Privacy Policy

Last updated: March 2026

At FOOTBALLS LEGACY, the protection of your personal data is a priority. This policy describes how we collect, use, share, and protect your information, in accordance with the General Data Protection Regulation (GDPR) and the Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD).

1. Data Controller

The data controller for your data is:

Identity: José Galdo Escourido
Trade name FOOTBALLS LEGACY.
Tax ID (NIF): 34635897J
Postal address: Vía de servicio Carretera de la Coruña, Km. 18.300, Las Rozas, 28231 Madrid, Spain
Email: info@footballslegacy.es
Activity: Sale and consultancy of football collectibles and memorabilia, certifications, and associated services.

There is no legal obligation to have a DPO; however, for any questions, you can contact our privacy officer at info@footballslegacy.es

2. Purposes and Legal Bases for Processing

We process your personal data for the following purposes and legal bases:

Management of purchases and services:
To process sales, valuations, certifications, on-demand services, and consignments.
Legal Basis: Performance of a contract.
VIP Club subscription and membership:
To manage access, benefits, and community on the Skool platform.
Legal Basis: Performance of a contract.
Management of authenticity certifications and historical traceability of items:
To issue authenticity certificates, document the provenance of items, manage photo-match processes, and maintain historical records necessary to preserve the traceability and documentary value of collectibles.
Legal Basis: Performance of a contract and legitimate interest in preserving the historical and documentary integrity of the items.
Management of consignment services and purchase of items from individuals:
To evaluate, manage consignment, intermediation, direct acquisition of items, and formalize sales or intermediation operations between collectors.
Legal Basis: Performance of a contract and application of pre-contractual measures.
Management of the Academy and training content:
To manage access to educational content, training programs, online sessions, exclusive materials, and track participation within the Academy.
Legal Basis: Performance of a contract.
Management of the community and platform participation:
To allow interaction between members, participation in discussions, publications, private events, or community activities linked to the VIP Club or Academy.
Legal Basis: Performance of a contract.
Management of advertising campaigns and performance analysis:
To measure the performance of digital marketing campaigns, perform basic segmentation, and display advertising related to our products or content through online advertising platforms.
Legal Basis: User consent given through the acceptance of marketing cookies.
Newsletter and commercial communications:
To send information about new items, Academy content, and exclusive promotions.
Legal Basis: Explicit consent, granted through a free and unchecked box.
Management of inquiries and customer service:
To respond to questions and requests made through contact forms or email.
Legal Basis: Application of pre-contractual measures or performance of a contract.
Legal and tax compliance:
For invoicing, fraud prevention, compliance with tax regulations, and legal obligations in e-commerce.
Legal Basis: Legal obligation.
Prevention of Money Laundering:
Processing of identity documents and transaction data to comply with due diligence obligations established in Law 10/2010 on the prevention of money laundering and terrorist financing.
Legal Basis: Compliance with legal obligation.

3. Personal Data Collected

We collect only the personal data necessary to provide our services and properly manage activities related to FOOTBALLS LEGACY.

Identification data:

Name, surname, DNI/NIE/passport, or other identity documents when necessary to formalize operations, issue certificates, or comply with legal obligations.

Contact data:

Email, phone number, and postal address for communications related to purchases, shipments, contracted services, or customer service.

Payment and billing data:

Information necessary to process payments and issue invoices, such as card details, bank account, billing address, or equivalent information managed through secure payment providers.

Transaction and commercial activity data:

Information related to purchases made, order history, value of items acquired or sold, contracted services, consignments, valuations, and certifications requested.

Data related to certifications and traceability of items:

Information linked to authenticity, provenance, ownership history, documentation associated with items, certification records, verification processes, or photo-match, when necessary to guarantee the authenticity and traceability of the collectible item.

Community interaction and membership data:

Information generated by participation in the VIP Club, Academy, or online community, such as publications, comments, participation in events, courses, or activities within the platforms used.

Preference and interest data:

Information about teams, players, types of items or collection interests, as well as subscription preferences and participation in content or communications.

Browsing and website usage data:

Technical information such as IP address, cookie identifiers, pages visited, interaction with content, or browsing behavior when the user has accepted the use of analytical or advertising cookies.

Mandatory data:

The data requested as mandatory is necessary to manage purchases, subscriptions, certifications, or requested services. If the user does not provide such data, we may not be able to provide the service or complete the requested operation.

4. Consent and Withdrawal

Consent is obtained freely, specifically, informed, and unambiguously.
We do not use pre-checked boxes.
Consent for marketing is independent of the acceptance of sales terms.
You can withdraw your consent at any time, as easily as you gave it, by writing to info@footballslegacy.es.

5. Recipients and Data Transfer

We do not sell your data to third parties. However, we share information with data processors to provide our services:

Shopify: Database and e-commerce management.
Skool: Membership and community platform.
Mailerlite: Email marketing and lead generation.
Billin: Invoicing and legal compliance.
GoDaddy: Hosting and web maintenance.
Shipping companies (UPS, DHL, FedEx, etc.): For the delivery of physical items.
Public authorities: When there is a legal obligation (AEAT, law enforcement).
Payment gateways operated by Shopify and Skool,

Providers are contractually obliged to process your data in accordance with GDPR and not to use it for purposes other than those indicated.

6. International Transfers

Some providers (Shopify, Mailerlite, Skool, Meta Ads) may process your data outside the European Economic Area (EEA), mainly in the United States.

Safeguards: These transfers are carried out under Standard Contractual Clauses (SCC) approved by the European Commission and/or recognized privacy frameworks such as the Data Privacy Framework, ensuring a level of protection equivalent to that in Europe.

In the absence of an adequacy decision, it is guaranteed that providers have Standard Contractual Clauses (SCC) and have carried out a TIA (Transfer Impact Assessment) to ensure data protection.

7. Data Retention

Customers: During the commercial relationship and up to 6 years thereafter, in accordance with accounting and commercial regulations.
Newsletter and community subscribers: Until you withdraw your consent or request deletion.
Authenticity certificates and item documentation: For item traceability: We will retain data linked to certificates/provenance during the item's lifecycle in the secondary market due to legitimate interest (Art. 6.1.f GDPR), irreversibly anonymizing identifying data of the original buyer after 6 years (tax/commercial limitation period), unless consent is given to maintain historical provenance.

8. Profiling and Automated Decision-Making

We perform basic segmentation to recommend products or content that match your interests, for example, collections from a specific team.
We do not use automated profiles that produce significant legal effects (Art. 22 GDPR). Segmentation is based on explicit or consented preferences.

9. User Rights

You have the right to:

Access: Know what personal data we process about you.
Rectification: Correct inaccurate or incomplete data.
Erasure ("right to be forgotten"): Request deletion of your data.
Restriction and objection: Object to processing or restrict it in specific cases.
Data Portability: Receive your data in a structured, readable, and reusable format.

Exercise of rights: Send an email to info@footballslegacy.es, attaching a copy of your DNI or equivalent document to verify identity.

If you believe your rights have not been met, you can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

10. Information Security

We implement advanced technical and organizational measures to prevent unauthorized access, loss, alteration, or improper disclosure of your data.

Measures include: AES-256 encryption for sensitive data, pseudonymization in databases, annual audits, access control with MFA, and incident response plans. We comply with Art. 32 GDPR.

11. Rights of Minors

FOOTBALLS LEGACY services are not intended for children under 14 years of age. We do not knowingly collect data from minors. If it is detected that data from a minor has been collected without parental consent, it will be immediately deleted.

12. Notification of Security Breaches

In the event of a security breach affecting your data and posing a high risk to your rights, we will notify you without undue delay (Art. 34 GDPR). We will notify the AEPD within 72 hours if applicable (Art. 33 GDPR). We will cooperate with authorities to mitigate impacts.

13. Cookies and Similar Technologies

On our website, we use first-party and third-party cookies to:

Analyze web traffic and user behavior.
Personalize content and product recommendations.
Display relevant advertising (retargeting).

The user can manage, accept, or reject cookies through the visible notice on the website or by configuring their browser settings.

14. Changes to the Privacy Policy

FOOTBALLS LEGACY may update this privacy policy periodically.

The current version will always be published on the website.
Continued use of our services implies acceptance of the most recent version.

15. Contact

For inquiries, issues, or privacy complaints:

Email: info@footballslegacy.es
Postal address: Vía de servicio Carretera de la Coruña, Km. 18.300, Las Rozas, 28231 Madrid, Spain