Full privacy notice

1. Controller and contact

Servicios de Innovación Fintech S.A. de C.V. is the controller of your personal data on Conboleto. Its address is Edificio Corporativo Urban Center, López Mateos Sur 7000, Tlajomulco de Zúñiga, Jalisco, Mexico, postal code 45640.

For privacy questions, to exercise your rights or to decline promotional communications, contact [email protected]. This notice applies to Conboleto accounts and services and is governed by Mexican personal data protection law.

2. Personal data we process

Depending on the services you use, we process your name, email address, phone number, country or calling code, profile photo if provided, authentication data, preferences and request records. We also process information about purchases, tickets, payments and their references, ticket transfers, complimentary tickets and admission checks; where applicable, tax information you provide for invoicing.

Use of the website generates technical browsing data such as IP address, browser, device, cookies and session identifiers. We do not request sensitive personal data for ordinary registration. Payment providers process payment information under their own privacy notices.

3. Necessary purposes

We use your data to create, authenticate and manage your account; verify and recover access; process and record purchases; deliver, transfer and validate tickets; manage payments, invoicing, inquiries and refunds; provide support; prevent fraud and comply with legal obligations.

Necessary emails include account verification and security, purchase confirmations, tickets, receipts and notices about changes, cancellations, admission or refunds for events related to your purchases. Unsubscribing from promotions does not stop these emails.

4. Additional purpose: event promotions

We may also use your name and email address to email you event news, recommendations, advertising and promotions from Conboleto. This purpose is optional and is not necessary to open an account or buy or use tickets.

Before submitting registration, you can open the web version of this notice and select ‘I do not want promotions’ under ‘Email preferences’. Your refusal is saved in this browser and applies when you create your account, including when the form is open in another tab on the same site. If you clear site data or use another browser, you must select it again. This option does not change existing accounts’ preferences.

If you receive this information and continue registering without declining this purpose, we record your tacit consent for promotions under Mexican law, together with the date, language and version of the notice provided. This does not authorize advertising through other channels or use of your data for third parties’ own advertising.

Existing accounts and accounts created through external providers are not treated as authorized for this purpose merely because they exist. Receiving promotions requires valid consent after this notice and a mechanism to decline them have been made available to you.

5. Declining, withdrawing consent and unsubscribing

You can decline promotions before registering under ‘Email preferences’ in the web version of this notice or use the ‘Unsubscribe from promotions’ link included in promotional emails. The email link requires no login; you confirm unsubscribing on the page it opens. You can also request this at [email protected], stating the email address you wish to exclude.

Unsubscribing through the email link is free and is recorded when confirmed. It applies to subsequent promotional sends and is checked again before sending; an email already handed to the delivery provider cannot be recalled. Your account, tickets, purchases and necessary emails remain available.

6. Providers and data transfers

We use hosting, authentication, email delivery and payment providers to deliver the service; some may operate outside Mexico. When acting on our behalf, they must process data for the contracted services and in accordance with applicable data protection obligations.

We may provide the organizers of events you purchase with data necessary to manage your purchase, admission, support or refund, and provide data to authorities when legally required. Transfers that legally require consent will be explained and consent requested before they occur. Permission to receive Conboleto promotions does not authorize organizers or other third parties to send you their own advertising.

7. ARCO rights and retention

You may request access, rectification, cancellation or opposition to processing of your data, withdraw consent or limit its use and disclosure by emailing [email protected]. Include your name, a contact method, a description of your request and documents necessary to establish your identity or representation; for rectification, describe the correction and provide relevant support. Avoid sending unnecessary additional data.

We will respond within the deadlines and requirements of applicable law: generally, up to twenty business days to communicate the decision and, if granted, fifteen additional business days to implement it, subject to legally permitted extensions. Declining promotions through the controls described above does not require an ARCO request.

We retain data while necessary for the service, legal obligations or handling liabilities. Cancellation and withdrawal requests may have limits where information must be retained for a legal obligation or an ongoing relationship; this does not prevent declining the promotional purpose. We apply administrative, technical and physical security measures to protect data.

8. Cookies and notice updates

We use cookies and similar technologies to maintain sessions and website functions. You can manage or delete cookies through your browser; blocking necessary cookies may prevent login or other functions. Permission to receive email promotions is not permission for other tracking purposes.

We publish updated versions at https://conboleto.com/en/aviso-de-privacidad. When a change introduces new purposes requiring consent, we will inform you and obtain the applicable authorization before using data for those purposes.