Privacy Notice — Linkvitación

This is a courtesy translation; the Spanish version prevails.

I. Identity and address of the data controller

Alicia Zitlalli Flores Alvarado, an individual engaged in business activities, who operates the Linkvitación platform at www.linkvitacion.com ("Linkvitación", "we"), is the controller responsible for the processing of your personal data.

• Address: Av. Ruiz Cortines 890, Col. La Laja, C.P. 39600, Acapulco, Guerrero, Mexico
• Email for privacy matters: hola@linkvitacion.com
• WhatsApp: +52 55 4034 1893

This notice applies to those who purchase or use Linkvitación ("customers" or "hosts"), to guests who open an invitation or RSVP, and to visitors of the site.

II. Personal data we process

Depending on how you interact with Linkvitación, we may process the following categories of data:

a) Customers (whoever purchases and manages an invitation): name, email address, phone or WhatsApp number (if you contact us that way), account data (sign-in email, sign-in dates) and purchase history (plan purchased, date, amount, payment status, coupons used).

b) Payment data: payments are processed through Stripe. Linkvitación does not receive or store your full card number, its expiration date or its security code; we only receive from Stripe the payment confirmation, the amount, the currency and the latest reference data of the transaction.

c) Billing data (only if you request an invoice): name or legal name, RFC (tax ID), tax regime, postal code of the tax address, CFDI use and email address to send the invoice.

d) Invitation content (what you enter to publish it): names of the couple, of the quinceañera or of the person being celebrated; names of parents and godparents; date and times of the event; name and address of the ceremony and the reception; photographs; texts and messages; links to gift registries or music playlists; and, if you choose to show them, details for deposits or transfers (bank, account holder name and CLABE). This content is visible to anyone who has the invitation link.

e) Guests (whoever receives the invitation and RSVPs): name, attendance response, number of plus-ones and, when the organizer requests it, answers to custom questions (for example, menu choice, dietary preferences or restrictions, need for transportation).

f) Browsing data: IP address, device and browser type, language, pages visited, date and time of access, and information stored in cookies or similar technologies (see section X).

We do not request financial data other than the data described above, nor data about assets.

III. Sensitive personal data

Linkvitación does not require sensitive data to work. However, when an event organizer enables questions about dietary restrictions or allergies, the guest's answer could reveal information related to their health, which the law considers sensitive data.

In those cases:

• The answer is always optional; guests can RSVP without answering it.
• Before sending it, the form will ask for the guest's express consent through a checkbox they must tick, with the text: "I authorize my dietary preferences or restrictions to be shared with the event organizers solely to plan the menu."
• That information will only be visible to the event organizer, will be used exclusively to plan the menu, and will be deleted together with the rest of the event data (see section XI).

Please do not include in invitations, messages or answers any information about health, religion, ethnic origin, sexual preferences, political opinions or other sensitive data that is not necessary for the event.

IV. Data of minors

Invitations for quinceañeras, baptisms, first communions or children's events may include the names and photographs of minors. Linkvitación does not contract with minors: the account and the purchase must be made by people over 18 years of age.

When publishing data or images of a minor, the user declares that they are the minor's mother, father or guardian, or that they have the authorization of whoever holds parental authority or guardianship, and accepts that this content will be visible to anyone who has the invitation link. If whoever holds parental authority asks us to remove data or photographs of a minor, we will handle the request as a priority.

V. Purposes of the processing

Primary purposes (necessary to provide you with the service; they do not require your consent because they derive from the contractual relationship):

1. Create and manage your account and let you sign in through a link or code sent to your email.
2. Create, edit, publish and keep your digital invitation online during the term of the plan purchased.
3. Process the payment, confirm the purchase and send you the emails related to your order.
4. Receive and show you your guests' RSVPs, and let you view and download them.
5. Issue the tax invoice (CFDI) when you request it.
6. Provide support and handle your questions, complaints or requests by email or WhatsApp.
7. Prevent fraud, misuse and unauthorized access, and keep the platform secure.
8. Comply with legal and tax obligations, and respond to requests from competent authorities.

Secondary purposes (not necessary for the service, but they help us improve it):

1. Send you promotions, news, discounts or new Linkvitación designs.
2. Invite you to answer satisfaction surveys or leave a review.
3. Prepare statistics and usage analysis to improve the site and the designs (preferably with aggregated or dissociated data).
4. Show your invitation as an example on our site or social media, only if you give us express and separate authorization.

How to opt out of secondary purposes: you can do so at any time by writing to hola@linkvitacion.com with the subject "No deseo finalidades secundarias" (I do not want secondary purposes), or by using the unsubscribe link included in every promotional message. If you do not object within 5 business days after your registration, we will understand that you agree, without prejudice to your right to object later. Opting out of these purposes will not affect the service you purchased.

Guests' data is not used for any secondary purpose of Linkvitación.

VI. Guests' data: who decides about it

When a guest RSVPs, their data is collected on behalf of the host, who decides whom to invite, what to ask and how to use the answers. With respect to that data, Linkvitación acts as a processor: it stores the data and makes it available to the organizer, without using it for its own purposes.

Accordingly:

• The organizer is responsible for using the answers only for their event and for not sharing them with third parties without justification.
• Linkvitación does not sell guests' data, does not contact guests for commercial purposes, and does not share their data with anyone other than the organizer and the technology providers listed in section VII.
• If you are a guest and want to correct or withdraw your RSVP, you can ask the organizer directly or write to us at hola@linkvitacion.com; we will help route the request and, where appropriate, handle it directly.

Every RSVP form will show a simplified notice with a link to this full notice.

VII. Transfers and providers

Linkvitación does not sell or rent personal data. To operate the service we rely on technology providers that process data on our behalf and under our instructions; some of them are located outside Mexico (mainly in the United States):

In addition, we may transfer data without requiring your consent in the cases permitted by law, for example: to competent authorities when there is a legal requirement, or when necessary for the recognition, exercise or defense of a right in judicial proceedings.

Outside these cases, we will not share your data with third parties without your consent.

VIII. How to limit the use of your data or revoke your consent

• Promotional emails: use the "Unsubscribe" link in each message or write to us at hola@linkvitacion.com.
• Internal opt-out list: if you ask us, we will add you to our list of people who do not wish to receive advertising.
• Public Registry to Avoid Advertising (REPEP) of PROFECO: you can register your phone number at repep.profeco.gob.mx.
• Revoke your consent: you can do so with the same procedure as in section IX. Revocation will not have retroactive effects and, in some cases, we will not be able to process it immediately when we must keep data due to a legal obligation (for example, tax). If you revoke consent for data necessary for the service, we may no longer be able to keep your invitation published.

IX. ARCO rights (access, rectification, cancellation and opposition)

You have the right to know what data we hold about you and how we use it (access), to correct it if it is inaccurate or incomplete (rectification), to ask us to delete it when it is no longer necessary (cancellation) and to object to its use for specific purposes (opposition).

How to submit your request: send an email to hola@linkvitacion.com with the subject "Solicitud ARCO" (ARCO request), including:

1. Your name and an email address where we can reply.
2. A copy of your official ID or, where applicable, that of your representative and the document proving the representation.
3. A clear description of the right you wish to exercise and of the data involved.
4. Any information that helps us locate the data (for example, your account email or the invitation link).
5. If you request a rectification, the corrections and, where applicable, the supporting document.

Deadlines: we will reply within a maximum of 20 days from the date we receive your complete request and, if applicable, we will carry it out within the 15 days following our reply. These deadlines may be extended once for an equal period when the case justifies it, and we will let you know. If your request is incomplete, we may ask you for the missing information within the following 5 days; you will have 10 days to send it.

The reply and, where applicable, the delivery of your data will be free of charge and sent by email or by the means we agree on. If you believe your request was not handled properly, you may go to the competent personal data protection authority.

X. Cookies and similar technologies

We use cookies and the browser's local storage to:

• Necessary operation: keep you signed in, remember your language and temporarily save your progress while creating your invitation. Without them the site does not work properly.
• Statistics: learn how many people visit the site and which pages they use, through Google Analytics, and how they navigate the site (heatmaps and session recordings, with fields and personal data hidden) through Microsoft Clarity. These tools are not loaded on published invitations or on their RSVP forms.
• Third-party content: the Google maps and the Spotify player embedded in invitations may set their own cookies according to their policies.

You can disable or delete cookies from your browser settings; if you disable the necessary ones, you may not be able to sign in.

Your choice: when you enter the site you will see a notice to accept or reject statistics cookies. If you reject them, Google Analytics and Microsoft Clarity are not loaded. You can change your choice at any time from "Cookie preferences", at the bottom of every page.

XI. Retention and security

How long we keep your data:

• Invitation, photos and RSVPs: while the invitation is active according to your plan and up to 30 days after it expires, so you can download your RSVPs. After that they are deleted or dissociated.
• Account: while you keep it active or until you request its cancellation.
• Purchase and billing data: for the period required by tax and commercial laws (generally 5 years).
• Support messages: up to 10 months after the case is closed.

Security: we apply reasonable administrative, technical and physical measures, including encrypted connections (HTTPS), access controls so that each person only sees their own invitations and RSVPs, passwordless access through single-use links, and providers with recognized security standards. No system is infallible; if a breach occurred that significantly affected your rights, we would inform you without delay so that you can take action.

XII. Changes to this notice

We may modify this notice due to legal changes, or changes in our services or providers. The current version will always be available at www.linkvitacion.com/privacidad with its last updated date. If the change affects purposes that require your consent, we will notify you by email before applying it.