Legal information
PRIVACY POLICY
LALIGA FANTASY (hereinafter, the “Game”) is a product offered by LaLiga Group International, S.L. (“LALIGA”). This Privacy Policy is intended to provide information on the processing of personal data carried out by LALIGA in connection with the use of the Game, in accordance with Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection legislation.
To use the Game, you must register with LALIGA Ecosistema, through which you will be able to access an environment created by LALIGA comprising several LALIGA applications and websites and incorporating a single registration system (Single Sign-On or “SSO”). Each user has a unique identifier, so that any selection or modification of preferences or any erasure request you make in one of the applications or websites forming part of the ecosystem will affect the rest of the LALIGA Ecosistema environment. You can find more information about LALIGA Ecosistema through this link.
Who is the controller of your personal data?
The controller of your personal data is LaLiga Group International, S.L. (“LALIGA”), with Tax ID No. B05421805 and registered office at Calle Torrelaguna 60, 28043 Madrid, Spain.
You can contact the Data Protection Officer at: dpo@laliga.es.
Where do we obtain your personal data from?
LALIGA may process personal data obtained from the following sources:
a) Data provided directly by you
LALIGA will process the personal data you provide directly when using the Game, including:
-
During the registration process: email address, alias or nickname, region and country (mandatory), as well as photograph and favourite team (optional).
-
Through your MyAccount profile: first name, surname, avatar or photograph, date of birth, gender, identity document, language, country of residence, province, city, address, postal code and telephone number (all optional).
-
Through your profile in the Game: your profile photograph, if you choose to add one.
b) Data obtained as a result of your use of the Game
While you use the Game, LALIGA may process certain information generated by your activity, including:
- registered user identifier;
- device identifier;
- advertising identifier (Mobile Advertising ID or MAID);
- vendor identifier (Identifier for Vendor or IDFV), which enables your device to be identified within LALIGA Ecosistema applications;
- identifier for advertisers (Identifier for Advertisers or IDFA), which enables your device to be identified across LALIGA Ecosistema applications and third-party applications, where applicable;
- operating system;
- device model; and
- usage and telemetry data, such as the content you click on or the amount of time you spend in the Game.
LALIGA may also process information relating to your interactions with communications sent to you by email, push notifications or in-app communications (for example, whether you open a communication or click on any of its content).
c) Data from other LALIGA Ecosistema assets
If you are a user of other assets integrated into LALIGA Ecosistema, LALIGA may process within the Game the personal data you have provided or that has been generated as a result of your use of those assets, for the purposes described in this Privacy Policy.
d) Data obtained through registration via social networks
You may register with LALIGA Ecosistema using certain social networks or third-party authentication services. If you choose this method of access and grant the relevant permissions, the authentication provider may disclose certain personal data to LALIGA in order to facilitate your registration or complete your profile.
Depending on the permissions you grant, Facebook may disclose the following data to LALIGA:
-
name (required in all cases to register for the Game);
-
email address (required in all cases to register for the Game);
-
date of birth;
-
gender;
-
city and province;
-
interest categories;
-
information relating to “Likes” on the LALIGA page; and
-
information from your biography that you have authorised to be disclosed during the authentication process.
Based on this information, LALIGA may obtain certain statistical or affinity indicators, such as Engagement, Social, Promotion and Fan Value, whose purpose is described in the section “For what purposes do we process your personal data?”
Google may disclose the following data to LALIGA, provided that you have authorised such disclosure:
- first name and surname;
- email address;
- date of birth;
- gender;
- country; and
- YouTube channels followed.
The use and transfer of information obtained through Google APIs will be carried out in accordance with the Google API Services User Data Policy, including its Limited Use requirements.
Apple
Apple may disclose only the data required to complete your registration with LALIGA Ecosistema:
-
Apple ID or email address; and
-
name.
LALIGA reminds you that processing carried out by social networks or authentication providers is subject to their own terms of use and privacy policies, over which LALIGA has no control. We therefore recommend reviewing them before using any of these access systems.
Once incorporated into your user account, personal data obtained through these services will become part of your LALIGA Ecosistema profile and will be processed by LALIGA in accordance with this Privacy Policy.
For what purposes do we process your personal data?
LALIGA will process your personal data for the purposes set out below. Depending on how you use the Game, not all purposes may apply to you. For each purpose, we indicate the data processed, the legal basis for processing and, where applicable, the existence of service providers or international data transfers.
Main purposes
Registration with LALIGA Ecosistema
If you do not already have a LALIGA Ecosistema account, LALIGA will process your personal data in order to create your user account and allow you to access the various assets integrated into the ecosystem through a single identification system (Single Sign-On or SSO).
For this purpose, LALIGA will process:
-
Email address (mandatory): required to create your user account and identify you within LALIGA Ecosistema.
-
Password (mandatory): required to ensure secure access to your account.
As part of the registration process, LALIGA will verify the validity of the email address provided. To do so, it uses the services of RP Solutions, S.L., which in turn uses the services of NeverBounce, Inc., a provider located in the United States. This entails the international transfer of your email address to that country. LALIGA has entered into the Standard Contractual Clauses approved by the European Commission with the provider, together with additional safeguards intended to ensure a level of protection equivalent to that required under the GDPR.
Once you have provided your email address and created your password, LALIGA will send you an email containing a verification code to validate your account and complete the registration process.
Once the process has been completed, LALIGA will send you a communication confirming your registration with LALIGA Ecosistema. LALIGA uses salesforce.com EMEA Limited for these communications. This provider participates in the Data Privacy Framework, and its use may involve an international transfer of data to the United States.
The legal basis for this processing is the performance of the contractual relationship arising from your request to register with LALIGA Ecosistema pursuant to Article 6(1)(b) GDPR and compliance with a legal obligation regarding confirmation of registration pursuant to Article 6(1)(c) GDPR.
Access to and participation in the Game
LALIGA will process your personal data to allow you to access and use the Game, manage your participation and provide the features associated with your user account.
For this purpose, LALIGA will process:
-
Email address: to identify you and allow you to access the Game.
-
Alias or nickname: to identify you within leagues and display your position in rankings.
-
Photograph (optional): to personalise your profile.
-
Favourite team (optional): to personalise your experience.
-
Region: to adapt certain content and sponsors according to the selected region.
-
Country: to enable certain Game features, such as participation in customised leagues.
When you participate in a Sponsored League, LALIGA may disclose your registration data to the sponsor responsible for that league under the terms described in this Privacy Policy.
The legal basis is the performance of the contractual relationship arising from the Game Terms of Use pursuant to Article 6(1)(b) GDPR.
Participation in competitions through the Game
LALIGA will process your personal data to manage your participation in competitions organised through the Game, verify compliance with participation requirements, communicate competition results and, where applicable, arrange delivery of the corresponding prize.
LALIGA may process your email address and alias/nickname. If you are a winner, LALIGA may request additional information such as your first name, surname or postal address. Where required to comply with applicable tax obligations —currently for prizes worth more than €300— LALIGA may request your identification document number (DNI, NIE or equivalent).
The legal basis is the performance of the Game Terms of Use and, where applicable, the Official Rules of the relevant competition pursuant to Article 6(1)(b) GDPR. Processing required to comply with tax obligations is based on Article 6(1)(c) GDPR.
Payments within the Game
If you make purchases or payments through the mobile application, payment processing will be carried out directly by Google or Apple through their respective payment gateways.
LALIGA does not access or process data relating to your payment method, such as your bank card number or other financial information.
However, LALIGA will process the transaction information necessary to validate the purchase and enable the associated premium features or content.
The legal basis is the performance of the contractual relationship arising from the purchase pursuant to Article 6(1)(b) GDPR.
User enquiries and support
LALIGA will process your personal data to manage enquiries, requests for information, incidents, suggestions or complaints and to provide the support required to resolve them.
This may include your name, email address and the information contained in your request.
Technical providers may have access to this information under data processing agreements entered into pursuant to Article 28 GDPR.
The legal basis is the performance of the Game Terms of Use pursuant to Article 6(1)(b) GDPR.
Transactional communications
LALIGA will process your user identifier and device identifier to send communications relating to the operation and use of the Game, such as notifications concerning the start of matches involving your favourite team, results, incidents, updates or new content.
You may manage your preferences or disable these communications through the Game's Notification Centre.
The legal basis is LALIGA's legitimate interest, pursuant to Article 6(1)(f) GDPR, in keeping users informed about the operation and content of the Game and providing a better user experience.
Internal reporting
LALIGA may process information obtained through your use of the Game and other LALIGA Ecosistema assets to produce metrics, statistics and internal reports to analyse use of the Game, assess campaign impact and improve its products and services.
This may include registration information, MyAccount information, social-login data, user and device identifiers, operating system, device model, telemetry information and interactions with LALIGA communications or Game support services.
The information will be used to produce aggregated statistics and segmentations that are not intended to identify individual users.
On iOS devices, processing of the IDFA requires Apple's tracking authorisation. If you do not grant such authorisation, LALIGA may use the IDFV where technically possible.
The legal basis is LALIGA's legitimate interest pursuant to Article 6(1)(f) GDPR.
Game security and quality control
LALIGA will process data generated through use of the Game to detect technical incidents, prevent errors, ensure Game security and improve the operation and quality of the services provided.
The legal basis is LALIGA's legitimate interest pursuant to Article 6(1)(f) GDPR.
Additional purposes
LALIGA commercial communications
If you provide your consent, LALIGA may send you commercial communications by email, push notification, in-app message, SMS or other instant messaging channels concerning its activities, products, services, competitions, offers, prize draws and promotions, including initiatives carried out jointly with official sponsors, partners, national federations or national and international broadcasters.
For this purpose, LALIGA will process your email address and user ID.
The legal basis is your consent, pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time.
Creation of basic segments
LALIGA may process certain personal data that you have provided directly in order to group you into basic user segments and send you more relevant commercial communications tailored to your interests.
These segments will be created exclusively using information you have directly provided within LALIGA Ecosistema, such as your age, gender, country, city or favourite team. LALIGA will not use inferred behavioural information or data obtained from third-party sources for this purpose.
The legal basis is LALIGA's legitimate interest pursuant to Article 6(1)(f) GDPR.
These segmentations will not produce legal effects concerning you or similarly significantly affect you.
Creation of comprehensive profiles
If you provide your consent, LALIGA will process your personal data to create a profile of your interests, preferences and usage behaviour in order to offer personalised experiences, content, products and commercial communications.
Depending on the profile created, LALIGA may:
-
send you personalised commercial communications;
-
show you personalised advertising in applications, websites or social networks; and
-
personalise the content and experiences displayed within the Game and other LALIGA Ecosistema assets.
For this purpose, LALIGA may use registration and MyAccount information, authorised social-login information, interactions with LALIGA communications and information generated through your use of the Game and other LALIGA Ecosistema assets.
Profiling techniques may include:
- Campaign performance measurement
- Campaign optimisation
- Lookalike Audiences
- Predictive affinity models
- Retargeting
LALIGA may use advertising tools provided by social networks and digital advertising platforms to create and manage custom or similar audiences and may disclose certain encrypted or pseudonymised identifiers to those platforms where necessary and in accordance with your consent.
The legal basis is your consent, pursuant to Article 6(1)(a) GDPR.
Profiling carried out by LALIGA will not produce legal effects concerning you or similarly significantly affect you.
Programmatic advertising networks
If you provide your consent, LALIGA will disclose certain personal data and audience segments to programmatic advertising network providers in order to show you personalised advertising within the mobile application and, where possible, in other compatible digital environments.
Programmatic advertising is an automated system for purchasing advertising space that enables personalised advertisements to be displayed to users with certain common interests or characteristics.
Programmatic advertising providers may, in certain cases, act as independent data controllers in relation to processing carried out after personal data has been disclosed to them.
The legal basis is your consent, pursuant to Article 6(1)(a) GDPR.
You may grant, withdraw or modify your consent at any time through the Programmatic Advertising Preference Centre available in your Game profile.
How long will we retain your personal data?
As a general rule, LALIGA will retain your personal data for as long as necessary to fulfil the purpose for which it was collected. Once that purpose has ended, the data will remain duly blocked for the period established under applicable legislation solely to address potential legal liabilities arising from the processing.
In particular:
- LALIGA Ecosistema registration: while your account remains active; subsequently blocked for 5 years.
- Access to and participation in the Game: while your account remains active and you continue using the Game; subsequently blocked for 5 years.
- Participation in competitions: for the duration necessary to manage the competition and prize; subsequently blocked for 5 years.
- Payments within the Game: for as long as necessary to manage the transaction and purchased features; subsequently blocked for 6 years.
- User enquiries and support: until the request is fully resolved; subsequently blocked for 3 years.
- Transactional communications: while your Game account remains active or until you object; subsequently blocked for 5 years.
- Internal reporting: while the legitimate interest continues to apply or until you object; subsequently blocked for 5 years.
- Game security and quality control: while the legitimate interest continues to apply or until you object; subsequently blocked for 5 years.
- LALIGA commercial communications: until you withdraw consent or request erasure; subsequently blocked for 5 years.
- Basic segmentation: while the legitimate interest continues to apply or until you object; subsequently blocked for 5 years.
- Personalised profiling: until you withdraw consent; subsequently blocked for 5 years.
- Management of data subject rights: for 1 year after the response to your request, followed by a 3-year blocking period.
After the applicable retention and blocking periods have expired, the personal data will be permanently deleted.
To whom will your personal data be disclosed?
LALIGA may disclose your personal data to third parties where necessary to provide requested services, comply with a legal obligation or where you have given prior consent.
a) Sponsors of Sponsored Leagues
If you win a prize in a Sponsored League, LALIGA may disclose to the sponsor responsible for that league the personal data strictly necessary to arrange delivery of the prize.
The legal basis is the performance of the contractual relationship pursuant to Article 6(1)(b) GDPR.
b) Your selected favourite club and third-party partners
If you provide your consent, LALIGA may disclose personal data obtained through LALIGA Ecosistema assets —email address and, where applicable, first name, surname, telephone number and country— to your selected favourite club and other partner entities so that they may send you their own commercial communications.
Where this entails an international transfer outside the EEA to a country without an equivalent level of protection, LALIGA will implement appropriate safeguards under Article 46 GDPR, including Standard Contractual Clauses where applicable.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR.
LALIGA may also disclose your personal data to courts, law enforcement authorities, public administrations or other competent authorities where required to comply with a legal obligation or lawful request.
What rights do you have when you provide us with your personal data?
You may exercise your data protection rights at any time and withdraw any consent you have given for consent-based processing.
In particular, you have the following rights:
-
Right of access
-
Right to rectification
-
Right to erasure
-
Right to object
-
Right to restriction of processing
-
Right to data portability
-
Right not to be subject to automated individual decision-making
How can I exercise my rights?
You can exercise your rights free of charge by emailing derechos@laliga.es.
Where processing is based on consent, you may withdraw your consent at any time. You may also object to processing based on LALIGA's legitimate interests through the procedures available in the relevant communications, through the Subscription Centre in the Game menu or by emailing derechos@laliga.es.
Withdrawing consent or objecting to a particular processing purpose will not affect your ability to use the application or the lawfulness of processing carried out before your withdrawal or objection.
You may also review and modify your personal data and preferences at any time through MyAccount.
If you registered through a social network or similar service, you may exercise your right to erasure by disabling the “LALIGA Ecosistema” service within the services connected to your social-network profile.
If you use the mobile application on Android or Apple, you can unsubscribe and delete your account directly through Profile > Consent Management.
If you believe that your rights have not been adequately addressed or that LALIGA's processing of your personal data does not comply with data protection legislation, you may contact LALIGA's Data Protection Officer at dpo@laliga.es or lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
What is MyAccount?
MyAccount is the personal area from which you can manage your profile information within LALIGA Ecosistema.
Through MyAccount you can:
- view the personal data associated with your account;
- complete or update your profile information;
- rectify inaccurate or outdated information;
- delete information you wish to remove, where possible; and
- manage the consents and privacy preferences you have provided to LALIGA.
Changes made through MyAccount will apply to those LALIGA Ecosistema assets in which you use the same user account.
Are there any restrictions?
Users must be at least 16 years old to use and register for the Game.