Full Privacy Notice

I. RESPONSIBLE

The Company is solely responsible for the collection, processing, and management of the personal data you provide, which will be used exclusively for the purposes described in this Privacy Notice. To exercise any of your ARCO rights, or to restrict, object to, or revoke the processing of your personal data, you may contact the responsible party by sending a request to the specified email address or by sending a signed written request to: Centro Comercial Pabellón, Col. La Noria, Puebla, Puebla CP 72410.

The Company may collect your personal data directly (through forms, phone calls or website interactions) or indirectly (through authorized third parties acting on behalf of the Company).

II. DEFINITIONS

For the purposes of this PRIVACY NOTICE, the following terms have the meaning specified in this document, whether in the singular or plural:

Personal data: any information relating to an identified or identifiable natural person.

Sensitive personal data: personal data relating to the private life of the data subject, the unlawful use of which could lead to discrimination or pose a serious risk. This category includes data revealing personal aspects of the data subject, such as racial or ethnic origin, current and future health, genetic information, religious, philosophical and moral beliefs, trade union membership, political opinions, sexual orientation or financial status.

ARCO rights: the right of the data subject to request from the controller access, rectification, deletion or opposition to their data, in accordance with the provisions of the LFPDPPP and its Regulation.

Dissociation: Process by which personal data can no longer be associated with the data subject or allow their identification due to its structure, content or degree of disaggregation.

Data Processor: Natural or legal person who, alone or jointly with others, processes personal data on behalf of the data controller and under their direction, in accordance with the established procedures and conditions.

LFPDPPP: Federal Law on the Protection of Personal Data Held by Private Parties.

Regulations: Legislative and regulatory acts derived from the LFPDPPP.

Data Subject: Natural person who provides their personal data and consents to its processing.

Establishment: Legal address where the person is authorized to carry out or manage any activity established by the competent authorities.

III. Personal data collected

The personal and sensitive data that you provide and that will be processed includes the following:

Identification data.

1. Full name.
2. Type of identification, issuing entity and document number.
3. Unique Population Registry Code (CURP).
4. Birthdate.
5. Marital status.
6. Administrator’s signature.
7. Federal Taxpayer Registry (RFC).
8. Client’s profession.

Contact information:

1. Email.
2. Landline phone.
3. Mobile or landline phone.

Datos financieros:

1. Bank account number or CLABE.
2. Debit or credit card number.
3. Name of the financial institution.
4. Details of the account holder or beneficiary.

The personal data collected is used solely to provide the services offered by the COMPANY and to collect statistical information.

The COMPANY does not request sensitive personal data unless necessary. However, if you have provided us with such information to maintain interactions with us, it will be processed in accordance with the security and precautionary measures established by the Federal Law on the Protection of Personal Data Held by Private Parties (FZPPD). Once this data is no longer needed, it will be deleted in full compliance with the law.

IV. Purpose of the data provided

The personal data collected will be used to provide you with the COMPANY’s services and to comply with the terms and conditions of those services. The main purposes for which the data is used include:

• Provision of the COMPANY’s physical and electronic services at the Winpot Casino and the Pabellón Shopping Center, located at Circuito Juan Pablo II No. 1757 Int. 2, Col. La Noria, Puebla, CP 72410.
• Verification, confirmation and verification of the identity of the data subject and the accuracy of the information provided.
• Management, operation and quality control of the COMPANY’s services and products.
• Detection and prevention of fraudulent activities, directly or through national and international third parties.
• Analysis of the data subject’s information to assess risks, solvency, transaction profile, economic situation and other factors in accordance with legislation for the provision of financial services.
• Integration and storage of information in the COMPANY’s database, directly or through third parties.
• Transfer or assignment of the COMPANY’s rights arising from the contracts entered into.
• Sending and receiving messages by electronic means related to the services provided.
• Providing information to government agencies and individuals to whom the COMPANY is required to disclose it.

If a data subject does not consent to the processing of their personal data, including financial or asset information, the COMPANY may be restricted in providing access to its physical and electronic resources. However, personal, asset, and financial data may be transferred to third parties, both domestic and foreign, solely for the purposes specified in this notice.

Secondary purposes of data use (optional, but intended to improve the service):

• Offer products and services similar to or different from those previously requested.
• To carry out commercial and advertising campaigns related to the products and services of the COMPANY and its subsidiaries.
• Evaluate the quality of customer service and resolve disputes.
• Conduct market research to optimize service and offer favorable conditions.
• Monitor and improve electronic communication channels to send useful and relevant information.

By consenting to the processing of your data, you authorize the COMPANY to use it to send promotional information through available communication channels: email, mobile messaging, social networks and other electronic means, as well as to conduct surveys and studies of customer service quality.

Furthermore, the COMPANY is obligated to collect and use the holder’s data to comply with the requirements of the law on the prevention and detection of illegal transactions, including the actions covered in Articles 139, 148 and 400 of the Penal Code, as well as the provisions of the Federal Law on the Prevention of Transactions with Illicit Resources (FZIN).

The data subject has the right to object to the use and processing of their personal data if they believe that the information provided is not necessary for the purposes specified above. To do so, simply send a notification to the COMPANY by email to [email protected], indicating any restrictions on data processing.

Acceptance of this Privacy Notice or use of the COMPANY’s services constitutes your explicit consent to the processing of your personal data. However, the data subject reserves the right to revoke their consent at any time and exercise their ARCO rights (Access, Rectification, Cancellation, and Opposition). Refusal to allow the processing of data for advertising or secondary purposes does not affect the provision of the main services and products requested from the COMPANY.

V. Obtaining and processing personal data

The Company may obtain information from the data subject by any means permitted by the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), including direct data collection through electronic platforms or websites. In particular, the information may come from:

• Directly from the data owner through the Winpot casino, Pabellon Shopping Center, Circuito Juan Pablo II No. 1757, Int 2, Col. La Noria, Puebla, Puebla CP 72410.
• From public information sources related to the data subject.
• Any other means permitted by law.

The Company is committed to processing and protecting personal data using digital, technical, and administrative means to ensure the highest level of security. At the same time, the confidentiality of all information provided will be maintained, and all necessary measures will be taken to prevent alteration, misuse, unauthorized processing, loss, or access by third parties.

The data subject declares that all information provided to the Company is accurate and truthful, without errors or fraudulent data, and releases the Company from any liability regarding the veracity of said information, including personal, employment, financial data and personal references.

All personal data collected by the Company will be stored on its servers and used strictly for the purposes set out in Section 4 of this Privacy Notice.

VI. Data Transfer

The use of the holder’s personal data is regulated and limited in accordance with this Privacy Notice, and the data will be kept for the period established by applicable law.

To fulfill the main objectives described in Section 4 of this Notice, the COMPANY may transfer your data to third parties without your explicit consent, in accordance with Article 37 of the LFPDPPP:

• To other companies that are or may be part of the COMPANY, as well as subsidiary and affiliated organizations.
• To judicial, governmental, financial or tax authorities to comply with current legislation and exercise legal rights.
• To third-party acquirers in the event of corporate changes (merger, sale, liquidation or transfer of assets) when the transfer is necessary to maintain or execute existing contractual relationships.

The transfer of data to domestic and foreign service providers is permitted only for the verification of your identity, the assessment of risks and credit profile, as well as for the updating of data after the conclusion of the contract.

The data subject accepts the transfer of their personal data under the following conditions:

• The COMPANY guarantees that the recipients will use the data only for the established processing purposes.
• Recipients may include government authorities, financial institutions, insurance companies, collection agencies, or any other organization or person providing services to the COMPANY.

The purposes of this transfer include:

• Compliance with current legislation on the protection of personal data.
• Execution of obligations and rights established in the contracts between the parties.
• Protection of the rights of the COMPANY and the DATA SUBJECT.
• Advertising and promotion of financial products offered by the COMPANY to the data subject.

In cases where the data is used for marketing or advertising purposes, the COMPANY will provide the data subject with the possibility of objecting to the processing.

Apart from these limitations, the data subject gives explicit consent for the transfer of their personal data.

VII. Revocation of consent

You may withdraw your consent to the processing of your personal data for the purposes set out in this notice at any time, and the Company will cease using it for those purposes. To do so, you must submit the corresponding request following the procedure described in Section 9 of this Privacy Notice. Please note that if you request the deletion of personal data used for the primary purposes, the Company may be obliged to suspend or discontinue the provision of the services you have contracted.

VIII. Exercise of ARCO rights

The data subject has the right to access their personal data stored by the Company, as well as to obtain complete information about its processing. They may request the correction of data if it is inaccurate or incomplete; delete data if they consider it unnecessary for the purposes indicated in this Privacy Notice, if it is used without their consent, or in the event of termination of contractual or service relationships; and they also have the right to object to the processing of data for specific purposes.

IX. Procedure to limit the use or transfer of personal data, exercise your ARCO rights and/or revoke your consent.

To exercise your right to limit and/or prohibit the use and transfer of your personal data, you must send a digitally signed (scanned) document to [email protected] containing the following information:

Full name.

Contact information: email address and phone number.

Date of birth, RFC (Mexican Tax ID) or CURP (Mexican National ID).

Clearly indicate the action you wish to take regarding your personal data: access, rectification, cancellation, or objection to processing, specifying which data your request refers to.

The document must be signed by you and attached to the email in .pdf or .jpg format.

Attach a valid official photo ID with signature issued by a Mexican authority (federal, state, or municipal). For foreign citizens, a valid passport confirming tourist status.

Once your request is received, the COMPANY will send an email confirmation within two business days, indicating that the process has begun or requesting additional information if necessary.

Within 15 business days of receiving your request, you will receive a response indicating whether your request has been approved and what steps will be taken. If it is not approved, the reasons will be explained. This period may be extended for another 15 business days if necessary, with notification to the data subject.

The provision of data will be free of charge after verification of your identity. In exceptional cases, when the request involves reasonable expenses (such as shipping, reproduction, or conversion)ón de datos a otros formatos), el titular de los datos deberá cubrir dichos costos, los cuales serán comunicados previamente.

X. Changes to the privacy notice

The Company reserves the right to modify or update this Privacy Policy at any time, in accordance with changes in legislation, internal regulations, or new requirements for the provision of our services. All updates will be available on our website, and users will also be notified by email so they can review the changes and take appropriate action.

Furthermore, data subjects are informed that they have the right to object to the processing of their personal data if they do not agree with the modifications made. To do so, they must follow the procedure for exercising ARCO rights described in Section 9 of this Privacy Policy. The Company guarantees that all objections will be addressed promptly and in accordance with current regulations.

XI. Complaints and reports regarding the improper handling of your personal data and limitations on the use or disclosure of your personal information

If you believe your right to personal data protection has been violated by actions of our staff, our responses, or any processing of your data, or if you suspect that the processing of your personal data does not comply with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), please contact us immediately at [email protected].

Once you notify us and we confirm improper handling of your data, you have the following options:

Initiate the personal data protection procedure before the Federal Institute for Access to Information and Data Protection (www.ifai.gob.mx) within 15 days of receiving the Company’s response or 20 days from the date of your request to exercise your rights.

Register with the Public Registry for the Prevention of Advertising and/or the Public Registry of Users.

We recommend keeping copies of all requests sent and responses received for your records. These measures help to ensure transparency and the full protection of their rights.

XII. Acceptance and understanding of the notice

This Notice is governed by the terms established by the COMPANY and constitutes a legally binding agreement between you, as the owner of the personal data, and the COMPANY.

XIII. Date of update

Last updated: March 2026