1. INFORMATION FOR USERS

Who is responsible for processing your personal data?

EMOTION SPORTS HISPANIA S.L. is the Data Controller responsible for processing the User's personal data and hereby informs you that such data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

What types of data do we request and process?

Depending on the form or method used to collect your data, we will always request only the minimum data necessary to fulfil the purposes specified in each case.

Depending on the form through which we have obtained your personal data, we will process it confidentially for the following purposes:

• To respond to enquiries or any other requests submitted by the User through any of the contact methods made available on the Data Controller's website.
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

• To send commercial and advertising communications by email, fax, SMS, MMS, social media or any other electronic or physical means, whether existing or developed in the future, that enables commercial communications to be sent. These communications will be sent by the Data Controller and will relate to its products and services, or those of

  its partners or suppliers with whom it has entered into a promotional agreement. In this case, third parties will never have access to the personal data.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

• To carry out statistical analyses and market research.
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

In the Newsletter form

• To send newsletters, news, offers and online promotions.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the Request a Quote form

• To send commercial quotations for products and services. (for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR)

• To send commercial and advertising communications by email, fax, SMS, MMS, social media or any other electronic or physical means, whether existing or developed in the future, that enables commercial communications to be sent. These communications will be sent by the Data Controller and will relate to its products and services, or those of its partners or suppliers with whom it has entered into a promotional agreement. In this case, third parties will never have access to the personal data. (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the Online Forum form

• To participate in online forums provided by the Data Controller.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the CV form

• To include the data subject in recruitment processes and analyse the applicant's profile for the purpose of selecting a candidate for a vacancy with the Data Controller. (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the Testimonial form

• To moderate and publish on the website the User's experiences, opinions and suggestions regarding a product or service.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the Comments form

• To moderate and publish opinions relating to a publication on the website.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the User Registration form

• To manage the User's account in order to provide personalised access to the website and the interactive services it offers.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the Prize Draws and Promotions form

• To participate in prize draws, competitions, promotions or other services offered by the Data Controller.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

• To send commercial and advertising communications by email, fax, SMS, MMS, social media or any other electronic or physical means, whether existing or developed in the future, that enables commercial communications to be sent. These communications will be sent by the Data Controller and will relate to its products and services, or those of its partners or suppliers with whom it has entered into a promotional agreement. In this case, third parties will never have access to the personal data.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the Competition Registration form

• To process and manage participation in competitions organised by the Data Controller.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

In the Reservations form

• To formalise reservations at the Data Controller's establishment.
  (for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR)

• To send commercial and advertising communications to customers by email, fax, SMS, MMS, social media or any other electronic or physical means, whether existing or developed in the future, relating to products or services similar to those initially contracted by the customer (Art. 21.2 LSSI).
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

Social Media

• Contact through social media in order to maintain a relationship between the User and the Data Controller, which may include the following activities: processing requests and enquiries; providing information about activities and events; providing information about products and/or services; and interacting through official profiles. The User has a profile on the relevant social network and has chosen to follow or join the Data Controller's social media account, thereby demonstrating an interest in the information published there. Accordingly, when requesting to follow our

  official page, the User gives consent to the processing of their data. The User may at any time access the privacy policies of the relevant social network and configure their profile to protect their privacy. Once the User follows or joins the Data Controller's social media account, they may publish comments, links, images, photographs or any other type of content supported by the platform. In all cases, the User must own the published content, hold the relevant copyright and intellectual property rights, or have the consent of the affected third parties. Commercial communications may also be sent regarding the activities of companies within the Group, as well as external companies with which commercial collaboration or intermediation agreements have been established.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

Instant Messaging

• To schedule appointments and meetings with the Data Controller.
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

• To send commercial and advertising communications to customers by email, fax, SMS, MMS, social media or any other electronic or physical means, whether existing or developed in the future, relating to products or services similar to those initially contracted by the customer (Art. 21.2 LSSI).
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

• To manage, maintain, improve or develop the services provided.
  (for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR)

• To manage your online purchase or order, process payment and arrange shipment in accordance with the general

  terms and conditions of sale.
  (for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR)

• To send commercial quotations for products and services.
  (for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR)

• To send commercial and advertising communications by email, fax, SMS, MMS, social media or any other electronic or physical means, whether existing or developed in the future, that enables commercial communications to be sent. These communications will be sent by the Data Controller and will relate to its products and services, or those of its partners or suppliers with whom it has entered into a promotional agreement. In this case, third parties will never have access to the personal data.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

• To respond to enquiries or any other requests submitted by the User through any of the contact methods made available on the Data Controller's website.
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

Video Surveillance

• Purpose: security and access control, workplace monitoring and monitoring of internal activities. Legal basis: public interest in security and access control and the legitimate interests of the Data Controller based on Art. 20.3 of the Spanish Workers' Statute. Retention period: a maximum of 30 days.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

Images and Recordings

• Files containing static and/or moving images. This includes publication through media belonging to the Data Controller or third parties.
  (based on the consent of the data subject, Art. 6(1)(a) GDPR)

Customers and Suppliers

• Commercial management of relationships with customers and suppliers.
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

Marketing Opt-Out

• Processing of data to prevent commercial communications from being sent to persons who have refused or objected to receiving them.

  (for compliance with a legal obligation, Art. 6(1)(c) GDPR)

Commercial Advertising

• Advertising management and commercial prospecting. This includes data obtained from legitimate publicly accessible sources.
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

Rights of Data Subjects

• To process requests from individuals exercising their rights under the GDPR.
  (for compliance with a legal obligation, Art. 6(1)(c) GDPR)

Website, App and Other Platform Users

• Identification data relating to users accessing the corporate website.
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

Training, Courses, Workshops, Activities or Similar

• Management of access and usage conditions.
  (based on the legitimate interests of the Data Controller, Art. 6(1)(f) GDPR)

How long will we retain your personal data?

Your personal data will be retained for no longer than necessary to fulfil the purposes for which it is processed or for as long as any applicable legal requirements require its retention. Once it is no longer required for these purposes, it will be deleted using appropriate security measures to ensure the anonymisation of the data or its complete destruction.

Who do we disclose your personal data to?

No personal data is expected to be disclosed to third parties except where necessary for the development and fulfilment of the purposes of the processing, including to our communications-related service providers, with whom the Data Controller has entered into the confidentiality and data processing agreements required under applicable privacy legislation.

In accordance with Article 44 of the GDPR, an international transfer of data to a country that has not been recognised as providing an adequate level of protection may only be authorised where sufficient safeguards are provided. Such authorisation may therefore be granted where the Data Controller provides a written agreement entered into between the data exporter and the data importer setting out the safeguards necessary to protect data subjects and ensure that they are able to exercise their rights.

The Data Controller may use service providers whose servers or registered offices are located in other countries and, as a result, such transfers may take place. For an up-to-date list of service providers, please contact the Data Controller at [email protected].

In addition, data may be disclosed to the following companies:

• EMOTION SPORTS GMBH GERMANY, located in Germany

• EMOTION MANAGEMENT GMBH, located in Austria

• MALLORCA LAWN TENNIS COUNTRY CLUB S.L., located in Spain.

The three companies listed above collaborate with the Data Controller in organising sporting events and it is necessary to disclose your data to them if you register for any event or request information about any event.

The Data Controller has entered into the corresponding and necessary data processing agreements with the companies listed above in accordance with the requirements of current personal data protection legislation.

What are your rights?

The User has the following rights:

• The right to withdraw consent at any time.

• The right of access, rectification, data portability and erasure of your personal data, and the right to restrict or object to its processing.

• The right to lodge a complaint with the supervisory authority (www.aepd.es) if you consider that the processing does not comply with applicable legislation.

Exercising your rights

You may exercise your rights of access, rectification, erasure, data portability, restriction of processing and objection using the form made available to you:

Download the Data Protection Rights Request Form (Spanish)

Contact details for exercising your rights:

EMOTION SPORTS HISPANIA S.L. C/ Industria, 5 5º - 07013 Palma (Illes Balears). Email: [email protected]

2. MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE USER

By ticking the corresponding boxes and entering data in the fields marked with an asterisk (*) on the contact form or included in downloadable forms, Users expressly, freely and unequivocally acknowledge that their data is necessary for the provider to respond to their request. Providing data in the remaining fields is voluntary. The User guarantees that the personal data provided to the Data Controller is accurate and is responsible for notifying the Data Controller of any changes to such data.

The Data Controller informs Users that all data requested through the website is mandatory where it is necessary to provide the User with an optimal service. Where all requested data is not provided, it cannot be guaranteed that the information and services provided will fully meet the User's needs.

3. SECURITY MEASURES

In accordance with applicable personal data protection legislation, the Data Controller complies with the provisions of the GDPR and LOPDGDD in relation to the processing of personal data for which it is responsible, and in particular with the principles set out in Article 5 of the GDPR, under which personal data must be processed lawfully, fairly and transparently in relation to the data subject and must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

The Data Controller guarantees that it has implemented appropriate technical and organisational policies and measures to apply the security measures established by the GDPR and LOPDGDD in order to protect Users' rights and freedoms and has provided them with the appropriate information to enable them to exercise those rights.

For further information regarding privacy safeguards, you may contact the Data Controller at EMOTION SPORTS HISPANIA S.L., Industria 5, 5º, 07013 Palma (Illes Balears). Email: [email protected]

4. VALIDITY

This Privacy Policy has been in effect since 09/03/2022.

The Data Controller reserves the right to amend this policy in order to adapt it to future applicable legislative or case-law developments, or for other technical, operational, commercial or corporate reasons, among others. If such changes affect Users' rights, the Data Controller undertakes to provide information regarding the reasons for those changes.