COMPREHENSIVE PRIVACY NOTICE

Winpot Online América S.A. de C.V. (winpot.mx) and Pur Umazal Tov S.A. de C.V., hereinafter referred to as the “COMPANY,” is the entity responsible for the processing of your personal data. This Comprehensive Privacy Notice (hereinafter, the “PRIVACY NOTICE”) is made available to our clients, visitors, and any individuals who access our physical premises (hereinafter referred to as the “ESTABLISHMENT”).

This PRIVACY NOTICE describes how we handle your personal data in relation to the services we offer and provide, as well as the security and confidentiality measures we implement, and the procedures to exercise your rights of Access, Rectification, Cancellation, and Opposition (ARCO rights), as well as data usage restrictions and/or limitations, in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its regulations.

I. DATA CONTROLLER

The COMPANY is responsible for handling and managing the personal data shared by individuals and will process such data according to the purposes outlined in this PRIVACY NOTICE.

To exercise your ARCO rights or to revoke, limit and/or restrict your personal data, please contact us by email at: soporte@winpot.mx, or submit a signed written request to our offices located at:

Centro Comercial Pabellón, Circuito Juan Pablo II No. 1757 Int 2, Col. La Noria, Puebla, Puebla, C.P. 72410.

The COMPANY may collect personal data directly or indirectly through phone calls, its website, or authorized third parties.

II. DEFINITIONS

For the purposes of this PRIVACY NOTICE, the following terms shall have the meanings assigned below, regardless of singular or plural usage:

• Personal Data: Any information relating to an identified or identifiable natural person.

• Sensitive Personal Data: Personal data that affects the data subject’s most private sphere or whose misuse may lead to discrimination or significant risk. This includes data revealing racial or ethnic origin, health status, genetic information, religious or philosophical beliefs, union affiliation, political opinions, sexual preference, or financial status.

• ARCO Rights: The rights of the data subject to Access, Rectify, Cancel, or Oppose the processing of their personal data under the LFPDPPP.

• Dissociation: The process by which personal data cannot be linked to an individual, nor allow identification due to its structure, content, or degree of disaggregation.

• Processor: A natural or legal person who processes personal data on behalf of the controller according to specified terms and conditions.

• LFPDPPP: The Federal Law on the Protection of Personal Data Held by Private Parties.

• Regulation: The Regulation of the LFPDPPP.

• DATA SUBJECT: Refers to the individual who consents to the processing of their personal data.

• ESTABLISHMENT: The legal premises authorized to carry out or manage any designated activity before the relevant authorities.

III. COLLECTED PERSONAL DATA

The personal and sensitive data collected and subject to processing may include:

Identification Data:

• Full name

• Type of ID, issuing authority, and ID number

• Unique Population Registry Code (CURP)

• Date of birth

• Marital status

• Signature

• Federal Taxpayer Registry (RFC)

• Occupation

Contact Information:

• Email address

• Home address

• Phone number (landline or mobile)

Financial Data:

• Bank account number or CLABE

• Debit or credit card number

• Financial institution

• Beneficiary account holder details

These data are collected for the purposes of providing the COMPANY’s services and for statistical analysis.

The COMPANY does not request sensitive data. However, should any be provided and deemed necessary to maintain the relationship, it will be handled with the security measures required by law. If not required, it will be deleted.

IV. PURPOSE OF DATA COLLECTION

Primary Purposes:

1. Provide physical or electronic services through the COMPANY at Winpot Casino, Centro Comercial Pabellón, Puebla.
2. Verify the identity and the accuracy of the provided data.
3. Manage and follow up on services and products for quality purposes.
4. Detect and manage fraud directly or via third parties.
5. Analyze information to assess financial risk, solvency, payment capability, and compliance.
6. Include in databases, create records, directly or via third parties.
7. Assign or transfer rights derived from contractual agreements.
8. Send and receive communications related to our services.
9. Share required data with authorities.

Refusal to allow processing of personal (including financial) data may hinder the provision of services.

The COMPANY may transfer your personal and/or financial data to third parties, nationally or internationally, for the purposes outlined above and to comply with applicable laws.

Secondary Purposes:

1. Offer similar or additional products and services.
2. Marketing and advertising related to the COMPANY or affiliates.
3. Evaluate service quality.
4. Resolve service-related issues.
5. Conduct market research to improve offerings.
6. Enhance digital service channels and send relevant communications.

By consenting to data processing, you authorize the COMPANY to send marketing messages via email, SMS, social media, or other electronic means, and to collect information through surveys.

To comply with anti-money laundering regulations (LFPIORPI), the COMPANY may collect additional data related to legal obligations.

If you do not consent to certain data uses, you may notify the COMPANY at soporte@winpot.mx. Acceptance of services implies consent unless expressly revoked.

V. COLLECTION AND PROCESSING OF PERSONAL DATA

The COMPANY may collect information through any means permitted by the LFPDPPP, including in person, via electronic platforms, or from publicly available sources.

The COMPANY will process and safeguard personal data using digital, technical, and administrative means to ensure an appropriate level of security. Information will be kept confidential and secure to prevent unauthorized access, use, or loss.

The data subject declares that all information provided to the COMPANY is accurate and provided in good faith, releasing the COMPANY from any liability regarding its veracity, including personal, financial, employment, and reference data.

Collected data will be stored on the COMPANY’s servers and used solely for the purposes stated in Section IV.

VI. DATA TRANSFER

Personal data will be used in accordance with this Privacy Notice and retained for as long as legally required.

To fulfill the purposes described in Section IV, the COMPANY may transfer personal data, without requiring express consent, under Article 37 of the LFPDPPP, to the following:

1. Other entities within the COMPANY’s group or affiliated companies.
2. Judicial, governmental, financial, or tax authorities, as required by law.
3. Third-party acquirers as part of corporate restructuring, mergers, or asset transfers necessary to maintain legal or business relationships.

Data may also be transferred to third-party service providers, both national and international, for identity verification and risk analysis during and after the contracting process.

By accepting this Privacy Notice, the data subject expressly consents to the transfer of their data for the purposes stated, including transfers to government entities, debt collection agencies, financial institutions, insurers, and service providers.

Transfers aim to:

1. Comply with data protection legislation;
2. Ensure proper origin and fulfillment of contractual obligations;
3. Protect the COMPANY’s rights;
4. Protect the data subject’s rights;
5. Promote the COMPANY’s financial products.

The COMPANY will notify the data subject and provide the opportunity to object to such transfers when applicable.

VII. CONSENT WITHDRAWAL

You may revoke your consent to data processing at any time by following the procedure described in Section IX. Revoking consent related to the Primary Purposes may result in the COMPANY being unable to continue providing services.

VIII. ARCO RIGHTS

The data subject may access their personal data held by the COMPANY, request corrections, cancel use, or oppose processing, especially when data is no longer necessary, is used without consent, or after the contractual relationship ends.

IX. PROCEDURE TO LIMIT USE, EXERCISE ARCO RIGHTS, OR REVOKE CONSENT

To exercise any of the above rights, send a signed request to soporte@winpot.mx with the following:

1. Full name
2. Contact information (email, phone)
3. Date of birth, RFC or CURP
4. Clearly state which right you wish to exercise and to which specific data it applies
5. Signature (included in a PDF or JPG attachment)
6. A valid official ID with photo and signature (passport in the case of foreign nationals)

Upon receipt, the COMPANY will acknowledge your request within 2 business days and respond within 15 business days. If needed, an extension of 15 more days may be applied. Personal data will be provided free of charge, except for justified reproduction or shipping costs.

X. PRIVACY NOTICE UPDATES

The COMPANY may update this Privacy Notice due to legal, operational, or service changes. Updates will be posted on our website and sent via email.

You may oppose such changes by exercising your ARCO rights as outlined in Section IX.

XI. COMPLAINTS AND MISUSE REPORTS

If you believe your personal data has been misused or your rights violated, contact us at soporte@winpot.mx. If unsatisfied with our response, you may file a complaint with the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI) at www.ifai.gob.mx, within 15 days of receiving our response or after the 20-day response period expires.

XII. ACCEPTANCE OF THIS PRIVACY NOTICE

This Notice forms a legal agreement between you (as the data subject) and the COMPANY. By using our services or submitting personal data, you accept the terms herein.

XIII. LAST UPDATED

March 2025