Privacy policy - AC Museoa

1. General information.

At Athletic Club we are committed to the protection of your privacy and the proper use of the personal data we process and that you submit to us, both online (through this website and, as appropriate, through any one of its subdomains, microsites and/or mobile apps), and offline.

Please read this policy carefully and ensure you understand it and agree with it before providing us with your personal data. If you do not agree with it, please do not use this website or its services and do not submit your data to us. If you access this website, use any of its services, or submit your data to us, whether online or offline, we shall understand this indicates you are clearly agreeing (whenever so necessary) to your data being used for the purposes as specified forthwith.

2. Who is responsible for processing your data?

Party responsible: Athletic Club
Postal address: Ambas en Alameda de Mazarredo 23, 48009 Bilbao (Spain)
Phone number: +34 94 424 08 77
Email: webmaster@athletic-club.eus or museoa@athletic-club.eus (solely for users of the museum and in relation to the processing of data in it).

3. How have we obtained your data?

If you are a member or follower, you have provided them, either online or offline, when registering to enable us to keep in contact with you.

If you have not submitted your data through this website, we gather information, for example, when you access the website, when you register as a user, complete any form requesting personal data, when you download our mobile app, when you launch a session in our services through third-party media such as Facebook or Google, when you buy something from our shop or purchase tickets, or when you communicate with us directly via email.

We may process and record your browsing, sessions and related information, either independently or with the assistance of third-party services, even through the use of cookies and other monitoring technologies.

By providing your personal data you are confirming that you are empowered to do so and that the information is correct, true, accurate and updated, that it is not confidential, that it is not in breach of any contractual constraints or third-party rights, and you undertake not to impersonate any other users by using their registration data for the website’s different services and/or content.

You are responsible for ensuring your data are correct and updated, with Athletic Club declining all responsibility in the event you should fail to do so.

The personal data processed by Athletic Club and the Athletic Foundation may be provided by third parties, such as, for example, affiliated clubs or entities or organisations with which we have reached agreements to undertake social, cultural and sports projects. In such cases, the categories of data we may process are those involving identification, personal characteristics, and even those social circumstances that are especially protected.

3.1. Third-party data.

Regarding other people’s data, you should respect their privacy by taking special care when posting their personal data. If you provide data on third parties, you are responsible for obtaining their prior and express consent for using them and disclosing them to us, and you are responsible for informing them that their data have been included in our files.

Any disclosure of the data of third parties without their consent may be in breach not only of legislation on data protection but also on said third parties’ right to honour, privacy and personality.

4. Why do we process your data?

The data you submit to us, as well as any other generated during the relationship we maintain with you, may be processed for different purposes, such as the following:

a) If you are one or more of the following: a Club member or follower, a member of a supporters’ club, a Foundation member, follower or collaborator, and/or a participant attending or taking part in any one of our activities, events or projects of a sports, social or cultural nature, we use your data for:

Keeping in contact and messaging you.
Managing the contractual and/or commercial relationships that, as appropriate, we may maintain, and sending you information on our activities, events, products and services and, as appropriate, managing your registration and/or participation in said activities or events.
Supervising accesses and compliance with regulations on the prevention of violence at sporting events.

b) If you are simply a user of our website (and, as appropriate, any one of its subdomains, microsites and/or mobile apps) we use your data to manage the online purchase of tickers (whether for matches, events, the museum …), any requests made or services arranged through our website or the Club’s official app, and the relationship, even contractual, as appropriate, arising from them, and whenever necessary, managing your registration and/or participation in the online activities or events in which you take part.

The provision of certain registration data (or their use when already registered as a member or follower and ticking the corresponding option on the registration form), or your Facebook profile data when you use the Facebook Connect option for registering, will be mandatory in some cases; for example, when accessing certain services or content, such as online purchases, online follower, contact, VIP area, accessing the display or download of audiovisual content … as these data must be processed for the purposes described above in this section. If this information is not provided, we cannot provide the services requested.

5. How long do we keep your data?

We keep the personal data you provide until you ask them to be removed; and we may still keep them, although their processing in this case will solely be to comply with legal obligations and/or for lodging or refuting claims.

6. What is the justification for processing your data?

In some cases (e.g., members, and purchasers of tickets or items from our online shop), the legal basis that entitles us to process your data is the relationship arising from the contract existing between the parties; in others, it will be your consent; for example, if you have submitted a request through our website, or if you are simply a user of the same, or a participant in the activities and/or events arising from any social, cultural or sports projects we undertake directly or in partnership with other entities and organisations. You provide this consent in an unequivocal manner when you provide your data online, through our website, or offline, understanding this submission to constitute clear confirmation of such permission. You may withdraw this permission at any time by sending us an email accordingly to webmaster@athletic-club.eus or to museoa@athletic-club.eus (solely for users of the museum and in relation to the processing of data in it) , although this withdrawal does not have an effect on the processing of your data for all the other purposes described.

In other cases, the reason may be a legal requirement; for example, in the case of regulations on the prevention of violence at sporting events, and in other cases, given the pertinent and appropriate relationship you maintain with us as a member, follower, collaborator, user of our website, participant in the activities and/or events arising from any social, cultural or sports projects we undertake…, we have a legitimate interest in processing your data for their maintenance and management.

For holding prize draws and promotions among our members and followers, and participants in the activities and/or events arising from any social, cultural or sports projects we undertake.
For taking photographs and/or videos at activities or events that may be posted on this website and, as appropriate, any one of its subdomains, microsites and/or mobile apps, involving the profiles the Club or the Foundation have on whatsoever social media, as well as on YouTube, for reporting on the event, documenting it, and including it in the same’s photo/video record. This means your image may appear on advertising posters, leaflets, programmes and any other materials the Club issues.
For enhancing your user experience or for further developing, customising and improving our services according to users’ preferences, experiences and shared or personal issues, for which we may create profiles with the information in our possession, although we shall not make any automated decisions based on those profiles.
For conducting opinion and/or satisfaction surveys and sending you information on our activities, products and/or services (including advertising and/or commercial messages pursuant to article art. 21 of Spain’s Law 34/2002, of 11 July, on Services of the Information Society and Electronic Commerce) or regarding any businesses that work with the Club or Foundation, although under no circumstances will we disclose your personal information, as that information will always be processed through our own means.
Any comments you make on Athletic Club’s profiles in social media may be published on our website, together with the photo accompanying such comments.

These usages are compatible with the initial reasons for gathering your data (managing our contact and communication with you and upholding the relationship between us) although, in all cases, the submission of your data for the above purposes, derived from our legitimate interest, is always voluntary, and your interests, rights and freedoms shall always prevail over our legitimate interest, so if you ask us to delete these data and stop using them for these purposes by sending an email stating this to webmaster@athletic-club.eus or to museoa@athletic-club.eus (solely for users of the museum and in relation to the processing of data in it) we shall do so, keeping them blocked to be used solely for the formulation, lodging or refutation of claims. This deletion does not have an effect on the processing of your data for all the other purposes described.

If you have provided sensitive data subject to special protection, the justification for using them is your express consent. You provide this consent in an unequivocal manner when you submit your data, understanding this submission to be a clear confirmation of this consent. The provision of the data requested is mandatory, as they are vital for responding to your request; if you do not provide them, we cannot answer you. You may withdraw this permission at any time by sending us an email accordingly to webmaster@athletic-club.eus, although this withdrawal does not have an effect on the processing of your data for all the other purposes described.

7. To whom may we disclose your data?

You are hereby informed that the data you provide may be disclosed to third parties for fulfilling those purposes directly related to the legitimate roles of assignor and assignee, such as the following:

To those companies responsible at any given moment for the logistics of despatching and delivering products from the online shop.
To those entities or bodies to which the Club is legally required to submit data, to Spain’s Professional Football League, as owner of the membership management software, to third parties as required by anti-violence legislation, and to Spain’s Professional Football League for controlling access and complying with anti-violence regulations at sporting events, and to the tax authorities.
To banking institutions for the management of payments.
To the Athletic Club Foundation for sending you information on its activities.
In the case of those competitions we organise within the framework of activities or events, we may disclose entrants’ data to the jury, although we will preferably do so using pseudonyms or anonymously.
You are hereby informed that if we use US suppliers to provide us with auxiliary services for our activity (hosting, housing, SaaS, remote backup copies, IT support or maintenance, email manager, delivery of e-mails, and e-mail marketing, etc.), which may involve the disclosure of personal data, we shall choose companies that have adhered to the Privacy Shield agreement between the US and the EU, whereby they undertake to comply with the same level of requirements as the EU in matters of data protection. Nevertheless, by accepting this data protection policy you expressly and unequivocally authorise the disclosure of your data to said companies, in the knowledge that this means the international transfer of data to a country outside the European Economic Area and providing your unequivocal consent to said transfer.
Our services contain certain social media features and widgets, such as “Link to Facebook” or “Launch session with Google”, the “Like” button on Facebook, the “Share” button, or other interactive mini-programs that are common on social media. These social media features may collect information on your IP address or on the page you are visiting on our website, and a cookie may be created to ensure they work properly. These social media features are not hosted by a third party or directly in our services. Your interactions with these third parties are governed by their own policies and not by our own.

8. What are your rights when you provide us with your data?

Right of access: You may ask us to tell you what personal data we are processing, and even for a copy of the same.
Right of correction: You may ask us to correct any inaccurate data or to complete any that are incomplete, even through an additional submission.
Right of deletion (right to be forgotten): You may ask us to delete your personal data in the following cases: when they are no longer required for the purposes for which they were gathered, when you withdraw your consent, when illegitimate use has been made of the same, or in compliance with a legal obligation.
Right to restricted processing: You may ask for your data to be subject to restricted processing, in which case we will hold them solely for the purpose of defending against claims.
Right to data portability: You may ask us to return (to you or to a third party you specify) your personal data in a format that is structured, of common usage, and involves mechanical reading.
Right of contestation: You may contest the processing of your data if this is informed by the file owner’s legitimate interest or when it is for advertising purposes.

You may exercise all these rights by submitting a written and signed request, in all cases attaching a copy of your ID or passport, to the postal address or email specified in section 2 herein. If the event of any change to your data please notify this to the same address, with the company declining any responsibility should you fail to do so.

Once we have received any one of the above requests, we shall reply to you within a maximum of 10 days.

You are entitled to submit a complaint to Spain’s Data Protection Agency. For more information on your rights and to request models of the forms for exercising your rights, please visit the website of Spain’s Data Protection Agency [Agencia Española de Protección de Datos] at www.agpd.es.