Privacy policy

This is a translation of the Spanish original, provided for information purposes. In the event of any discrepancy, the Spanish version shall prevail.

Last updated: 17 August 2026

This Privacy Policy has been drawn up in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Act 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

It explains what data we process when you shop or browse on the Official Online Store of Villarreal C.F., for what purpose, on what legal basis, for how long, who we share it with and what rights you have.

WHO IS THE DATA CONTROLLER?

  • Controller: VILLARREAL CLUB DE FÚTBOL, S.A.D.
  • Tax ID (CIF): A12362927
  • Address: Camino Miralcamp 128, 12540 Vila-real (Castellón), Spain
  • Store contact: retail@villarrealcf.es · +34 964 524 921
  • Data protection contact: rgpd@villarrealcf.es

WHAT DATA DO WE PROCESS?

Data you provide to us:

  • Identification and contact details: name and surname, email address and telephone number.
  • Shipping and billing address: address, postcode, town, province and country.
  • Tax details, when you request an invoice.
  • Personalisation content, if you personalise a product.
  • The content of your enquiries, when you write to us.

Data generated by your activity:

  • Order and returns history.
  • Transaction data: amount, date, payment method, and the last four digits and brand of your card. We do not store your full card details: payment is processed through a secure payment gateway.
  • Browsing data: IP address, device, browser and pages visited, collected by means of cookies. See our Cookie Policy.

The data marked as required on each form is essential in order to process your order; the rest is optional.

WHERE DOES IT COME FROM?

As a general rule, you provide the data to us directly.

If you log in with your Villarreal C.F. account through the single sign-on (SSO) system, we receive from that system the identification data needed to link your account with the store.

WHY DO WE PROCESS IT AND ON WHAT LEGAL BASIS?

Purpose Legal basis
Managing your registration and customer account Performance of the contract (Art. 6(1)(b) GDPR)
Processing, preparing and shipping your order, and handling exchanges, returns and guarantee claims Performance of the contract (Art. 6(1)(b))
Handling payment and preventing payment fraud Performance of the contract (Art. 6(1)(b)) and legitimate interest in preventing fraudulent transactions (Art. 6(1)(f))
Issuing invoices and complying with accounting and tax obligations Legal obligation (Art. 6(1)(c))
Dealing with your enquiries, incidents and complaints Performance of the contract (Art. 6(1)(b)) or legitimate interest in assisting you when you are not yet a customer (Art. 6(1)(f))
Sending you marketing communications from the store if you have subscribed Your consent (Art. 6(1)(a))
Grouping our customers into segments, based on purchase history, so that marketing communications are more relevant Legitimate interest in tailoring our communications (Art. 6(1)(f)). You may object at any time
Sending you information about third-party and sponsor products or services Your consent (Art. 6(1)(a))
Measuring use of the store by means of analytics cookies Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI)
Showing you personalised advertising by means of advertising cookies Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI)
Responding to requests from public authorities, judges and courts Legal obligation (Art. 6(1)(c))

You may withdraw your consent at any time, as easily as you gave it, without this affecting the lawfulness of processing carried out beforehand. See the section on rights.

DO WE CARRY OUT PROFILING?

Customer segmentation. We use a tool that groups our customers into segments based on their purchase history, so that the marketing communications we send are more relevant. This segmentation does not produce legal effects concerning you or similarly significantly affect you: it does not determine the price you pay, your access to products, or the terms of your purchase.

You may object to this segmentation at any time, without having to give a reason, by writing to rgpd@villarrealcf.es.

Advertising. If you accept advertising cookies, the providers listed in our Cookie Policy may use your browsing information to build audiences and show you personalised advertising inside and outside our store. You can prevent this by refusing or withdrawing consent for those cookies.

The payment platform applies automated fraud risk analysis to orders. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you without human intervention.

HOW LONG DO WE KEEP YOUR DATA?

  • Account data: for as long as you keep your account active. If you request its deletion, it is deleted unless it must be retained for the reasons below.
  • Order and transaction data: for the duration of the legal guarantee (three years from delivery) and for as long as liabilities may arise from the contract.
  • Invoicing and accounting: six years, in accordance with Article 30 of the Spanish Commercial Code, and the applicable tax limitation periods.
  • Enquiries and complaints: while they are being handled and for the limitation period of any actions that might arise.
  • Marketing subscriptions: until you unsubscribe or withdraw your consent.
  • Cookies: the retention period for each one is set out in the Cookie Policy.

Once those periods have elapsed, the data is blocked and remains available only to public authorities, judges and courts in order to address any liabilities, until these become time-barred, at which point the data is erased.

WHO DO WE SHARE YOUR DATA WITH?

In order to provide the service, the following processors have access to your data, acting on our instructions and under a contract compliant with Article 28 GDPR:

  • E-commerce platform: Shopify Inc., which provides store hosting, payment processing, forms and transactional email delivery.
  • Carriers: MRW for domestic shipments and DHL Express for international shipments.
  • Cookie consent management: Pandectes.
  • Single sign-on (SSO) with your Villarreal C.F. account: miniOrange.
  • Promotions and discounts: Planet.
  • Customer segmentation for marketing communications: Clustie.
  • Store data management: Matrixify, for internal imports and exports.
  • Technology services provider giving support and maintenance to the store on behalf of Villarreal C.F.
  • Digital analytics and advertising: Google LLC and Meta Platforms Inc., if you accept the corresponding cookies. They are identified in the Cookie Policy.

Your data may also be disclosed to public authorities, judges and courts where there is a legal obligation to do so.

Apart from these cases, we do not disclose your data to third parties.

ARE THERE INTERNATIONAL TRANSFERS?

Yes. Some of the providers listed in the previous section are located outside the European Economic Area, mainly in the United States.

These transfers are made with the safeguards provided for in Chapter V GDPR: Standard Contractual Clauses approved by the European Commission, with any applicable supplementary measures, or the provider's certification under the EU-US Data Privacy Framework.

You can request information about the applicable safeguards by writing to rgpd@villarrealcf.es.

WHAT RIGHTS DO YOU HAVE?

  • Access: to know whether we process your personal data and obtain a copy of it.
  • Rectification: to correct inaccurate data or complete incomplete data.
  • Erasure: to ask us to delete your data when it is no longer necessary.
  • Restriction: to ask us to suspend processing in certain cases.
  • Objection: to object to processing based on legitimate interest. You may object at any time and without giving reasons to processing for direct marketing purposes.
  • Portability: to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
  • Automated decisions: not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.
  • Withdrawal of consent at any time, without this affecting the lawfulness of processing carried out beforehand.

HOW TO EXERCISE THEM

Write to us at rgpd@villarrealcf.es, or by post to Camino Miralcamp 128, 12540 Vila-real (Castellón), Spain, stating which right you wish to exercise. We may ask you to prove your identity if we have reasonable doubts about who is making the request.

To unsubscribe from our marketing communications you can also use the link included in each of those emails. To review your cookie consent, use the cookie preferences panel.

We will respond within one month of receiving your request. That period may be extended by a further two months if the request is complex, in which case we will let you know.

If you believe we have not properly dealt with your rights, you may lodge a complaint with the Spanish Data Protection Agency: C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es.

WHAT IF YOU DO NOT PROVIDE YOUR DATA?

The data marked as required on each form is essential in order to process your order, issue the invoice and deliver the product to you. If you do not provide it, or if it is incorrect or incomplete, we will not be able to complete the purchase or deal with your request.

Providing data in order to receive marketing communications is always optional.

MINORS

The store is not aimed at minors and purchases are permitted only to persons over 18. If we find that a minor's data has been provided without the authorisation of their parent or guardian, we will delete it.

SECURITY MEASURES

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, aimed at ensuring the confidentiality, integrity, availability and resilience of our systems, restoring access to data in the event of an incident, and regularly testing the effectiveness of the measures in place.

CHANGES TO THIS POLICY

This Policy may be revised to adapt it to legislative changes, new services or changes in processing activities. Changes take effect from the moment they are published in the store, and the date of the latest update appears at the beginning of this document.