General Contractual Terms and Conditions

These general terms and conditions (the "General Terms and Conditions" or "Terms and Conditions") will govern the commercial relationship between LALIGA TECH, S.L., a Spanish company with registered offices at Calle Torrelaguna 60, 28027 in Madrid, with N.I.F. (tax ID no.) B05421805 (“LaLiga Tech” or “Provider”), and the companies to which it provides services (the “Client”).

These Terms and Conditions will govern the general terms for the provision of services, which will be detailed in the attached specific terms and conditions (hereinafter, the "Specific Terms and Conditions", including the Binding Commercial Offer that may be signed between the parties). Both documents constitute the entire agreement (hereinafter, the "Contract") between the parties and replace any prior communication, whether verbal or written, between the parties.

Hereinafter, LaLiga Tech and the Client will be referred to jointly as the “Parties”, and individually as the “Party”.

1. Scope of application and order of priority

The subject matter of these General Terms and Conditions is the provision of the services described in the Specific Terms and Conditions by the Provider (hereinafter, the "Services") for the duration of the Contract.

The Parties agree that, in the event of any express conflict or contradiction between what is governed by these General Terms and Conditions and the Specific Terms and Conditions, the Specific Terms and Conditions will first prevail, secondly, these General Terms and Conditions, and thirdly, any annexes that are attached to the Specific Terms and Conditions or these General Terms and Conditions.

2. Terms and conditions of the provision of the Services

2.1 General principles

In implementing and providing its Services, and without prejudice to any other obligations arising under the Contract, LaLiga Tech undertakes to:

1. Carry out its work with the highest degree of quality and diligence possible, for which it will use the necessary sources of recognised rigour and seriousness, taking into consideration the standards and norms generally accepted in the sector.
2. Use the appropriate methods, technology and knowledge for its work to be of the utmost rigour and accuracy according to the most widespread professional ethical standards.
3. Manage the Service with the speed, diligence and efficacy in line with market standards, using for this purpose the staff and IT and technological resources as well as other kinds of resources it deems necessary and, in particular, to resolve any incidents that could arise during the provision of service contracted through it.
4. Strictly respect and follow all the instructions provided by the Client to guarantee the appropriate conservation and use of the materials that, where relevant, the Client provides or gives access to for the provision of the Services (hereinafter, the “Client Materials”), as well as to take the measures required to prevent any deterioration or loss of the same. Notwithstanding the foregoing, the Provider will not be required to comply with any instructions from the Client that are contrary to applicable legislation or that would necessarily entail an infringement of the rights of third parties.

To ensure an adequate provision of the Service, the Client undertakes to:

1. Provide all the information, sufficiently in advance, required for the appropriate implementation of the Services.
2. Appoint a person with sufficient technical knowledge to act as a point of contact with LaLiga Tech to coordinate and implement the Services.
3. Provide LaLiga Tech with the Client Materials required for the appropriate implementation and provision of the Services, as well as providing the instructions required for LaLiga Tech to take the appropriate measures to conserve and use the same.
4. Use the technology platforms that LaLiga Tech may make available to the Client for the provision of the Services in accordance with the different terms and conditions that are applicable to such platforms.

2.2 Human resources

LaLiga Tech has the staff with the technical capacity required to meet the needs of the provision of the Services; it is responsible for the technical quality of the work carried out and the outputs and services provided.

In this regard, LaLiga Tech assumes in relation to the staff it allocates from among its workforce for the provision of its Services for all purposes the legal status of employer, with all the rights and obligations inherent to said legal status, in line with the legislation in force at any given time, and consequently excluding said staff from the Client's labour, organisational and disciplinary sphere of influence.

The selection, management, recruitment, supervision and training of the staff allocated to the provision of the Services will at all times be the exclusive responsibility of LaLiga Tech; the latter undertakes to effectively and constantly exercise such obligations vis-à-vis its own staff in such a way that they are at all times under its exclusive sphere of influence as respects management, discipline and hierarchy.

LaLiga Tech will be responsible for managing staff absences and substitutions, with the contracted Service under no circumstances being affected.

3. Price, billing and payment method

For the Services described in the Specific Terms and Conditions, the Client undertakes to pay the amount, by the due dates and with the payment method also described in the Specific Terms and Conditions.

Prior to making the payments stipulated in the Specific Terms and Conditions, LaLiga Tech will send the Client the corresponding invoice issued in accordance with current tax legislation, with the amounts broken down and an appropriate description of the items invoiced.

The Client undertakes to pay the amounts corresponding to the Services provided within thirty (30) calendar days of receipt of the invoice issued by LaLiga Tech by bank transfer to the account number indicated on the invoice in question.

For this purpose, the bank accounts used for the transfer of funds in relation to this Contract must be held by the Client and not located in countries or jurisdictions that do not have adequate systems for the prevention of money laundering and terrorist financing, or in territories with a financial system under sanctions maintained by the OFAC (Office of Foreign Assets Control) of the United States or the European Union. Likewise, said transfers of funds must identify the identity of the originating bank and the bank account number from which the transfer is ordered.

4. Causes and consequences of termination

4.1 Without prejudice to the other provisions herein, the following are grounds for termination of the Contract:

1. By mutual agreement of the Parties, with the effects that may result from said agreement; this desire to terminate the Contract must be notified to the other Party at least one month in advance.
2. Breach by either of the Parties of the obligations arising from the Contract will authorise the other party to be able to terminate it, provided that compliance has been expressly required in writing and the breach is not remedied within a maximum of fifteen (15) working days. If the breach has not been remedied by said deadline, the injured Party may choose between continuing with the fulfilment of the Contract or terminating it, with compensation for damages in both cases under the terms and limits provided in the liability clause. Said Party may also demand termination, even after having chosen to continue with the Contract, when this proves to be impossible to fulfil due to force majeure.
3. A lack of legal capacity and/or being prohibited from entering into contracts, due to unexpected reasons.
4. In the case of force majeure.
5. In the event of total or partial transfer in favour of a third-party, natural or legal person, of the rights and obligations of the Parties arising under these General Terms and Conditions, without complying with the provisions of the Transfer and Subcontracting Condition.
6. When either Party becomes insolvent or requests are filed to initiate insolvency proceedings, payment suspensions, bankruptcy or other similar insolvency proceedings, and either of the Parties conveys to the other party a written notification for the termination of these General Terms and Conditions, with the Party that is in any of these situations of termination having to compensate the other Party for the damages arising from said termination in accordance with the terms and conditions established in the liability clause. This section will not be applicable in the event that the Party that requests voluntary bankruptcy, or in any case is declared bankrupt or becomes insolvent, offers the other Party sufficient guarantees as to its ability to continue meeting on time and regularly the obligations arising under the Contract until its intended completion, as well as meeting any liabilities that could arise under the same.

4.2 On termination of the Contract for any of the grounds listed:

1. (i) LaLiga Tech will cease to provide the Services.
2. (ii) Intellectual Property licenses and rights of use granted by virtue of this Contract shall cease to have effect, hence the Client shall not be able to access to the Services rendered under SaaS licenses from then onwards and LaLiga tech shall immediately cease to use Client Materials.
3. (iii) The Client must pay all amounts owed to LaLiga Tech.
4. (iv) Except as provided in the regulations in force at any given time, all documentation, information and materials received from the other Party must, at the latter's choice, either (i) be returned to it, said Party may in any case extend the deadline for the return, unless said Party has expressly waived in writing its right to receive the documentation or materials, or (ii) be destroyed. In the event that the Party that provided the documentation, information or materials chooses for it to be destroyed, it must be notified to said Party in writing that it has been destroyed and that it is no longer in the other Party’s possession or under its control.

5. Liability

5.1 Circumstances may arise in which the Client would be entitled to claim damages from LaLiga Tech due to a breach by LaLiga Tech of its contractual obligations or any other responsibility. In these cases, LaLiga Tech's sole liability for any claims that in total could arise from or in relation to the Services, or that could otherwise arise in relation to the Contract, will be limited solely to compensation for direct and proven damages that are actually an immediate consequence of the breach by LaLiga Tech of said obligations and that are attributable to LaLiga Tech. Under no circumstances may said damages exceed the greater of the following; €300,000 (three hundred thousand euros), or the amount corresponding to the charges for the Services (if they were regular or recurring, the charges for 12 months will be applied) that caused the damage or loss.

This limit also applies to subcontractors and is the maximum amount for which LaLiga Tech and its subcontractors will be jointly liable. The following amounts are not subject to the limitation on the amounts for damages:

1. third-party claims covered in the Intellectual Property Condition and
2. physical injury to people or damage to property for which LaLiga Tech is legally liable.

5.2 Claims for which LaLiga Tech is not liable and for which the Client grants it full indemnity as respects any damages that might be caused to the Client. Under no circumstances will LaLiga Tech, its staff or its subcontractors be liable for:

1. any loss, damage, incident or error caused during the provision of the Services to the personal data that is the Client's responsibility, liability for which is not attributable to LaLiga Tech or its subcontractors;
2. any loss, damage, incident or error caused by any other events or circumstances beyond LaLiga Tech's control;
3. any loss, damage, incident or error caused by the Client or third parties used by the Client to manage its data bases as a result of the failure to comply its obligations;
4. any loss, damage, incident or error caused by the Client's use of the technology platforms made available by LaLiga Tech for the provision of the Services, in a manner not in accordance with the terms and conditions that are applicable to such platforms;
5. any third-party claims (including, but not limited to, competent authorities, courts or data subjects) for the unlawfulness of the personal data provided by the Client to LaLiga Tech;
6. any damages that arise indirectly or as a remote consequence of a breach or that are not a natural consequence of such breach; or
7. loss of profits, business, income, expected capital gains or any form of loss of earnings.

The limitation of liability established in this Clause will not be applicable when the grounds for the claim are based on fraud or malice.

6. Intellectual Property

For the purposes of these General Terms and Conditions, "Intellectual Property" is understood without limitation to mean any asset that can be protected by any applicable intellectual property regulations for any purpose and for any form of use (in particular, copyrights, related rights or neighbouring rights, or sui generis rights on databases), as well as any asset that can be protected by the applicable industrial property regulations (in particular, patents, utility models, industrial models and drawings, designs and brands), also including domain names, know-how and trade secrets, whether they are registered, applied for or not registered, and in any case including the authority to apply for the appropriate registrations to obtain or protect said rights. On the other hand, when reference is made to Intellectual Property rights, other property rights or rights that have an equivalent effect in any part of the world and any rights over the same, as well as applications, registrations, extensions and renewals in relation to any of these rights anywhere in the world are understood to be included.

Except under the conditions set out in this Contract, the Parties may not use the Intellectual Property of the other Party without its prior written authorisation.

6.1 Intellectual Property of shared information

Each Party will retain the exclusive ownership of any Intellectual Property rights over any kind of information, documentation or materials that may be disclosed or provided to the other Party in fulfilling this Contract, regardless of the way they are disclosed or the media in which they are found. After the termination of this Contract for any reason, each Party will refrain from accessing or using, whether in whole or in part, the other Party's information, documentation or materials, including extracting or reusing the content thereof, whether in whole or in part, for any purposes.

The disclosure of information or the delivery of documentation or materials by one of the Parties may under no circumstances be understood to mean that any rights, titles or licenses have been granted as respects said information, documentation or materials, nor as authorisation to use the same for any purposes other than that expressly agreed in this Contract.

6.2 Intellectual Property of LaLiga Tech

All Intellectual Property rights owned by LaLiga prior to or independently of the fulfilment of this Contract will continue to be owned by LaLiga Tech; nothing in the provisions may imply that any rights or licenses as respects the same have been granted in favour of the Client. In particular, the Client may not use the trademarks without the prior written consent of LaLiga Tech and, in this case, it may only use them in accordance with any consent provided.

6.3 Third-party claims

If the Client receives a claim for infringement of Intellectual Property rights for the Services provided, LaLiga Tech will defend the Client at its own expense against said claim and will pay any compensation imposed by the courts in a final sentence, or any approved by LaLiga Tech in an out-of-court settlement agreed with the third party in question, provided that the Client:

1. Notified LaLiga Tech as soon as possible and in writing of said claim; and
2. Allows LaLiga Tech control of, and cooperates with, the defence and any negotiations on an agreement.

7. Non-involvement and non-exclusivity

Pursuant to these General Terms and Conditions, LaLiga Tech and the Client do not assume any kind of exclusivity, both Parties may carry out the activities included in their respective corporate purposes and contract third parties without any limitations whatsoever.

The relationships between the Parties covered by these Terms and Conditions are that of two legal entities that are separate from each other and from third parties, consequently, neither acts as an agent of the other, nor may their acts or omissions give rise to links of any kind that could bind the other Party in respect of third parties. Moreover, the signing or fulfilment of these General Terms and Conditions do not mean or cannot be interpreted so as to mean, a partnership or risk/return relationship shared by the Parties involved herein.

LaLiga Tech exercises its own business activity and has stable assets, means, resources and organisation, providing in the fulfilment of the Contract its own direction and management of its means and resources, keeping the staff on its workforce allocated to the Services under this Contract, within the scope of its management, organisational, governing and disciplinary authority, and maintaining with respect to the same the rights, obligations, risks and responsibilities inherent in the status of employer. Consequently, such employees will continue to be under LaLiga Tech's business management, the Client may not exercise over them either the authority or the capacities inherent in the status of employer.

The relationship between the Parties is of an exclusively commercial nature; there is no employment relationship whatsoever between LaLiga Tech and the Client, although the former may provide services at the Client's registered offices.

8. Transfer and subcontracting

Neither of the Parties may transfer this Contract, in whole or in part, without the prior written consent of the other Party. Any attempt will for all purposes be null and void. However, the transfer of a Contract, in whole or in part, within a group of companies in accordance with Article 42 of the Commercial Code will only require written notification to the other Party. Any attempt made by the Parties to transfer or cede without the express prior written consent of the other Party will not be valid or binding; the foregoing without prejudice to the affected Party’s right to terminate the Contract immediately, reserving the right to claim the corresponding damages.

However, LaLiga Tech will not require the Client's prior written consent in cases where the transfer of a Contract is the result of any operation that involves the transfer of a branch of activity or a part of LaLiga Tech's business, which similarly affects all its clients.

LaLiga Tech may contract third parties for the provision of certain services under this Contract, without requiring the Client's prior approval.

9. Confidentiality

For the purposes of this Contract, "Confidential Information" will be deemed to mean any information that is or has been disclosed by either Party to the other Party, even before this Contract is signed, by reason of the relationships and/or negotiations held between them in connection with this Contract or the fulfilment of the Contract itself, regardless of the subject matter (technical, commercial, economic-financial, legal etc.), or the way it is or has been provided or the media in which it is found (verbal, in writing, by photo-reproductive, mechanical, magnetic, telematic or any other means). In particular, and without prejudice to the foregoing, the following (including, but not limited to) will be deemed to be Confidential Information:

1. any data, information, content, terms, conditions and/or circumstances relating to this Contract;
2. any studies, analyses, assessments and, in general, documentation prepared by either of the Parties based on or in any way using the Confidential Information; and
3. any copies or reproductions, in whole or in part, of the Confidential Information that may be obtained or provided, as well as any other information or data the knowledge or verification of which would only have been possible due to having access to the content of the Confidential Information provided by either of the Parties.

If, as a result of the implementation of the work under the provisions of this Contract, LaLiga Tech has access to the Client's exclusive and/or confidential information or information relating to personal data, LaLiga Tech undertakes to keep said information secret and not to disclose it to third parties or use it for purposes other than the purposes provided for in these General Terms and Conditions.

Regarding the Confidential Information, with the content of these General Terms and Conditions and any other information provided by either of the Parties ("Disclosing Party") to the other Party ("Recipient Party") being deemed to be Confidential Information, the latter undertakes to:

1. Protect, store and safeguard such Confidential Information reasonably and appropriately, or in accordance with applicable professional standards and at least in accordance with measures similar to those used for processing its own Confidential Information.
2. Use the Confidential Information solely with the purpose of fulfilling its obligations under these General Terms and Conditions.
3. Refrain from disclosing or revealing the Confidential Information directly or indirectly, in any way and by any means.
4. Copy the Confidential Information only to the extent required to fulfil its obligations under these General Terms and Conditions.
5. Reveal or give access to the Confidential Information received from the Disclosing Party (or a part of said Confidential Information) to its employees solely and exclusively to the extent that they have a need to know it in the context of these General Terms and Conditions and provided that the Recipient Party has obtained the necessary commitment to secrecy, confidentiality and non-disclosure by said employees prior to any such disclosure or access.

Notwithstanding the foregoing, the Parties may communicate Confidential Information to their subcontractors, where relevant, and insurers, legal advisors or any of the companies in their group, or use it for internal quality reviews.

This clause will not apply to information that:

1. is or becomes generally available to the public because of a reason other than the result of a breach of any obligations established under this clause;
2. is already known to the Recipient Party;
3. has been provided to a third party without any restrictions;
4. has been independently developed by the Recipient Party; or
5. has been disclosed in compliance with a court injunction, or a legal, administrative or governmental requirement.

The obligations included in this clause will remain in force for a minimum period of (5) years after the termination of the Contract for any reason.

10. Compliance with anti-corruption and anti-money laundering laws

10.1 As part of its contracting procedure, LaLiga Tech applies to its third parties, including clients, a risk analysis or due diligence process in which it may request whatever information and/or documentation it deems appropriate and relevant for analysing financial, regulatory compliance, data protection and/or information security risks; its third parties must provide said information and documentation.

In general, this risk analysis or due diligence process is carried out prior to contracting, although it may also be reviewed at any time during the term of the Contract. In case of refusal to collaborate by providing any information or documentation that may be required during this process, or if, where relevant, the analysis of the information provided identifies risks for LaLiga Tech, the latter may decline or terminate the contract, without the counterparty affected by said decision being able to claim any compensation whatsoever.

10.2 The Parties state and guarantee that they are not directly or indirectly involved in illegal activities, nor do they have any outstanding claims, charges, investigations or legal actions that could directly or indirectly affect this contract or the Parties’ reputation.

10.3 The Parties state that during the negotiations prior to this document being signed they have acted at all times in an ethical, professional and legal manner. Likewise, the Parties state that there is no conflict of interest between themselves or between the people who are part of them, nor do they have any connection whatsoever with the capacity to influence this contracting. The Parties undertake to notify each other if, in the future during the term of the contractual relationship, any situation arises that could generate a conflict of interest.

10.4 The Parties declare and guarantee that their actions and that of their corresponding subcontractors, where relevant, will be governed at all times by the principles of contractual good faith and duly subject to the law, consequently, in no case have they directly or indirectly participated, nor will they participate in, the commission of any conduct that could breach the law, regulations or other applicable legislation.

In this regard, the Parties also express their commitment to complying with all applicable anti-corruption legislation, and guarantee to each other that they will not make any illegal payments, whether through a transfer of value or through gifts or presents, directly or indirectly, to civil servants, political parties or members thereof, intermediaries or any other third parties, let alone if such payment is intended to influence or induce said persons to improperly perform or stop performing a function or activity in connection with their assigned tasks in the public service, company or organisation to which they belong.

10.5 The Parties undertake to inform each other of any illegal conduct or conduct contrary to the provisions of this document that may be observed during the development of the contractual relationship. In that case, the Parties undertake to work and collaborate with each other to clarify the events that occurred, identify those responsible and settle any liabilities that could arise from said circumstances.

10.6 Any breach of the provisions of this Condition will grant the affected Party the authority to terminate the contractual relationship and, where relevant, demand compensation for damages provided for under the law.

11. Personal data protection

11.1 Information on personal data processing:

The Parties hereby inform the representatives who sign these General Terms and Conditions that their personal data will be processed by each of the Parties in order to maintain their contractual relationships.

The legal basis for processing the data subjects’ data is the need for signing and fulfilling these General Terms and Conditions.

The data to be processed will be retained during the term of these General Terms and Conditions and, where relevant, afterwards to the extent that contact and possible commercial relations are maintained between the Parties. The Parties undertake to communicate the content of this clause to the employees whose personal data may be processed for the purpose of maintaining the contractual relationship, and expressly inform them that they can exercise their rights of access, rectification, erasure, restriction or objection to processing and data portability at any time by writing to either of the Parties. As regards LaLiga Tech, they can do so by emailing the following address: lopd@laliga.es. Likewise, they must be informed that the data subject has the right to file a claim with each Party's Data Protection Officer or with the competent national supervisory authority. In the case of LaLiga Tech, they can do so by emailing dpo@laliga.es.

11.2 In the event that personal data that is the Client's responsibility is processed:

This clause will be applicable in the event that the Service involves LaLiga Tech and/or its subcontractors processing personal data that is the Client's responsibility. In this case, LaLiga Tech will comply with the provisions of the applicable data protection regulations in relation to the personal data it may process under the Contract and its annexes, signed by the Parties. Likewise, LaLiga Tech, acting as the Data Processor of the Client (hereinafter, the “Data Controller”), undertakes to:

1. only process the personal data following the documented instructions received from the Data Controller, indicated in the "Personal data processing" annex attached to the Specific Terms and Conditions, including with regard to transfers of personal data to a third country or an international organisation, unless it is required to do this under regulations that apply to the data processor; in that case, the data processor will inform the data controller of this legal requirement prior to the processing, unless such regulations prohibit this for reasons of substantial public interest;
2. guarantee that it will apply the appropriate technical and organisational measures so that the data is processed in accordance with these General Terms and Conditions and with the requirements of any applicable data protection regulations, and guarantees the protection of the data subject's rights. This provision also extends, where relevant, to sub-data processors subcontracted by the Data Processor to carry out certain processing operations;
3. guarantee that no international data transfer will take place without the Data Controller’s prior written authorisation. The Client authorises LaLiga Tech to carry out the international data transfers identified in the "Subcontractors" Annex to the Specific Terms and Conditions. In all other cases, only transfers that are made with the prior offer of adequate guarantees in line with any applicable data protection regulations will be authorised;
4. guarantee that the persons authorised to process personal data have committed to respecting the confidentiality or are subject to a statutory obligation of confidentiality, as well as to making the documentation proving said obligation available to the Client;
5. guarantee the necessary training on personal data protection for the persons authorised to process the Client's personal data.

The Data Processor undertakes to implement the appropriate technical and organisational measures to guarantee the security of the personal data and data subjects’ rights, taking into account the existing risk. Likewise, the Data Processor will use all the means at its disposal to avoid the alteration, loss, processing or unauthorised access to the personal data, taking into account the state of technology, the nature of the data stored and the risks to which it is exposed, whether from human action or from the physical or natural environment. Without prejudice to the security measures set out in these General Terms and Conditions, the Data Processor will apply the following technical measures as a minimum:

1. where relevant, the pseudonymisation and encryption of the personal data;
2. the ability to guarantee the continuous confidentiality, integrity, availability and resilience of the processing services and systems;
3. the ability to restore availability and access to the personal data quickly in the event of a physical or technical incident;
4. a process of regular verification, evaluation and assessment of the effectiveness of the technical and organisational measures to guarantee the security of the processing.

The Data Processor will allow and contribute to audits being conducted, including inspections, on the personal data processing it carries out, by the Data Controller or third parties contracted by the latter, with a view to determining the adequate compliance with the obligations included in these General Terms and Conditions and current regulations. The audits or inspections may consist of the Data Processor completing the corresponding questionnaire on information security and data protection, the content of which will be previously agreed between the Parties, upon request by the Data Controller with reasonable notice given.

Depending on the results of said questionnaire, the Data Controller and the Data Processor will discuss the hypothetical deficiencies that may have been found and will deal with and address them by mutual agreement based on the risk posed.

In any case, audits and inspections may be conducted as long as they are notified sufficiently in advance, under no circumstances less than one month, except for justified emergencies. They will be limited to the documentation and scope of the service and under no circumstances will they entail an unjustified intrusion on the rights, the normal course of business, the facilities, procedures and/or systems of the Data Processor; the frequency is limited to an annual audit or inspection. The cost of the audits or, where relevant, the inspections conducted will be borne by the Data Controller.

Likewise, the Data Processor will make available to the Data Controller, on request, all the information needed to prove compliance with the obligations set out in these General Terms and Conditions. On the other hand, the Data Processor undertakes to support the Client in carrying out impact assessments related to personal data protection, as well as prior consultations with the supervisory authorities, where relevant.

In the event that the Data Processor suffers any kind of destruction, loss, disclosure, alteration, illegal access or any other kind of security breach that affects the Client's personal data, said incident must be notified to the Data Controller as soon as possible and in any case within a maximum of forty-eight (48) hours from when it became aware of the incident. Said notification must include the following information as a minimum:

1. Description of the nature of the personal data security breach and, where possible, the categories and approximate number of data subjects affected, as well as the categories and approximate number of personal data records affected.
2. Description of the possible negative consequences that could arise from the personal data security breach.
3. Description of the measures adopted or proposed to remedy the personal data security breach, including the measures adopted to mitigate the possible negative effects, if applicable.

Likewise, the Data Processor will undertake to cooperate with the Data Controller in order to identify the causes of the incident and mitigate its possible negative consequences. In the event that the data subjects, whose data is under the Client's responsibility, exercise any of the rights that are recognised under data protection regulations with the Data Processor, the latter must transfer said request to the Data Controller within a maximum of seven (7) working days of receipt of the request. The Client must provide an email address to which these requests should be sent. In general, the Data Processor will undertake to carry out whatever actions are necessary to assist the Client in the due fulfilment of its obligations regarding the attention given to data subjects’ rights.

The Data Processor undertakes to destroy or return the personal data, as well as any media or documents in which personal data under the services appears, once the provision of the services described has finished. The decision to destroy or return both the personal data and any media or documents in which it appears will be made by the Client. In the event that it is chosen to destroy the personal data, the Data Processor must certify to the Client the destruction of the data. Where relevant, the personal data will be returned by the Data Processor in the format and on the media used to store said data originally.

The Data Controller authorises the Data Processor to subcontract to the entities identified in the "Subcontractors" Annex to the Specific Terms and Conditions in which the identity of the subcontractors is indicated, the part of the services they are going to provide and the location where the subcontractors will process the personal data to which it is going to have access, as well as the appropriate guarantees that have been adopted in the event that the contracting involves an international data transfer. The Data Processor will inform the Data Controller of any change planned in the incorporation or substitution of other data processors. The subcontracting will be understood to be authorised if the Client does not express its objection within seven (7) days of the notification of the subcontractor’s identity.

Likewise, when the Data Processor uses another data processor to carry out certain processing activities on behalf of the Data Controller, the same data protection obligations as those stipulated in these General Terms and Conditions will be imposed on the other data processor through a contract, in particular, the provision of sufficient guarantees for the application of the appropriate technical and organisational measures so that the processing is in accordance with the provisions of applicable data protection regulations. If the other data processor breaches its data protection obligations, the Data Processor will remain fully liable to the Data Controller with regard to the fulfilment of the other data processor’s obligations. The Data Controller must:

1. Guarantee that the personal data processed by the Data Processor for the provision of the services has been obtained in a lawful, fair and transparent manner, and that only the data that is strictly necessary for the provision of the services will be processed, also adopting the technical and organisational measures that are required to guarantee the security of the same.
2. When appropriate, carry out an impact assessment on the personal data protection in the processing operations to be carried out by the Data Processor.
3. Make the corresponding prior consultations.
4. Not allow access to special personal data categories or data with a high level of criticality that may require impact assessments on the data protection, unless the provision of the services requires it, in which case it must be transferred to the Data Processor in advance to coordinate support for said assessments.
5. Ensure, in advance and throughout the processing, that the Data Processor complies with data protection regulations.

Both Parties undertake to comply with any other obligations that have not been expressly established in these General Terms and Conditions, and that are applicable to each of them in relation to the data protection regulations in force at any given time.

12. Information security

The Service will be provided guaranteeing the confidentiality, integrity, availability, authenticity and traceability of the Client's information to which LaLiga Tech has access due to the provision of the Services, and at all times in compliance with applicable regulatory and legal requirements.

12.1 In the event that Confidential Information is processed:

LaLiga Tech has an Information Security Officer and an Information Security Office to respond to issues regarding the security of the Service or the security controls implemented. Whenever Client information that is not public knowledge or in the public domain is processed, it will be considered to be confidential, in which case LaLiga Tech will follow, respect and comply with the following security controls as a minimum:

1. Security in human resources: All professionals on behalf of LaLiga Tech who are involved in the provision of the Service will know and comply with the confidentiality clauses established.
   Likewise, they will be made aware of information security and trained in the security controls relating to the provision of the service, as well as being aware of the associated risks and compliance with their responsibilities and roles in this respect.
2. Asset management: LaLiga Tech will identify and update the inventory of assets associated with the provision of the service.
   LaLiga Tech will, if requested, securely return and delete all the service information in its possession when it is no longer necessary for the provision of the service or due to regulatory and/or legal requirements.
3. Access control: For the provision of the service, LaLiga Tech will guarantee that it has control mechanisms in the identification, authentication and authorisation of access to the Client's information and the systems that process it, based on the principles of need to know and need to use.
4. Cryptography: LaLiga Tech will ensure the appropriate and effective use of data encryption whenever necessary to protect the confidentiality, authenticity and integrity of the service information.
5. Physical and environmental security: LaLiga Tech will adopt the appropriate physical and environmental security measures provided that they are at its disposal to prevent unauthorised physical access, theft or damage to the Client’s information.
6. Operational security: LaLiga Tech will guarantee that the information systems and IT equipment under its responsibility that are required for the provision of the service are operated securely, preventing the risk of malware, unauthorised access or software vulnerabilities.
   Likewise, it will make backups of the information required for the provision of the service, as well as the systems that process it, to guarantee restoration in the event of data loss or unavailability of the service.
7. Security in communications: LaLiga Tech will protect the information required for the provision of the service, guaranteeing its confidentiality, integrity and authenticity, when using communication networks and when it is shared with third parties in order to provide the service.
8. Incident management: LaLiga Tech has an information security incident management procedure that will guarantee adequate capacity to detect and respond to security incidents that affect the provision of the service.
   It will also notify the Client proactively and without delay about any security incidents that it suffers and that may directly or indirectly affect the provision of the service and will provide, if requested, all the associated evidence, events and logs it has available.
9. Third parties and supply chain: LaLiga Tech will convey and enforce, within its means, the above requirements, as well as the associated security controls that may be necessary, for the supply chain and the providers it relies on for the provision of the service.

12.2 In the event that software is developed or provided:

When the provision of the Service involves the development or provision of software, LaLiga Tech will carry it out based on a Secure Software Development Life Cycle model (S-SDLC).

In addition, it will comply with the Secure Software Procedure defined by LaLiga Tech, which imposes a series of minimum security requirements and security audits to detect software vulnerabilities. If serious vulnerabilities are detected in the software, they will be corrected by LaLiga Tech diligently, providing mitigating measures in the meantime in the case of software that is already in production.

12.3 In case of payment card data processing:

When the provision of the Service entails the obligation to be adapted or to adapt to the Payment Card Industry Data Security Standard (PCI-DSS), LaLiga Tech will comply with the requirements set by the PCI-DSS standard.

13. Notifications

All notifications, demands, communications, requests, withdrawals or any other communications that can or should be made in accordance with these General Terms and Conditions will be duly made in writing or in any other way that allows due receipt to be recorded.

Such notifications will be sent to the addresses indicated in the preamble to these General Terms and Conditions or to any new addresses that may be notified by the Parties.

14. Validity and amendment to the Terms and Conditions

These General Terms and Conditions will apply for all the Specific Terms and Conditions signed by the Client.

With a view to maintaining flexibility in its commercial relationships, LaLiga Tech may change the terms of these General Terms and Conditions through written notification to the Client at least three (3) months in advance. However, these changes will not be retroactive and will take effect on the date specified by LaLiga Tech in the notification; they will only apply to new contracted Services or renewals that are in place and do not expire.

The Client will accept the application of said changes if:

1. it requests a new Service after the specified effective date;
2. it allows a renewal after receipt of the notification of the change, or
3. it does not request the termination of the Services that are in place and that do not expire before the effective date of the change.

For any other change to the General Terms and Conditions to be valid, it must be duly signed by both Parties.

15. Miscellaneous

15.1 Representations and warranties

Both Parties will be responsible and liable for:

1. The veracity of the data and information provided in these General Terms and Conditions.
2. The quality and appropriate provision of the Services in accordance with the description included in the Specific Terms and Conditions and these General Terms and Conditions.
3. The appropriate conduct of their staff, especially as respects the confidentiality of the information to which they have access.
4. The appropriate safekeeping and processing of data and information to which their staff have access while performing their duties.

15.2 Advertising

The Client authorizes LaLiga Tech to share the progress and improvements obtained thanks to the marketing management and consultancy work provided by LaLiga Tech through the preparation of a “Success Story” document that, with the Client's prior approval, will be shared in forums and meetings as part of the Client's technology partner agreement with LaLiga Tech.

15.3 Single Agreement

The General Terms and Conditions, together with the Specific Terms and Conditions of the Services, constitute the only agreement existing between the Parties and regulate all their rights and obligations in relation to the subject matter thereof. Any other prior agreement, where relevant, including contracts, offers or any other kind of verbal or written communication between the Parties is hereby annulled and, therefore, is without any legal effect whatsoever.

15.4 Invalidity

The invalidity of one or more provisions of the Terms and Conditions established herein or of any instrument granted in connection with the same will not affect the other clauses of the General Terms and Conditions, which will apply as long as they are valid in accordance with the law.

15.5 Waiver of rights

The lack of total or partial exercise by either of the Parties of any rights or actions, including the termination of the General Terms and Conditions, may not be interpreted as a waiver by said Party of their right to exercise the right or action in question. Neither will the requirement by the Party to comply with the provisions of the General Terms and Conditions.

15.6 Force majeure

Neither Party is required to comply with the Contract, nor will it be liable to the other Party for damages that may have been caused to the latter, when an inability to comply is due to force majeure. Force majeure will be understood to mean any unforeseeable event, or an event that is foreseen but is unavoidable, that prevents the provision of the contracted Services, which will be notified to the Client the day after the lack of service occurs.

16. Law and jurisdiction

These General Terms and Conditions will be subject to Spanish Legislation. In the event of any disputes arising from the interpretation or execution thereof, the Parties will try to find an amicable solution. If this is not achieved, the Parties agree to submit to the jurisdiction of the Courts of Madrid Capital and expressly waive their own jurisdictions, if any, for any actions or claims that could arise from this Contract.

Nothing included in the preceding clause will limit LaLiga Tech's right to take action against the Client in any other competent court.

In witness whereof, each of the Contracting Parties acknowledges and agrees that these General Terms and Conditions are conditional upon the terms and conditions included in the Specific Terms and Conditions signed for this purpose and in the annexes and/or appendices incorporated into this on signing or at a later date, the Parties sign that document in identical counterparts for one purpose.