The purpose of this Privacy Policy (hereinafter, the "Policy") is to regulate the personal data processing activities carried out by LaLiga Group International S.L. (hereinafter, "LALIGA") through the game "Head Football" (hereinafter, the "Game").

To use the Game, you need to register on LALIGA Ecosistema, through which you will access an environment created by LALIGA made up of different applications and websites, both from LALIGA and affiliated football clubs with which LALIGA has collaboration agreements. Through a common registration implemented by LALIGA in these assets (LALIGA Single Sign-On), each user receives a unique identifier so that any selection or modification of preferences or deletion request made in one of the applications or websites that are part of the ecosystem will affect the rest of the LALIGA Ecosistema environment and the entities that comprise it. Access the link to learn more about LALIGA Ecosistema and the entities that are part of it.

Who is responsible for processing your personal data?

Your personal data will be processed by LALIGA, with CIF B05421805 and address at Calle Torrelaguna 60, 28043, Madrid.

Contact LALIGA's Data Protection Officer: dpo@laliga.es

Where do we get your personal data from?

LALIGA will process the data you provide through the registration form (email, country and favourite team, which are mandatory, and name, surname(s), telephone number, gender, city, postcode and age, which are optional data) and other data inferred as a result of your use and activity in the Game (registered user ID; Device ID; Mobile Advertising ID (MAID); identifier for the provider of the service provided through the Game, LALIGA, (IDFV) which identifies your device in order to track your activity within the LALIGA Ecosistema applications; identifier for advertisers (IDFA) which identifies your device to track your activity between LALIGA Ecosistema applications and third-party applications; operating system; device model and telemetry, for example, when you click on particular content or the time you stay in the asset) and your interactions with the communications that we send you via push notification, in-app or email, if applicable (for example, clicking on the content of a communication).

Likewise, in the event that you are a user of another asset under the responsibility of LALIGA or in which LALIGA acts as joint data controller and which forms part of LALIGA Ecosistema, LALIGA may process in the Game the aforementioned personal data, declared or inferred in said assets.

Finally, we inform you that, in the iOS version of the Game, Apple will ask for your permission for the use of your device's advertising identifier ("IDFA") by LALIGA for any of the purposes that require it, in accordance with the section What purposes do we process your personal data for? of this privacy policy.

Importing data from social networks

We hereby inform you that you can use the social networks of which you are a user to register on LALIGA Ecosistema. Also, if you so consent, the social network you have chosen may share with LALIGA additional information to complete your profile in the LALIGA asset.

Data shared through Facebook:

· Name and profile picture (required for registration, however, please note that LALIGA does not process your profile picture)

· Email address (required)

· Birthday (optional)

· Gender (optional)

· Current city and province (optional)

· Page likes (optional)

· Bio posts (optional, your public and private bio posts, including photos and videos, information about the places tagged in them and the types of reactions they receive)

· Categories of interests:

o Food

o Animals and Pets

o Art and Culture

o Banks, Finance and Economics

o Alcoholic Beverages

o Beauty

o Cinema, Theatre and Musicals

o Sports

o Electronics and IT

o Energy, Science and Industry

o Social Groups

o Home and Housing

o Children

o Media

o Fashion

o Automotive

o Women

o Music

o Leisure and Entertainment

o NGOs and Causes

o Health, Hygiene and Wellness

o Insurance

o Professional Services

o Shopping

o Technology and the Internet

o Telecommunications

o TV and Radio

o Travel

o Video games

o Viral Media

LALIGA will obtain the following inferred data through page likes and bio posts:

· Engagement value: this value measures the volume of interactions that the user has with the official LALIGA page Facebook wall.

· Social value: this value measures the user's social media influence.

· Promotion value: users' walls are analysed for references to prize draws, promotions and prize draw entries, and a value is assigned that measures the promotional ratio on the user's wall. It also checks whether the user's profile follows Facebook pages dedicated to advertising promotions, raffles and prize draws.

· Fan value: this score is a combination of the previous 3 scores that ranks users by the value obtained (a user with a higher score will be considered a more valuable user).

Data shared through Google:

· Name and surname(s) (required for registration).

· Email address (required for registration).

· Birthday (optional).

· Gender (optional).

· Country (optional).

· YouTube channels you follow (optional).

Use (of the application) and transfer of information received from Google APIs to any other application will adhere to the Google API Services User Data Policy, including limited use requirements.

In this regard, we hereby inform you that LALIGA uses the tool of a third-party technical provider for the collection and structuring of the information provided by Facebook and Google.

Data shared through Apple:

· Apple ID or email (required for registration)

· Name (required for registration)

Apple will only share the aforementioned data, which is necessary to carry out the registration on the LALIGA asset.

We also remind you that LALIGA is not responsible for the legal alignment of the social network that you use for the registration on the LALIGA asset. For this reason, we recommend that you review the terms of use and privacy policy of the social networks you are going to use for this purpose so you can verify that the processing of your personal data is in accordance with your expectations of privacy and the data protection regulations applicable in each case.

Once the data have been imported and incorporated into your registered user account, your data will be integrated into LALIGA Ecosistema and processed by LALIGA for the purposes described in this Privacy Policy.

For what purpose do we process your personal data?

Main purposes:

/ Registration, access and participation in the Game: The personal data you provide in the registration will be processed by LALIGA for the purpose of facilitating your registration and access to the Game, as well as managing your participation in it. Likewise, LALIGA will use them to enable your access to the rest of the LALIGA Ecosistema assets. In particular, LALIGA will use the following personal data to fulfil this purpose:

o Email: required for registration and access to the Game.

o Alias or nickname: used to identify the user within the Game.

o Favourite team: used to designate your team within the Game.

o Region: used to display the Game sponsors for the selected region (in America the Game sponsors are different than in Europe).

In this regard, in order to verify the validity of the email address provided to LALIGA to register for the Game, LALIGA uses the services of a third-party provider (RP Solutions, Inc.) which involves international transfer to the United States, a country that guarantees a level of protection equivalent to that of the European Union for personal data transferred from Europe to third-party providers in the United States that are adhered to the Data Privacy Framework, including this provider.

/ Personalisation of the Game: LALIGA will process the data on your favourite team in order to personalise the Game based on this choice. In this way, LALIGA will only process your favourite team for this purpose.

/ In-Game Payments: In the event that you make payments within the Game, we inform you that your personal data will be processed by Google or Apple through their payment gateways to manage the payments. In this regard, we invite you to review the privacy policies of Google or Apple for information on the processing of your data. The information relating to the payments you make will not be processed by LALIGA.

/ Handling of queries: LALIGA may process your personal data relating to your email address and other data you provide in order to manage the requests you make to us through the Game regarding the operation of the Game, answering queries, receiving suggestions and/or resolving incidents in order to provide you with a response.

/ In-app notifications related to the Game: You may receive in-app communications related to the Game (e.g. about changes to the privacy policy, legal notice or terms and conditions of use of the Game, announcements about new features etc.). These notifications are only displayed when you are within the mobile application and LALIGA will use your user ID to send you the notification. In this regard, we hereby inform you that LALIGA uses technical providers to send in-app notifications.

The legal basis for the aforementioned purposes is that the processing is necessary for the performance of a contract to which the data subject is a party pursuant to Article 6(1)(b) of the General Data Protection Regulation. The data necessary and essential for the provision of these services within the Game are the favourite team, country, email address and user IDs. If you do not provide these data, you will not be able to enjoy the services requested.

/ Internal reporting: LALIGA will also process in aggregate form the personal data you have provided (in this case, favourite team) or social login (where applicable, birthday, gender, page likes and current city), usage data of the Game and other LALIGA Ecosistema assets you use (user ID, device ID (IDFA or where applicable, IDFV), device model, operating system and telemetry, e.g. clicking on particular content or time spent on the asset) and finally, interactions with communications of any kind that you receive (e.g. clicking on the content of a communication) or in communication with Game support, for developing relevant metrics and statistics that allow LALIGA to analyse the use made of the Game by the different user segments generated and the impact of its campaigns, evaluating the interest that the campaigns have aroused among the aforementioned segments based on the data analysed. In particular, LALIGA will carry out aggregate segmentations based on the aforementioned data, including:

o Segmenting according to favourite team (e.g. 20 users have selected X team as favourite).

In this regard, we hereby inform you that LALIGA uses technical providers to carry out internal reporting.

Use of the Identifier for Advertisers ("IDFA") on iOS devices (Apple)

The use of the IDFA for the purpose of "Internal Reporting" requires the user's permission to track within the Apple iOS operating system. In the event that the user has not given permission for the use of the IDFA, LALIGA may carry out this purpose using the IDFV of the device.

The user may accept or reject the tracking permission in the iOS settings of the user's Apple device at any time.

The legal basis for the aforementioned purpose is that the processing is necessary to satisfy the legitimate interest of LALIGA under the provisions of Art. 6(1)(f) of the General Data Protection Regulation, consisting of extracting learnings from the information provided and obtained from users that allows it to improve the Game and optimise the communication campaigns it carries out based on the interest that these generate among the different groups of users. Before doing so, we would like to inform you that LALIGA has carried out a proportionality analysis between its legitimate interest and the rights and freedoms of its users. You can request the conclusions of this analysis at lopd@laliga.es.

You have the right to object to the above-mentioned purpose at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?".

Additional purposes:

/ LALIGA commercial communications: So that LALIGA can send you commercial communications via email, push notifications, in-app, SMS or other instant messaging channels about its activities (the competitions it organises, campaigns, public viewings, shows or live events), products (applications, web platforms and games developed by LALIGA), services, competitions, offers, prize draws and/or promotions run by LALIGA itself, or competitions, offers, prize draws and/or promotions carried out by LALIGA on products and services promoted jointly by LALIGA with its official sponsors, which you can consult here, national federations or national and international television channels.

For this purpose, LALIGA will only process the email address, your user ID and, if applicable, the telephone number that you have provided in the registration form.

We also hereby inform you that, in order to send you commercial communications via email or SMS, LALIGA uses the services of a third-party provider (salesforce.com EMEA Limited) which involves international transfer to the United States, a country that guarantees a level of protection equivalent to that of the European Union for personal data transferred from Europe to third-party providers in the United States that are adhered to the Data Privacy Framework, including this provider.

The legal basis for processing your data for the above-mentioned purpose is the consent you have given us to process your data for the specific purposes selected in accordance with the provisions of Art. 6(1)(a) of the General Data Protection Regulation. Your personal data will be kept for this purpose until you revoke your consent.

You have the right to withdraw your consent at any time in accordance with the procedure described in the section "What are your rights when you provide us with your personal data?", without this affecting the lawfulness of the consent-based processing prior to its withdrawal.

/ Development of simple segmentations: So that LALIGA can send you segmented commercial communications via email, SMS or other instant messaging channels about LALIGA's products and services. These communications will be made based on the information you have provided through the registration (for example, we will send you communications about products that may be of interest to you based on your age, favourite team or your province of residence).

The information used for the development of segments will be only that declared by the data subject in the registration of any of the assets that make up LALIGA Ecosistema (in this case, gender, country, city, age and favourite team or sport), with a low level of detail on the user profile without using information inferred from the data subject or from third-party sources, with the segmentations in any case not being in depth. In this way, commercial communications can be sent according to the simple segments created with the aforementioned information, avoiding sending content that has no connection to you.

In this regard, we hereby inform you that LALIGA uses consulting and technical support providers to carry out simple user segmentations.

The legal basis for the aforementioned purpose is that the processing is necessary to satisfy the legitimate interest of LALIGA under the provisions of Art. 6(1)(f) of the General Data Protection Regulation, consisting of making effective use of the personal data provided by the user to achieve greater interest and return from the communications sent. Before doing so, we would like to inform you that LALIGA has carried out a proportionality analysis between its legitimate interest and the rights and freedoms of its users, the conclusions of which you can request at lopd@laliga.es .

Under no circumstances will profiling carried out by LALIGA have any legal effect or significantly affect you in any similar way.

/ Development of comprehensive profiles: If you give us your permission, LALIGA will create a comprehensive profile of you so that it can offer you personalised experiences, information and products by sending personalised commercial communications via email, SMS or other instant messaging channels, sending you personalised push or in-app notifications (provided that you have given your consent for the purpose "LALIGA commercial communications") or showing you banners with personalised advertising on websites, apps or social networks about LALIGA products and services (for example, if we identify that you are a fan of a particular club, we will offer you personalised incentives, such as a football shirt of your favourite team).

In this way, the aforementioned information will be directed to the segments (groupings of users that are made according to the information obtained from them or the use you make of the Game or other assets in LALIGA Ecosistema) that we can develop based on the following data sources:

o The information you provide during registration (in this case, favourite team);

o Social login (in this case, first and last name(s), email address, birthday, gender, city and province in which you reside, interest categories, as well as inferred values - engagement, social, promotion and fan value - obtained from your Facebook bio posts and page likes);

o Interactions with communications or notifications you receive (e.g. clicking on the content of a communication);

o Data inferred as a result of usage and activity on the Platform (device ID, registered user ID, device model, operating system and telemetry, e.g. clicking on particular content or time spent on the asset).

In addition, LALIGA will generate these segments taking into account the following profiling techniques:

o Measurement of individual campaign performance: LALIGA will use information relating to opening rates, average click-through rates, email bounces and unsubscription rates to measure the performance of the campaign at an individual level, and as a result, make segmentations based on the information inferred about you and the other information declared, in order to impact you again with certain campaigns that are more connected to you or include you only in those in which you have shown more interest (for example, if you are a very active user in certain communications we may send you communications of the same type more frequently). For these purposes, we hereby inform you that through the data management tools provided by the social networks in which LALIGA has an account, user audiences will be created which may be shared, within each social network and in encrypted form, with third parties outside LALIGA, in order to create their advertising campaigns within the social network itself.

o Optimisation of campaigns: we will exclude you from advertising campaigns about prize draws in which you have participated, about applications in which you have registered or downloaded, about products you have purchased or about services you have previously purchased (for example, we will avoid offering you a LALIGA app if we know that you have previously downloaded it). To do so, we will cross-reference your information with information obtained from other LALIGA assets of which you are a user.

o Users with similar tastes and preferences: using the profile that LALIGA creates about you, we can send you personalised content taking into account other profiles similar to yours (for example, if we identify that other users similar to you like eSports, we will show you advertising related to eSports).

o Valuation of users: LALIGA will obtain an unknown variable from known variables provided or inferred from you so that it can carry out an analysis of its users with the aim of identifying those with a greater propensity to use or contract LALIGA products, and where appropriate, offer you LALIGA products and services.

o Retargeting: in the event that you have interacted with LALIGA without having registered or without having used or downloaded the corresponding LALIGA asset, LALIGA may use the identifying data of your device and/or your email address to impact you with advertising in other environments outside LALIGA in order to achieve the interaction desired by LALIGA.

In this regard, we hereby inform you that LALIGA uses consulting and technical support providers to carry out complex profiling.

Under no circumstances will profiling carried out by LALIGA have any legal effect or significantly affect you in any similar way.

The legal basis for processing your data for the above-mentioned purposes is the consent you have given us to process your data for the specific purposes selected pursuant to Art. 6(1)(a) of the General Data Protection Regulation. Your personal data will be kept for these purposes until you revoke your consent.

/ Push notifications regarding Game content: If you access the Game's mobile application, you may receive push notifications regarding Game content through the usual notification system on your Smartphone or Tablet. You may opt out of receiving such communications at any time via the Game's "notification centre" or via the settings on your own Smartphone or Tablet. These notifications may be displayed on your device when you are outside or inside the mobile application and LALIGA will use your user ID to send you the notification.

The legal basis for the aforementioned purpose is that the processing is necessary to satisfy the legitimate interest of LALIGA under the provisions of Art. 6(1)(f) of the General Data Protection Regulation, consisting of achieving greater consumption of the content offered through the Game. Before doing so, we would like to inform you that LALIGA has carried out a proportionality analysis between its legitimate interest and the rights and freedoms of its users. You can request the conclusions of this analysis through lopd@laliga.es .

How long will we keep your personal data?

The personal data we process will be kept for as long as the purposes for which they were collected persist and/or you do not revoke any consent you may have given, or you do not exercise your rights of erasure, objection or restriction of processing.

In this regard, after the end of said period, LALIGA will keep your personal data, duly blocked, for the sole purpose of meeting any responsibilities that may arise.

Specifically:

/ Registration, access and participation in the Game: the data provided for registration, access and participation in the Game will be kept as long as you do not request the deletion of your data, this purpose persists and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ Personalisation of the Game: the data provided for the personalisation of the Game will be kept as long as you do not request the deletion of your data, this purpose persists and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ In-game payments: the data provided for in-game payments will be kept as long as you do not request the deletion of your data, this purpose persists and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ Handling queries: the data provided for handling queries will be kept as long as you do not request the deletion of your data, this purpose persists and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ In-app notifications related to the Game: the data provided for in-app notifications related to the Game will be kept as long as you do not request the deletion of your data, this purpose persists and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ Internal reports: the data provided for internal reports will be kept as long as you do not request the deletion of your data, this purpose persists, you do not object to the processing and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ LALIGA commercial communications: the data provided for commercial communications carried out by LALIGA will be kept as long as you do not request the deletion of your data, this purpose persists, you do not revoke the consent granted or limit the processing and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ Development of simple segmentations: the data provided for the development of simple segmentations will be kept as long as you do not request the deletion of your data, this purpose persists, you do not object to the processing and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ Development of comprehensive profiles: the data provided for the development of comprehensive profiles will be kept as long as you do not request the deletion of your data, this purpose persists, you do not revoke the consent granted or limit the processing and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

/ Push notifications about the content of the Game: the data provided for push notifications about the content of the Game will be kept as long as you do not request the deletion of your data, this purpose persists, you do not oppose the sending of the same and, once this purpose has ended, during the period of limitation for the legal actions that could arise from it.

Such personal data will be deleted after the end of the time limits indicated.

To which recipients will your personal data be communicated?

Your personal data may be communicated to other persons or companies to be used for their own purposes provided that you give us your consent by ticking the box provided or for the purpose of the service you request. In this regard, we hereby inform you that your personal data will be communicated to third parties as explained in the section "For what purposes do we process your personal data?

/ LALIGA will communicate your personal data, declared or inferred (identified in the section Where do we get your personal data from?) in the Game, to the affiliated football clubs that are part of LALIGA Ecosistema in order for you to access their assets and have the same profile throughout the ecosystem. All this will be possible as long as you are a registered user of any of the assets under the responsibility of these clubs, in accordance with the privacy policies of the assets of each club and depending on the consents you have given to them.

The legal basis for this communication of personal data is that the processing is necessary for the performance of a contract to which the data subject is a party under the provisions of Art. 6(1)(b) of the General Data Protection Regulation, in particular, the provision of the services offered to users in LALIGA Ecosistema through LALIGA Single Sign-On, which are regulated in the conditions of use of the Game, and in the conditions of the other assets that are part of the ecosystem. To learn more about LALIGA Ecosistema and which clubs are part of it, you can access the following link.

/ LALIGA will communicate your personal data obtained in the assets belonging to LALIGA Ecosistema of which you are a user (email and, where appropriate, name, surname(s), phone number and country) to your Favourite Team and to third parties so that they can send you commercial communications about their activities, products, services, competitions, offers and/or promotions.

In this regard, we would like to inform you that your personal data will only be communicated to third parties and football teams belonging to the first and second division of the National Professional Football League, which have signed a collaboration agreement with LALIGA. In the following link there is a list of third parties and football teams that currently have an agreement with LALIGA and that, if you authorise us, may send you commercial communications.

We also hereby inform you that the communication of your data to third parties may, in some cases, involve the international transfer of your data to countries that either have an adequate level of protection, comparable to that of the European Union, or do not guarantee it. In the latter case, LALIGA has adopted the corresponding measures to ensure that your data are treated with a level of protection equivalent to that of the European Union. For this reason, LALIGA has signed standard contractual clauses adopted by the European Commission with these third parties under the provisions of Art. 46(2)(c) of the General Data Protection Regulation, including additional guarantees and obligations, following an analysis of the impact of the transfer carried out, aimed at these third parties for the greatest possible security and transparency. The content of the standard contractual clauses is available upon request at lopd@laliga.es.

The legal basis for this communication of personal data is the consent you have given us in accordance with the provisions of Art. 6(1)(a) of the General Data Protection Regulation.

/ LALIGA may communicate your personal data to Taproom SL. If you authorize us, LALIGA may communicate your personal data (email, name and surname(s)) to Taproom SL, in order to send you commercial communications about its activities, products, services, offers and / or promotions via email.

The legal basis for this communication of personal data is the consent you have given us in accordance with the provisions of Art. 6(1)(a) of the General Data Protection Regulation.

Likewise, LALIGA may disclose personal data and any other user information when required to do so by public authorities exercising their lawful responsibilities and in accordance with the applicable regulations.

Similarly, LALIGA uses some subcontracted entities that will access personal data and information as data processors or sub-processors in order to provide LALIGA with a necessary service. As such, LALIGA uses technical providers and technical and business consultancy providers in order to carry out the purposes indicated in the section "For what purposes do we process your personal data?".

These service providers sign a contract that obliges them to use your personal information only for the provision of the services set out in this policy.

What are your rights when you provide us with your personal data?

We hereby inform you that you can exercise your rights of access, rectification, objection, erasure, data portability, not to be subject to automated decisions and restriction of processing at any time with LALIGA.

What are your rights as a user?

/ Right of access: you have the right to obtain confirmation as to whether LALIGA processes your personal data, as well as the right to access your personal data.

/ Right to rectification: you may request the modification or rectification of inaccurate personal data.

/ Right to erasure: you may request the erasure of your personal data.

/ Right to restrict processing: in certain circumstances, you may request that we restrict the processing of your data, in which case it will only be kept for the purpose of pursuing or defending claims.

/ Right to object: you may object to the processing of your data for the purpose you specify. LALIGA will cease processing the data, except for compelling legitimate grounds, or the exercise or defence of possible claims.

/ Right not to be subject to automated individual decisions: you have the right not to be subject to a decision based solely on automated processing, including profiling, which is likely to produce legal effects concerning you or similarly significantly affect you.

/ Right to data portability: if the game allows it, you may exercise the right to the portability of your data, in a structured, commonly used and machine-readable format, and to transfer it to another data controller.

How do I exercise my rights?

By sending an email to lopd@laliga.es . Exercising your rights will be completely free of charge.

Likewise, you may revoke the consent granted or object to the processing of data based on legitimate interest at any time, either by following the procedure established in each of the communications you receive, through the Subscriptions Centre located in the Game menu or by sending an email to the following address: lopd@laliga.es .

Your objection to a particular purpose or revocation of the consents granted will not affect your use of the application or the lawfulness of processing based on those consents prior to their withdrawal.

On the other hand, if you have registered in the Game through a social network or similar service, you can exercise your right to the erasure of your data by deactivating the service "LALIGA Ecosistema" within the services connected to your profile in the social network. For more information, please consult the conditions of each service:

o Google: https://myaccount.google.com/permissions

o Facebook: https://facebook.com/help/218345114850283

o Apple: https://support.apple.com/es-es/HT210426

Remember that if you are using the mobile application on Android or Apple you can unsubscribe and delete your account directly through the 'Profile' section in 'Consent management'.

Finally, if you feel that your rights have not been exercised satisfactorily or that the processing of your personal data by LALIGA has not been in accordance with data protection regulations, you may contact the LALIGA Data Protection Officer at the email address dpo@laliga.es or file a complaint with the Spanish Data Protection Agency through its website http://www.aepd.es.

Are there any limitations?

LALIGA would like to inform you that users of the game must be at least 16 years old.