Privacy Policy

Last updated: 2026-08-04

This Privacy Policy explains how [NOM_COMPLET] (hereinafter, "the controller") processes the personal data of users of the "Supporters App" mobile application.

2. Data we collect

We collect the following personal data:

• Alias: A username freely chosen by the user.
• Internal identifier: A random code generated by the system to uniquely identify the user.
• Geolocation data: GPS coordinates of the user (only when using the stadium attendance verification feature).
• Usage data: Anonymous browsing and interaction statistics (via Firebase Analytics).
• Notification token: Identifier for sending push notifications (FCM).

3. Purposes of processing

The collected data is processed for the following purposes:

• Managing user registration and identification within the application.
• Verifying attendance at sporting events by comparing the user's location with stadium coordinates (using a geospatial calculation service).
• Sending push notifications related to the event (reminders, schedule changes, etc.).
• Analyzing application usage to improve user experience.

4. Legal basis

The legal basis for data processing is the user's explicit consent (Article 6.1.a of the GDPR), which is given at the time of registration and acceptance of this policy.

For geolocation, additional and specific consent is requested before activating the feature.

5. Data processors (providers)

The controller uses the services of the following companies for data processing:

• Google LLC (Firebase): Authentication, Firestore database, Remote Config, FCM (notifications), and Analytics. Information at: https://firebase.google.com/privacy
• MongoDB, Inc. (Atlas): Geospatial database for location verification. Information at: https://www.mongodb.com/legal/privacy-policy

6. International transfers

Data stored in Firebase is primarily located on servers within the European Union. However, Google LLC is a company based in the United States, so there is an international data transfer.

This transfer is covered by the Standard Contractual Clauses (SCC) approved by the European Commission, which ensure an adequate level of protection. Users may request further information about these safeguards at the provided email address.

7. Data retention

Data will be retained as long as the user maintains an active account. After 2 years of inactivity, the controller may proceed to delete personal data, unless the user requests deletion earlier.

8. User rights

The user has the right to exercise the following rights at any time by sending a written request to [EMAIL_PER_DRETS_ARCO]:

• Access: Know what data we hold about you.
• Rectification: Modify inaccurate data.
• Erasure (right to be forgotten): Delete your data.
• Restriction of processing: Restrict the use of your data.
• Objection: Object to processing for specific purposes.
• Portability: Receive your data in a structured, machine-readable format.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe we have not processed your data correctly.