Privacy Notice – Integral

Last update: May 4, 2026 – Effective: as of publication.

This Privacy Notice is issued in compliance with Articles 8, 15, 16, 17 and 22 of the Federal Law for the Protection of Personal Data in Possession of Individuals (hereinafter, the“LFPDPPP“), its Regulations and the Privacy Notice Guidelines published by the National Institute of Transparency, Access to Information and Protection of Personal Data (“INAI”).

Identity and address of the Person Responsible

The person responsible for the processing of your personal data is:

• Company name: Grupo Idoli, S.A. de C.V. (operating commercially as “Club de Ídolos” / “Idolos.mx”, hereinafter“ÍDOLOS“, “the Responsible” or “the Company”).
• RFC: GID220324ER0
• Fiscal address: Durango 245 int 203A, Col. Roma Norte, Cuauhtémoc, C.P. 06700, Mexico City.
• Website: https://idolos.mx
• General attention: [email protected]
• Legal and Privacy Officer: [email protected]
• WhatsApp / phone number: +52 55 6542 3455

ÍDOLOS operates the online store of autographed sports, music and entertainment memorabilia available at idolos.mx.

2. Personal data we collect

For the purposes described in this Notice, ÍDOLOS collects the following categories of personal data, either directly when you provide them, indirectly when you obtain them from sources permitted by law, or personally when you interact with our customer service channels:

2.1. Identification and contact information

• Full name
• Date of birth (when applicable)
• Gender (optional)
• E-mail address
• Telephone number(s)
• Address for shipment of goods

2.2. Fiscal data (when requesting invoice)

• Company name
• RFC
• Tax domicile
• Tax regime
• Use of CFDI

2.3. Payment information

• Bank card data (tokenized; ÍDOLOS does not store the complete number).
• Proof of payment.
• CLABE for reimbursements via SPEI when applicable.

Important: ÍDOLOS does not store your complete card data in full. Payment processing is done directly through our PCI-DSS Level 1 certified Openpay provider (Banco BBVA Bancomer / Banorte as acquirers), through an encrypted channel (card tokenization).

2.4. Transaction data

• Products purchased, order number, characteristics.
• Purchase history.
• Reimbursements requested.

2.5. Navigation and device data

• IP Address
• Browser type and operating system
• Pages visited within the Site
• Session duration
• Traffic origin (search engine, social networks, advertisements)
• Cookie identifiers and similar technologies (see our Cookie Policy).

2.6. Sensitive personal data

ÍDOLOS does not request or collect sensitive personal data (health, racial or ethnic origin, religious beliefs, political opinions, sexual preference, genetic or biometric data) through the Website or its service channels.

3. Purposes of treatment

In accordance with article 16, section II of the LFPDPPP, ÍDOLOS treats your personal data for the following purposes:

3.1. Primary purposes (necessary for the legal relationship)

• Process and complete the purchase orders you place on the Website.
• Collect the amount of products purchased through authorized payment processors.
• Ship the purchased products to the address you indicate us, by third party parcels.
• Generate and send digital tax receipts (CFDI) when you request them.
• Manage refunds, returns, warranties and clarifications.
• Respond to requests for information, questions, comments and complaints.
• Verify your identity when necessary to prevent fraud.
• Create, manage and maintain your user account on the Site.
• Comply with the legal, fiscal and administrative obligations applicable to the Company.

3.2. Secondary purposes (not necessary for the legal relationship)

The following purposes require your consent. If you do not want your data to be processed for these purposes, you can express this at any time in accordance with the procedure described in section 7 of this Notice:

• Send commercial communications, newsletters, offers, promotions and new product announcements by email, SMS and WhatsApp.
• Perform statistical, demographic and behavioral analysis to improve the experience on the Site.
• Show you personalized advertising within the Site and on third party platforms (Meta – Facebook and Instagram, Google Ads).
• Conduct retargeting campaigns and lookalike audiences on social networks and search engines.
• Invite you to participate in surveys, sweepstakes or loyalty programs.

Opposition mechanism: If you do not want your data to be processed for any or all of the secondary purposes, you can communicate it by sending an email to [email protected] with the subject “Opposition to secondary purposes”, or by using the unsubscribe link included at the bottom of each marketing email we send you.

4. Transfers and remissions of personal data

In accordance with article 36 of the LFPDPPP, we inform you that your personal data may be transferred or forwarded (shared with processors who process them on our behalf) to the following categories of third parties, within and outside the Mexican territory. When applicable, international transfers are made only to countries with adequate legal frameworks or under contractual clauses that guarantee equivalent protection:

4.1. Data Processors (data forwarding – no additional consent required)

4.2. Transfers for secondary purposes (requires consent)

4.3. Transfers permitted without consent (Article 37 LFPDPPP)

ÍDOLOS may transfer your personal data without requiring your consent in the following cases:

• When provided for in a law or international treaty.
• When necessary for prevention, diagnosis or medical treatment.
• When it is made to controlling companies, subsidiaries or affiliates of the Responsible Party that operate under the same internal processes and policies.
• When required by competent authority by court order or formal request.
• When necessary for the recognition, exercise or defense of a right in a judicial proceeding.

Except in the above cases, ÍDOLOS does not sell, rent or exchange your personal data with third parties.

5. Tracking technologies (cookies)

The Website uses cookies, web beacons and similar technologies to improve your browsing experience, remember your preferences, analyze traffic and display relevant advertising. To learn the details of each cookie used, its purpose, duration and provider, as well as the options to disable them, we invite you to consult our Cookies Policy.

6. Time period for the conservation of personal data

ÍDOLOS keeps your personal data for the following terms:

• Transactional data (orders, invoices, payments): 5 years from the date of the transaction, in accordance with the obligation of accounting and tax preservation of the Fiscal Code of the Federation (article 30) and the Commercial Code (article 46).
• User account data: as long as the account remains active. In case of inactivity for more than 24 consecutive months, the account may be archived or deleted upon notice.
• Data for marketing purposes: until you revoke your consent or exercise your right to object.
• Browsing data (server logs): 12 months maximum.
• Data related to claims, refunds or legal procedures: until the procedure is resolved and the corresponding action is time-barred, in accordance with the applicable legislation.

Once the above deadlines have expired, the data will be blocked during the period of limitation of actions arising from the legal relationship and, subsequently, definitively deleted, in accordance with Article 11 of the LFPDPPP and Article 32 of its Regulations.

7. ARCO rights and revocation of consent

In accordance with articles 22 to 27 of the LFPDPPP and articles 28 to 35 that regulate the procedure, you have at all times the following rights over your personal data:

• Access: to know what personal data we have about you, what we use it for and the conditions of use.
• Rectification: request the correction of personal data that is inaccurate or incomplete.
• Cancellation: request the deletion of your data when you consider that they are not required for any of the purposes stated in this Notice, or when they are no longer necessary.
• Opposition: to oppose the use of your data for specific purposes, including secondary purposes or automated decisions that produce legal effects.
• Revocation of consent: to withdraw the consent you have given for the processing of your data.
• Limitation of use or disclosure: request that your data not be shared or used for certain purposes, without the need to cancel it completely.

7.1. Procedure to exercise your ARCO rights

To exercise any of the above rights, you must send a written request to the e-mail [email protected] with the subject “ARCO Rights”, or to the address of the Responsible indicated in section 1, containing the following (article 29 LFPDPPP):

1. Full name of the owner and e-mail address or other means of communicating the response.
2. Documents proving your identity (copy of valid official identification: INE, passport or professional ID). When the application is made by a representative, the representation must also be evidenced by a legal instrument.
3. Clear and precise description of the personal data on which you are seeking to exercise any of the ARCO rights.
4. Any element or document that facilitates the location of the data.
5. In the case of rectification, the modifications to be made and the supporting documents.

7.2. Response times

• ÍDOLOS will inform you of the decision taken within a maximum period of 20 business days from receipt of the request (article 32 LFPDPPP).
• If appropriate, the response will be effective within 15 working days from the date of the communication.
• The terms may be extended once for an equal period when justified by the circumstances of the case.

7.3. Cost

The exercise of ARCO rights is free of charge. You may only be charged for justified shipping costs, reproduction of documents or certification, in accordance with Article 35 of the LFPDPPP.

8. Security measures

ÍDOLOS implements reasonable administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction or unauthorized use, access or processing, in accordance with article 19 of the LFPDPPP:

• Encryption in transit: the Site uses the HTTPS protocol (TLS 1.2 or higher) for all data transmissions.
• Encryption at rest: order databases encrypted at storage level.
• Card tokenization: card data is never stored on our servers; it is tokenized through Openpay (PCI-DSS Level 1).
• Web Firewall (WAF): protection against injection attacks, XSS and malicious bots through Cloudflare.
• Access control: multifactor authentication on administrative panels, principle of least privilege for employees and suppliers.
• Backups: periodic and encrypted backups.
• Training: training of personnel with access to personal data on confidentiality obligations.

Despite the above measures, absolute security cannot be guaranteed on the Internet. In the event that a security breach is detected that significantly affects your economic or moral rights, ÍDOLOS will notify you immediately through the registered e-mail address and by means of a notice on the Website, in accordance with article 20 of the LFPDPPP.

9. Privacy of minors

The Website is intended for persons over 18 years of age. ÍDOLOS does not intentionally collect personal data from minors. If you are a parent or guardian and believe that your minor child has provided us with personal information without your permission, please contact us at [email protected] to proceed with its deletion.

10. Links to third party sites

The Web Site may contain links, banners or buttons that direct to third party sites. Idolos is not responsible for the privacy practices of such sites. We encourage you to review the applicable privacy notice whenever you access an external site through our links.

11. Modifications to the Privacy Notice

ÍDOLOS reserves the right to modify this Notice at any time to reflect legislative, jurisprudential, internal changes, new products or services, or market practices. Any modification will be published on this page, indicating the date of the last update at the beginning of the document. In case of substantial modifications that affect the processing of your data, we will notify you via registered e-mail or by means of a visible notice on the home page of the Site.

We encourage you to periodically review this Notice to stay informed of any changes.

12. Privacy Officer’s contact details

For any questions, comments, complaints or requests related to the processing of your personal data or the exercise of your ARCO rights, you may contact the person designated as the privacy officer of ÍDOLOS:

• Name: Gabriel Castro
• Position: Responsible / Privacy Officer
• E-mail: [email protected]
• Suggested subject: “Personal data – [type of request]”.

13. Regulatory Authority

If you believe that your personal data protection rights have been violated, you have the right to file a complaint or request for the protection of your rights before the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI):

• Website: https://home.inai.org.mx
• Phone: 800 835 4324 (Tel-INAI)
• Address: Av. Insurgentes Sur 3211, Col. Insurgentes Cuicuilco, Alcaldía Coyoacán, C.P. 04530, Mexico City.

14. Acceptance of Privacy Notice

By using the Website, registering, making a purchase, or providing your personal data by any means to ÍDOLOS, you represent that:

1. That you have read, understood and accepted the terms of this Privacy Notice.
2. That you expressly consent to the processing of your personal data in accordance with the primary and, where appropriate, secondary purposes described, in terms of article 8 of the LFPDPPP.
3. That you acknowledge that your consent may be revoked at any time in accordance with the procedure described in section 7 of this Notice.

This Privacy Notice is governed by the laws of the United Mexican States. For any dispute arising hereunder, the parties submit to the jurisdiction of the competent courts of Mexico City, waiving any other jurisdiction that may correspond to them by reason of their present or future domicile.

Document generated in accordance with the Federal Law for the Protection of Personal Data in Possession of Individuals (DOF 05-Jul-2010), its Regulations (DOF 21-Dec-2011) and the Privacy Notice Guidelines (DOF 17-Jan-2013). It is complemented by the Site’s Cookie Policy.