Privacy Policy

Introduction

Clube Desportivo de Mafra, referred to below as CD Mafra, cares about your privacy and is committed to protecting your personal data. This Privacy and Data Protection Policy sets out how the personal data you give us is used and kept safe. It applies whenever we collect personal data, including when you use this website or other CD Mafra digital platforms. Please read it carefully.

This Policy should be read together with our Terms and Conditions. The definitions in the Terms and Conditions apply to this Policy unless stated otherwise. If you do not accept this Policy or do not agree to comply with the Terms and Conditions, please stop using this website.

Here we explain which personal data we may collect, for what purposes, what measures we take to keep it safe, what your rights are and how to contact us.

Our website and other digital platforms may contain links to third-party websites, provided for your convenience. CD Mafra is only responsible for the privacy, data protection and security practices of its own platforms. We recommend that you read the policies of every website you visit.

Read the Terms and Conditions

Who we are

CD Mafra was founded on 24 May 1965 (its first statutes were approved on 19 October that year) and re-founded an earlier club created in 1940 with the same crest. It is the sporting ambassador of the town and municipality of Mafra and of the Saloia region, promotes sport among young people, takes part in professional football competitions and organises events.

This Policy applies to the whole CD Mafra group, which includes the Club and the SAD (football company). The data controllers are:

• Clube Desportivo de Mafra, tax no. (NIPC) 501130365;
• Clube Desportivo de Mafra – Futebol, SAD, Lda., tax no. (NIPC) 513588302.

How to contact us

We welcome questions, comments or suggestions about this Policy. If you have any question about how we collect, store or use your personal data, contact us:

• Email: proteccao.dados@cdmafrasad.pt
• Address: Rua Serpa Pinto, no. 89, Campo Dr. Mário Silveira, Mafra, Portugal

What data we collect

Personal data is information about the personal or factual characteristics of a person who can be identified from it, such as name, address, phone number, date of birth or citizen card number. Information that does not identify you and cannot be directly linked to your identity is not personal data.

We record, process and protect all personal data in accordance with national and European data protection law, notably Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). We may supplement the information we collect with data obtained from other entities in the context of contracts, or provided by other organisations, for example sponsors or partners.

When we provide you with products or services, we may collect and keep the personal data you give us, such as your name, address, email, phone number and information about the payment method used. The same applies when you sign up for marketing communications, enter a prize draw, fill in a form (online or on paper) or give us data in any other way.

Data collected automatically

When you use our digital platforms, we automatically collect the data below about your visit. It helps us understand how fans use them and create more relevant content and communications. Audience measurement with Google Analytics is only switched on if you consent (see Cookies and Google Analytics).

• how you accessed the platform and the IP address used;
• browser type and version, plug-ins and operating system;
• your path through the site, including links followed, searches made, time spent on each page and other interactions;
• which videos you watched and for how long;
• which content you liked and which you shared;
• which ads you saw and responded to;
• which pop-up or push messages you saw and responded to;
• subscription status;
• data from any form you filled in.

From your IP address we can infer your country and analyse the activity that led to specific operations, such as downloading the app.

What we use data for

In general terms, we use your data to:

• manage and provide products and services that you request or have shown interest in;
• register athletes with the associations and federations of the sports we officially practise, with Liga Portugal and in tournaments our teams enter;
• publicise competitions, offers or promotions you have shown interest in;
• tell you when products or services you ordered or requested are unavailable;
• verify and prevent fraud;
• carry out market research to improve the products and services we offer members and users;
• keep records;
• monitor your activity on our digital platforms;
• build your individual profile, so we can understand and respect your preferences;
• personalise and improve your experience and tailor the communications we send you;
• build profiles to personalise the marketing communications you agree to receive.

Depending on the case, the legal grounds for processing are: performance of a contract or pre-contractual steps at your request, compliance with legal obligations, your consent (for example, newsletter and analytics cookies) and the club's legitimate interest (for example, security and fraud prevention). We keep data only for as long as needed for these purposes and to meet legal obligations.

Website forms

The website forms (contact, membership, press and newsletter) store only the data needed for your request: your name, your email and the message you write (and, depending on the form, other fields such as phone number, media outlet or subject), together with a record of your consent, including the version of the text you accepted.

To prevent abuse, we also store the page language, the browser used and an encrypted identifier (hash) of your IP address, never the plain address. The forms may use an anti-spam service (Cloudflare Turnstile).

We use this data only to answer your request, process your application or send you the newsletter you subscribed to. Messages received through the forms are deleted after 12 months.

News, offers and opportunities

We want you to be among the first to hear about signings, competitions, club news, ticket availability and offers from official partners. Every newsletter and email we send includes a way to stop receiving them (opt-out), through a link in the message or a request for full or partial removal sent to proteccao.dados@cdmafrasad.pt.

If you choose not to receive this information, we will not be able to keep you informed about new services, products, events or special offers that may interest you.

You can see the up-to-date list of our sponsors and partners on this website or at the Club Office, at Campo Dr. Mário Silveira. If you show interest in an offer from a sponsor or partner, they may be told of your interest.

Disclosure of your data to third parties

To promote our products and services or perform contracts, we may need to appoint another organisation to process your data on our behalf. For example: football associations and federations, payment processors (such as Stripe), delivery companies, fraud prevention and credit risk management companies, or postal collection and distribution companies.

We may also share your data with third parties:

• where there is a legal or regulatory duty to do so;
• where necessary to enforce our Terms and Conditions or other contractual rights;
• to help the police or security services prevent and detect crime or terrorist activity.

We may share your data with carefully selected sponsors and partners, who may change over time, but only if you have consented to receive marketing related to them or one of the situations above applies.

Some of the organisations we may disclose data to are outside Portugal and the European Union, in countries whose laws may not protect privacy as broadly. If we transfer data to those territories, we take appropriate measures, such as the safeguards provided for in the GDPR, so that it is protected in line with this Policy. Whenever we disclose your data to third parties, we make sure it is adequately protected.

Cookies and Google Analytics

Under Portuguese Law no. 41/2004 of 18 August, as amended by Law no. 46/2012 of 29 August, storing information, and accessing information already stored, on a subscriber's or user's terminal equipment is allowed within the legal limits. Like many websites, we use cookies: small files that your browser stores on your device.

Cookies do not install anything on your system or damage your files. Most browsers accept them automatically, but you can reject or accept them in your browser settings. If you switch them off, your experience on the site may be limited.

We use cookies that are essential for the site to work. Audience measurement with Google Analytics (GA4), a Google service that uses cookies and may transfer and store information on servers in the United States of America, is only switched on after you accept analytics cookies. Google uses this information to evaluate use of the site, compile reports on its activity and provide other related services. The IP address sent by your browser to Google Analytics is not combined with other Google data. You can withdraw your consent at any time.

Details of each cookie and how to manage your choices are in the Cookie Policy.

See the Cookie Policy

Information security

We use security procedures to protect our database systems, electronic or paper, against loss and misuse. Access to those databases is only allowed where strictly necessary and always in line with the rules on the use of personal data.

Whenever a password is needed to access areas of our platforms, the user is responsible for keeping it safe and confidential and for not disclosing it to others.

Video surveillance

For your safety, a closed-circuit television (CCTV) system operates at Estádio Municipal de Mafra on official match days, run by the GNR (National Republican Guard).

Minors

Under 16. If you are under 16 and registered in restricted areas of our platforms, we collect and store your date of birth, your name and the other data you give us when registering and browsing, so we can handle it appropriately under this Policy. While you are under 16, we do not send marketing communications, we do not allow access to the message boards of our platforms and we do not share your details with commercial partners. If you requested a product or service, we may contact you about it.

Aged 13 to 15. You must tell your parents or legal guardian that you want to register on our platforms and obtain their consent, in particular before:

• sending us an email or asking us to contact you by email;
• sending us any personal information or data;
• entering any contest or prize draw that requires personal data or offers a prize;
• signing up as a member;
• offering or agreeing to buy any product online.

If you are the parent or guardian of a user aged 13 to 15, we do not ask for your direct consent to the minor's registration, but we ask that you are informed and that you give consent before the minor registers or does any of the activities above.

Under 13. If you are under 13, you can only use the restricted areas of our platforms with the prior consent of your parents or guardian.

To register, you must give your name, email, country and date of birth. The system then asks for the name and email of your parents or guardian, whom we email to tell them about the request and ask for consent, which they must confirm they have the authority to give. Registration cannot continue without this information.

We need their answer within 7 (seven) days; if we do not receive one, we assume consent has been refused. Refusal or consent is communicated by email. Consent can be withdrawn at any time.

Even with consent to register, your parents or guardian must be informed and give prior consent before you:

• send us an email or ask us to contact you by email;
• send us any personal information or data;
• take part in any contest or prize draw that requires personal data or offers a prize;
• sign up as a member, or offer or agree to buy any product online.

We inform parents and guardians that children under 13 can access and use the unrestricted areas, but that their direct consent is needed for access to restricted areas.

CD Mafra is not responsible for false information given by children under 13, in particular about their age when registering.

Your rights

You can exercise your rights at any time by writing to proteccao.dados@cdmafrasad.pt. To make sure the request comes from the right person, please include your name, address, date of birth, email and membership number (if applicable). We reply within one month, which may be extended as provided for in the GDPR.

• Rectification and updating: you can correct or update your personal data by email or, where one exists, in your account on the site.
• Erasure (right to be forgotten): this is not an absolute right. If you want to remain a member, we cannot delete the data we need to keep you as one. Once we delete your data, you will stop receiving alerts from CD Mafra (ticket promotions, merchandising, etc.).
• Restriction of processing: you can request it, without prejudice to any legally required exceptions.
• Access and portability: you have the right to receive a copy of the personal data we hold about you and to ask for it to be transferred directly to another controller, or for your own records, where technically possible. The first copy is free; we may only charge a reasonable fee, based on administrative costs, for additional copies or for manifestly unfounded or excessive requests.
• Marketing and consent: you can unsubscribe from marketing communications at any time, using the same email address or your account on the site, and withdraw any consent given, without affecting the lawfulness of earlier processing.
• Objection: you can object to the processing of your personal data, or to any aspect of this Policy, by writing to us.

As a last resort, you can lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt.

Changes to this Policy

Our aim is to meet high standards of security and privacy, so our policies and procedures are constantly under review. We may change this Policy whenever appropriate and necessary. We recommend that you check this page periodically to read the latest version, which shows the date of the last update.