Privacy Policy.

1. IDENTIFICATION

· Owner/Data controller: CLUB ATLÉTICO DE MADRID,S.A.D. (hereinafter, the "Club")
· Tax ID number: A-80373764.
· Registered office: Av. de LuisAragonés, 4 – 28022 Madrid.
· Email: datos@atleticodemadrid.com.
· Data Protection Officer: dpo@atleticodemadrid.com.
‍
2. INFORMATION
‍
By accepting this Privacy Policy, the user (hereinafter, the "User" or, where applicable, the "Users") is informed that the personal data provided through the website located at the URL www.mr-red.com. (hereinafter, "Mr. Red Website") will be processed by the Club, as well as data derived from their browsing and any other data that the User may provide in the future. 

The User must carefully read this Privacy Policy, which has been written in a clear and simple manner to facilitate its understanding, and the User may freely and voluntarily determine whether they wish to provide their personal data to the Club.

3. MANDATORY PROVISION OF DATA
‍
The data requested in the forms on the Mr. Red website are, in general, mandatory (unless otherwise specified in the required field) to fulfil the purposes for which they are being collected.

Therefore, if the User does not provide this data or does not provide it correctly, the User's requests cannot be processed with, without prejudice to the fact that the User may freely view certain content on the Mr. Red website.  

4. ORIGIN OF THE DATA

‍The data processed by the Club for the purposes described below may originate from the following sources: 
‍
· Provided directly by the User: data supplied through the forms available on the Mr. Red Website, data obtained from the User’s use and browsing of the website (including cookies or similar technologies), and any additional data the User may provide, according to the consent granted to the Club where applicable. 
‍
· From third-party sources: only when the User has provided consent for the Club to create a profile in order to send personalised commercial communications. In such cases, theClub may obtain information regarding the User’s browsing habits.

5. HOW THE CLUB WILL PROCESS USER'S DATA?
‍
Personal data provided through the Mr. Red website or other means made available to users will be processed by the Club as follows: 

a)   Management of business proposals:  
‍
· Purpose: to manage and respond to requests sent via the contact form in order to contact interested parties and assess possible jobs, projects or commercial collaborations. 
· Legal basis:  Performance of a contractual or pre-contractual relationship. 
· Categories of data:
- Identification: name and surname.
- Professional: company
- Contact: email address. 
· Retention period:  data will be kept while the proposal orbusiness initiative is being evaluated and, once this has been completed, forthe applicable statutory limitation periods.

b) Management of the "Talent"section and receipt of CVs:
 
· Purpose: to manage the receipt of CVs and information sent by people interested inworking at the Club, as well as their participation in future selectionprocesses. 
· Legal basis: implementation of pre-contractual measures. 
· Categories of data processed:
- Identification: name, surname(s).
- Contact: email address, telephone number(optional), postal address.
- Academic and professional: education, experience, CV and any information included by the candidate. 
· Retention period: CVs and related information will beretained for up to one year for potential future recruitment processes, unlessthe candidate requests their deletion beforehand. 

c) Responding to questions raised by theUser through the contact channels provided:

· Purpose: to manage, process and provide supportfor the User's requests, applications, incidents, complaints or queries madethrough the various communication channels made available to them. 
· Legal basis: User consent, which may be withdrawnat any time. Withdrawal of consent will prevent the processing of the enquiry. 
· Categories of data: 
- Identification:name, surname.
- Contact: email address, telephonenumber.
- Other: any data that the User may provide in relation to the query or request made. 
· Retention period: data will be kept for the time necessary to process and respond to your request and, once this has been completed, forthe limitation period of any legal actions arising from the aforementioned request. 

If the User provides data relating to third parties, they declare that they have obtained the necessary authorisation and have informed such parties of the content of this Privacy Policy. The Club may carry out appropriate checks to verify compliance with data protection obligations. 

6. DISCLOSURE OF USER´S DATA
‍
All personal data provided by the User through the Mr. Red website may be disclosed to:
‍
a) Public administrations, in the cases provided for bylaw, based on compliance with a legal obligation. 
‍
b) Courts and tribunals, in the cases provided for by law, based on compliance with a legal obligation. 

Additionally, the Club may work with third-party service providers who may access and process personal data on behalf of the Club, strictly following its instructions and under a data processing agreement in accordance with Article 28 GDPR. 

Such providers may include firms in sectors such as legal advisory services, technology and IT services.

7. INTERNATIONALDATA TRANSFERS 
‍
For the purposes described above, the Club may use authorised subcontractors acting as data processors (e.g., internet service providers, data hosting or technical support providers). These providers are contractually bound to act solely under the Club’s instructions. Whenever such providers or recipients are located outside the European Economic Area, international data transfers will be carried out in accordance with data protection laws.
‍
The Club generally avoids transfers outside the EEA, but when necessary, it adopts appropriate technical, organisational and contractual safeguards, such as: 

· Standard Contractual Clauses (SCCs)
· Transfer impact assessments
· Encryption (in transit or at rest)
· Pseudonymisation
· Mechanisms allowing  
· Users to claim damages against transferees 

8. COMMERCIAL AND PROMOTIONAL COMMUNICATIONS 
‍
In accordance with Law 34/2002 on information society services and electronic commerce, commercial communications may be sent electronically provided they are clearly identifiable as such and indicate the sender. 

Where Users have authorised or not opposed the processing of their data for this purpose, the Club may send commercial communications relating to products, services, promotions, offers, events or relevant news. Users may unsubscribe at any time by emailing [...] or by clicking the link included in each communication. 

9. USERRESPONSIBILITY 
‍
The User guarantees that they are over fourteen (14) years of age and that the information provided to the Club is true, accurate, complete and up to date.Users must ensure that the data they provide remain accurate and reflect their actual situation. Where the User provides third-party data, they guarantee that the third party has been informed and has authorised the disclosure of their data to the Club. TheUser will be liable for any false, inaccurate or outdated information provided and for any direct or indirect damage caused to the Club or to third parties.

10. EXERCISE OF RIGHTS
‍
Users may exercise their data protection rights at any time, free of charge, by sending a written request to the address indicated at the beginning of thisPolicy or by email to datos@atleticodemadrid.com, attaching proof of identity. 

The rights include: 
‍
a) Right of access: 
You have the right to be informed by the Club as to whether or not it is processing your personal data and, if so, to access such data and receive information on the purposes for which it is being processed, the categories of data affected by the processing, the recipients to whom your personal data has been disclosed and the expected period of data retention, among other information. 
‍
b) Right of rectification: 
You have the right to request the rectification of inaccurate data concerning you when, among other reasons, it is no longer necessary for the purposes for which it was collected.  
‍
c) Right of erasure: 
You have the right to request the erasure of personal data provided that the legal requirements are met.  
‍
d) Restriction of processing, withdrawal of consent and total or partial opposition to processing: 
In certain circumstances (for example, if the applicant disputes the accuracy of their data, while the accuracy of the data is being verified), you may request that the processing of your personal data be restricted, and the data will only be processed for the exercise or defence of claims.  You will also have the right to withdraw your consent and object to the processing at any time, for reasons related to your situation, if the processing is based on our legitimate interest or the legitimate interest of a third party (including processing for direct marketing and the creation of corresponding profiles). In this case, the Club will cease processing, unless it can demonstrate legitimate grounds. 
‍
e) Portability of your data: 
You have the right to receive the personal data you have provided to the Club in a structured, commonly used and machine-readable format, and to transmit it to another data controller without hindrance from the controller to whom you have provided it, in the cases provided for by law for this purpose. 
‍
f) Automated individual decisions:
In addition to the aforementioned rights, in the event of automated decisions, including profiling, you have the right to obtain human intervention from the Club, to express your point of view and to challenge the decision.  
‍
g)   Others: 
Similarly, when personal data is transferred to a third country or to an international organisation, you have the right to be informed about how you can access or obtain a copy of the appropriate safeguards relating to the transfer. 
Users may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at C/ Jorge Juan, 6, 28001 – Madrid.

11. SECURITY MEASURES
‍
TheClub will treat the User's data at all times in an absolutely confidential manner and will maintain the mandatory duty of secrecy regarding the same, in accordance with the provisions of the applicable regulations, adopting for this purpose the necessary technical and organisational measures to guarantee the security of your data and prevent its alteration, loss, un authorised processing or access, taking into account the state of technology, the nature of the data stored and the risks to which it is exposed.

12. CHANGES
‍
The Club reserves the right to revise its Privacy Policy at any time it deems appropriate, in which case it will notify Users. For this reason, we ask Users to regularly check this privacy statement to read the most recent version of the Club's Privacy Policy.

13. ACCEPTANCE AND CONSENT
‍
The User declares that they have been informed of the conditions regarding personal data protection and accepts the content of this Privacy Policy.
‍

Last update: 26/02/2026 
‍
Copyright © CLUB ATLÉTICO DE MADRID, S.A.D.
All rights reserved.