This document describes the way in which FUNDACIO DAMM will treat the personal data of our customers and web users in compliance with current legislation on data protection.
In it we will provide all the legal information about the use we will make of your personal data: the purposes for which we want to treat them, the legal bases that allow it, the periods of time during which we will keep them, the third parties with whom -if necessary- we may have to share them, or the rights that our customers and users can exercise, among other issues.
1Who is responsible for the processing of your personal data?
The entity legally responsible for the processing of your personal data is the commercial company (hereinafter, "the Data Controller"), with registered office in Barcelona, Rosselló street, 515, CIF G62759758 and email address privacidad@cfdamm.cat.
2What personal data is processed?
The Data Controller will process the personal data of those individuals (customers, potential customers, or users of our websites, hereinafter referred to as "the data subject") who provide them to us for the purposes described in Section 4 of this Privacy Policy.
For this purpose, the Data Controller will process the following personal data:
| Category | Personal Data |
|---|---|
| Identification data of the player and parents or guardians | Name and surname, ID, age, date of birth. |
| Contact information | Email, contact telephone number and postal address. |
| Image | Photos and videos. |
3How did we obtain your personal data?
The personal data that the Data Controller will collect and process from the interested party are:
- those that the interested party directly provides when registering on our website,
- those collected during any purchase process, and
- those that the interested party may provide during their commercial and contractual relationship, or when making any inquiries, requests, complaints, or claims.
In this way, and as a general rule, the Data Controller will not collect personal information about its data subjects from other external sources, but only directly from them. In this respect, and for this reason, the data subject guarantees that all the information and/or documentation that he/she may provide to the Data Controller is truthful and is his/her own. In those exceptional cases in which it is a third party who provides us with personal information about a data subject (such as when a visit is arranged for a group of several people), we will expressly advise (i) the need for that third party to be duly authorised to provide the Data Controller with such personal information and (ii) the manner in which the data subjects will receive this legal information.
4For what purposes and on what grounds do we process your personal data?
The Data Controller will process the data of data subjects for the purposes and in accordance with the legitimate bases detailed below:
4.1Processing necessary for compliance with legal obligations
The Data Controller will need to process personal data of the data subjects to comply with the various legal obligations required at any given time. These obligations will exist and must be fulfilled even after their contractual relationship with the Data Controller has ended, as applicable in each case.
As a result of these legal obligations, the following processing will be carried out, by way of example:
- Compliance with legal, tax, accounting obligations and judicial requirements. The Data Controller will process the personal data of the data subjects to comply with accounting, legal, tax, administrative obligations, as well as to respond to any requirements coming from the Court or Tribunal, Law Enforcement Agencies or any other competent Public Administration to which the Data Controller is obligated.
- Customer service. The Data Controller will process the personal data of its customers to manage the requests, inquiries, questions or claims that they may submit through its Customer Service. Additionally, the Data Controller will process the personal data of those social media users who interact with the official accounts (username, full name, email address and user profile photo) to make any inquiry, request, complaint or claim.
4.2Processing operations carried out based on the data subject's consent
Provided that the data subject has given their consent, the Data Controller may carry out the following data processing:
- Sending newsletters: with information about products, services, and upcoming events, to the email address with which the data subject has registered.
- Image processing, for promotional purposes, exclusively in the context of the player's sporting activity. These images may be published on the website, magazines, yearbooks, or other media owned by the Data Controller or accredited media, always in relation to the data subject's status as a player and their participation in training, tournaments, matches, events, or activities organized by the Data Controller.
The data subject can in any case refuse to give their authorization (or give it initially, but later withdraw it), without this affecting their relationship with the Data Controller or causing any harm. However, the data subject should be aware that if they withdraw their authorization, it will not affect the legitimacy of what the Data Controller has done until that moment, as it does not have retroactive effects.
4.3Treatments necessary for the development of the contractual relationship between the Data Controller and the interested party
The Data Controller may perform those processes necessary for the formalization, control, and compliance of the contractual relationship between them and the data subject:
- If the data subject, on behalf of their child or ward, requests registration for sporting events offered by the Data Controller, processing the personal data provided during registration (name, surname, phone number, date of birth, email address, postal address).
4.4Treatments protected by the legitimate interest of the Data Controller
The Data Controller will carry out additional processing based on the legitimate interest provided for in the current data protection regulations.
Regarding such processing, the data subject has the right to (i) obtain more information about what this "legitimate interest" consists of, (ii) know how the Data Controller has concluded that their data protection is not harmed, or (iii) directly oppose it.
Among all these, the Data Controller has performed what is known as a "balancing test." It is an internal analysis to confirm that the Data Controller's legitimate interest does not harm the data subjects' interests in the protection of their personal data. If the data subject wants more information about this test, they can request it through the email address privacidad@cfdamm.cat.
These processes are detailed below.
- Damm Group entities may access the data subject's data to carry out internal administrative and accounting tasks.
The Data Controller will also process the personal information of our users using anonymization or pseudonymization techniques to achieve statistical purposes to draw conclusions about their behavior, thus improving our services and, consequently, customer satisfaction.
4.5Tratamiento realizado en base a un interés público
En las instalaciones del Responsable del Tratamiento existen instaladas cámaras de videovigilancia que recogerán y tratarán la imagen personal de cualquier interesado que acceda a sus instalaciones.
La finalidad de este tratamiento es proteger las instalaciones y los activos que estén dentro de ellas, así como la propia indemnidad y seguridad de las personas que también se encuentren en dichas instalaciones. De acuerdo con la normativa vigente en materia de protección de datos, este tratamiento se basa en el cumplimiento de una misión de interés público.
Las imágenes no serán cedidas a ningún tercero y únicamente se conservarán durante el plazo de un mes desde que fueron obtenidas. No obstante, en el caso que lo solicitase una autoridad competente (Juzgados y Tribunales, Fuerzas y Cuerpos de Seguridad), el Responsable del Tratamiento cederá dichas imágenes a dicha autoridad. En otros casos, las autoridades mencionadas pueden ordenar al Responsable del Tratamiento la conservación de las imágenes más allá del plazo legalmente permitido. Las imágenes también serán utilizadas por el Responsable del Tratamiento, como evidencia o prueba, en el caso en que deba exigir responsabilidad a un interesado por cualquier actuación ilícita.
5How long will the Data Controller retain your data?
The personal data of the interested parties will be retained until the purpose for which it was collected has been fulfilled. After that, and before being destroyed, it will be duly blocked to address potential claims and to be made available to the competent authorities during the legally established limitation periods. In these cases, the necessary technical and organizational measures will be adopted to ensure that it is used only for this purpose.
6To whom will we share your data?
The Data Controller will only communicate the personal data of the interested party to those third parties, bodies, and competent public institutions of the autonomous and local administrations, including the judicial bodies to which it is legally obliged to provide them.
Apart from the aforementioned data communications, the Data Controller will have the collaboration of third-party service providers who may have access to personal data and who will process them on behalf and in the name of the Data Controller as a result of their service provision.
The Data Controller follows appropriate criteria for selecting service providers in order to comply with its obligations in terms of data protection and undertakes to sign the corresponding data processing contract with them, through which it will impose the obligations established in the applicable regulations.
Furthermore, the personal data of the interested parties will not be transferred internationally. However, in the event that the personal data are transferred internationally as a result of the Data Controller's relationship with its service providers, the latter will inform the interested parties about such transfers, and they will be carried out in accordance with the applicable personal data protection regulations and, in particular, sufficient guarantees will be adopted to demonstrate that the providers provide a comparable level to the level required in the European Union.
7What are your rights?
The interested party can exercise, if desired, their rights of access, rectification and deletion, as well as request the limitation of the processing of their personal data, oppose it, request the portability of their data, as well as not be subject to automated individual decisions, and withdraw their consent, by sending a written communication to the Privacy Office of the Data Controller at the postal address of Barcelona, Rosselló Street 515, CP 08025, or to the email address privacidad@cfdamm.cat, providing an official document that proves their identity, when necessary.
They can also file a complaint with the Spanish Data Protection Agency regarding the response they have received in response to their rights. In any case, the interested party can contact the Data Protection Officer, accessible through the email dpo@dammcorporate.com, to resolve any claim so that we can help them in this regard as well as any issue related to their functions.