The purpose of this Privacy Policy (hereinafter, the "Policy") is to regulate the processing of personal data carried out by LaLiga Group International S.L. (hereinafter, "LALIGA") through the LALIGA Official App (hereinafter, the "LALIGA Official App" or the "APP").

In order to access the APP, you need to register on LALIGA Ecosistema, through which you access an environment created by LALIGA made up of different applications and websites, from affiliated football clubs with which LALIGA has collaboration agreements. By means of a common registration implemented by LALIGA in these assets (LALIGA Single Sign-On), each user receives a unique identifier so that any selection or modification of preferences or deletion request made in one of the applications or websites that are part of the ecosystem will affect the rest of the LALIGA Ecosistema environment and the entities that comprise it. Access the link to learn more about LALIGA Ecosistema and the entities that are part of it.

Who is responsible for processing your personal data?

Your personal data will be processed by LALIGA, with NIF: B-05421805 and address at Calle Torrelaguna 60, 28043, Madrid.

Contact the LALIGA Data Protection Officer: [email protected]

Where do we get your personal data from?

LALIGA will process the data you provide directly in the mobile application (email as mandatory data, and first name, surname(s), country, language and favourite team, which are optional data) and other data inferred as a result of your use and activity in the APP (device ID; Mobile Advertising ID (MAID); identifier for the provider of the service provided through the APP, LALIGA (IDFV), which identifies your device in order to track your activity within LALIGA Ecosistema applications; identifier for advertisers (IDFA) which identifies your device to track your activity between LALIGA Ecosistema applications and third-party applications; operating system; device model and telemetry, for example, when you click on particular content or the time you stay in the asset) and your interactions with the communications that we send you via push notification, in-app, if any (for example, clicking on the content of a communication).

Similarly, in the event that you are a user of another asset under the responsibility of LALIGA or in which LALIGA acts as joint data controller and which forms part of LALIGA Ecosistema, LALIGA may process in the APP the aforementioned personal data, declared or inferred in said assets.

Finally, we inform you that, in the iOS version of the Platform, Apple will ask for your permission for the use of your device's advertising identifier ("IDFA") by LALIGA for any of the purposes that require it, in accordance with the section "For what purposes do we process your personal data? of this privacy policy.

Importing data from social networks

We hereby inform you that you can use the social networks of which you are a user to register on LALIGA Ecosistema. Also, if you so consent, the social network you have chosen may share with LALIGA additional information to complete your profile in the LALIGA asset.

Data shared through Facebook:

Name and profile picture (required for registration, however, we inform you that LALIGA does not process your profile picture)

Email address (optional)

Birthday (optional)

Bio posts (optional; your public and private bio posts, including photos and videos, information about the places tagged in them and the types of reactions they receive)

Gender (optional)

Page likes (optional)

Current city (optional)

Categories of interests:

Food

Animals and Pets

Art and Culture

Banks, Finance and Economics

Alcoholic Beverages

Beauty

Cinema, Theatre and Musicals

Sports

Electronics and IT

Energy, Science and Industry

Social Groups

Home and Housing

Children

Media

Fashion

Automotive

Women

Music

Leisure and Entertainment

NGOs and Causes

Health, Hygiene and Wellness

Insurance

Professional Services

Shopping

Technology and the Internet

Telecommunications

TV and Radio

Travel

Video games

Viral Media

LALIGA will obtain the following inferred data through page likes and bio posts:

Engagement value: this value measures the volume of interactions that the user has with the official LALIGA page Facebook wall.

Social value: this value measures the user's social media influence.

Promotion value: users' walls are analysed for references to prize draws, promotions and prize draw entries, and a value is assigned that measures the promotional ratio on the user's wall. It also checks whether the user's profile follows Facebook pages dedicated to advertising promotions, raffles and prize draws.

Fan value: this score is a combination of the previous 3 scores that ranks users by the value obtained (a user with a higher score will be considered a more valuable user).

Data shared through Google:

First and last name(s) (required for registration)

Email address (required for registration)

Birthday (optional).

Gender (optional).

Country (optional).

YouTube channels you follow (optional).

Use (of the application) and transfer of information received from Google APIs to any other application will adhere to the Google API Services User Data Policy, including limited use requirements.

In this regard, we hereby inform you that LALIGA uses the tool of a third-party technical provider for the collection and structuring of the information provided by Facebook and Google.

Data shared through Apple:

Apple ID or email (required for registration)

Name (required for registration)

Apple will only share the aforementioned data, which is necessary to carry out the registration on the LALIGA asset.

We also remind you that LALIGA is not responsible for the legal alignment of the social network that you use for the registration on the LALIGA asset. For this reason, we recommend that you review the terms of use and privacy policy of the social networks you are going to use for this purpose so you can verify that the processing of your personal data is in accordance with your expectations of privacy and the data protection regulations applicable in each case.

Once the data have been imported and incorporated into your registered user account, your data will be integrated into LALIGA Ecosistema and processed by LALIGA for the purposes described in this Policy.

For what purpose do we process your personal data?

Main purposes

Registration in the APP: The personal data you provide in the registration (email), as well as inferred data (device ID) will be processed by LALIGA for the purpose of facilitating your access to the APP and providing you with the requested services. Likewise, LALIGA will use them to enable your access to the rest of the LALIGA Ecosistema assets. In particular, LALIGA will use the following personal data to fulfil this purpose:

Email (required): necessary to register in the APP.

Name and surname(s) (optional): used to identify the user within the APP.

Favourite team (optional): used to customise the user's display panel.

Language (optional): used to display the content in the language selected by the user.

Country (optional): to be able to personalise the content or communications sent to the user.

Hereby, we inform you that LALIGA uses the services of a third-party provider (RP Solutions, S.L.), which, in turn, uses the services of a provider located in the United States (Neverbounce, Inc.), which implies the international transfer of your email to the United States. This country does not guarantee a level of protection equivalent to that of the European Economic Area. For this reason, standard contractual clauses adopted by the European Commission have been signed with said service provider in accordance with Article 46.2(c) of the General Data Protection Regulation, including additional guarantees and obligations directed towards these providers for the highest possible security and transparency. The content of the standard contractual clauses is available upon request via [email protected].

The legal basis for the aforementioned purposes is that the processing is necessary for the performance of the legal conditions in which the user is a party, in accordance with Article 6.1(b) of the General Data Protection Regulation. The necessary and essential data for the provision of this service are the email address and telemetry data to enable your registration in the APP. If you do not provide this data, you will not be able to register in the APP.

Push and In-app Notifications: You may receive push and in-app notifications related to the content of other LALIGA assets to inform you about other products that may be of interest to you, as well as to provide information about the content of the APP itself. You can object to the sending of such communications at any time through the "notification center" of the APP. In-app notifications are shown only when you are inside the mobile application, while push notifications are displayed both when you are outside and inside the mobile application. For this purpose, LALIGA will use your user/device ID to send you notifications. In this regard, we inform you that LALIGA uses technical providers for sending push and in-app notifications.

The legal basis for the aforementioned purpose is that the processing is necessary for the satisfaction of LALIGA's legitimate interest in accordance with Article 6.1(f) of the General Data Protection Regulation, which consists of increasing the consumption of LALIGA’s content through the use of its assets. Prior to this, we inform you that LALIGA has carried out a proportionality analysis between its legitimate interest and the rights and freedoms of its users. You may request the conclusions of this analysis by contacting [email protected].

You have the right to object to the aforementioned purpose at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?".

Internal reporting: LALIGA will process in aggregate form the personal data you have provided directly (in this case, country, language, favourite team), the APP usage data (user ID, device ID (IDFA, or where applicable, IDFV), device model, operating system and telemetry, e.g. clicking on particular content or the time you stay on the asset) and finally, interactions with communications of any kind you receive (e.g. clicking on the content of a communication) or in communication with the support of the APP, for the preparation of relevant metrics and statistics that allow LALIGA to analyse the use made of the APP by the different user segments that are generated and the impact of its campaigns, evaluating the interest that the campaigns have aroused among the aforementioned segments based on the data analysed. In particular, LALIGA will carry out aggregate segmentations based on the aforementioned data, including:

Segmenting according to favourite team (e.g. 20 users have selected team X as their favourite team).

In this regard, we hereby inform you that LALIGA uses technical providers to carry out internal reporting.

The legal basis for the aforementioned purposes is that the processing is necessary to satisfy the legitimate interest of LALIGA under the provisions of Art. 6(1)(f) of the General Data Protection Regulation, consisting of extracting learnings from the information provided and obtained from users to enable it to improve the APP and optimise the communication campaigns it carries out based on the interest that these generate among the different groups of users. Before doing so, we would like to inform you that LALIGA has carried out a proportionality analysis between its legitimate interest and the rights and freedoms of its users. You can request the conclusions of this analysis at [email protected].

You have the right to object to the above-mentioned purpose at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?".

Use of the Identifier for Advertisers ("IDFA") on iOS devices (Apple)

The use of the IDFA for the purpose of "Internal Reporting" requires the user's permission to track within the Apple iOS operating system. In the event that the user has not given permission for the use of the IDFA, LALIGA may carry out this purpose using the IDFV of the device.

The user may accept or reject the tracking permission in the iOS settings of the user's Apple device at any time.

Additional purposes

LALIGA commercial communications: So that LALIGA can send you commercial communications via email, push notifications, in-app, SMS or other instant messaging channels about its activities (the competitions it organises, campaigns, public viewings, shows or live events), products (applications, web platforms and games developed by LALIGA), services, competitions, offers, prize draws and/or promotions run by LALIGA itself, or competitions, offers, prize draws and/or promotions carried out by LALIGA on products and services promoted jointly by LALIGA with its official sponsors, which you can consult here, national federations or national and international television channels.

For this purpose, LALIGA will only process the email address and your user ID.

We also hereby inform you that, in order to send you commercial communications via email or SMS, LALIGA uses a service provided by a third-party provider (salesforce.com EMEA Limited) which involves international transfer to the United States, a country that guarantees a level of protection equivalent to that of the European Union for personal data transferred from Europe to third-party providers in the United States that are adhered to the Data Privacy Framework, including this provider.

The legal basis for processing your data for the above-mentioned purpose is the consent you have given us to process your data for the specific purposes selected in accordance with the provisions of Art. 6(1)(a) of the General Data Protection Regulation. Your personal data will be kept for this purpose until you revoke your consent.

You have the right to withdraw your consent at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?", without this affecting the lawfulness of the consent-based processing prior to its withdrawal.

Development of simple segmentations: So that LALIGA can send you segmented commercial communications via email, SMS or other instant messaging channels about LALIGA's products and services. These communications will be made based on the information you have provided through the registration (for example, we will send you communications about products that may be of interest to you based on your age, favourite team or your province of residence).

The information used for the development of segments will be only that declared by the data subject in the registration of any of the assets that make up LALIGA Ecosistema (in this case, gender, country, city, age and favourite team or sport), with a low level of detail on the user's profile without using information inferred from the data subject or from third-party sources, with the segmentations in any case not being in depth. In this way, commercial communications can be sent according to the simple segments created with the aforementioned information, avoiding sending content that has no connection to you.

In this regard, we hereby inform you that LALIGA uses consulting and technical support providers to carry out simple user segmentations.

The legal basis for the aforementioned purpose is that the processing is necessary to satisfy the legitimate interest of LALIGA under the provisions of Art. 6(1)(f) of the General Data Protection Regulation, consisting of making effective use of the personal data provided by the user to achieve greater interest and return from the communications sent. Before doing so, we would like to inform you that LALIGA has carried out a proportionality analysis between its legitimate interest and the rights and freedoms of its users, the conclusions of which you can request at [email protected].

You have the right to object to the above-mentioned purpose at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?".

Under no circumstances will profiling carried out by LALIGA have any legal effect or significantly affect you in any similar way.

Development of comprehensive profiles: If you give us your permission, LALIGA will create a comprehensive profile of you to improve its commercial campaigns, offering you personalised advertising, information, services and products by sending personalised commercial communications via email, SMS or other instant messaging channels, sending you personalised push or in-app notifications (provided that you have given your consent for the purpose "LALIGA commercial communications") or showing you banners with personalised advertising on websites, apps or social networks about LALIGA products and services (for example, if we identify that you are a fan of a specific club, we will offer you personalised incentives, such as a football shirt of your favourite team).

In this way, the aforementioned information will be directed to the segments (groupings of users that are made according to the information obtained from them or the use you make of the APP or other assets in LALIGA Ecosistema) that we can develop based on the following data sources:

The information you provide directly at registration (in this case, favourite team, country, language);

Social login (in this case, first and last name(s), email address, birthday, gender, city and province in which you reside, interest categories, as well as inferred values - engagement, social, promotion and fan value - obtained from your Facebook bio posts and page likes);

Interactions with communications or notifications you receive (e.g. clicking on the content of a communication);

Data inferred as a result of usage and activity on the Platform (device ID, registered user ID, device model, operating system and telemetry, e.g. clicking on particular content or time spent on the asset).

In addition, LALIGA will generate these segments taking into account the following profiling techniques:

Measurement of individual campaign performance: LALIGA will use information relating to opening rates, average click-through rates, email bounces and unsubscription rates to measure campaign performance at an individual level, and as a result, make segmentations based on the information inferred about you and the other information declared, in order to impact you again with certain campaigns that are more connected to you or include you only in those in which you have shown more interest (for example, if you are a very active user in certain communications we may send you communications of the same type more frequently). For these purposes, we hereby inform you that through the data management tools provided by the social networks in which LALIGA has an account, user audiences will be created which may be shared, within each social network and in encrypted form, with third parties outside LALIGA, in order to create their advertising campaigns within the social network itself.

Optimisation of campaigns: we will exclude you from advertising campaigns about prize draws in which you have participated, about applications in which you have registered or downloaded, about products you have purchased or about services you have previously acquired (for example, we will avoid offering you a LALIGA app if we know that you have previously downloaded it). To do so, we will cross-reference your information with information obtained from other LALIGA assets of which you are a user.

Users with similar tastes and preferences: using the profile that LALIGA creates about you, we can send you personalised content taking into account other profiles similar to yours (for example, if we identify that other users similar to you like eSports, we will show you advertising related to eSports).

Valuation of users: LALIGA will obtain an unknown variable from known variables provided or inferred from you so that it can carry out an analysis of its users with the aim of identifying those with a greater propensity to use or contract LALIGA products, and where appropriate, offer you LALIGA products and services.

Retargeting: in the event that you have interacted with LALIGA without having registered or without having used or downloaded the corresponding LALIGA asset, LALIGA may use the identifying data of your device and/or your email address to impact you with advertising in other environments outside LALIGA in order to achieve the interaction desired by LALIGA.

In this regard, we hereby inform you that LALIGA uses consulting and technical support providers to carry out complex profiling.

Under no circumstances will profiling carried out by LALIGA have any legal effect or significantly affect you in any similar way.

How long will we keep your personal data?

The personal data we process will be kept for as long as the purposes for which they were collected persist and/or you do not revoke any consent you may have given, or you do not exercise your rights of erasure, objection or restriction of processing.

After the end of said period, LALIGA will keep your personal data, duly blocked, for the sole purpose of meeting any responsibilities that may arise.

Specifically:

Registration in the APP: the data provided for registration in the APP will be kept as long as you do not request the deletion of your data, this purpose persists and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

Push and In-app Notifications: the data provided for push and in-app notifications will be kept as long as you do not request the deletion of your data, this purpose persists and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

Internal reports: the data provided for internal reports will be kept as long as you do not request the deletion of your data, this purpose persists, you do not object to the processing and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

LALIGA commercial communications: the data provided for commercial communications carried out by LALIGA will be kept as long as you do not request the deletion of your data, this purpose persists, you do not revoke the consent granted or limit the processing and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

Development of simple segmentations: the data provided for the development of simple segmentations will be kept as long as you do not request the deletion of your data, this purpose persists, you do not object to the processing and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

Development of comprehensive profiles: the data provided for the development of comprehensive profiles will be kept as long as you do not request the deletion of your data, this purpose persists, you do not revoke the consent granted or limit the processing and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

Such personal data will be deleted after the end of the time limits indicated.

To which recipients will your personal data be communicated?

Your personal data may be communicated to other persons or companies to be used for their own purposes provided that you give us your consent by ticking the box provided or for the purpose of the service you request. In this regard, we hereby inform you that your personal data will be communicated to third parties as explained in the section "For what purposes do we process your personal data?

LALIGA will communicate your personal data, declared or inferred (identified in the section Where do we get your personal data from?) in the APP, to the affiliated football clubs that are part of LALIGA Ecosistema in order for you to access their assets and have the same profile throughout the ecosystem. All this will be possible as long as you are a registered user of any of the assets that are the responsibility of these clubs, in accordance with the privacy policies of the assets of each club and depending on the consents you have given to them. The legal basis for this communication of personal data is that the processing is necessary for the performance of a contract to which the data subject is a party under the provisions of Art. 6(1)(b) of the General Data Protection Regulation, in particular, the provision of the services offered to users in LALIGA Ecosistema through LALIGA's Single Sign-On, which are regulated in the conditions of use of the APP, and in the conditions of the other assets that are part of the ecosystem. To learn more about LALIGA Ecosistema and which clubs are part of it, you can access the following link.

LALIGA will communicate your personal data obtained in the assets belonging to LALIGA Ecosistema of which you are a user (email and, where appropriate, name, surname(s), phone number and country) to your Favourite Team and to third parties so that they can send you commercial communications about their activities, products, services, competitions, offers and/or promotions.

In this regard, we would like to inform you that your personal data will only be communicated to third parties and football teams belonging to the first and second division of the National Professional Football League, which have signed a collaboration agreement with LALIGA. In the following link there is a list of third parties and football teams that currently have an agreement with LALIGA and that, if you authorise us, may send you commercial communications.

We also hereby inform you that the communication of your data to third parties may, in some cases, involve the international transfer of your data to countries that either have an adequate level of protection, comparable to that of the European Union, or do not guarantee it. In the latter case, LALIGA has adopted the corresponding measures to ensure that your data are treated with a level of protection equivalent to that of the European Union. For this reason, LALIGA has signed standard contractual clauses adopted by the European Commission with these third parties under the provisions of Art. 46(2)(c) of the General Data Protection Regulation, including additional guarantees and obligations, following an analysis of the impact of the transfer carried out, aimed at these third parties for the greatest possible security and transparency. The content of the standard contractual clauses is available on request at [email protected]

The legal basis for this communication of personal data is the consent you have given us in accordance with the provisions of Art. 6(1)(a) of the General Data Protection Regulation.

Likewise, LALIGA may provide the user's personal data and any other information when required to do so by public authorities exercising responsibilities that have been lawfully granted to them and in accordance with applicable regulations.

Similarly, LALIGA uses some subcontracted entities that will access personal data and information as data processors or sub-processors in order to provide LALIGA with a necessary service. As such, LALIGA uses technical providers and technical and business consultancy providers in order to carry out the purposes indicated in the section "For what purposes do we process your personal data?".

These service providers sign a contract that obliges them to use your personal information only for the provision of the services set out in this policy.

What are your rights when you provide us with your personal data?

We hereby inform you that you can exercise your rights of access, rectification, objection, erasure, data portability, not to be subject to automated decisions and restriction of processing, as well as revoke your consent, at any time with LALIGA.

What are your rights as a user?

Right of access: you have the right to obtain confirmation as to whether LALIGA processes your personal data, as well as the right to access your personal data.

Right to rectification: you may request the modification or rectification of inaccurate personal data.

Right to erasure: you may request the erasure of your personal data.

Right to restrict processing: in certain circumstances, you may request that we restrict the processing of your data, in which case it will only be kept for the purpose of pursuing or defending claims.

Right to object: you may object to the processing of your data for the purpose you specify. LALIGA will cease processing the data, except for compelling legitimate grounds, or the exercise or defence of possible claims.

Right not to be subject to automated individual decisions: you have the right not to be subject to a decision based solely on automated processing, including profiling, which is likely to produce legal effects concerning you or similarly significantly affect you.

Right to data portability: if the APP allows it, you may exercise the right to the portability of your data, in a structured, commonly used and machine-readable format, and to transfer it to another data controller.

How do I exercise my rights?

By sending an email to [email protected] . The exercise of your rights will be completely free of charge.

If on accessing and, where appropriate, registering in the APP, you have given your consent for the purposes for which you were requested, you may revoke the consent granted or object to the processing of data based on legitimate interest at any time; by following the procedure established in each of the communications from LALIGA that you receive, through Consent Management, found in the menu of the APP, or by sending an email to the address: [email protected].

Objection to a particular purpose or revocation of consents given will not affect your use of the application or the lawfulness of the processing prior to the objection or revocation of consent.

On the other hand, if you have registered in the APP through a social network or similar service, you can exercise your right to the erasure of your data by deactivating the service "LALIGA Ecosistema" within the services connected to your profile in the social network. For more information, please consult the conditions of each service:

Google: https://myaccount.google.com/permissions

Facebook: https://facebook.com/help/218345114850283

Apple: https://support.apple.com/es-es/HT210426

Remember that if you are using the mobile application on Android or Apple you can unsubscribe and delete your account directly through the 'Profile' section in 'Consent Management'.

Finally, if you feel that your rights have not been exercised satisfactorily, you are not satisfied with the processing carried out with your personal data, you can contact LALIGA's data protection officer at the email address [email protected] or, where appropriate, file a complaint with the Spanish Data Protection Agency through its website www.aepd.es.

LIMITATIONS.

LALIGA would like to inform you that you must be at least 16 years old to use and register in the APP.