LOPDGDD) and other applicable regulations.

This Privacy Policy aims to inform individuals who provide their personal data, and/or the data of the person they represent, regarding which information is being collected, about the specific aspects related to the processing of their data, the purposes of the processing, the contact details to exercise their rights, the retention periods for the information and the security measures, among other things.

WHO IS RESPONSIBLE FOR THE PROCESSING?

In terms of data protection, VILLARREAL CFSAD must be considered the Data Controller, in relation to the processing of personal data carried out by this entity.

The contact details of the Data Controller are provided below:

either Identity of the responsible party: VILLARREAL CF SAD (CIF: A12362927)

either Physical address: Calle Miralcamp s/n, 12540 Vila-real (Castellón)

either Email: info@villarrealcf.es

either Telephone: 964 50 02 50

WHAT PERSONAL DATA DO WE PROCESS?

All information collected by VILLARREAL CFSAD will be treated in a fair, lawful and transparent manner.

Likewise, the data requested in each of the treatments carried out will consist only of those strictly necessary to achieve the intended and informed purpose in each case.

In this way, the data collected will be adequate, relevant, and not excessive in relation to the purposes for which it is processed in each case. Therefore, your personal data will be collected for specific, explicit, and legitimate purposes and will not be further processed in a manner incompatible with those purposes. Furthermore, it will be updated whenever necessary.

In order to complete the purchase process, ship the product, issue the corresponding invoice, and address any issues or queries from our customers, the following personal data will be requested before placing the order:

● name, surname, telephone, country, address, postal code, country, town/city, and province (all are required fields)

● Information on financial transactions: VILLARREAL CFSAD uses two payment methods: credit card payment through the Redsys payment gateway or cash on delivery. The USER must choose their preferred payment method before proceeding with the purchase.

● Payment Card: To process payments using this method, a payment gateway, also known as a virtual POS terminal, is used. This is a faster payment option than the previous one. VILLARREAL CFSAD accepts card payments through the Redsys payment gateway. VILLARREAL CFSAD works with accredited banks specializing in online payment methods, which have a secure and confidential system in place when the user purchases products. During the payment process, communication is exclusively between the user and the bank, and VILLARREAL CFSAD only receives confirmation from the bank that the purchase has been successfully completed.

Cash on delivery: through this method, the user pays for the merchandise at the time of its physical delivery.

Placing an order with VILLARREAL CFSAD implies that you are the actual owner and customer, and are not impersonating anyone else. The information you provide must be real and truthful. If VILLARREAL CFSAD detects fraudulent information or any attempt to violate this Privacy Policy, we will take appropriate action, including reporting the information to the relevant authorities.

WHERE DOES THE PERSONAL DATA COME FROM?

As a general rule, personal data is always collected directly from the data subject; however, in certain exceptions, data may be collected through third parties, entities or services other than the interested party.

In this regard, this fact will be conveyed to the interested party through the information clauses contained in the different means of collecting information and within a reasonable period or in the first communication made to the interested party.

FOR WHAT PURPOSE AND IN WHAT SPECIFIC CASES DO WE PROCESS PERSONAL DATA?

In general terms, personal data is processed for the following purposes:

either User registration management: The information you provide in the registration form will be used to manage users on our platforms. After registering, you will be able to view your order history, redeem gift cards or discount vouchers, modify your personal information and/or shipping and billing addresses, wish lists, ratings, or alerts.

either Management, fulfillment and execution of the purchase contract: Specifically, personal data will be used for the formalization of the purchase contract; for the management of payment transactions; to contact you in case of any incident related to your order; for the management of invoicing and delivery of purchase tickets and invoices; for the management of returns of purchased products; to inform you about the availability of the requested products; and/or for the management of coupons or gift cards that you redeem on the website or in our stores.

either Communications: To keep you informed, by mail and/or electronic means, about the activities organized by the club, both its own and those of others, as well as products, all of them in the sporting field and, among others, with the aim of promoting sport among its members and subscribers.

Furthermore, VILLARREAL CF collaborates with other organizations, both public and private (such as the sponsors listed on its website), that offer products or services that could be of interest to its members and season ticket holders, related to the activities of VILLARREAL CF, so unless you state otherwise, we may also send you this type of information.

either Contact: In order to respond to your request, we will process the essential data, which generally corresponds to your contact information (email) and data related to your order or the issue you report, as well as responding to requests for information received about the products and services offered or any type of request made by the user through any of the contact methods available.

When using social media to send us your inquiries, please avoid entering personal data. Remember that we do not have control over the data entered on these platforms, so we advise you to carefully read the privacy policies of the social network you are using.

either Customers: carry out the management of sales of goods and services, invoicing, accounting, collections, non-payments, offers, budgets and contracts, customer service, contact and business relations.

The personal data collected will not be used to create profiles or make automated decisions.

However, all the explicit purposes for which each of the treatments is carried out are included in the information clauses incorporated in each of the data collection methods (web forms, paper forms, voice messages or posters and information notes, invoices, contracts and other documents that contain personal data).

WHAT IS THE LEGAL BASIS FOR PROCESSING THE DATA?

As a general rule, prior to the processing of personal data, information is provided on the legal basis that establishes the legitimacy of the processing in question.

However, the organization may process personal information for the following purposes:

either Compliance with Legal and Regulatory Obligations: By way of example and not limitation. General Law for the Defense of Consumers and Users, General Tax Law, Corporate Income Tax Law, Audit Law, Value Added Tax Law, Civil Code, Commercial Code, as well as the existence of a specific law or regulation that authorizes or requires the processing of the interested party's data, which will be stated in the corresponding information clause.

either Contract Execution: for the prior management of a contracted service or product, development of the execution of a contract or subsequent management derived from said operations.

either Consent: Some data processing activities are based on obtaining the express and unambiguous consent of the data subject. This is achieved by incorporating informed consent clauses into the various information collection systems, providing consent through a declaration or a clear affirmative action, such as checking a box provided for this purpose, signing the relevant document, or submitting data through the indicated contact methods. Additionally, we inform you that we will only use your personal information in accordance with this Privacy Policy and, in general, we will request your consent for uses other than those for which you initially provided it.

HOW LONG DO WE PROCESS PERSONAL DATA?

Personal data is processed for the time necessary to fulfill the purpose for which it was collected, while the service is provided or the employment or contractual relationship is maintained, there is a mutual interest and/or for the time provided for in the corresponding regulations

Once the established timeframes have been met, the data will be deleted. This deletion will result in the blocking of the data, which will be retained solely for the use of Public Administrations, Judges, and Courts to address any potential liabilities arising from the processing, for the duration of the applicable statute of limitations. After this period has expired, the information will be destroyed.

WHO DO WE SHARE PERSONAL DATA WITH?

In order to carry out the delivery service of the purchased products, VILLARREAL CF informs you that it will transfer your contact data to the transport companies with which it works for the sole purpose of being able to send the merchandise correctly according to the destination indicated by THE USER in the purchase form.

Similarly, data for billing, accounting or tax purposes will be communicated to the authorities, regulatory bodies and public administrations with competence in the matter as established by current legislation.

We inform you that your personal data will be transferred, in compliance with legal obligations, to the competent bodies in the matter that require or request them (Royal Spanish Football Federation, public administration or the state security forces and bodies according to their respective powers).

ARE INTERNATIONAL TRANSFERS MADE?

We inform you that, as a general rule, no international data transfers are made outside the European Economic Area (EEA). Should a data transfer outside the EEA occur, THE ORGANIZATION will have appropriate safeguards in place to carry out said transfer, in accordance with the requirements of the General Data Protection Regulation (GDPR).

WHAT RIGHTS CAN YOU EXERCISE?

According to European regulations, your rights are as follows:

● Right of Access, the right to request information from the data controller about whether your personal data is being processed.

● Right of Rectification, a right that allows the affected person to request the modification of data that is inaccurate or incomplete.

● Right to object, the right of a person to object to the processing of their personal data or the cessation of such processing.

● Right to Automated Individual Decisions, right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

● Right to Restriction, right to suspend the processing of the user's personal data in certain cases

● Right to Erasure or Right to be Forgotten, right to erasure of the personal data of the interested party

● Right to Portability, the right to request the data controller to provide personal data in a structured and clear format to another controller.

● Right to lodge a complaint with the competent supervisory authority if you believe that the processing does not comply with current regulations.

HOW TO EXERCISE YOUR RIGHTS?

The applicant may exercise their rights through the following means:

either Email rgpd@villarrealcf.es providing documentation that proves the identity of the applicant (copy of the front of the National Identity Document, or equivalent)

In any case, you can request the protection of the Spanish Data Protection Agency through its website

In this regard, your request will be addressed as soon as possible and taking into account the deadlines provided for in the regulations on data protection.

WHAT COULD BE THE CONSEQUENCES OF NOT PROVIDING THE INFORMATION?

The data requested in the established fields marked with an asterisk (*) or those provided in the documents or media where the information is provided, are those strictly necessary in relation to the purpose for which they are collected, or for the provision of an optimal service to the interested party or through a legal obligation imposed on the data controller or a requirement necessary to enter into a contract, the inclusion of data in the remaining fields being voluntary.

If all the data is not provided, it is not guaranteed that the information and services provided will be fully tailored to your needs.

Therefore, if the required data is not provided, or is provided incorrectly or incompletely, your request cannot be processed, making it impossible to provide you with the requested information or to carry out the contracting of services.

Similarly, the user guarantees that the information transmitted in any of the forms is truthful, accurate and corresponds to data that he owns.

Our website services are not intended for minors, therefore registration is only permitted for persons over 18 years of age; otherwise, please note that any potential liabilities arising from the use of our website will be the responsibility of the minor's parents or guardians.

To prevent the use of our services by minors, we try to verify the age of our users when they formalize their registration by requesting their date of birth.

WHAT SECURITY MEASURES DO WE HAVE IN PLACE?

The security measures adopted by VILLARREAL CFSAD are those required, in accordance with the provisions of Article 32 of the GDPR.

In this regard, VILLARREAL CFSAD, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, has established appropriate technical and organizational measures to ensure a level of security appropriate to the existing risk.

In any case, VILLARREAL CFSAD has implemented sufficient mechanisms to:

● Ensure the ongoing confidentiality, integrity, availability, and resilience of treatment systems and services.

● Restore the availability and access to personal data quickly, in the event of a physical or technical incident.

● Regularly verify, evaluate and assess the effectiveness of the technical and organizational measures implemented to ensure the security of the treatment.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be revised from time to time to reflect changes in applicable law, updates to procedures for collecting and using personal information, the introduction of new services, or the discontinuation of existing ones. These changes will take effect upon publication on the website, so it is important that you review this Privacy Policy regularly to stay informed of any updates.