PRIVACY POLICY — CONMEBOL

1. Data controller

The data controller for personal data is:
South American Football Confederation – CONMEBOL
Address: Avenida Sudamericana y Valois Rivarola, Luque, Paraguay
Contact email (privacy and ARCO/DSR rights): privacidad@conmebol.com

2. Scope of this Policy

This Privacy Policy describes how CONMEBOL collects, uses, stores, shares and protects users' personal data when:

they access and use the official digital platforms of CONMEBOL Libertadores and CONMEBOL Sudamericana,
they use mobile applications and related digital services, and
they interact with CONMEBOL through forms, games, contests, communications and associated events (collectively, the “CONMEBOL Platforms”).

This Policy is supplemented by and should be read together with the CONMEBOL General Terms and Conditions and the Cookie Policy.

3. Principles and regulatory compliance

CONMEBOL processes personal data in accordance with the principles of:

lawfulness, fairness and transparency,
purpose limitation,
data minimization,
accuracy,
storage limitation,
integrity and confidentiality.

Processing is carried out in compliance with applicable legislation, including — as applicable to the user and the service —:

General Data Protection Regulation (GDPR – European Union),
General Data Protection Law (LGPD – Brazil),
data protection regulations of Argentina, and
other applicable legal frameworks.

4. Personal data we collect

Depending on the platform and the interaction, CONMEBOL may process the following categories of data:

Identification data: First and last name, date of birth, country of residence, identity document (when required).
Contact data: Email address, telephone number and shipping or contact addresses (when applicable).
Account and profile data: Username, encrypted password, preferences, interests, participation in games or contests, feedback and surveys.
Transactional data: Information related to purchases, tickets or experiences (when applicable, mainly during finals).
Financial data: Data necessary to process payments through external providers. CONMEBOL does not store complete payment card numbers.
Technical and usage data: IP address, device identifiers, browser type and version, operating system, time zone, pages visited, interactions and usage metrics.
Marketing and communications data: Subscription preferences and communications management.
Cookies and similar technologies: As described in the Cookie Policy.
Image and audiovisual recording: Images or videos captured at official events, always in institutional and security contexts.

5. How we collect data

Information provided directly by the user: creating an account (18+ only), participating in games, contests or digital experiences, subscribing to communications, purchasing tickets or services, contacting CONMEBOL.
Automatic collection: cookies, system logs and similar technologies when browsing the Platforms.
Authorized third parties: technology providers, ticketing, hospitality and access control operators (limited to finals), venue and security operators, commercial partners, solely for permitted purposes and without indiscriminate data transfer.

6. Purposes and legal bases for processing

Performance of a contractual relationship: creation and management of user accounts, provision of digital services, participation in games or contests, management of tickets and access at finals.
Compliance with legal obligations: accounting, tax and administrative obligations, fraud prevention, security, integrity and access control, compliance with authorities.
Legitimate interest of CONMEBOL: security of Platforms and events, continuous improvement of services and content, handling inquiries, operational communications, institutional audiovisual recording, defense of legal rights and interests.
User consent: marketing communications, management of non-essential cookies and third-party features only after prior consent.

7. Marketing communications

CONMEBOL may send promotional communications with express consent when required or under legitimate interest with a prior legal relationship. Users can unsubscribe via links or by writing to privacidad@conmebol.com.

8. Data sharing

CONMEBOL may share personal data only when necessary and with safeguards with technology providers, ticketing operators, venue and security operators, commercial partners, and public authorities. CONMEBOL does not sell personal data.

9. International transfers

Personal data may be processed and stored in cloud infrastructure in Brazil (AWS sa-east-1) and EU (AWS eu-west-1 – Ireland) by authorized personnel and providers under CONMEBOL’s instructions and safeguards. International transfers apply contractual, technical and organizational safeguards.

10. Data retention

User account: while active and up to 2 years after inactivity.
Transactional / ticketing data: up to 10 years.
Marketing: while consent or relationship exists, up to 2 years from last interaction.
Technical logs: between 12 and 24 months.

After retention periods, data will be securely deleted or anonymized.

11. User rights

Users may exercise rights: access, rectification, erasure, restriction of processing, portability, objection, withdrawal of consent, filing complaints. Requests to privacidad@conmebol.com.

12. Information security

CONMEBOL applies reasonable technical and organizational measures to protect personal data. No system is completely secure.

13. Children's privacy

CONMEBOL Platforms are not intended for persons under 18. Data from minors is not knowingly collected; inadvertent data will be deleted.

14. Links to third parties

Platforms may contain third-party links or features. Third parties may process personal data according to their own privacy policies, outside CONMEBOL’s control. Users should review these policies before interacting.