PRIVACY POLICY

Special Section: Independent Promoters & "El Squid Roe Promoter" App

Last Updated: October 30, 2026

1. Scope and Language Prevalence

This Special Section applies exclusively and additionally if you register for, access, or use the promoter web portal or the "El Squid Roe Promoter" mobile application (collectively, the "Promoter Platform") in your capacity as an independent commercial promoter or contractor (with no employment or subordinate relationship). For matters not expressly covered in this section, the general provisions of the Privacy Policy apply. In the event of any discrepancy or conflict between the English and Spanish versions of this section, the Spanish version shall invariably prevail for all legal purposes in Mexico.

2. Data Controllers and Binational Allocation of Responsibilities

Pursuant to the Mexican Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) and applicable U.S. federal and state regulations, your personal data is processed separately according to each entity's specific role:

• Cabo Hospitality LLC, a limited liability company organized in the State of Arizona, United States, with address at 5810 N 133rd Ave, Litchfield Park, AZ 85340, United States, acts as the Data Controller regarding the development, U.S. server hosting, security, and operation of the Promoter Platform, user account administration, commission calculation, and international disbursement of commercial payouts.
• Operadora Calamar, S.A. de C.V., a Mexican corporation with tax address at Av. Lázaro Cárdenas s/n, between Zaragoza and Morelos, Col. Centro, C.P. 23450, Cabo San Lucas, Baja California Sur, Mexico, acts as the Data Controller solely regarding on-site reservation validation, venue access control, and verification of actual guest consumption at the "El Squid Roe" establishment.

For data protection purposes, each entity answers for its own processing. Who pays you and what you are owed is set by the Promoter Agreement. Processing your personal data does not create or imply an employment relationship with either entity.

3. Personal Data We Collect and Primary Purposes

All personal data listed below is strictly necessary to establish, perform, and maintain the independent commercial agreement between you and us (Primary Purposes). We do not process your personal data for secondary purposes (such as unrelated third-party marketing or advertising profiling).

Mandatory Nature of Financial and Tax ID Data: Providing your CURP, address, country of citizenship, bank account number, and CLABE is strictly required to register you and disburse commissions. Without this information, we cannot enter into or perform the Promoter Agreement with you.

Biometric Authentication Disclosure (Face ID / Touch ID / Fingerprint): If you enable biometric lock in the mobile app, authentication occurs entirely locally on your device using Apple (iOS) or Google (Android) native system APIs. We never request, receive, transmit, or store your facial data, fingerprints, or any biometric identifiers on our servers.

4. What We Do NOT Do

• No Advertising Tracking: Promoter screens and the mobile app do not use third-party behavioral advertising cookies or commercial tracking pixels. We do not track you across third-party apps or websites (App Tracking).
• No Invasive Device Permissions: The app does not request or access your GPS location, address book/contacts, microphone, or photo library.
• No Sale of Personal Data: We never sell, rent, or trade your personal or financial information to third parties.

5. Personal Data of Your Clients (Indirect Collection)

When building a reservation link for a client, you may optionally enter your client's name, WhatsApp phone number, occasion, and booking notes. The following rules govern this data:

1. Mandatory Prior Authorization: You must only enter a client's details if the client provided them to you and expressly authorized you in advance to share them with us to pre-fill their booking, in accordance with your Promoter Agreement.
2. Limited Use and Client Control: We use this information solely to pre-populate the client's booking form. Before making any payment, the client reviews the form, can edit or delete any detail, and sees the link to our Guest Privacy Policy.
3. Retention Limit: If the client does not complete and pay for the booking, the pre-filled details are automatically deleted after 12 (twelve) months. If the client pays and completes the booking, their data is governed by the general Guest section of this Privacy Policy.

6. Data Sharing: Service Providers (Processors), Transfers, and U.S. Jurisdiction

We engage technology providers who act as Data Processors (Encargados) on our behalf, under the service and data processing terms each one offers. Several of these providers store and process data in the United States:

Personal Data Transfers: In addition to the Processors above, we make the following transfers without separate consent, under the exceptions in Article 36 of the Mexican LFPDPPP:

1. Wise (the payment platform Cabo Hospitality LLC pays you through) and the banks involved in the transfer: We transfer your full name, physical address, CLABE or bank account number, and payout amount solely to send you your earned commissions (Sections IV and VII). Wise processes this data as an independent controller under its own financial obligations, including its fraud and sanctions checks.
2. Between Cabo Hospitality LLC and Operadora Calamar, S.A. de C.V.: We share your username and the reservations attributed to you, to validate them on site and calculate your commission (Section VII). We do not share your CURP, address, or banking details with venue staff.
3. Competent Authorities (Mexico & U.S.): We disclose tax, accounting, or identification records to tax (Mexican SAT or U.S. IRS), financial, administrative, or judicial authorities when required by law or legally binding mandate (Sections I and V).

Cross-Border Processing and U.S. Jurisdiction: By registering as a promoter, you acknowledge and agree that our primary technical infrastructure (including Supabase database servers in Oregon, U.S., and Vercel), the Promoter Platform, and commission payments are operated from the United States of America by Cabo Hospitality LLC. Consequently, your personal data and payout records are transmitted to, processed, and stored within the United States, and are concurrently subject to applicable U.S. federal and state laws.

7. Data Retention, Tax Blocking Period, and Account Deletion

We keep your account data active for as long as you remain an active promoter. You may delete your account at any time directly inside the app (Account → Delete My Account / Cuenta → Borrar mi cuenta) or via the web at elsquidroe.com/promoters/borrar-cuenta.

When you ask to delete your account, the following happens. If our team deactivates your participation, we pay what you have earned and you can request this same deletion by following the steps on that page:

• Immediate Deletion: Your login credentials, mobile phone number, physical address, bank account number, push notification token, and GoHighLevel promoter profile are deleted immediately (if we owe you commission, that profile is deleted once it is paid).
• Pending Commission Exception: Your CLABE and email address are also deleted immediately, unless you have unpaid earned commissions at the time of deletion. In that case, we retain your CLABE and email in a restricted state solely to disburse and notify you of your final payout, and automatically delete both immediately after payment settles.
• Tax & Accounting Blocking Period (6 Years): Tax laws require us to keep support for what we pay (in Mexico, Article 30 of the Federal Fiscal Code generally sets 5 years; in the U.S., IRS record-keeping rules apply). So your full name, CURP, username, historical sales and payout ledger, your tax certification (which includes the address you certified), and the evidence of your acceptances are placed into a restricted Blocking Period (Periodo de Bloqueo), with no operational or commercial use. They are permanently deleted 6 (six) years after the close of the fiscal year in which you received your last payout, unless an authority or pending litigation requires us to keep them longer.
• Guest Bookings: If you also made personal bookings as a venue guest, those records follow the Guest retention rules of this Privacy Policy.
• System Backups: Backups are stored with restricted access. Deleted data disappears from them within 90 days at most, as each copy expires.

8. Security Measures

You log in using a hashed password and email device verification codes. Our servers validate your session on every screen. The app displays only the last 4 digits of your CLABE and does not let anyone change banking details: only our team does, at your request from your account email, to prevent fraud if your phone is stolen. If a security breach significantly affects your financial or moral rights, we will tell you without delay so you can protect yourself.

9. Your Privacy Rights (ARCO Rights, Consent Revocation & U.S. Privacy Disclosures)

• ARCO Rights & Revocation: You have the right to Access, Rectify, Cancel, or Object to the processing of your personal data (ARCO Rights), as well as to revoke your consent or limit data use. To exercise these rights, email info@cabohospitality.com from your registered account email, stating your full name, username, the specific right you wish to exercise, and attaching a copy of your official ID where necessary to verify identity. We will respond within a maximum of 20 business days and, if applicable, execute the request within the following 15 business days. Cancellation or revocation does not apply to records we are legally required to retain under tax blocking rules.
• Additional U.S. State Privacy Disclosures: Because Cabo Hospitality LLC operates from the United States, we additionally disclose pursuant to applicable U.S. state privacy laws (including the California Consumer Privacy Act, CCPA/CPRA, to the extent applicable): (i) We do not "sell" or "share" your personal information or sensitive government/financial identifiers with third parties for cross-context behavioral advertising; (ii) sensitive identifiers (CURP and CLABE) are used strictly for permitted operational, payout, security, and tax compliance purposes; and (iii) we do not retaliate or discriminate against any individual for exercising their statutory privacy rights.

10. Competent Data Protection Authority

If you believe your data protection rights under Mexican law have been infringed, you may file a complaint before the Mexican Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), which serves as the federal data protection authority under current Mexican law, or before the applicable data protection or consumer authority in your jurisdiction.

11. Minimum Age

The promoter program and app are strictly restricted to individuals 18 years of age or older.

12. Changes to This Section

If we make material changes to this section, we will update the "Last Updated" date at the top in elsquidroe.com/privacy and notify you via the app or by email. If the change requires your consent, we will ask for it again when you log in.