Privacy Policy Open Innovation

1. Identification

  • Data Controller: Club Atlético de Madrid S.A.D. (hereinafter, the “Club”)
  • Tax ID Number: A-80373764
  • Registered office: Av. de Luis Aragonés, 4, 28022 Madrid
  • Data Protection Officer: dpo@atleticodemadrid.com

2. Information

By accepting this Privacy Policy, the user (hereinafter, the “User” or, where applicable, the “Users”) is informed that the personal data provided through the website atletilabopenconnect.com (hereinafter, the “Website”), as well as the data derived from their browsing and any other data that the User may provide in the future on the same, will be processed by the Club as the data controller for the purposes indicated in this policy.

The User must carefully read this Privacy Policy, which has been written in a clear and simple manner to facilitate its understanding, and the User may freely and voluntarily determine whether they wish to provide their personal data to the Club.

3. Mandatory Provision of Data

The data requested in the forms on the Website are, in general, mandatory (unless otherwise specified in the required field) in order to fulfil the purposes for which they are being collected. Therefore, if the User does not provide them or does not provide them correctly, the User’s requests cannot be dealt with, without prejudice to the fact that the User may freely view certain content on the Website.

4. Origin of the Data

The data processed by the Club for the purposes listed in the following section comes from the User themselves through the various forms on the Website and from the User’s use of the Website and their browsing of it (through cookies or data storage and retrieval devices), in accordance with the consent given by the User to the Club, where applicable.

5. For What Purposes, On What Legitimate Basis, What Type of Data and For How Long Will the Club Process the User’s Data?

a) Registration and Management of Participation in the “Atleti Lab Open Connect powered by Telefónica” Challenge

  • Purpose of processing: To manage registration, participation and the running of the competition, including the evaluation of proposals, communication with participants, the awarding of prizes and the dissemination of related activities.
  • Legal basis: Execution of the contract formalised through registration in the Competition.
  • Type of data processed: Identification and contact details (name, surname, email, job title), image and voice of participants.
  • Retention period: The data will be kept for the period necessary to manage participation and, once this has ended, for the limitation period of any legal actions arising from the request.

b) Publication of Images and/or Videos

  • Purpose of processing: To reproduce and publicly communicate recordings and photographs for informational purposes on the website, social media, or for internal use.
  • Legal basis: Legitimate interest of the Club as organiser to publicise its activities.
  • Type of data processed: Image and voice.
  • Retention period: The data will be retained as long as the participant does not object and, once the request has been processed, for the limitation period of any legal actions arising.

c) Responding to Questions Raised by the User Through the Enabled Contact Channels

  • Purpose of processing: To manage, process and provide support for requests, incidents, complaints or queries made by the User through the various communication channels made available by the Club.
  • Legal basis: Consent given by the User, which may be withdrawn at any time.
  • Type of data processed:
    • Identifying data: name, surname
    • Contact details: email address, telephone number
    • Employment data: position
    • Other data related to the query or request made
  • Retention period: The data will be kept for the time necessary to process and respond to the request and, once completed, for the limitation period of any legal actions arising.

6. Processing of Third-Party Data by the Club

In the event that the User provides data from third parties, they declare that they have their consent and/or sufficient legitimacy and undertake to pass on to them the information contained in this Privacy Policy, exempting the Club from any liability in this regard. The Club may carry out checks to verify this fact and take due diligence measures in accordance with data protection regulations.

7. With Which Recipients Will the User’s Data Be Shared?

All personal data provided by the User through the Website may be communicated to:

  • Telefónica Group, as the collaborating entity in the Contest.
  • Public Administrations, where required by law.
  • Courts and Tribunals, where required by law.
  • Third-party service providers processing data on behalf of the Club, under Article 28 of the GDPR and bound by data processing agreements.

8. User Responsibility

The User guarantees that they are over eighteen (18) years of age and that the data they provide to the Club is true, accurate, complete and up to date. They are responsible for keeping the information updated and for informing any third parties whose data they provide. The User shall be liable for any false or inaccurate information provided and for any damages caused to the Club or third parties.

9. Exercise of Rights

The User may exercise their rights by contacting the Club at the address indicated in this Privacy Policy or by email at datos@atleticodemadrid.com.

The rights include:

  • Right of access: To be informed whether the Club processes your data and to access it.
  • Right of rectification: To correct inaccurate or outdated data.
  • Right to erasure: To request deletion of data when legally permitted.
  • Restriction of processing: To request limited processing in certain cases.
  • Withdrawal of consent: To revoke consent at any time without affecting prior processing.
  • Opposition to processing: To object to processing for legitimate reasons.
  • Portability: To receive your data in a structured, commonly used format and transmit it to another controller.
  • Automated decisions: To request human intervention, express your view and challenge decisions.
  • Others: To be informed about safeguards for international data transfers.

The User may also lodge a complaint with the Spanish Data Protection Agency at C/ Jorge Juan, 6, 28001 Madrid, if they consider that the Club has violated their data protection rights. Additionally, they may contact the Club’s Data Protection Officer at datos@atleticodemadrid.com.

10. Security Measures

The Club will treat the User’s data confidentially and maintain the duty of secrecy, adopting the necessary technical and organisational measures to guarantee security, prevent alteration, loss, unauthorised processing or access, considering the state of technology and the nature of the data.

11. Changes

The Club reserves the right to revise its Privacy Policy at any time and will notify Users accordingly. Users are encouraged to regularly check this statement for the most recent version.

12. Acceptance and Consent

The User declares that they have been informed of the conditions regarding personal data protection and accepts the content of this Privacy Policy.

Last update: 30 September 2025.