PRIVACY POLICY

We are pleased that you are interested in data protection on our website. When you visit our website and mobile app, we want you to feel comfortable and safe, and to see with full transparency what data we collect and what we use it for.

The following information explains the type and scope of the processing of your personal data by Freesports Marketing, S.L.U. Personal data means any data that can be linked, directly or indirectly, to you. This processing is based on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), as well as Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

Table of contents

1. General overview
2. Access to our website
3. Contact form / emails / phone calls / customer surveys
4. Sending of newsletters
5. Online presence and website optimisation
6. Recipients outside the European Union
7. Your rights as a data subject
8. Contact persons
9. Data controller and data protection contact details

1. General overview

Freesports Marketing, S.L.U.'s processing of data is essentially based on the fact that, when you access the Freesports Marketing, S.L.U. website, data of various kinds — which may include personal data — is exchanged between your device and our server. The information collected in this way is used, among other purposes, for the proper functioning and optimisation of our website and, where you have given your consent, for analytics or advertising purposes.

2. Access to our website

Purposes of processing / legal basis:

When you access our website, the browser used by your device automatically sends the following information:

• the IP address of the internet-enabled device used;
• the date and time of access;
• the name and URL of the file accessed;
• the website / application from which access was made (referrer URL);
• the browser used and, where applicable, the operating system of your device, as well as the name of your internet access provider.

We store this data temporarily in a log file for the following purposes: ensuring a smooth connection; ensuring the comfortable use of our website / app; and evaluating system security and stability.

The legal basis for processing the IP address and access data is Article 6(1)(f) GDPR. Our legitimate interest arises from the purposes of processing described above. This is strictly necessary technical data required for the provision of the service, so it does not require your consent under Article 22.2 of Spanish Law 34/2002 (LSSI-CE).

Recipients / categories of recipients:

As a general rule, this data is not disclosed to third parties, except to hosting and infrastructure providers acting as data processors.

Retention period / criteria for determining the retention period:

Data is stored for as long as necessary to provide our service and/or to comply with legal obligations. Once this period has elapsed, the data is automatically deleted.

3. Contact form / emails / phone calls / customer surveys

Purposes of processing / legal basis:

The personal data you provide by completing contact forms, or by phone or email, is treated confidentially. We use your data exclusively to handle your enquiry. The legal basis for this processing is Article 6(1)(b) GDPR, where your enquiry relates to the contracting of our services, or Article 6(1)(f) GDPR (legitimate interest) in all other cases. Both our legitimate interest and yours in this processing arise from the aim of responding to your enquiries, resolving any issues, and maintaining and improving your satisfaction as a customer or user of our website.

Recipients / categories of recipients:

As a general rule, this data is not disclosed to third parties. In exceptional cases, other service providers may process the data on our behalf. We carefully select such providers, monitor them, and contractually bind them to comply with their obligations under Article 28 GDPR.

In addition, it may be necessary for us to pass on extracts of your enquiries to third parties with whom we have contractual relationships (for example, suppliers for product- or service-specific queries) in order to handle your enquiry. In these cases, the enquiry is anonymised beforehand wherever possible. If, in a specific case, it is necessary to disclose your identifying personal data, we will inform you in advance and request your consent where legally required.

The results of customer surveys we carry out are used solely for internal analysis purposes. As a general rule, this data is not disclosed to third parties; we do not disclose your personal data to third parties without your express consent, except where legally required.

Retention period / criteria for determining the retention period:

Personal data you provide to us in enquiries (suggestions, comments or complaints) through this website, by email or by phone will be deleted or anonymised within a maximum of 90 days from our final response, unless it must be kept for longer to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

4. Sending of newsletters

Purposes of processing / legal basis:

You can subscribe to our newsletter on our website. If you have given your consent to receive our emails, we will use your email address and, where necessary, your name, to send you information (personalised where possible) about products, promotions, competitions and news about our offers and stores, as well as other current and future Free Motion services (sporting events, trips, etc.), and for customer satisfaction surveys.

With your specific, separate consent, we may record your usage habits on the website www.free-motion.com, our mobile app and the newsletter itself (for example, which sections you visit or which links you click), in order to personalise the content we send you and to improve our offers.

The legal basis for processing data for sending the newsletter and, where applicable, for creating usage profiles, is your consent under Article 6(1)(a) GDPR.

To make sure no error has occurred when entering your email address, we use a double opt-in procedure: once you have entered your address in the subscription form, we will send you a confirmation link. Only once you click this link will your email address be added to our mailing list.

You may withdraw your consent to receive the newsletter, or to the creation of usage profiles, at any time with future effect — for example, by unsubscribing via the link included in every newsletter. Withdrawal results in the deletion of the user data collected for that purpose.

Recipients / categories of recipients:

Where we engage external providers to send the newsletter, they are contractually bound to comply with their obligations under Article 28 GDPR. As a general rule, this data is not disclosed to third parties for other purposes.

Retention period / criteria for determining the retention period:

If you withdraw your consent to receive the Free Motion newsletter, your data will be removed from the relevant mailing list.

5. Online presence and website optimisation

5.1. Cookies: general information

We use cookies and similar technologies on our website and mobile app. Cookies are small files stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your device and do not contain viruses, trojans or other malware.

We distinguish between two categories of cookies according to their purpose:

• Technical or strictly necessary cookies: these enable browsing and the use of basic website functions, such as keeping you logged in, remembering the contents of your shopping cart, or ensuring system security and stability. Their use does not require your consent, under the exemption in Article 22.2 of Spanish Law 34/2002 (LSSI-CE), and their legal basis is our legitimate interest in the proper functioning of the website (Article 6(1)(f) GDPR).
• Analytics, personalisation and third-party cookies (for example, Google Analytics or LiveChat, described in sections 5.2 and 5.3): these are only installed if you give your prior consent through the cookie management panel shown on your first visit to the website. You can accept, reject or configure these cookies equally easily, and change your choice at any time via the cookie settings link available in the website footer. Their legal basis is your consent (Article 6(1)(a) GDPR and Article 22.2 LSSI-CE).

If you reject non-essential cookies, you can continue to browse the website normally, although some personalised features may not be available.

5.2. Google Analytics

Purposes of processing / legal basis:

Where you have given your consent through our cookie management panel, we use Google Analytics, a web analytics service provided by Google Ireland Limited ("Google"), to design our website according to demand and to continuously optimise it. The legal basis for this processing is your consent, under Article 6(1)(a) GDPR and Article 22.2 LSSI-CE. In this context, pseudonymous user profiles are created and cookies are used. Among other things, the cookie generates the following information about your use of this website:

• browser type and version;
• operating system used;
• referrer URL (the previous web page visited);
• device identifier or IP address (truncated/anonymised); and
• date and time of access.

This information is used to analyse the use of our website, to compile reports on website activity, and to provide other services related to website and internet use, for market research purposes and to improve our offering. Google processes this data on behalf of Freesports Marketing, S.L.U. as a data processor, under the relevant data processing terms entered into with Google.

You can withdraw your consent at any time with future effect via the cookie settings panel on the website. You can also generally prevent the collection of data generated by the cookie relating to your use of the website (including your IP address), as well as the processing of this data by Google, by downloading and installing the Google Analytics opt-out browser add-on. For more information on data protection in connection with Google Analytics, please see the Google Analytics help website.

Recipients / categories of recipients:

The information generated by the cookie may be transferred to, and stored on, Google's servers located in the United States, under the conditions described in section 6 of this policy. Your full IP address is never combined with other Google data. This information may also be passed on to third parties where required by law, or where such third parties process the data on Google's behalf.

Retention period / criteria for determining the retention period:

The retention period for user-level and event-level data in our Google Analytics property is set to a maximum of 14 months (the maximum available for standard Google Analytics 4 accounts), after which it is automatically deleted. The aggregated reports we compile from this data contain no personal references.

5.3. LiveChat

Purposes of processing / legal basis:

Where you have given your consent through our cookie management panel, we use LiveChat, an online chat service provided by LiveChat, Inc. ("LiveChat"), to assist you and resolve your queries in real time. The legal basis for this processing is your consent, under Article 6(1)(a) GDPR and Article 22.2 LSSI-CE. In this context, cookies are used which generate, among other things, the following information:

• browser type and version;
• operating system used;
• referrer URL (the previous web page visited);
• IP address; and
• date and time of access.

In addition, the information you provide through LiveChat, such as your name or email address, is used to provide you with support and resolve any issues or queries you raise.

Recipients / categories of recipients:

The information generated by the cookie and by conversations held via LiveChat may be transferred to, and stored on, LiveChat, Inc.'s servers located in the United States, under the conditions described in section 6 of this policy. Your IP address is never combined with other LiveChat data without a legal basis for doing so. This information may also be passed on to third parties where required by law, or where such third parties process the data on LiveChat's behalf.

Retention period / criteria for determining the retention period:

Once your query has been resolved, your data will only be retained for the period legally required to deal with any potential claims.

5.4. Managing your cookie preferences (opt-out)

You can accept, reject or configure the non-essential cookies described in sections 5.2 and 5.3 at any time via the cookie settings panel available on our website. You can also configure your browser to block cookies, or to notify you before they are installed. Please note that if you reject or block non-essential cookies, some personalised website features may not be available.

6. Recipients outside the European Union

As a general rule, we do not disclose your data to recipients located outside the European Union or the European Economic Area. The exception is the processing described in sections 5.2 and 5.3, which involves transferring data to the servers of Google Ireland Limited and LiveChat, Inc., some of which are located in the United States, and only where you have given your consent to those cookies.

These transfers are carried out under one or more of the following safeguards:

• the European Commission's Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-U.S. Data Privacy Framework (DPF), where the recipient is certified under that framework; and/or
• the standard contractual clauses approved by the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021.

Please note that the adequacy decision for the EU-U.S. Data Privacy Framework is currently subject to legal challenges before the courts of the European Union, and its validity may therefore change in the future; should this occur, we will update this policy and, where necessary, seek your consent again. You may request a copy of the safeguards applicable to these transfers at any time by writing to support@free-motion.com.

7. Your rights as a data subject

7.1. Overview

In addition to the right to withdraw any consent you have given us at any time, you have the following rights, provided the legal requirements are met:

• Right of access to your personal data stored in our systems, under Article 15 GDPR.
• Right to rectification of inaccurate data or completion of incomplete data, under Article 16 GDPR.
• Right to erasure of your data stored in our systems, under Article 17 GDPR.
• Right to restriction of processing of your personal data, under Article 18 GDPR.
• Right to data portability, under Article 20 GDPR.
• Right to object, under Article 21 GDPR.

7.2. Right of access under Article 15 GDPR

Under Article 15(1) GDPR, you have the right to obtain, on request and free of charge, information about your personal data stored in our systems, in particular regarding: the purposes of processing; the categories of personal data processed; the recipients or categories of recipients to whom your data have been or will be disclosed; the envisaged retention period or, if not possible, the criteria used to determine it; the existence of the rights to rectification, erasure, restriction or objection; the existence of a right to lodge a complaint with a supervisory authority; any available information on the source of the data, where not collected directly from you; and the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR, with meaningful information on the logic involved and the significance and envisaged consequences of such processing.

Where we transfer your personal data to a third country or an international organisation, you have the right to be informed of the appropriate safeguards relating to the transfer, under Article 46 GDPR.

7.3. Right to rectification under Article 16 GDPR

You have the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

7.4. Right to erasure under Article 17 GDPR

You have the right to obtain, without undue delay, the erasure of personal data concerning you where one of the following applies: the data are no longer necessary for the purposes for which they were collected; you withdraw the consent on which the processing is based and there is no other legal basis; you object to the processing under Article 21(1) or (2) GDPR and there are no overriding legitimate grounds; the data have been unlawfully processed; erasure is required to comply with a legal obligation; or the data were collected in relation to the offer of information society services under Article 8(1) GDPR.

Where we have made your personal data public and are obliged to erase it, we will take reasonable steps, considering available technology and the cost of implementation, to inform third parties processing that data that they should erase any links to, or copies or replications of, that personal data.

7.5. Right to restriction of processing under Article 18 GDPR

You have the right to obtain restriction of processing where: you contest the accuracy of the personal data, for the period enabling us to verify it; the processing is unlawful and you oppose erasure, requesting restriction of use instead; we no longer need the data for the purposes of processing, but you need it for the establishment, exercise or defence of legal claims; or you have objected to processing under Article 21(1) GDPR pending verification of whether our legitimate grounds override yours.

7.6. Right to data portability under Article 20 GDPR

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance from us, where the processing is based on your consent or on a contract and is carried out by automated means. When exercising this right, you also have the right to have us transmit the data directly to another controller, where technically feasible.

7.7. Right to object under Article 21 GDPR

Where the requirements of Article 21(1) GDPR are met, you may object to the processing of your data on grounds relating to your particular situation. This right applies to the processing described in this policy that is based on our legitimate interest (Article 6(1)(f) GDPR). In that case, we will stop processing your personal data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. You can exercise this right by contacting Freesports Marketing, S.L.U. using the contact details in section 8.

8. Contact persons

8.1. If you have questions or wish to exercise your data protection rights

If you have any questions about the website or about exercising your rights in relation to the processing of your data, please contact our Customer Care team at support@free-motion.com, enclosing a copy of an identity document.

8.2. If you have questions regarding data protection

Freesports Marketing, S.L.U.'s Data Protection Officer is Atico34 (www.atico34.com), an external firm specialising in data protection. The general point of contact for any data protection matter is our Customer Care team, who will route your query to the Data Protection Officer where necessary. You can write to support@free-motion.com, stating "Data Protection" in the subject line, or by post to the address given in section 9.

8.3. Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), via its online office (www.aepd.es), if you consider that the processing of your personal data does not comply with applicable law.

9. Data controller and data protection contact details

This privacy policy applies to the processing of data by Freesports Marketing, S.L.U., Tax ID B35575521, address at Av. 8 de marzo, s/n, Hotel Sandy Beach, local 9, E-35100 Playa del Inglés, Gran Canaria (Spain) (the "controller"), in connection with the website www.free-motion.com and the Free Motion mobile app. Freesports Marketing, S.L.U.'s Data Protection Officer is Atico34 (www.atico34.com)