Privacy Notice (legal term)

PRIVACY NOTICE - Flamengo


a) INTRODUCTION

In accordance with your rights and the guidelines of Law No. 13.709/2018, the General Data Protection Law, we present our Privacy Notice, a publication that explains how FLAMENGO uses personal data and seeks to guarantee the privacy and protection of data under its responsibility, in accordance with Brazilian law and in line with some of the main international laws and regulations.

First of all, we have provided a frequently asked questions (FAQ) section below.


b) FAQ

LGPD | PERSONAL DATA | SENSITIVE DATA | DATA SUBJECTS | RIGHTS | DPO | SERVICE CHANNEL | CHANNEL EXCLUSIONS | DEADLINES | SECURITY [Ld1.1]


What is LGPD?

The General Data Protection Law (Law No. 13.709/2018), known as LGPD, exists to protect the fundamental rights of freedom and privacy of individuals regarding their personal data and the free development of their personality.


What qualifies as personal data?

According to the LGPD (Brazilian General Data Protection Law), any information or set of personal data that allows a person to be identified is PERSONAL DATA (name, CPF [Brazilian taxpayer ID], RG [Brazilian national ID], registration number + company where they work / school where they study, registration number in a football club, health plan or professional association, medical record, photograph, audio, video, etc.).


What is sensitive personal data?

Personal data related to specific issues defined by the LGPD (Brazilian General Data Protection Law) includes: data identifying racial, ethnic, or religious origin, political affiliation, union membership, participation in religious, philosophical, or political-party organizations, and data concerning health, sex life, genetics, or biometrics. The LGPD has special guidelines for this data.


What is the concept of "personal data subjects"? 

Any person, individual, human being, natural person, individual. By law, the data subject is the sole holder of rights over their personal data. These rights are described and provided for in the LGPD (Brazilian General Data Protection Law) and can be seen below.


What are the rights of data subjects? 

Accessing the organization through a customer service channel and making requests to: confirm if data processing exists and what types of data are processed, access the data available to the organization, request correction, deletion, anonymization, portability, information about the sharing of your data, and revoke previously granted consents.


What is a DPO (Data Protection Officer), or in Portuguese, Encarregado de Dados Pessoais?

According to the LGPD (Brazilian General Data Protection Law), it is responsible for communication between organizations – in this case, FLAMENGO – and the data subject – in this case, you – other organizations, and competent bodies of the Public Administration, whose contact relationship involves privacy and the protection of personal data.


What is a data subject support channel?

It is a means by which all organizations located within the national territory must receive requests from data subjects who wish to exercise their rights under the LGPD (Brazilian General Data Protection Law). In the case of FLAMENGO, the data subject service channel is called the DATA SUBJECT PORTAL.

To submit a request through the PORTAL, you must be over 18 years of age. A request can be opened at any time. If it is on behalf of a minor, the legal guardian representing the minor will open the request. For all requests, we will need to request documentation proving the identity of the applicants and, when applicable, proof of their legal responsibility if a minor is involved as the data subject.


What services are not offered on the DATA SUBJECT PORTAL?

Any request that does not relate to the exercise of the rights of data subjects described herein, under the terms of the LGPD (Brazilian General Data Protection Law). In these cases, please contact the customer service channel provided by your contact area with the Club or, as a second option, contact the Ombudsman's Office via email: ouvidoria@flamengo.com.br.


What is the timeframe for receiving a response to my request? 

Our estimated response time to the initial contact is up to 15 (fifteen) days, in accordance with the LGPD (Brazilian General Data Protection Law). The request, its progress, and the response can be viewed in your access to the PORTAL.


How can I protect myself from safety?

It is important to note that your login and password – or those of your dependents – on our PORTAL or other systems are personal and non-transferable. Do not provide this information to other people, even close relatives, if they are not authorized to make requests on your behalf. FLAMENGO will not provide your information to third parties who are not formally authorized by you and will not be responsible for sharing carried out by data subjects or by third parties who have access to the data subject's data, when the data subject himself is the author of the sharing. Try to change your password periodically and, if you suspect that someone unauthorized has gained access to your login and password, change your password immediately and notify us through the DATA SUBJECT PORTAL.   


c) PRIVACY NOTICE

INTRODUCTION | SUMMARY TABLE | FLAMENGO AS A DATA PROCESSING AGENT | DATA SUBJECT RIGHTS | DATA ORIGIN | DATA PROCESSED | PURPOSES AND HYPOTHESES | SHARING | COOKIES | SECURITY MEASURES | INTERNATIONAL TRANSFER | PRIVACY AREA | UPDATES | CONTACTS | LEGISLATION AND JURISDICTION [Ld2.1]

INTRODUCTION

CLUBE DE REGATAS DO FLAMENGO, a professional sports entity registered with the CNPJ under number 33.648.575/0001-99, headquartered in Rio de Janeiro/RJ, hereinafter simply referred to as "FLAMENGO", deems it relevant to inform you about the processing of personal data carried out by the CLUB through this PRIVACY NOTICE, which highlights all the necessary, pertinent and relevant information for personal data subjects, in accordance with Law 13.709/2018, the General Data Protection Law, in the SUMMARY TABLE.

SUMMARY TABLE
Flamengo's role as the applicable data processing agent in this notice -  CONTROLLER

RIGHTS OF THE POSSESSOR AND HOW TO EXERCISE RIGHTS AT FLAMENGO
By law, you have the right, at any time, to:
To have information about what data we collect from you;
Change and correct your data;
To deny or revoke previously given consent to the processing of your data. Please note that this measure may make it impossible to offer some of the services we currently provide to you, depending on the request.
You may request anonymization, blocking, or deletion of your data if you do not want your personal data to be exposed in any way. This is possible as long as there is no law or regulation that prevents us from doing so. 
Furthermore, exclusion may make it impossible to provide the service, depending on the request.
Request data portability to another club. We never expect you to change teams. But, if that ever happens, we will fulfill our part of the agreement!
Become aware of the partners and third parties with whom FLAMENGO shares your data.
Fulfilling all your rights is our commitment to FLAMENGO and in accordance with the LGPD (Brazilian General Data Protection Law). As part of this commitment, we provide below the communication channel that FLAMENGO has for its data subjects: the DATA SUBJECT PORTAL. Through the PORTAL, you can open your requests and exercise any of your rights listed above, in direct contact with the Club's Data Protection Officer, who will then respond to your requests.
On Flamengo's main website: https://flamengo.com.br/privacidade, click on "Portal do Titular" (Owner's Portal).
Through the Fan Club website: https://nacao.flamengo.com.br/aviso-de-privacidade, click on "Member Portal".
We've provided a QR code for immediate access via your mobile device. 




ORIGIN OF PERSONAL DATA ENTRY AT FLAMENGO
Personal data is generally provided by individuals who become Club members, fan club members, affiliates, store or TV customers, employees, suppliers, service providers, journalists, or visitors to the Club headquarters or Museum.

Personal data commonly processed by Flamengo
In general, we have the following information: name, CPF/RG/foreigner identification, date of birth, gender, telephone number, email address, address, bank or credit card details – for payment processing, signature – when applicable, photo, photo of identity card and facial biometrics, when there is a need to confirm ownership in order to provide services to the data subject, sell tickets securely to the buyer and enable access to the Maracanã stadium or the Club, Technical Center or other FLAMENGO facilities, or in the case of ticket purchases for the Maracanã – when the sale is made by FLAMENGO. 
For employees and third-party contractors located at FLAMENGO facilities, in addition to the data already described, we also collect their work permit, PIS/PASEP number, dependent information, pre-employment, periodic and termination medical examinations, medical certificates, and we may also request medical reports (for people with disabilities, work-related accidents, etc.). 
In the acquisition of goods and services, we may occasionally request contact or asset information from partners of bidding companies, in addition to commonly obtaining contact information from representatives in bidding processes (name, phone number, position, and email), a standard practice in Purchasing transactions.

PURPOSES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
Due to the nature of Flamengo's operations, the purposes for processing personal data are diverse. The main purposes, primarily necessary to enable Flamengo's operation as an organization, are described below:
Employees: hiring, periodic medical examinations, transfers, promotions, salary payments, technical/legal verification, accountability to the Public Administration. Legal basis applicable: compliance with legal or regulatory obligations (CLT, PCD, NRs, PCMSO, e-Social, Civil Code, etc.);
Third parties assigned to the facilities: registration of third parties assigned for the management and control of contracts, outsourced labor, security and access control to the facilities, compliance with technical and operational standards, and compliance with labor regulations. Applicable legal hypotheses: execution of a contract or preliminary procedures and/or compliance with a legal or regulatory obligation (CLT, PCMSO, various NR standards, Civil Code, etc.).
Club Members / Fan Members: admission of membership contract, membership registration for card issuance, payment and billing control, invoice issuance, controllership, attendance control at facilities or sporting events, space rental management, granting of benefits to members, and confirmation of ownership of applicants or ticket buyers. Applicable legal hypotheses: execution of contract or preliminary procedures. Compliance with legal or regulatory obligation (General Sports Law, in the case of games at the Maracanã stadium).
Public Visitors - Club Headquarters, Technical Center, Museum, etc.: control of entry and exit of people in the facilities who arrive punctually for professional or recreational activities, possible registration for receiving purchased products or services, offers or news – if of interest to the visitor – and confirmation of ownership of applicants or ticket buyers. Applicable legal hypotheses: execution of a contract or preliminary procedures, protection of life (emergency access for health professionals), consent (holiday camp, visiting schools, etc.) and/or compliance with a legal or regulatory obligation (court officer, legal protocol, etc.).

SHARING DATA WITH THIRD PARTIES
We do not rent, sell, or share personal data without the knowledge and prior authorization of the data subject. If you have any questions about any authorization you have provided, access the DATA SUBJECT PORTAL and request clarification. In general, personal data sharing occurs with various commercial partners who sponsor, are licensed by FLAMENGO, and/or provide services in FLAMENGO's operations, whether at the headquarters, technical centers, or the Maracanã stadium. As these partners change regularly – and within a few months, given that the validity of these contracts is not coincident – ​​we cite some examples and remind you that through the DATA SUBJECT PORTAL, you can find out about our current partners: just open a ticket!
Tickets: Flamengo contracts the services of a ticketing company that handles ticket sales for Flamengo. In 2025, we began a partnership with FUTEBOL CARD. Therefore, the data of ticket buyers is shared with this partner; including that of club members.
Facial Biometrics: the registration and safeguarding of facial biometrics used for ticket purchase and access to the Maracanã stadium are handled by another partner, a specialist in this type of service. Until March 2025, BE PASS is the partner responsible for this service for FLAMENGO.
Professional Football Sponsors: In August 2025, FLAMENGO announced Betano, which joined the group of sponsors, including Adidas, Shoppe, BRB, Assist Card, Brahma, Zé Delivery, sócios.com, Texaco, Rede D'Or, Shell, Estácio, Vale, Ortobom, Betano, Wap, Axia Energia, Advanced Recovery, and Hapvida. Depending on the type of sponsorship, the database and commercial or business transactions involving campaigns, products, and services included in the agreements need to be shared for contract execution, accountability, revenue accounting, and other reasons related to the sponsorship agreement. 
NOTE: Flamengo's partner organizations are aware of and committed to respecting the Club's data protection and privacy, in accordance with this document and our internal guidelines, as stipulated by the LGPD (Brazilian General Data Protection Law) or other related national or international regulations, depending on the applicable law.

Cookies
Flamengo uses cookies to facilitate navigation, adapt pages to your interests and needs, and compile information about the use of our websites and services, to speed up future user activities and experiences on our pages, and to indicate Flamengo pages on websites that the user has visited. Flamengo may share this information with third parties and business partners. 
You can (and should) choose which types of cookies can be used, among those that are not essential for browsing. See the difference between them:
Essential (necessary): These help us understand how visitors interact with FLAMENGO's pages, providing information about the areas visited, the time spent on the site, and any problems encountered, such as error messages.
Functional features: allow Flamengo's pages to remember your choices in order to provide a more personalized experience. In addition, they enable users to watch videos and utilize social tools, comment sections, forums, and more.
Analytical and/or performance metrics: These provide statistical information about our website – they are used to measure and improve performance. This category is also known as Analytics. Activities such as page visit count, page load speed, bounce rate, and technologies used to access our website are included in this category.
NOTE: 
FLAMENGO stores a cookie on your device to remember your choice for the next session, and the user may revoke their consent to cookies whenever they deem it appropriate. Warning: if the user does not accept some cookies from FLAMENGO pages, certain services may not function optimally. Third-party analytics are used to track and measure website usage so that we can continue to produce engaging content. These cookies may track things like how long you spend on the site or the pages you visit, which helps us understand how we can improve the sites for you. Periodically, new features are tested and subtle changes are made to the way the site presents itself. And these cookies may be used to ensure you receive a consistent experience while browsing, while FLAMENGO understands which optimizations our users appreciate most.

security and administrative measures adopted
Flamengo adopts technical and administrative measures to prevent privacy incidents and demands the same practice from its partners. It has a dedicated area within its organization, invests in training and awareness, and invests in security resources. Any information about a data subject will be collected and stored in accordance with market-recommended security standards and will not be publicly available, provided, or sold under any circumstances. Unless there is a legal or judicial order or prior authorization from the data subject, personal data will not be transferred or used for purposes other than those that Flamengo previously communicates to the data subject and obtains their consent for.

international transfer 
The transfer of personal data to other countries may only be carried out by FLAMENGO if the procedure meets the requirements of Article 33 of the LGPD (Brazilian General Data Protection Law), especially its first paragraph, which states that the country or territory in question or the international organization in question ensures an adequate level of protection for the user's data. Otherwise, if there is a real need, FLAMENGO will make every effort to protect the data with the utmost rigor, using contractual clauses, global standards or regularly issued seals, certificates and codes of conduct.
We use several service providers, such as AWS, Google, and Microsoft, that maintain their data centers outside of Brazil, but we prioritize using them in countries that have privacy agreements with Brazil or specific legislation regarding privacy and data protection.

Flamengo's data protection officer (DPO)
The Data Protection Officer, or simply DPO, of Clube de Regatas do Flamengo is represented by the external law firm TERRA ROCHA ADVOGADOS, where Dr. WILLIAM LIMA ROCHA, registered with the OAB/RJ under number 75.214, is designated for the role. He can be contacted by opening a ticket on the USER PORTAL.
Your direct contact email is privacidade@flamengo.com.br. However, please note that if you wish to exercise the rights provided for in the Law, the correct service channel is the Member Portal. Through this direct email, they can respond to the member on matters directly related to the Law, but which are not related to the exercise of rights – those that require opening a support ticket on the Member Portal. For Club operations, such as registration, ticket purchases, payment slips, membership cards, etc., we ask that the member seek access to the communication channel of the area that provides the service to the member.

legislation and jurisdiction
This Privacy Notice is governed, interpreted and enforced in accordance with the laws of the Federative Republic of Brazil, especially Law No. 13.709/2018 – General Data Protection Law, regardless of the laws of other states or countries, and the courts of the capital city of Rio de Janeiro shall have exclusive jurisdiction to resolve any dispute arising from this document.
Rio de Janeiro, June 2026.