I. Personal Data Subject to Processing

To fulfill the purposes described in this notice, the Controller may process, as applicable and only when necessary, adequate, and proportional, the following categories of personal data:

a) Identification and contact data: Full name, date of birth, age, official ID, signature, email, phone number, city, state, country of residence, and emergency contact details.

b) Purchase, billing, and payment data: Ticket folio, ticket type, zone, date and time of purchase, payment method, payment reference, last digits of card, receipts, transaction history, RFC (tax ID), company name, tax address, tax regime, and CFDI use, when an invoice is requested.

c) Event access and operation data: QR codes, access codes, wristbands, RFID or technological identifiers, entry validations, entry and exit times, visited zones, accreditations, consumptions, top-ups, balances, and movements associated with wristbands or cashless systems, when applicable.

d) Technological data: IP address, device identifiers, browser, operating system, advertising identifiers, cookies, pixels, SDKs, browsing logs, interactions with websites, applications, emails, and official social media.

e) Image, voice, and security data: Photographs, videos, audio recordings, video surveillance logs, incident reports, security logs, access restrictions, and evidence related to festival security.

f) Social media and communication data: Username, messages, comments, interactions, tags, photographs shared with official accounts, participation in contests, surveys, dynamics, waiting lists, or digital communities.

g) Health, accessibility, or special care data: Medical information provided voluntarily or generated during an emergency, allergies, reported medical conditions, medications, care provided, transfers, accessibility requests, mobility support, assistance requirements, or emergency contacts.

h) Optional sensitive data: Gender, gender identity, gender expression, pronouns, health data, or any data that could reveal intimate aspects of the data subject or whose improper use could generate discrimination or serious risk.

The Controller recognizes that, due to the nature, theme, communication, community, and operation of ARENA FESTIVAL, certain personal data could reveal or allow the inference of sensitive aspects of the data subjects, including gender identity or expression, pronouns, health status, accessibility needs, medical assistance, or, in certain contexts, aspects linked to the private life of attendees.

The processing of sensitive data will be exceptional, voluntary, proportional, limited to the minimum necessary, and subject to the express written consent of the data subject—via handwritten signature, electronic signature, an independent checkbox with an authentication mechanism, or any other valid means allowing proof of such consent—except for the exceptions provided by applicable law, including emergencies or medical care when the data subject is not in a position to grant it.

ARENA FESTIVAL is intended for adults when required by the nature of the event, the sale or consumption of alcoholic beverages, access to certain areas, or applicable law. The Controller may request strictly necessary data or documents to validate legal age, prevent unauthorized access, comply with legal obligations, and protect the safety of attendees and third parties.

Confidentiality and Non-Discrimination Policy

Due to the theme and cultural niche of the festival, registration, purchasing access, or participating in the festival could infer information related to your sexual orientation or gender identity (considered sensitive personal data under the LFPDPPP).

The Controller will implement reasonable, sufficient, and proportional administrative, technical, and physical security measures relative to the risk, data sensitivity, processing volume, technological development, and possible consequences for data subjects.

Staff, suppliers, processors, authorized third parties, accredited media, and anyone involved in the processing of personal data must maintain confidentiality regarding the data to which they have access, an obligation that will persist even after their relationship with the Controller ends.

In the event of a security breach that significantly affects the financial or moral rights of data subjects, the Controller will immediately inform the affected individuals, specifying, when applicable, the nature of the incident, compromised data, protection recommendations, implemented corrective actions, and contact information for further details.

In this regard, “The Controller” declares:

• Non-Conditioning: Under no circumstances will ticket sales, festival entry, use of services, or the exercise of your rights be conditioned upon disclosing your sexual orientation, gender identity, or any other sensitive data.
• Zero Discrimination: Any use of this information for exclusion, segregation, discriminatory commercial profiling, or conduct violating human dignity is strictly prohibited.
• Enhanced Security Measures: This data will be processed under the strictest administrative, technical, and physical security measures, restricting access solely to essential and authorized personnel.

This Privacy Notice applies to personal data processing carried out by UX HOLDINGS GROUP, S.A. DE C.V. regarding individuals who purchase tickets, attend the festival, use websites, applications, ticketing platforms, wristbands, access systems, customer service, official social media, promotional dynamics, physical booths, VIP areas, security zones, medical services, or any other channel related to ARENA FESTIVAL. Data may be collected directly, personally, electronically, visually, audibly, by technological means, or through third parties involved in operating the festival in accordance with this notice.

The processing of this data is governed by the principles of legality, human dignity, and non-discrimination, in strict adherence to the zero-discrimination policy and Article 1 of the Political Constitution of the United Mexican States.

Medical Assistance: If emergency medical attention is required inside the festival, health data collected by paramedics will be processed exclusively to safeguard your physical integrity and under professional secrecy standards (Article 9, fractions V and VI of the LFPDPPP).

II. Purposes of Data Processing

The personal data we collect from you will be used for the following Primary Purposes, which are necessary for the requested service:

• Manage the purchase, delivery, and validation of your tickets, passes, or VIP access.
• Control access to the festival venue and operate cashless wristband/prepayment systems or electronic access control systems.
• Ensure safety and order within the festival through video surveillance, monitoring, and access control systems.
• Contact you exclusively for logistical reasons, line-up changes, rescheduling, cancellation, or any emergency related to the festival.
• Issue corresponding tax invoices for purchases made.

Additionally, we will use your personal information for the following Secondary Purposes, which are not necessary for the requested service but allow us to provide better service:

• Send advertising information, newsletters, and promotions about upcoming editions of the festival or events organized by “The Controller”.
• Use your image and voice in photographic and video advertising materials for the festival for dissemination on official social media, television, websites, and mass media.
• Send exclusive promotions from official festival sponsors.
• Refusal to process data for secondary purposes:

If you do not want your personal data processed for secondary purposes, you may express your refusal right now by sending an email to: info@arena.mx. Refusal to use your data for these purposes will not be a reason to deny you access to the festival.

III. Personal Data Transfers

The Controller may grant access to personal data to processors acting on behalf of the Controller under its instructions, including, but not limited to, suppliers of ticketing, payment processing, billing, access control, wristbands, cashless systems, hosting, storage, CRM, email delivery, analytics, private security, video surveillance, medical care, civil protection, technological support, customer care, production, logistics, accreditations, and auditing. Such processors must process data strictly for instructed purposes, implement security measures, maintain confidentiality, and not use data for their own purposes.

The Controller may make national or international data transfers to third parties when necessary, legal, or consented to, including competent authorities, emergency bodies, medical institutions, insurers, parent companies, subsidiaries or affiliates under common control, suppliers, or partners when necessary by contract in the interest of the data subject, or third parties necessary for the recognition, exercise, or defense of legal rights.

The Controller will not transfer identifiable personal data to sponsors, commercial partners, brands, media, or third parties for advertising, commercial, profiling, prospection, or direct marketing purposes without the consent of the data subject, unless covered by a legal exception.

When the Controller sends sponsor promotions without sharing identifiable data with said sponsors, this will be considered a secondary marketing purpose of the Controller, and the data subject may object or unsubscribe at any time.

IV. Means and Procedure for Exercising ARCO Rights

You have the right to know what personal data we have about you, what we use it for, and the conditions of its use (Access). Likewise, it is your right to request the correction of your personal information if it is outdated, inaccurate, or incomplete (Rectification); that we remove it from our records or databases when you consider it is not being used in accordance with principles, duties, and obligations provided by law (Cancellation); as well as to oppose the use of your personal data for specific purposes (Opposition). These rights are known as ARCO Rights.

To exercise any of the ARCO rights, you must submit the respective request via email to info@arena.mx, addressed to the Personal Data Department.

The request must contain and include the following:

1. The name of the data subject and address or other means to communicate the response to your request.
2. Documents proving identity (copy of voter ID/INE or Passport) or, where appropriate, legal representation of the data subject.
3. A clear and precise description of the personal data regarding which you seek to exercise any of the aforementioned rights.
4. Any other element or document that facilitates locating the personal data.

“The Controller” will inform you of the decision adopted within a maximum period of 20 (twenty) business days from the date the request was received. If appropriate, it will become effective within 15 (fifteen) business days following the date the response is communicated.

V. Revocation of Consent and Limitation of Use/Disclosure

You may revoke the consent you have granted us for processing your personal data or limit its use by sending your request to info@arena.mx. However, it is important to note that we may not be able to address your request or end use immediately in all cases, as legal obligations may require us to continue processing your data.

VI. Use of Cookies and Tracking Technologies

We inform you that on our website we use cookies and other technologies through which it is possible to monitor your behavior as an internet user to provide better service and browsing experience. The data we obtain includes: browsing schedules, time spent on our website, sections consulted, and websites accessed prior to ours. These technologies can be disabled directly from your web browser’s security settings.

VII. Confidentiality and Enhanced Image Processing

Given that this festival targets a niche market, the “Controller” recognizes that the image, voice, or presence of attendees could constitute sensitive personal data, insofar as it allows direct or indirect identification of aspects related to sexual orientation, gender identity, or gender expression.

Consequently, the processing of images, audiovisual recordings, and any other material that allows identification of attendees will be conducted under an enhanced confidentiality regime, in compliance with the principles of legality, purpose, proportionality, minimization, security, and non-discrimination.

The Controller commits to:

a) Identifiable images will be used solely for informative, documentary, and promotional purposes of the festival, without associating, describing, or classifying them based on sexual orientation, gender identity, or expression of the attendee.

b) The use of wide, panoramic, or general shots will be prioritized, avoiding identifiable close-ups unless express consent is given.

c) Access to audiovisual material will be strictly limited to authorized personnel, suppliers, and accredited media bound by contractual confidentiality and data protection obligations.

d) Under no circumstances will images be used for discriminatory or stigmatizing purposes or actions that violate the dignity, security, or privacy of attendees.

e) Attendees may exercise their rights of opposition, limitation, or deletion at any time, requesting the removal, blocking, or blurring of their image in accordance with the procedure set forth in this Privacy Notice.

Audiovisual recordings are made at this festival under criteria of confidentiality and non-discrimination. If you do not wish to appear in identifiable material, request information about non-recording zones or exercise your rights per the Privacy Notice available on the official website.

VIII. Changes to the Privacy Notice

This privacy notice may undergo modifications, changes, or updates resulting from new legal requirements, our own needs regarding the services offered, or our privacy practices.

We commit to keeping you informed about any changes this privacy notice may undergo through our official website: https://www.arena.mx/

IX. Consent

Consent for processing personal data will be collected according to the nature of the data and corresponding purposes. General acceptance of the notice will not, by itself, imply consent for all secondary purposes, commercial transfers, identifiable advertising use of image or voice, or processing of sensitive data.

Where applicable, the Controller may collect separate and independent consents for: (i) secondary marketing purposes; (ii) sending promotions from sponsors or partners; (iii) transferring data to sponsors for commercial purposes; (iv) use of image, voice, or identifiable recordings for advertising, commercial, or promotional purposes; (v) processing optional sensitive data, including gender identity, pronouns, health data, accessibility, or any data whose improper use could cause discrimination or serious risk.

Checkboxes or acceptance mechanisms for secondary purposes, sensitive data, commercial transfers, and identifiable image/voice use must not be pre-selected.

Consent for additional purposes and potentially sensitive data

When personal data processing is not strictly necessary for executing the service, or when it involves the use of image, voice, or other data that, due to context, could be considered sensitive personal data, the Controller will collect the express consent of the subject through independent mechanisms, such as checkboxes, digital forms, social media, or equivalent means.

The data subject may revoke consent at any time, without retroactive effect, following the procedure outlined in this Privacy Notice.