In line with our commitment to security and privacy, we inform you that the Royal Spanish Golf Federation (RFEG) has become aware of a vulnerability in an information system that contained data included in the registration forms of federated members.

As soon as the data breach was discovered, the RFEG activated all security protocols. Our IT department immediately analyzed the vulnerability, resolved it, prevented access, and investigated whether any unauthorized access to personal data had occurred.

On March 24, 2026, it was confirmed that between March 20 and 23, 2026, there was unauthorized access to personal data of members, which affected basic, identification, contact, location and banking data (but not means of payment).

Following a thorough investigation and a technical audit, we have verified that access was only granted to the person who collaborated with the RFEG to identify and resolve the vulnerability, and there is no evidence that the data has been copied, disseminated, or used for purposes other than those of said collaboration, nor communicated to third parties.

Therefore, based on the information available to date, we have no evidence that this breach has had a negative impact on your rights and freedoms, and we do not consider such an impact likely. However, given that some risks, such as misuse of data, phishing attempts, or spam, can never be completely ruled out, we immediately reported the breach to the Spanish Data Protection Agency (AEPD), published this notice on the RFEG website, and, finally, contacted those affected individually for whom we have contact information.

This communication is therefore issued as a preventative measure, so that you may take any steps you deem appropriate. In particular, we recommend that you pay close attention to any suspicious communications or unusual requests you receive by email or telephone. We would also like to remind you that the RFEG will never request your personal data via email, SMS, messaging services, or telephone.

We have reinforced security protocols and are monitoring all possible access points to RFEG applications and web portals, and we will promptly inform you if there are any significant developments in this matter.

We sincerely apologize for any inconvenience this situation may cause. In any case, if you have any questions about this matter or wish to report any irregularities or suspicions you may detect, you can contact our Data Protection Officer (DPO) by email at lopd@rfegolf.es or by phone at +34 91 555 26 82.

ROYAL SPANISH GOLF FEDERATION