Privacy Policy

Scope of Application

This Master Privacy Policy (hereinafter, "This Policy") describes how the Company handles the information and personal data you have provided to us, allowing us to effectively manage the relationship you maintain with Us.

This Policy applies to Our websites, applications, products, and/or services that link to This Policy or do not have an independent privacy policy (hereinafter, Our services). This Privacy Policy aims to give you a better understanding of the data we collect, why we collect it, how we process it, the entities with which we share such personal data, your rights regarding the collection, processing, and sharing of such data, and any other relevant privacy and security issues.

All personal data you provide to us or already in our possession will be processed in accordance with This Privacy Policy and as set out herein. All information will be provided through any of the Company's websites ("The Website"), designated phone numbers, or any other means that the Company makes available to you from time to time.

By reading This Policy, you understand and acknowledge that your personal data may be processed as set out in this policy. If you do not agree with the terms of This Privacy Policy, please do not use the Website or otherwise provide Your Personal Data to us.

Any reference in This Policy to "The Company," "We," "Us," or "Our" refers to the Data Controller, namely, UNOCAPALI LA PAZ OPERADORA S.A. DE C.V., located at Boulevard Lázaro Cárdenas No. 674, Interior 4, Colonia Jardines del Lago, Mexicali, Baja California.

All processing of Personal Data by the Company as provided in this Privacy Policy will be carried out in accordance with:

• The Federal Law on the Protection of Personal Data Held by Private Parties and its Regulations (hereinafter, the "DPA"), as well as any subsidiary legislation enacted under the DPA that may be amended from time to time.

The Company determines the means and purposes of the processing of Personal Data and thus acts as the "Data Controller" under applicable Data Protection Laws.

Definitions

Data controller

"The Data Controller" is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Mexican law, the data controller or the specific criteria for its nomination may be provided for by Mexican law.

Data processor

"The Data Processor" means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller.

Personal data

"Personal Data" means any information that identifies you individually or relates to an identified or identifiable natural person who may also be defined as a data subject.

Security

The Company has adopted a secure communication protocol over the Internet, TLS 1.2, used to implement protected remittances. This protocol involves the encryption of Your Personal Data during transmission over the Internet. Additionally, the Company digitally stores Your Personal Data on encrypted hard drives, providing an additional guarantee of the security of personal data.

Our services are registered with site identification authorities so that your browser can confirm Our identity before any personally identifiable information is sent. Additionally, our secure servers protect this information using advanced firewall technology.

Protection of Personal Data

The Personal Data we hold is protected using the most stringent security processes and systems in the industry. Our commitment to protecting Personal Data extends not only to quality and high standards but also to the best and most effective law enforcement application. We are obligated to process Personal Data only if such processing is based on a genuine and legitimate reason for doing so based on one of the legal grounds established in the DPA.

Processing based on our legitimate interests

A legitimate interest exists when we have a business or commercial reason for processing Personal Data. In such a case, we are committed to protecting all and every one of Your Personal Data and the way such data is processed, as well as ensuring that such processing is not unfair to you or Your Interests.

When we decide to process Your Personal Data based on a legitimate interest, we will inform you, explain what those legitimate interests are, and provide a process through which you can raise any questions and/or objections you may have regarding such processing. It is important to note that the Company is not required to stop processing if the reasons for such processing outweigh your right to object. An example of this may be if we need to process Your Data to comply with anti-money laundering purposes.

Processing based on your consent

All personal data will be processed with your consent unless there is an exception to this requirement established by applicable legislation. When we process Your Personal Data based on Your consent, you have the right to withdraw your consent at any time in the same manner as it was previously provided. If you exercise your right to withdraw consent, we will determine whether we can (or are required to) process your personal data on any other legal basis other than consent. If so, we will notify you. Such withdrawal of your consent will not invalidate the processing operations carried out before you withdrew your consent.

Data retention policy

All and any personal data held by the Company will be protected to the best extent possible and will only be used for purposes consistent with applicable Data Protection Laws, as well as any other applicable laws. The Company will retain your personal data only for as long as necessary (taking into account the purpose for which it was originally obtained). The criteria we use to determine what is "necessary" will depend on the specific Personal Data in question and the specific relationship we have with you (including its duration).

7.1 Generally, Our usual practice is to determine whether there are any specific laws in Mexico (e.g., tax or corporate laws) that permit or even require us to retain certain Personal Data for a certain period (in which case we will retain the Personal Data for the maximum period indicated by such law). For example, data used to comply with our anti-money laundering obligations must be retained for five (5) years.

We would also need to determine if there are any laws and/or contractual provisions that may be invoked against Us by you and/or third parties and, if so, what the limitation periods for such actions are. In this latter case, we will retain any relevant Personal Data that we may need to defend ourselves against any claims, disputes, or other such actions by you and/or third parties for as long as necessary.

When we no longer need your Personal Data, we will securely delete or anonymize it.

7.2 Failure to provide your Personal Data may prevent the Company from fulfilling its legal and regulatory obligations, meeting its contractual obligations, and providing and/or performing the necessary services to manage and maintain your account satisfactorily. Therefore, the failure to provide the necessary personal data may result in the Company being unable to provide certain products and/or services to you.

Personal data we collect, purpose of processing, legal basis for processing

The following table describes the categories of personal data we process, the purpose for which we process such data, as well as the corresponding legal basis used for such processing. It is pertinent to know that the same categories of personal data may be processed for different purposes and thus based on various legal grounds simultaneously, depending on the purpose of the processing.

The Company may also collect Personal Data from publicly accessible sources, such as Internet searches, company records, and media, provided it is reasonable to do so and such conduct does not harm your rights and freedoms.

8.1 Some of Your Data will also be used to conduct checks that help complete the profiling of your account. Profiling is a procedure that includes any form of automated processing of personal data necessary to comply with anti-money laundering directives and to prevent any other fraudulent activity using your personal data. For example, tax evasion or suspicious betting patterns.

No automated decision-making will be done for marketing purposes. Some examples of data that the system automatically checks are the IP address or necessary PEP checks. The email address is also verified; however, you will receive an email to confirm your email address.

Processing based on consent

To avoid any doubt, we would like to point out that in those limited cases where we cannot or decide not to rely on another legal basis (e.g., Our legitimate interests), we will process Your Personal Data based on Your consent.

In those cases where we process based on Your consent (which we will never assume but will have obtained clearly and expressly from you), YOU HAVE THE RIGHT TO WITHDRAW YOUR CONSENT AT ANY TIME, in the same way, you gave it to us.

If you exercise your right to withdraw your consent at any time (by writing to us at the physical or email address provided below), we will determine whether at that point there is an alternative legal basis for processing Your Personal Data (e.g., based on a legal obligation we are subject to) where we would be legally authorized (or even required) to process Your Personal Data without your consent, and if so, we will notify you.

When we request such Personal Data, you may always refuse; however, if you refuse to provide us with the necessary data we need to provide you with the requested services, we may not be able to provide you with such services (especially if consent is the only legal basis we have).

Just to clarify, consent is not the only basis that allows us to process Your Personal Data. In the last section above, we have outlined the various reasons we rely on to process Your Personal Data for specific purposes.

Other purposes

We may be required to use and retain personal information for; loss prevention; and to protect Our rights, privacy, safety, or property, or those of others in accordance with Our legitimate interests.

Authorized disclosure of personal data to third parties

Notwithstanding any other provision contained in this Privacy Policy, personal data about you may be shared with authorized third parties or any relevant competent authorities located within or outside of Mexico when such disclosures are permitted or required in accordance with Data Protection Laws and/or any other applicable legislation.

These authorized third parties may include, among others, entities of the Company, other third parties, and organizations such as law enforcement agencies, accounting and auditing partner companies, regulators, competent authorities, and digital marketing providers. We may also share such personal data with organizations that have introduced you to us, third parties you have asked or allowed us to share your data with, or any other third party we necessarily need to share your personal data with in order to provide you with the products and/or services you have requested. The personal data shared will depend on the product(s) and/or service(s) you decide to use.

When any of these personal data needs to be transferred outside of Mexico, we ensure that all necessary and appropriate safeguards are applied. We may also disclose personal information to other companies within affiliated or subsidiary companies, business partners, or successors in title to Our business. The following details how data transfer outside of Mexico is managed. Your Personal Data will never be shared with third parties for their marketing purposes (unless you consent to it).

Marketing

We will use Your Personal Data, such as your name, address, email address, phone number, etc., collected by us and/or through our external subcontractors to provide you with promotional material through various marketing techniques such as direct mail, telephone marketing, SMS, and postal mail in connection with the Service, as well as products, services, websites, and applications that may be of interest to you, including the administration of contests, promotions, surveys, or other site-related functions concerning: (i) other companies in the Company's group; or (ii) the Company's business partners and affiliates (collectively: "Marketing Affiliates"), which we believe may interest you.

We may also share and disclose Personal Information with our Marketing Affiliates to provide you with different marketing offers that we, or our Marketing Affiliates, believe are relevant to you. Our Marketing Affiliates may use this Personal Information for different marketing techniques, such as direct mail, postal mail, telephone SMS for marketing purposes.

We will use your Personal Information to provide you with promotional materials only when we have a legitimate interest in doing so, or when we have obtained your affirmative consent.

You may opt out at any time from receiving new marketing offers from us or our business partners and marketing affiliates by: following the links inserted in the promotional emails (e.g., selecting the opt-out link), contacting our customer service at the email address soporte@campobet.mx . Please note that even if you unsubscribe from our marketing mailing list, we may still send you service-related updates and notifications.

Our direct marketing list may be operated by software and servers located abroad, and your Personal Information may be sent abroad as part of our marketing.

Sharing personal data with other categories of recipients

Relevant data will also be disclosed or shared as appropriate (and in all cases in line with Data Protection Laws) to/with Company members and staff, to/with other Company entities (e.g., in compliance with legal obligations), and/or to/with affiliated entities and/or subcontractors established within Mexico if relevant to any of the purposes listed in this Privacy Policy (including to/with Our service providers who facilitate the Site's functionality and/or any service you may require). Personal information will only be shared by Us to provide the services you request or for any other legal reason (including authorized disclosures that do not require your consent).

Any such authorized disclosure will be made in accordance with Data Protection Laws (e.g., all Our processors are contractually bound by the requirements of such Data Protection Laws, including the strict obligation to keep any information they receive confidential and to ensure that their employees/staff are also subject to similar obligations). Such service providers (Our processors) are also bound by a series of other obligations under the DPA.

Your Personal Data will never be shared with third parties for their marketing purposes (unless you consent to it).

Internet communications

You are aware that data sent over the Internet may be transmitted across international borders, even when the sender and recipient of the information are in the same country. We are not responsible for anything you or a third party do or omit to do in relation to Personal Data before we receive it, including but not limited to transfers of Personal Data from you to us through a country with a lower data protection level than that in force in Mexico, and by any technological means (e.g., WhatsApp, Skype, Dropbox, etc.).

Additionally, we will not accept any responsibility for the security of Your data while it is in transit over the Internet unless Our liability is explicitly derived from a law in force in Mexico.

Accuracy of personal data

All reasonable efforts are made to keep the Personal Data we may hold about you updated and as accurate as possible. You can check the information we hold about you at any time by contacting us as explained below. If you find any inaccuracies, we will correct them and, if necessary, delete them. Please see below for a detailed list of Your legal rights under any applicable data protection law.

Links to third-party sites

The links we provide to third-party websites are clearly marked, and we are not responsible in any way (nor can we be deemed to endorse in any way) the content of such websites (including the applicable privacy policies or data processing operations of any kind). We suggest you read the privacy policies of such third-party websites.

Data transfer outside the EEA

Your personal data will only be transferred outside of Mexico and the EEA or to any other non-EEA country that the European Commission has deemed to provide an adequate level of protection (also referred to as "whitelisted countries" - listed here https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) in the following circumstances: when you have expressly consented to it; when it is necessary to form or execute a contract between you and the Company; or to comply with and adhere to any and all legal obligations or duties.

If personal data is transferred outside of Mexico and the EEA, within the Company or to any of the Company's business partners, we ensure that all necessary safeguards are implemented to ensure the same level of protection and the same standards that would apply within the EEA. You have the right to receive a copy of such safeguards by contacting Us at dpo@soft2bet.com.

Contracts containing the EU Standard Contractual Clauses (EU Model Clauses) will be used, which require the entity receiving personal data to apply the same standards as would be applicable within the EEA. If data is transferred to the U.S. and the receiving entity is registered with the Privacy Shield (a framework that ensures the protection of personal data), it will be considered that the level of protection is the same as that approved by the European Commission.

Rights of the data subject

The Company is committed to assisting you in the best possible way if you decide to exercise any of your rights concerning Your Personal Data. In certain cases, we may need to verify your identity before we can accommodate your request to exercise any relevant right. You hold the following ARCO rights under the DPA, as well as the others described herein.

18.1 Right of Access

You have the right to ask us whether we are processing any personal data concerning you and, if so, you will have the right to access such personal data, as well as the following information:

• What personal data we have,
• Why we process it,
• To whom we disclose it,
• How long we plan to retain it (where possible),
• If we transfer it abroad and the safeguards we take to protect it,
• What your rights are,
• How you can file a complaint,
• Where we obtained your personal data, and
• Whether we have carried out any automated decision-making (including profiling) as well as related information.

18.2 Right to rectification

You have the right to request that we rectify and/or complete any inaccurate or incomplete personal data concerning you.

18.3 Right to Erasure (the "Right to be Forgotten")

You have the right to ask us to erase your personal data, and we will comply without undue delay when:

• The Personal Data is no longer necessary for the purposes for which it was collected; or you have withdrawn your consent (in those cases where we process based on your consent) and we have no other legal grounds to process Your Personal Data; or
• you have successfully exercised Your right to object (as explained below); or
• Your Personal Data has been unlawfully processed; or
• There is a legal obligation to which we are subject; or
• There are special circumstances concerning certain children's rights

In any case, we will not be legally obligated to comply with your erasure request if the processing of Your Personal Data is necessary to comply with a legal obligation imposed on us.

18.4 Right to object to processing

In certain cases, you have the right to object to the processing of Your Personal Data. Where we only process Your Personal Data based on one of the following purposes:

• When the processing is necessary for the performance of a task carried out in the public interest; or
• When the processing is necessary for the pursuit of legitimate interests pursued by Us or a third party, the processing will only cease when the Data Controller has not provided compelling and legitimate reasons that override the objections you have raised in such a request and that require the continuation of the processing.
• When the processing of Your Data is carried out for direct marketing purposes, you have the right to object to the processing of Your Personal Data at any time.
• In all other cases, aside from those listed above, this general right to object will not subsist.

18.5 Right to restrict processing

You have the right to ask us to restrict the processing of your personal data. However, you can only exercise this right when:

• The accuracy of Your Personal Data is contested (see right to data rectification above), for a period enabling us to verify the accuracy of the Personal Data; or
• The processing is unlawful, and you object to the erasure of Your Personal Data; or
• We no longer need the Personal Data for the purposes for which it was collected, but you require it for the establishment, exercise, or defense of legal claims; or
• you have exercised your right to object, and the verification of our legitimate grounds for overriding your objection is pending.
• If you successfully exercise this right, we will only be in a position to process your personal data:
• With your consent; or
• For the establishment, exercise, or defense of legal claims; or
• For the protection of the rights of another natural or legal person; or
• For important public interest reasons.

18.6 Right to data portability

You have the right to request that we provide you with the personal data you have previously provided to us. We will provide you with such data in a structured, commonly used, and machine-readable format, or (where technically feasible) we may have the data sent directly to another Data Controller, provided that this does not adversely affect the rights and freedoms of others. You can only exercise this right when:

• The processing is based on your consent or the performance of a contract with you; and
• The processing is carried out by automated means.

18.7 Right to withdraw consent

You have the right to withdraw your consent at any time. For detailed information on this right, please refer to section 9 "PROCESSING BASED ON CONSENT" found above.

18.9 Right to Lodge a Complaint

As a data subject, you may file a complaint with the National Institute of Transparency, Access to Information and Personal Data Protection (INAI) at any time if you believe the Company has violated any of your rights.

Notwithstanding the foregoing, we ask that you try to resolve any issues you may have with Us before filing a complaint with the INAI.

It is important to note that despite such rights, the Company may deny such a request if it can reasonably justify such a decision. Such denial does not prohibit you from filing a complaint with the relevant data protection authority.

Company contact information

If you have any questions or comments about privacy or if you wish to exercise any of your individual rights, please contact us directly at dpo@soft2bet.com or by calling our contact number (+356) 27369050 (during office hours from 09.00 to 18.00) or by contacting our Data Protection Officer. If necessary, you can also contact our customer service team, who will be happy to provide you with the necessary assistance.

The Company's Data Protection Officer is Oksana Tsyhankova, who can be contacted directly at dpo@soft2bet.com.

Cookie Policy

When you visit or access our websites or applications operated by us, or when you interact with or participate in our content ("Services"), we use (and authorize third parties to use) cookies, pixel tags, beacons, local storage, and similar technologies ("Tracking Technologies"). These allow us to automatically collect information about you, your device, and your online behavior (e.g., your computer or mobile device) to improve your browsing on our Services, enhance the performance of our Services, conduct analyses, personalize your experience, and offer you, for example, personalized content and ads that better match your interests. We also allow third parties to collect information about you through Tracking Technologies.

What are cookies?

Cookies are small text files (consisting only of letters and numbers) that a web server places on your computer or mobile device when you visit a web page. When used, cookies can help make our Services easier to use, for example, by remembering your preferences and language settings. You can find more information about cookies at www.allaboutcookies.org.

Cookies are widely used to make web pages work efficiently. The use of cookies allows you to navigate between pages efficiently. Cookies remember your preferences and make the interaction between you and the Services smoother and more effective. Cookies are also used to help ensure that the ads you see online are relevant to you and your interests.

Storage of Tracking Technologies

We store Tracking Technologies when you visit or access our Services (e.g., when you visit our Website or use our mobile applications) - these are called "First-Party Tracking Technologies." Additionally, Tracking Technologies are stored by other third parties (e.g., our analytics service providers, business partners, and advertisers) who run content on our Services - these are called "Third-Party Tracking Technologies."

Both types of Tracking Technologies can be stored either for the duration of your visit to our Services or for repeated visits.

What types of Tracking Technologies do we use?

When you use or access our Services, we use the following categories of Tracking Technologies:

Strictly necessary tracking technologies - these Tracking Technologies are automatically placed on your computer or device when you access our Services. These Tracking Technologies are essential to enable you to navigate and use the features of our Services. We do not need to obtain your consent to use these Tracking Technologies;

Functionality tracking technologies - these Tracking Technologies allow our Services to remember the choices you make (such as your language) and provide enhanced, personalized features. For example, these Tracking Technologies are used for authentication (to remember when you are logged in) and support other features of our Services;

Performance Tracking Technologies - these Tracking Technologies collect information about your online activity (e.g., the duration of your visit to our Services), including behavioral data and engagement metrics with the content. These Performance Tracking Technologies are used for analytical, research, and statistical purposes (based on aggregated information).

Marketing or Advertising Tracking Technologies - these Tracking Technologies are used to offer you personalized offers and ads, based on your derived interests, as well as to conduct email marketing campaigns. They can also be used to limit the number of times you see an ad and to help measure the effectiveness of the ad campaign. They are typically placed by our advertisers (e.g., advertising networks) and provide them with information about the people who view their ads and interact with them, visit their websites, or use their applications.

Social Media Tracking Technologies - Our website includes social media features, such as Facebook's "Like" or "Share" buttons. These features are hosted by a third party or directly on our services. Your interactions with these features are governed by the privacy statement of the company that provides them.

The following Tracking Technologies are used in connection with our services. For additional information about any of the Third-Party Tracking Technologies, please visit the links provided by the companies that provide them.

Cookies allow us to:

• Improve the use of the Service and make the content more interesting and relevant to the users' desires, such as offering more relevant promotional offers.
• Distinguish you from other users of our sites to ensure a good user experience.
• Identify your settings and preferences in relation to personalized content or functionality.
• Your login data to confirm you as a registered user of our Service.
• Collect statistical analysis on the use of our Service.

Managing Your Cookies

Most browsers accept cookies automatically. However, one can configure the browser so that no cookies are stored on their computer or that a notification appears before a new cookie is created. Please refer to the relevant operator's advice to disable cookies. Other methods to manage your tracking technology preferences include: changing your browser settings to send a "Do Not Track" signal. In such cases, your browser will send us a special signal to stop tracking your activity.

Disabling cookies completely may result in reduced functionality for certain features of the Company's website.

To learn more about how you can manage your cookies, below is a list of useful links that can provide you with more information on how to manage your cookies:

Google Chrome

Internet Explorer

Mozilla Firefox

Safari (Desktop)

Safari (Mobile)

Android Browser

Disabling Third-Party Advertising Cookies: You can disable certain third-party cookies for advertising purposes by visiting the Network Advertising Initiative, located here: Network Advertising Initiative or the DAA opt-out program, located here: https://www.aboutads.info/choices/, https://www.youronlinechoices.eu and here (for mobile devices): https://www.aboutads.info/appchoices.