Privacy policy

PRIVACY POLICY

IDENTIFICATION

• Data Controller: SMARTNET SL (hereinafter, “SMARTNET”)
• NIF: B86133360
• Registered office: CALLE INVESTIGACION 1, 28906 GETAFE, MADRID, SPAIN.
• Email:

INFORMATION

• By accepting this Privacy Policy, the user (hereinafter, the “User” or, where applicable, the “Users”) is informed that the personal data provided through the website located at the URL https://shop.rfef.es/ (hereinafter, the “Website”), will be processed by SMARTNET, as well as data derived from browsing and any other data that the User may provide in the future.
• The User must carefully read this Privacy Policy, which has been drafted in a clear and simple manner to facilitate its understanding, allowing the User to determine, freely and voluntarily, whether they wish to provide their personal data to SMARTNET.

OBLIGATORY NATURE OF PROVIDING DATA

• The data requested in the forms on the Website are, in general, mandatory (unless specified otherwise in the required field) to fulfill the purposes for which they are being collected.
• Therefore, if the User does not provide them or does not provide them correctly, the User's requests cannot be addressed, without prejudice to the fact that they will be able to freely view certain contents of the Website.

ORIGIN OF THE DATA

• The data processed by SMARTNET for the purposes listed in the following section come from:
• The User themselves: data provided by the User through the various forms on the Website, data obtained from the User's use of the Website and their browsing history (through cookies or data storage and retrieval devices), subject to the consents given to SMARTNET, where applicable.
• Third-party sources: only in cases where the User gives their consent, because the User has accepted that SMARTNET may create a profile with their personal data in order to send commercial communications tailored to their tastes and preferences. Specifically, SMARTNET may obtain information from the User's browsing history.

WHAT PROCESSING WILL SMARTNET CARRY OUT WITH THE USER'S DATA?

• The personal data provided through the Website or other means made available to Users will be processed by SMARTNET in accordance with the following:
• Management of the sale of official store products:
• Purpose: To manage the sales process of official store products, as well as to provide the user with the necessary information to properly complete the purchase and its subsequent processing.
• Legal basis: The processing of data derived from this purpose will be based on the fulfillment of the contractual relationship.
• Types of data processed: Identification data, Contact data, Professional data, Economic and financial data, and other data related to the inquiry or request raised.
• Retention period: The data will be processed for this purpose until the contractual relationship ends and, once finalized, during the statute of limitations period for legal actions that may derive from it.
• Responding to inquiries raised by the User through the enabled contact channels:
• Purpose: To manage, process, and support requests, inquiries, incidents, claims, or consultations made by the User through the different communication channels made available.
• Legal basis: The processing of data derived from this purpose is the consent of the user, which can be withdrawn at any time. If the User withdraws consent, the inquiry or request cannot be processed.
• Types of data processed: Identification data, Contact data, and any other data provided in relation to the inquiry or request.
• Retention period: The data will be kept for the period necessary to process and answer the request and, once finalized, during the statute of limitations period for legal actions derived from said request.
• Sending commercial and promotional communications from third parties:
• Purpose: Sending commercial communications by electronic means (SMS, email, etc.) relating to products and services offered by third-party collaborators.
• Legal basis: The processing derived from this purpose is based on the consent granted by the User by ticking the checkbox enabled for this purpose, which can be withdrawn at any time.
• Types of data processed: Identification data and Contact data.
• Retention period: The data will be processed for this purpose until the User revokes their consent.
• Sending commercial and promotional communications by SMARTNET regarding products and services similar to those contracted:
• Purpose: SMARTNET may send commercial communications by electronic means (SMS, email, etc.) for products similar to those contracted, provided that the User has not expressed opposition.
• Legal basis: The processing derived from this purpose is legitimized by legitimate interest based on the exception provided in Article 21.2 of the Law on Information Society Services and the provisions of Recital 47 of the General Data Protection Regulation. This legitimate interest is based on conducting direct marketing to achieve user loyalty, with the User retaining the right to object at any time.
• Types of data processed: Identification data and Contact data.
• Retention period: The data will be processed for this purpose until the User objects to receiving them.
• Developing a commercial profile of the User based on User preferences, using third-party sources:
• Purpose: To use information obtained from the User's browsing history on the Website to offer products and services according to their interests, if authorized by the User by checking the corresponding box. In case of authorization, it will be carried out automatically to adjust commercial communications, and consent may be revoked at any time.
• Legal basis: The processing will be based on the consent provided by the User by ticking the corresponding box.
• Types of data processed: Identification data, Contact data, Location data, Economic and financial data, data on contracted services, contributed content, and browsing data.
• Retention period: The data will be processed for this purpose until the User revokes their consent.
• Developing a commercial profile based on the information provided by the User to SMARTNET:
• Purpose: To send commercial communications that may be of interest, with the User being able to object at any time.
• Legal basis: The processing will be based on legitimate interest to offer communications that may be of interest, recognizing the right to object.
• Types of data processed: Identification data, Contact data, Location data, Economic and financial data, data on contracted services, contributed content, and any other data provided.
• Retention period: The data will be processed for this purpose until the User objects to the processing and, under no circumstances, shall it refer to a period exceeding one (1) year.
• Conducting quality and satisfaction surveys for Users:
• Purpose: To know the opinion of Users regarding the services provided by SMARTNET, as well as to carry out analysis of the reports and statistics obtained.
• Legal basis: The processing will be based on the legitimate interest of being able to offer services with the highest quality and best possible experience. Personal information will be deleted once the anonymous statistical report is prepared.
• Types of data processed: Identification data, Contact data, data on contracted services or products, and opinions or comments provided.
• Retention period: The data provided will be kept for the duration of the surveys and, once finalized, during the statute of limitations period for legal actions that may derive from them.
• Use of Artificial Intelligence (AI) chatbots:
• Purpose: Use of automated assistance tools based on Artificial Intelligence (chatbots) to manage inquiries, improve the User experience, offer personalized support, and optimize internal processes.
• Legal basis: The processing of data derived from this purpose will be based on the Customer's consent, as well as the legitimate interest of SMARTNET to detect and improve the support provided.
• Types of data processed: Identification data, Contact data, data derived from the interaction with the chatbot (queries, messages, and metadata), and any other information voluntarily provided.
• Retention period: The data will be kept for the period necessary to process and answer the request and, once finalized, during the statute of limitations period for legal actions.
• In the event that the User provides data of third parties, they declare that they have the consent of these parties and undertake to transfer the information of this Privacy Policy to them, exempting SMARTNET from any liability. SMARTNET may carry out appropriate verifications in accordance with regulations.

WITH WHICH RECIPIENTS WILL THE USER'S DATA BE SHARED?

• All personal data provided by the User through the Website may be communicated to:
• Public Administrations, in the cases provided by law, based on compliance with a legal obligation.
• Courts and Tribunals, in the cases provided by law, based on compliance with a legal obligation.
• The Real Federación Española de Fútbol, so that it may send its own commercial communications, based on the consent granted by checking the box enabled for this purpose.
• Additionally, SMARTNET will have the collaboration of third-party service providers who may have access to their personal data as data processors (legal advice and technological and computer services), under strict contracts according to Article 28 of the GDPR.

INTERNATIONAL TRANSFERS OF DATA

• To execute the described processing purposes, use may be made of authorized subcontractors (internet, hosting, technical support providers, etc.) acting as data processors.
• When these are located outside the European Economic Area, an international transfer of data will be carried out in accordance with data protection regulations.
• Generally, international transfers will be avoided, and data will be processed within the European Economic Area. If necessary, organizational, technical, and contractual measures will be adopted (such as European Commission Standard Contractual Clauses or "SCCs", impact assessments, encryption, pseudonymization, etc.) to guarantee security.

COMMERCIAL AND PROMOTIONAL COMMUNICATIONS

• Law 34/2002, of July 11, on information society services and electronic commerce allows for identifiable commercial communications through the internet and electronic media.
• If the User has authorized it or has not objected, SMARTNET will process the data to send information relating to products, services, promotions, offers, events, or relevant news.
• In case of wishing to unsubscribe, the User can request it by sending an email or by clicking on the link that appears at the bottom of the received communications.

USER LIABILITY

• The User guarantees that they are over fourteen (14) years of age and that the data provided are true, accurate, complete, and updated, being responsible for their truthfulness and maintenance.
• Likewise, they guarantee that they have informed and obtained authorization from third parties whose data they provide, if applicable.
• In any case, the User will be responsible for false or inaccurate information and for direct or indirect damages caused to SMARTNET or third parties.

EXERCISE OF RIGHTS

• As the data subject, the User can send a written request to SMARTNET, at the address indicated in the header, or by email to dpo@gfmservicios.com, proving their identity free of charge at any time to exercise the following rights:
• Right of access: To know if SMARTNET is processing their data and access information regarding the purposes, categories, recipients, and retention period, among others.
• Right to rectification: To request the correction of inaccurate data concerning them.
• Right to erasure: To request the deletion of personal data when legal requirements are met.
• Restriction of processing, revocation of consent, and objection: To request the restriction of processing under certain circumstances, revoke the consent given, or object to the processing at any time for reasons related to their particular situation when based on legitimate interest (including direct marketing and profiling). SMARTNET will cease processing unless compelling legitimate grounds are shown.
• Data portability: To receive the personal data provided in a structured, commonly used, and machine-readable format to be able to transmit them to another controller under the scenarios provided by law.
• Automated individual decisions: The right to obtain human intervention on the part of SMARTNET, express their point of view, and contest decisions based on automated processing or profiling.
• Other rights and claims: The right to be informed about the safeguards of transfers to third countries. Likewise, a claim regarding data protection can be filed before the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 - Madrid) if the data subject considers that SMARTNET has violated their rights.

SECURITY MEASURES

• SMARTNET will process the User's data at all times in an absolutely confidential manner, maintaining the mandatory duty of secrecy, adopting the technical and organizational measures necessary to guarantee security and prevent alteration, loss, unauthorized processing, or access.

CHANGES

• SMARTNET reserves the right to review its Privacy Policy when it deems appropriate, communicating it to Users. Please check this privacy statement regularly to read the most recent version.

ACCEPTANCE AND CONSENT

• The User declares to have been informed of the conditions on personal data protection, accepting the content of this Privacy Policy.

CLOSING INFORMATION

• Last updated: April 2026
• All rights reserved.