FUTUR FESTIVAL MÉXICO

COMPREHENSIVE PRIVACY NOTICE

Data controller: Lostnights, S.A. de C.V., controller of the processing of your personal data.
Address: Pensylvania #143, interior 13, Colonia Nápoles, Alcaldía Benito Juárez, C.P. 03810, Mexico City.
Privacy email: privacidad@futurfestivalmexico.com
Last updated: April 2026

1. IDENTITY AND ADDRESS OF THE DATA CONTROLLER
In compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations and the Privacy Notice Guidelines, Lostnights, S.A. de C.V., in its capacity as controller of the processing of personal data, with address at Pensylvania #143, interior 13, Colonia Nápoles, Alcaldía Benito Juárez, C.P. 03810, Mexico City, makes this Comprehensive Privacy Notice available to the data subject.

For the purposes of this document, “FUTUR FESTIVAL MÉXICO”, “Controller”, “we” or “our” shall mean the company identified above, as well as the business units, platforms, websites and official channels through which tickets, admissions, experiences, products or services linked to the festival are sold.

2. PERSONAL DATA THAT MAY BE COLLECTED
FUTUR FESTIVAL MÉXICO may collect, personally, directly or indirectly, the following categories of personal data, to the extent necessary for the purposes set out in this Notice:

• Identification and contact data: full name, date of birth, signature, image of official identification, email address, home address, country of residence, telephone number and username on digital platforms.
• Transaction and billing data: tax details, RFC tax ID, company name, tax address, payment method, card type, transaction reference, reference number, amount, purchase history, charges, chargebacks, invoices and receipts.
• Authentication and fraud prevention data: name of the payment method holder, evidence of ownership, validation documents, images or copies of identification, verification reports, matches, incidents and records linked to manual or automated validations.
• Digital access and usage data: IP address, device identifiers, operating system, browser, activity logs, approximate geolocation derived from the connection, cookies, tags, pixels, logs and browsing analytics.
• Event access and operations data: tickets issued, QR code, zone purchased, benefits, check-in, admissions, entry incidents, security records, customer service and communications arising from the commercial relationship.
• Image and voice data: photographs, video recordings, incidental recordings and closed-circuit television records inside facilities, venues, entrances, validation areas or operational zones of the event.
• Sensitive personal data, only where strictly necessary: health or emergency medical care information provided by the data subject, a companion, medical staff or security personnel in order to safeguard the data subject's wellbeing during the event.

FUTUR FESTIVAL MÉXICO does not ordinarily collect sensitive personal data; however, in extraordinary situations involving medical care, civil protection, security or legal compliance, it may process the minimum data strictly necessary to address the relevant contingency.

3. PERSONAL DATA OF MINORS
FUTUR FESTIVAL MÉXICO does not primarily direct its commercial offering at minors. Where any form of admission, promotion, activity or service allows or involves the processing of minors' personal data, such processing must be carried out through the person holding parental authority, guardianship or the corresponding legal representation, and on the terms permitted by applicable law and by the specific policies of the event.

4. PRIMARY PURPOSES OF PROCESSING
Personal data will be processed for the following primary purposes, which are necessary for the existence, maintenance and performance of the legal relationship between the data subject and FUTUR FESTIVAL MÉXICO:

• To identify the data subject and, where applicable, verify their identity, legal age and capacity to contract or access restricted services.
• To register accounts, process requests, issue tickets, assign reference numbers, validate transactions and complete online sales operations.
• To manage payments, collections, invoicing, legally applicable refunds, clarifications, chargebacks, anti-fraud verification and prevention of irregular transactions.
• To manage event admissions, check-in, zones, experiences, special services, VIP packages, tables, consumption, upgrades and benefits linked to the purchase.
• To send confirmations, reminders, operational changes, rescheduling, schedule updates, security incidents, access instructions and communications directly related to the purchase or the event.
• To handle support requests, customer service, claims, questions, complaints, lost property reports, entry incidents or special validations.
• To maintain security controls, video surveillance, civil protection, violence prevention, protection of facilities, capacity control and compliance with venue and competent authority guidelines.
• To respond to medical emergencies, referrals to health services, communications with emergency contacts where appropriate, and the generation of internal reports arising from incidents.
• To comply with legal, regulatory, tax, contractual and administrative obligations and to cooperate with competent authorities.
• To retain digital, documentary and operational evidence of transactions, admissions and communications for auditing, legal defense, compliance, traceability and risk management purposes.

5. SECONDARY PURPOSES
In addition, and provided the data subject does not object, FUTUR FESTIVAL MÉXICO may process their personal data for the following secondary purposes:
• To send promotional information, presales, announcements of new editions, festivals, events, products, experiences, official merchandise and commercial content of its own or of brands linked to the festival.
• To carry out satisfaction surveys, market research, consumption analytics, commercial segmentation and evaluation of audience preferences.
• To invite the data subject to promotional activities, loyalty programmes, benefits, activations, contests, experiences and advertising campaigns.
• To personalize content, recommendations, advertising and commercial communications through electronic or digital means.

If you do not wish your personal data to be processed for the secondary purposes indicated above, you may say so from this moment by writing to privacidad@futurfestivalmexico.com, stating your full name, contact details and the specific purposes you wish to opt out of. Your refusal will not be grounds for denying you the services and products you request or contract with FUTUR FESTIVAL MÉXICO.

6. LEGAL BASIS AND LEGITIMACY OF PROCESSING
The processing of personal data is based on the data subject's consent, on the legal and commercial relationship arising from the purchase or use of the services offered by FUTUR FESTIVAL MÉXICO, on the legal obligations applicable to the Controller, on the legitimate interest in fraud prevention, security and operational continuity, and on the other grounds permitted by Mexican legislation on the protection of personal data and electronic commerce.

7. TRANSFERS OF PERSONAL DATA
FUTUR FESTIVAL MÉXICO may transfer your personal data, within and outside Mexican territory, without requiring additional consent in the cases permitted by law, and in particular where necessary for:
• Holding companies, subsidiaries, affiliates or entities belonging to the same corporate group as the Controller that operate under internal processes and policies compatible with this Privacy Notice.
• Ticketing platforms, payment processors, aggregators, technology providers, anti-fraud tools, hosting services, CRM, messaging, electronic invoicing and other processors essential to operations.
• Venues, logistics operators, private security companies, access control staff, civil protection, medical providers, insurers and third parties directly involved in the execution or operation of the event.
• Administrative, judicial, tax, security, civil protection, health or any other competent authorities, where there is a duly founded request or a legal obligation.
• Third-party acquirers, assignees or successors to the Controller's rights, in the event of corporate restructuring, merger, spin-off, sale of assets or transfer of operations, always under the corresponding legal mechanisms.

Where a transfer requires the data subject's consent under applicable law, FUTUR FESTIVAL MÉXICO will obtain such consent by the appropriate means.

8. PROCESSORS AND SERVICE PROVIDERS
FUTUR FESTIVAL MÉXICO may send personal data to third parties acting as processors, who will process the data on behalf of the Controller and in accordance with documented instructions, security measures and confidentiality obligations, without this constituting a transfer within the meaning of the law where the applicable conditions are met.

9. MEANS AND MECHANISMS TO LIMIT USE OR DISCLOSURE
The data subject may limit the use or disclosure of their personal data for secondary purposes by written request sent to privacidad@futurfestivalmexico.com. The data subject may also follow the unsubscribe instructions contained in promotional communications or exercise the corresponding rights under this Notice.

10. ARCO RIGHTS AND WITHDRAWAL OF CONSENT
You have the right to Access your personal data; Rectify it when it is inaccurate or incomplete; Cancel it when you consider it is not required for any of the stated purposes, is being used for purposes you did not consent to, or the legal or service relationship has ended; and Object to its processing for specific purposes. You may also withdraw any consent you have given for the processing of your personal data, except in the cases of exception provided for by law.

To exercise your ARCO rights or request the withdrawal of consent, the data subject must send a request to privacidad@futurfestivalmexico.com, enclosing at least:

• Full name of the data subject and a means of communicating the response.
• Documents proving their identity or, where applicable, the corresponding legal representation.
• A clear and precise description of the personal data in respect of which a right is being exercised.
• A description of the right to be exercised or of the withdrawal requested.
• Any item or document that helps locate the personal data.

FUTUR FESTIVAL MÉXICO will address the request within the periods provided for by applicable law. If the request is well founded, it will be given effect within the legal time limits and in accordance with the nature of the corresponding processing.

Cancellation, objection or withdrawal will not apply where processing is necessary to comply with legal or contractual obligations, security, fraud prevention, handling of disputes, protection of rights or any of the exceptions provided for in the applicable regulations.