Comprehensive Privacy Notice and Policy

The data controller responsible for processing your personal data is the entity operating the MyLiveFest brand in Mexico.

For any privacy-related inquiry or to exercise your ARCO rights, you may write to contacto@mylivefest.com or use our contact form. We will update this section with definitive registration details as soon as they are available.

This notice applies to the processing of personal data carried out through the website mylivefest.com, its subdomains, associated applications, and official contact channels operated under the MyLiveFest brand.

It does not cover third-party websites, applications, or services you may access via links on our platform; each has its own privacy policies, over which we have no control.

Depending on how you interact with MyLiveFest, we may process the following categories of personal data:

• Identifying and contact data: name, email address, subject, and content of messages sent through forms.
• Account data (when registration is available): user identifier, display name, profile photo, language preferences, and notification settings.
• Technical and browsing data: IP address, device or browser identifiers, operating system, pages visited, time on site, referral source, and error logs.
• Approximate geolocation data derived from IP address or device settings, not precise GPS unless you expressly authorize it for specific features.
• Cookie and similar technology data as described in section 12 of this notice.
• User-generated content: comments, ratings, lists, photographs, or other materials you choose to publish in enabled features.
• Subscription or payment data (only if you purchase paid services): transaction identifiers, masked payment method, and subscription status; we do not store full card numbers.

We obtain personal data from various sources, depending on the context of processing:

• Directly from you when you complete forms, create an account, publish content, or subscribe to communications.
• Automatically through cookies, server logs, and analytics tools when you browse the site.
• From public or licensed sources related to artists, festivals, concerts, and media, to build informational profiles (generally without visitors' personal data).
• From providers and processors that deliver technical, analytics, or advertising services on our behalf.
• From third-party authentication platforms, if we enable federated sign-in in the future, only with your prior consent.

We process your personal data for the following primary purposes necessary to operate the service:

• Provide, maintain, and improve MyLiveFest's informational platform about festivals, concerts, and artists.
• Manage and respond to inquiries sent through contact forms or email.
• Administer user accounts, authentication, access recovery, and preferences when registration is available.
• Publish and moderate user-generated content in accordance with our Terms and Conditions.
• Ensure the security, integrity, and availability of the site, including fraud detection, abuse prevention, and unauthorized access.
• Comply with legal obligations, requests from competent authorities, and content takedown procedures.
• Process payments and manage subscriptions when you purchase paid services, where applicable.

Additionally, and only with your consent where required by law, we may process data for secondary purposes:

These purposes are not necessary to use the site's basic features. You may refuse or withdraw your consent at any time through the cookie banner, your account settings, or by writing to contacto@mylivefest.com, without affecting primary purposes.

• Sending newsletters, editorial updates, or promotional communications about MyLiveFest.
• Statistical and audience analysis using tools such as Google Analytics 4 to understand aggregate site usage.
• Personalized or contextual advertising through programs such as Google AdSense, in accordance with your cookie settings and provider preferences.
• Satisfaction surveys and usability testing to improve the platform experience.

Under the LFPDPPP, processing of personal data is based on one of the grounds provided by law: data subject consent, compliance with legal obligations, performance of a contractual relationship or pre-contractual measures, or the controller's legitimate interest when it does not affect the data subject's rights.

Acceptance of the Terms and Conditions of use does not constitute consent for processing personal data for secondary purposes or for non-essential cookies. Each consent is obtained separately and in an informed manner where applicable.

If you access MyLiveFest from the European Economic Area or the United Kingdom and the General Data Protection Regulation (GDPR) or UK GDPR applies, we process your data under those frameworks in addition to the LFPDPPP.

In that case, legal bases include consent (non-essential cookies, marketing), contract performance or pre-contractual measures (account and requested services), legitimate interest (security, aggregated analytics with safeguards), and legal compliance. You may exercise additional rights under the GDPR by contacting us at contacto@mylivefest.com.

Information you voluntarily publish on public profiles, comments, lists, or forums may be visible to other users and indexable by search engines.

You are responsible for the content you share and for any third parties' personal data you include. You may request deletion or limitation of publication by contacting us; we will handle your request in accordance with the law and our Terms and Conditions.

We may share personal data with processors that provide services to us under documented instructions and confidentiality obligations. We do not sell or rent personal data.

Common processors include web hosting providers, email services, Google (Analytics 4, AdSense, Consent Mode), payment processors when transactions exist, and moderation or support tools. An updated list may be requested at contacto@mylivefest.com.

Some processors may process data in the United States or other countries outside Mexico. Where required by law, we implement contractual clauses, risk assessments, or other recognized transfer mechanisms.

By accepting non-essential cookies or using services that involve international transfer, you acknowledge that your data may be processed outside Mexico with applicable safeguards.

We use cookies and similar technologies classified as: essential (site operation), analytics (audience measurement), and marketing/advertising (ad personalization). We display a consent banner before activating non-essential cookies.

You may accept all, reject non-essential cookies, or configure preferences by category. Non-essential cookies remain blocked until you give consent. Your choice is stored on your device and may be changed at any time. For more details on acceptable use of the site, see also our Terms and Conditions.

privacy.section12.content3

We retain personal data only for as long as necessary to fulfill the purposes described and applicable legal obligations.

Specific retention periods vary by data category:

• Contact messages: up to 24 months from the last interaction, unless a longer legal retention obligation applies.
• Active account data: while you maintain the account; after cancellation, blocking and deletion within a maximum of 90 days, except data we must retain by law.
• Technical and security logs: up to 12 months, unless investigating an incident.
• Aggregated or pseudonymized analytics data: up to 26 months per Google Analytics 4 configuration.
• Cookie data: according to the duration indicated in the banner and your preference settings.
• Billing and payment data: in accordance with applicable tax and commercial periods in Mexico.

We implement reasonable technical, administrative, and physical measures to protect personal data against unauthorized access, loss, alteration, or improper disclosure.

No system is completely infallible. In the event of a security breach that significantly affects your rights, we will notify you in accordance with Article 19 of the LFPDPPP and, where applicable, the competent authority, indicating the nature of the incident, measures taken, and recommendations to protect yourself.

As a data subject, you have the rights of Access, Rectification, Cancellation, and Opposition (ARCO), as well as the right to withdraw consent and limit the use or disclosure of your data where permitted by law.

To exercise your rights, send a request to contacto@mylivefest.com including: full name, means to receive a response, clear description of the right you wish to exercise, and documents proving your identity or legal representation. We will respond within a maximum of 20 business days; if granted, we will implement the decision within the following 15 business days.

• Access: know what data we process and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Cancellation: request deletion when data is no longer necessary or you withdraw consent.
• Opposition: object to specific processing based on legitimate interest.
• Consent withdrawal: revoke consents granted for secondary purposes or cookies.
• Portability (where GDPR applies): receive your data in a structured format.

MyLiveFest is not directed at minors under 18. We do not knowingly collect data from minors without verifiable consent from a parent or legal guardian. If we detect such data, we will delete it promptly.

We do not make decisions based solely on automated processing that produce significant legal effects on you. We may update this notice; material changes will be communicated via notice on the site. If you believe your rights have not been addressed, you may contact the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) or another competent authority.