Comprehensive Privacy Notice

For purposes of this notice, the data controller will be the organizing committee of the Torneo de Orilla Bocana Adventure 2026, composed of Bocana Adventure and the official event organizers, reachable through the contact channels listed in section 15 of this document.

Official site: bocanaadventure.com.

For the purposes described in this notice, the controller may collect and process the following personal data, either directly when the data subject provides it through the form at bocanaadventure.com, or indirectly when it is generated through use of the system:

• Participant's full name.
• Contact phone number.
• Email address.
• Age.
• Place of origin or city from which the participant is visiting.
• Participation category (Open or Kids).
• Shirt size.
• Name and phone number of an emergency contact.
• For minors: parent or guardian name, phone number, and relationship.
• Comments or notes voluntarily provided during registration.
• Registration folio generated by the system.
• On-site payment status and payment method used: cash or card.
• Event attendance or check-in status.
• Commemorative shirt delivery status, when applicable.
• Date and time of registration and, where applicable, check-in and delivery of event-related products.
• Basic technical data derived from site usage, such as IP address, browser identifier, security and diagnostic event logs, when necessary for operation, integrity, and security of the service.

In the current registration version, no sensitive personal data is requested under article 3, section VI of the Law. We also do not request fishing permits, medical documentation, or information about racial or ethnic origin, health status, genetic information, religious, philosophical, or moral beliefs, union membership, political opinions, or sexual preference.

If additional data is required in the future for tournament operations, this notice will be updated and the data subject will be duly informed.

The personal data collected will be used for the following primary purposes, which are necessary to provide the service and operate the tournament:

• Register the participant in the official tournament roster.
• Generate and assign a unique registration folio.
• Identify the participant on event day and validate registration.
• Classify the participant in the appropriate category based on age.
• Manage on-site registration payment on event day, either by cash or card.
• Keep attendance control (check-in).
• Manage delivery of the commemorative shirt and other event-related products.
• Contact the participant to send relevant operational tournament information.
• Contact the emergency contact if necessary for safety or health reasons.
• Maintain administrative, operational, and statistical control of the event.
• Respond to questions, clarifications, requests, or claims related to registration or participation.
• Comply with applicable administrative, tax, or legal obligations.

Additionally, unless the data subject objects, personal data may be used for the following secondary purposes, which are not required for the service but help provide a better experience:

• Send information about future tournament editions or related activities.
• Send notices, promotions, or invitations from Bocana Adventure or similar events organized by the committee.

The data subject may object to the processing of their data for these secondary purposes at any time by sending a request to the email address listed in section 15. Refusal will not be a reason to deny services or benefits derived from tournament registration.

Participation in the Kids category is intended for children under 13 years old, so registration must be completed by the child's parent or legal guardian, or expressly authorized by them.

In these cases, in addition to the minor's data, we collect the parent or guardian name, a contact phone number, and the relationship to the minor.

Registration of a minor implies express acceptance of this notice by the parent or guardian. The minor's data will be used exclusively for registration, tournament operation, safety, communication with the responsible adult, and the other purposes described in this document.

The controller may transfer personal data only in the cases allowed by the Law and only to the following recipients:

• Tournament operations staff, volunteers, and organizers, for event operation.
• Technology providers hired for site hosting, database storage, email delivery, infrastructure, security, or system administration services.
• Competent authorities when there is a duly founded and reasoned request.
• Emergency or assistance services, when necessary to protect participants' physical integrity.

Personal data will not be sold, commercialized, or assigned to third parties for profit under any circumstance. The transfers described in this notice do not require the data subject's consent under article 37 of the Law.

The controller has implemented reasonable administrative, technical, and physical measures to protect the integrity, confidentiality, and availability of the personal data processed, including:

• Restricted access to the administrative panel through individual credentials.
• Encrypted password storage and time-limited session-based authentication.
• Safeguarding information in site infrastructure with encrypted connections (HTTPS).
• Internal operation logs that help identify access to and modifications of information.

Nevertheless, no information system can guarantee absolute security. The controller may not be held responsible for misuse resulting from events outside its control.

Personal data will be retained for the time necessary to administer the tournament, respond to questions and clarifications arising from it, and comply with applicable administrative, tax, or legal obligations.

Once the purpose for which the data was collected has concluded, the data will be blocked, deleted, or anonymized according to the controller's internal policies and applicable regulations.

The data subject has the right to know what personal data is held about them (Access), what it is used for, and the conditions of its use; to request correction of information when it is inaccurate or incomplete (Rectification); to request deletion from the controller's records when they consider it is not being used according to the principles, duties, and obligations established by the Law (Cancellation); and to object to the use of their data for specific purposes (Opposition).

To exercise any of these rights, the data subject or their representative must submit a request by email to:

contacto@scprogreso.com

The request must include at least:

• Full name of the data subject and a means to receive the response.
• Document proving the data subject's identity or, where applicable, legal representation.
• A clear and precise description of the right to be exercised and the personal data involved.
• Any other element or document that helps locate the personal data.

The controller will respond within the timeframes established by the Law, informing the data subject whether the request is granted or denied and, where applicable, the actions taken.

The data subject may withdraw at any time the consent granted for processing their personal data, when applicable under the Law.

Withdrawal requests are submitted through the same channel listed in the previous section: contacto@scprogreso.com.

In some cases, it may not be possible to fulfill the withdrawal request or immediately stop using the data, because a legal or contractual obligation may require continued processing of personal data.

During the tournament, photographs and videos may be captured of the environment, awards, general activities, and participation. These images may be used for event memory, institutional communication, the organizing committee's social media, and promotion of future editions.

If a person does not wish to appear identifiably in such publications, they may inform the organizing committee through the contact channels listed in section 15 so reasonable measures can be taken to address the request.

This does not apply to general or contextual shots in which people are not reasonably identifiable.

The site may use strictly necessary cookies for service operation, such as those that maintain the administrative session, as well as local storage limited to form functionality.

In the current version of the site, no third-party analytics tools, personalized advertising, or browsing trackers are used. If these technologies are added in the future, this notice will be updated and, where applicable, the data subject's consent will be requested.

This notice may be modified at any time to comply with regulatory updates, internal requirements, or new services or products related to the tournament. Changes will be published at bocanaadventure.com/aviso-de-privacidad?lang=en and will include the last updated date.

Data subjects are encouraged to review this notice periodically to stay informed.

For any request related to personal data protection, exercise of ARCO rights, withdrawal of consent, questions, or clarifications about this notice, the data subject may contact:

• Email: contacto@scprogreso.com
• David Ojeda: 646 179 2989
• Restaurante Las Cabañas: 615 109 9512

This privacy notice is governed by Mexico's Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, the Privacy Notice Guidelines, and other applicable provisions in force in the United Mexican States.

Any dispute arising from the interpretation or enforcement of this notice will be submitted to the jurisdiction of the competent authorities for personal data protection matters in Mexico.